claude-dev-env 4.3.0 → 7.1.0

package/scripts/tests/test_local_verification.py

@@ -0,0 +1,348 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from local_verification import check_runner
+from local_verification.config.constants import (
+    COLLECTION_ERROR_KIND,
+    FAILED_STATUS,
+    NONZERO_EXIT_ERROR_KIND,
+)
+from local_verification.manifest import (
+    ManifestRunFatal,
+    compute_manifest_digest,
+    load_manifest,
+)
+from local_verification.model import (
+    CheckSpec,
+    CommandCapture,
+    ExclusionSpec,
+    VerificationManifest,
+    VerificationReport,
+)
+from local_verification.runner import run_verification
+
+
+def _manifest(*checks: CheckSpec) -> VerificationManifest:
+    return VerificationManifest(1, tuple(checks), ())
+
+
+def _python_check(check_id: str, script_text: str, cwd: str = ".") -> CheckSpec:
+    return CheckSpec(check_id, (sys.executable, "-c", script_text), cwd, 10.0)
+
+
+def _run_git(repository_path: Path, *all_arguments: str) -> str:
+    completed_process = subprocess.run(
+        ["git", "-C", str(repository_path), *all_arguments],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    assert completed_process.returncode == 0, completed_process.stderr
+    return completed_process.stdout.strip()
+
+
+def _create_git_repository(tmp_path: Path) -> tuple[Path, str]:
+    repository_path = tmp_path / "repository"
+    repository_path.mkdir()
+    _run_git(repository_path, "init", "--quiet")
+    _run_git(repository_path, "config", "user.email", "tests@example.com")
+    _run_git(repository_path, "config", "user.name", "Local Verification Tests")
+    (repository_path / "tracked.txt").write_text("stable\n", encoding="utf-8")
+    _run_git(repository_path, "add", "tracked.txt")
+    _run_git(repository_path, "commit", "--quiet", "-m", "initial")
+    return repository_path, _run_git(repository_path, "rev-parse", "HEAD")
+
+
+def _assert_check_outputs(report: VerificationReport, output_path: Path) -> None:
+    assert report.aggregate_status == "failed"
+    assert [each_record.status for each_record in report.checks] == [
+        "passed",
+        "failed",
+        "incomplete",
+        "incomplete",
+    ]
+    assert report.checks[1].exit_code == 7
+    assert report.checks[2].error_kind == "missing_tool"
+    assert report.checks[3].error_kind == "timeout"
+    assert output_path.exists()
+    for each_record in report.checks:
+        assert each_record.stdout_log.exists()
+        assert each_record.stderr_log.exists()
+    run_log_path = output_path.with_suffix(".logs") / "run.log"
+    assert "aggregate: failed" in run_log_path.read_text(encoding="utf-8")
+
+
+def test_load_manifest_requires_unique_check_ids(tmp_path: Path) -> None:
+    manifest_path = tmp_path / "manifest.json"
+    manifest_path.write_text(
+        json.dumps(
+            {
+                "version": 1,
+                "checks": [
+                    {
+                        "id": "same",
+                        "argv": ["python"],
+                        "cwd": ".",
+                        "timeout_seconds": 1,
+                    },
+                    {
+                        "id": "same",
+                        "argv": ["python"],
+                        "cwd": ".",
+                        "timeout_seconds": 1,
+                    },
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    with pytest.raises(ManifestRunFatal, match="unique"):
+        load_manifest(manifest_path)
+
+
+def test_load_manifest_preserves_exclusions_and_collection_floor(
+    tmp_path: Path,
+) -> None:
+    manifest_path = tmp_path / "manifest.json"
+    manifest_path.write_text(
+        json.dumps(
+            {
+                "version": 1,
+                "checks": [
+                    {
+                        "id": "tests",
+                        "argv": ["python", "-m", "pytest"],
+                        "cwd": "packages/app",
+                        "timeout_seconds": 2,
+                        "minimum_tests": 3,
+                    }
+                ],
+                "exclusions": [{"selector": "manual", "reason": "requires a human"}],
+            }
+        ),
+        encoding="utf-8",
+    )
+
+    loaded_manifest = load_manifest(manifest_path)
+
+    assert loaded_manifest.checks[0].minimum_tests == 3
+    assert loaded_manifest.checks[0].cwd == "packages/app"
+    assert loaded_manifest.exclusions == (ExclusionSpec("manual", "requires a human"),)
+
+
+def test_run_verification_executes_pass_fail_missing_and_timeout_checks(
+    tmp_path: Path,
+) -> None:
+    all_checks = (
+        _python_check("passes", ""),
+        _python_check("fails", "raise SystemExit(7)"),
+        CheckSpec("missing", ("command-that-does-not-exist",), ".", 10.0),
+        _python_check("times-out", "import time; time.sleep(2)"),
+    )
+    timed_check = CheckSpec("times-out", all_checks[-1].command_arguments, ".", 0.1)
+    output_path = tmp_path / "reports" / "verification.json"
+
+    report = run_verification(
+        _manifest(all_checks[0], all_checks[1], all_checks[2], timed_check),
+        tmp_path,
+        "base-sha",
+        output_path,
+    )
+
+    _assert_check_outputs(report, output_path)
+
+
+def test_run_verification_keeps_argv_spaces_and_runs_outside_caller_directory(
+    tmp_path: Path,
+) -> None:
+    repository_path = tmp_path / "repository with spaces"
+    repository_path.mkdir()
+    script_path = repository_path / "folder with spaces" / "check.py"
+    script_path.parent.mkdir()
+    script_path.write_text("raise SystemExit(0)\n", encoding="utf-8")
+    check = CheckSpec("spaces", (sys.executable, str(script_path)), ".", 10.0)
