claude-dev-env 4.3.0 → 7.1.0

package/scripts/tests/test_policy_lint_rules_pairing.py

@@ -0,0 +1,163 @@
+"""Test pairing behavior for changed source documents."""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapters
+from policy_lint.config.approved_test_pairs import (
+    APPROVED_TEST_PATHS_BY_PRODUCTION_PATH,
+)
+from policy_lint.model import (
+    ContentOrigin,
+    Diagnostic,
+    Document,
+    DocumentSet,
+    SelectionKind,
+)
+
+_MODULE_DOCSTRING_BEFORE = '''"""Before."""
+
+def work() -> None:
+    """Old function documentation."""
+    return None
+'''
+_MODULE_DOCSTRING_AFTER = '''"""After."""
+
+def work() -> None:
+    """Updated function documentation."""
+    return None
+'''
+_BODY_BEFORE = '''"""Before."""
+
+def work() -> None:
+    return None
+'''
+_BODY_AFTER = '''"""After."""
+
+def work() -> None:
+    return 1
+'''
+
+
+def _changed_document(
+    current_source: str, prior_source: str, suffix: str = ".py"
+) -> Document:
+    return Document(
+        PurePosixPath(f"src/feature{suffix}"),
+        current_source,
+        prior_source,
+        frozenset({1}),
+        ContentOrigin.REVISION_DIFF,
+    )
+
+
+def _pairing_diagnostics(
+    temporary_path: Path, changed_document: Document
+) -> tuple[Diagnostic, ...]:
+    document_set = DocumentSet((changed_document,), SelectionKind.BASE, temporary_path)
+    return adapters.test_pairing_diagnostics(document_set)
+
+
+def test_approved_pairs_name_files_that_exist() -> None:
+    repository_root = Path(__file__).resolve().parents[4]
+    for (
+        production_path,
+        all_test_paths,
+    ) in APPROVED_TEST_PATHS_BY_PRODUCTION_PATH.items():
+        assert (repository_root / production_path).is_file(), production_path
+        for each_test_path in all_test_paths:
+            assert (repository_root / each_test_path).is_file(), each_test_path
+
+
+def test_pairing_ignores_python_docstring_only_changes(tmp_path: Path) -> None:
+    all_diagnostics = _pairing_diagnostics(
+        tmp_path,
+        _changed_document(_MODULE_DOCSTRING_AFTER, _MODULE_DOCSTRING_BEFORE),
+    )
+    assert all_diagnostics == ()
+
+
+def test_pairing_requires_a_test_for_python_body_changes(tmp_path: Path) -> None:
+    all_diagnostics = _pairing_diagnostics(
+        tmp_path,
+        _changed_document(_BODY_AFTER, _BODY_BEFORE),
+    )
+    assert len(all_diagnostics) == 1
+
+
+def test_pairing_rejects_python_syntax_errors_without_a_test(tmp_path: Path) -> None:
+    all_diagnostics = _pairing_diagnostics(
+        tmp_path,
+        _changed_document("def work(:\n    return None\n", _BODY_BEFORE),
+    )
+    assert len(all_diagnostics) == 1
+
+
+def test_pairing_keeps_non_python_changes_on_existing_matching_rules(
+    tmp_path: Path,
+) -> None:
+    all_diagnostics = _pairing_diagnostics(
+        tmp_path,
+        _changed_document(
+            "export const work = 1;\n", "export const work = 2;\n", ".ts"
+        ),
+    )
+    assert len(all_diagnostics) == 1
+
+
+_APPROVED_PRODUCTION_PATH = PurePosixPath(
+    "packages/claude-dev-env/scripts/automatic_advisory/state.py"
+)
+_APPROVED_TEST_PATH = PurePosixPath(
+    "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+)
+_UNRELATED_PRODUCTION_PATH = PurePosixPath(
+    "packages/claude-dev-env/scripts/automatic_advisory/new_module.py"
+)
+
+
+def _body_change_at(path: PurePosixPath) -> Document:
+    return Document(
+        path, _BODY_AFTER, _BODY_