+
+    report = run_verification(
+        _manifest(check),
+        repository_path,
+        "base-sha",
+        tmp_path / "verification.json",
+    )
+
+    assert report.aggregate_status == "passed"
+    assert report.checks[0].command_arguments == (sys.executable, str(script_path))
+
+
+def test_run_verification_enforces_minimum_tests_for_pytest(tmp_path: Path) -> None:
+    empty_tests = tmp_path / "tests"
+    empty_tests.mkdir()
+    check = CheckSpec(
+        "pytest",
+        (sys.executable, "-m", "pytest", "tests"),
+        ".",
+        30.0,
+        1,
+    )
+
+    report = run_verification(
+        _manifest(check),
+        tmp_path,
+        "base-sha",
+        tmp_path / "verification.json",
+    )
+
+    assert report.aggregate_status == "failed"
+    assert report.checks[0].status == "failed"
+    assert report.checks[0].error_kind == "minimum_tests"
+    assert report.checks[0].collected_tests == 0
+
+
+def test_run_verification_rejects_all_required_tests_skipped(tmp_path: Path) -> None:
+    skipped_test_path = tmp_path / "test_skipped.py"
+    skipped_test_path.write_text(
+        """import pytest
+
+@pytest.mark.skip(reason="requires service")
+def test_required_service():
+    pass
+""",
+        encoding="utf-8",
+    )
+    check = CheckSpec(
+        "pytest",
+        (sys.executable, "-m", "pytest", "test_skipped.py"),
+        ".",
+        30.0,
+        1,
+    )
+
+    report = run_verification(
+        _manifest(check),
+        tmp_path,
+        "base-sha",
+        tmp_path / "verification.json",
+    )
+
+    assert report.aggregate_status == "incomplete"
+    assert report.checks[0].error_kind == "skipped_tests"
+    assert report.checks[0].collected_tests == 1
+    assert report.checks[0].exit_code == 0
+
+
+def test_run_verification_records_publishable_clean_git_revision(
+    tmp_path: Path,
+) -> None:
+    repository_path, base_revision = _create_git_repository(tmp_path)
+    check = _python_check("passes", "")
+    manifest = _manifest(check)
+    output_path = tmp_path / "verification.json"
+
+    report = run_verification(
+        manifest,
+        repository_path,
+        base_revision,
+        output_path,
+    )
+
+    assert report.head_revision == base_revision
+    assert report.base_revision == base_revision
+    assert report.manifest_digest == compute_manifest_digest(manifest)
+    assert report.worktree_clean is True
+    assert report.inputs_unchanged is True
+    assert report.publishable is True
+    report_mapping = json.loads(output_path.read_text(encoding="utf-8"))
+    assert report_mapping["head"] == base_revision
+    assert report_mapping["base"] == base_revision
+    assert report_mapping["manifest_digest"] == report.manifest_digest
+    assert report_mapping["publishable"] is True
+
+
+def test_run_verification_keeps_dirty_git_candidate_advisory(
+    tmp_path: Path,
+) -> None:
+    repository_path, base_revision = _create_git_repository(tmp_path)
+    (repository_path / "untracked.txt").write_text("local\n", encoding="utf-8")
+
+    report = run_verification(
+        _manifest(_python_check("passes", "")),
+        repository_path,
+        base_revision,
+        tmp_path / "verification.json",
+    )
+
+    assert report.aggregate_status == "passed"
+    assert report.worktree_clean is False
+    assert report.inputs_unchanged is True
+    assert report.publishable is False
+
+
+def test_run_verification_invalidates_git_candidate_when_head_changes(
+    tmp_path: Path,
+) -> None:
+    repository_path, base_revision = _create_git_repository(tmp_path)
+    tracked_path = repository_path / "tracked.txt"
+    commit_script = (
+        "from pathlib import Path; import subprocess; "
+        f"Path({str(tracked_path)!r}).write_text('changed\\n'); "
+        f"subprocess.run(['git', '-C', {str(repository_path)!r}, 'add', 'tracked.txt'], check=True); "
+        f"subprocess.run(['git', '-C', {str(repository_path)!r}, 'commit', '--quiet', '-m', 'check'], check=True)"
+    )
+
+    report = run_verification(
+        _manifest(_python_check("changes-head", commit_script)),
+        repository_path,
+        base_revision,
+        tmp_path / "verification.json",
+    )
+
+    assert report.aggregate_status == "passed"
+    assert report.head_revision == base_revision
+    assert _run_git(repository_path, "rev-parse", "HEAD") != base_revision
+    assert report.inputs_unchanged is False
+    assert report.publishable is False
+
+
+def test_run_verification_never_publishes_failed_or_incomplete_git_checks(
+    tmp_path: Path,
+) -> None:
+    repository_path, base_revision = _create_git_repository(tmp_path)
+    all_checks = (
+        _python_check("fails", "raise SystemExit(4)"),
+        CheckSpec("missing", ("missing-command",), ".", 10.0),
+    )
+
+    report = run_verification(
+        _manifest(*all_checks),
+        repository_path,
+        base_revision,
+        tmp_path / "verification.json",
+    )
+
+    assert report.aggregate_status == "failed"
+    assert [each_record.status for each_record in report.checks] == [
+        "failed",
+        "incomplete",
+    ]
+    assert report.publishable is False
+
+
+def test_failed_command_keeps_failed_status_when_collection_also_fails() -> None:
+    check = CheckSpec("unit", ("pytest",), ".", 10.0, minimum_tests=1)
+    failed_collection = CommandCapture(1, "", "", COLLECTION_ERROR_KIND, "no collect")
+
+    status, error_kind, _ = check_runner._classify_collection(
+        check, (failed_collection, None), FAILED_STATUS, NONZERO_EXIT_ERROR_KIND, "x"
+    )
+
+    assert (status, error_kind) == (FAILED_STATUS, NONZERO_EXIT_ERROR_KIND)

package/scripts/tests/test_local_verification_cli.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+import io
+import json
+import sys
+from pathlib import Path
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+from local_verification.cli import main
+
+
+def _write_failure_manifest(tmp_path: Path) -> Path:
+    manifest_path = tmp_path / "manifest.json"
+    manifest_path.write_text(
+        json.dumps(
+            {
+                "version": 1,
+                "checks": [
+                    {
+                        "id": "fails",
+                        "argv": [sys.executable, "-c", "raise SystemExit(4)"],
+                        "cwd": ".",
+                        "timeout_seconds": 10,
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    return manifest_path
+
+
+def _run_failure_cli(tmp_path: Path) -> tuple[int, str, str, Path]:
+    manifest_path = _write_failure_manifest(tmp_path)
+    output_path = tmp_path / "verification.json"
+    standard_output = io.StringIO()
+    standard_error = io.StringIO()
+    exit_code = main(
+        [
+            "--manifest",
+            str(manifest_path),
+            "--repo",
+            str(tmp_path),
+            "--base",
+            "base-sha",
+            "--output",
+            str(output_path),
+        ],
+        stdout=standard_output,
+        stderr=standard_error,
+    )
+    return exit_code, standard_output.getvalue(), standard_error.getvalue(), output_path
+
+
+def test_cli_writes_json_and_returns_failure_code(tmp_path: Path) -> None:
+    exit_code, standard_output, standard_error, output_path = _run_failure_cli(tmp_path)
+
+    assert exit_code == 1
+    assert "check start: fails" in standard_output
+    assert "aggregate: failed" in standard_output
+    assert "revision: head=unresolved base=unresolved" in standard_output
+    assert (
+        "eligibility: clean=false unchanged=false publishable=false" in standard_output
+    )
+    assert f"report: {output_path}" in standard_output
+    assert "verification failed" in standard_error
+    assert (
+        json.loads(output_path.read_text(encoding="utf-8"))["aggregate"]["status"]
+        == "failed"
+    )
+
+
+def test_cli_rejects_zero_checks_without_writing_success(tmp_path: Path) -> None:
+    manifest_path = tmp_path / "manifest.json"
+    manifest_path.write_text(json.dumps({"version": 1, "checks": []}), encoding="utf-8")
+    output_path = tmp_path / "verification.json"
+    output_path.write_text(json.dumps({"publishable": True}), encoding="utf-8")
+
+    exit_code = main(
+        [
+            "--manifest",
+            str(manifest_path),
+            "--repo",
+            str(tmp_path),
+            "--base",
+            "base-sha",
+            "--output",
+            str(output_path),
+        ],
+        stdout=io.StringIO(),
+        stderr=io.StringIO(),
+    )
+
+    assert exit_code == 2
+    assert not output_path.exists()

package/scripts/tests/test_policy_lint_rules_archive.py

@@ -0,0 +1,120 @@
+"""Archive boundaries for automatic and explicitly requested policy checks."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path, PurePosixPath
+
+import pytest
+from policy_lint.engine import _runtime_document_set, lint
+from policy_lint.model import (
+    Diagnostic,
+    Document,
+    DocumentRule,
+    DocumentSet,
+    LintRequest,
+    Location,
+    SelectionKind,
+    Severity,
+    TextDocument,
+)
+
+
+def _git(repository_root: Path, *arguments: str) -> None:
+    environment = {
+        variable_name: variable_text
+        for variable_name, variable_text in os.environ.items()
+        if not variable_name.upper().startswith("GIT_")
+    }
+    subprocess.run(
+        ["git", *arguments], cwd=repository_root, env=environment,
+        check=True, capture_output=True, text=True,
+    )
+
+
+@pytest.fixture
+def archive_repository(tmp_path: Path) -> Path:
+    _git(tmp_path, "init", "--quiet", "-b", "main")
+    _git(tmp_path, "config", "user.name", "Archive Tests")
+    _git(tmp_path, "config", "user.email", "archive@example.invalid")
+    _git(tmp_path, "config", "commit.gpgsign", "false")
+    for relative_path in ("active.py", "skill-archive/old.py", "src/skill-archive/live.py"):
+        file_path = tmp_path / relative_path
+        file_path.parent.mkdir(parents=True, exist_ok=True)
+        file_path.write_text("first\n", encoding="utf-8")
+    _git(tmp_path, "add", ".")
+    _git(tmp_path, "commit", "--quiet", "-m", "archive fixture")
+    for file_path in tmp_path.rglob("*.py"):
+        file_path.write_text("second\n", encoding="utf-8")
+    _git(tmp_path, "add", ".")
+    return tmp_path
+
+
+def _marker_diagnostics(document: Document, repository_root: Path) -> tuple[Diagnostic, ...]:
+    assert (repository_root / document.path).is_file()
+    return (Diagnostic("marker", Severity.ERROR, "Checked document", Location(document.path, 1)),)
+
+
+def _accept_document(document: Document) -> bool:
+    return bool(document.path.parts)
+
+
+def _marker_rule() -> DocumentRule:
+    return DocumentRule(
+        "marker", frozenset({"changed", "repository"}),
+        _accept_document, _marker_diagnostics,
+    )
+
+
+@pytest.mark.parametrize("selection", (SelectionKind.STAGED, SelectionKind.BASE, SelectionKind.REPOSITORY))
+def test_automatic_checks_keep_live_code_and_exclude_only_root_archive(
+    archive_repository: Path, selection: SelectionKind,
+) -> None:
+    requests = {
+        SelectionKind.STAGED: LintRequest.staged(archive_repository),
+        SelectionKind.BASE: LintRequest.base(archive_repository, "HEAD"),
+        SelectionKind.REPOSITORY: LintRequest.repository(archive_repository),
+    }
+    report = lint(requests[selection], all_registry=(_marker_rule(),))
+    assert report.checked_documents == (
+        PurePosixPath("active.py"), PurePosixPath("src/skill-archive/live.py"),
+    )
+    assert len(report.diagnostics) == 2
+    assert report.executed_rules == ("marker",)
+    assert report.exit_code == 1
+
+
+@pytest.mark.parametrize("selection", (SelectionKind.FILES, SelectionKind.TEXT))
+def test_explicit_archive_checks_still_execute_rules(
+    archive_repository: Path, selection: SelectionKind,
+) -> None:
+    archive_path = Path("skill-archive/old.py")
+    request = (
+        LintRequest.files(archive_repository, [archive_path])
+        if selection is SelectionKind.FILES
+        else LintRequest(archive_repository, TextDocument(archive_path, "editor text\n"))
+    )
+    report = lint(request, all_registry=(_marker_rule(),))
+    assert report.checked_documents == (PurePosixPath("skill-archive/old.py"),)
+    assert len(report.diagnostics) == 1
+    assert report.exit_code == 1
+
+
+def test_retirement_and_restoration_preserve_live_change_metadata(tmp_path: Path) -> None:
+    retired_path = PurePosixPath("active/retired.py")
+    archive_path = PurePosixPath("skill-archive/retired.py")
+    restored_source = PurePosixPath("skill-archive/restored.py")
+    restored_path = PurePosixPath("active/restored.py")
+    deleted_path = PurePosixPath("active/deleted.py")
+    document_set = DocumentSet(
+        (Document.from_text(archive_path, "archived"), Document.from_text(restored_path, "restored")),
+        SelectionKind.BASE,
+        tmp_path,
+        (deleted_path, PurePosixPath("skill-archive/deleted.py")),
+        ((retired_path, archive_path), (restored_source, restored_path)),
+    )
+    runtime_set = _runtime_document_set(document_set)
+    assert tuple(document.path for document in runtime_set.documents) == (restored_path,)
+    assert runtime_set.deleted_paths == (deleted_path, retired_path)
+    assert runtime_set.renamed_paths == ((restored_source, restored_path),)

package/scripts/tests/test_policy_lint_rules_engine.py

@@ -10,7 +10,7 @@ from pathlib import Path, PurePosixPath
 import pytest
 from policy_lint import adapters
 from policy_lint.config.constants import INCOMPLETE_EXIT_CODE
-from policy_lint.engine import lint
+from policy_lint.engine import _runtime_document_set, lint
 from policy_lint.model import (
     ContentOrigin,
     Diagnostic,
@@ -309,7 +309,11 @@ def test_state_description_diagnostics_maps_and_scopes_phrases(
     lint_report = _lint_documents(
         tmp_path,
         (source_document,),
-        (_changed_document_rule("state-description", adapters.state_description_diagnostics),),
+        (
+            _changed_document_rule(
+                "state-description", adapters.state_description_diagnostics
+            ),
+        ),
     )
     assert len(lint_report.diagnostics) == 1
     assert lint_report.diagnostics[0].location is not None
@@ -351,8 +355,12 @@ def test_failed_adapter_rolls_back_continues_and_exits_incomplete(
         _source_document("pkg/second.py"),
     )
     all_rules = (
-        _changed_document_rule("flaky", lambda document, _root: _flaky_diagnostics(document)),
-        _changed_document_rule("stable", lambda document, _root: _stable_diagnostics(document)),
+        _changed_document_rule(
+            "flaky", lambda document, _root: _flaky_diagnostics(document)
+        ),
+        _changed_document_rule(
+            "stable", lambda document, _root: _stable_diagnostics(document)
+        ),
     )
     lint_report = _lint_documents(repository_root, all_documents, all_rules)
     assert lint_report.failed_rules == ("flaky",)
@@ -379,3 +387,16 @@ def test_process_interrupt_is_not_swallowed(tmp_path: Path) -> None:
             (_source_document("pkg/mod.py"),),
             (_changed_document_rule("interrupt", interrupt_diagnostics),),
         )
+
+
+def test_runtime_document_set_keeps_base_revision_for_base_selection(
+    tmp_path: Path,
+) -> None:
+    document_set = DocumentSet(
+        (_source_document("pkg/mod.py"),),
+        SelectionKind.BASE,
+        tmp_path,
+        base_revision="abc123def",
+    )
+    runtime_document_set = _runtime_document_set(document_set)
+    assert runtime_document_set.base_revision == "abc123def"

package/scripts/tests/test_policy_lint_rules_installed_loader.py

@@ -0,0 +1,29 @@
+"""Load terminology through the verified installed shared-tree resolver."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+from policy_lint import adapters
+
+
+def test_pr_loop_loader_uses_the_shared_tree_resolver(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    module_name = "policy_fixture_terminology"
+    (tmp_path / f"{module_name}.py").write_text("IS_FIXTURE = True\n", encoding="utf-8")
+    all_calls: list[tuple[object, ...]] = []
+
+    def resolve_directory(*all_arguments: object) -> Path:
+        all_calls.append(all_arguments)
+        return tmp_path
+
+    monkeypatch.setattr(adapters, "resolve_shared_scripts_directory", resolve_directory)
+    monkeypatch.setattr(sys, "path", list(sys.path))
+    loaded = adapters._pr_loop_script_module(module_name)
+    assert loaded.IS_FIXTURE is True
+    assert Path(loaded.__file__).parent == tmp_path
+    assert all_calls[0][2:] == ("pr-loop", f"{module_name}.py", 2)
+    monkeypatch.delitem(sys.modules, module_name)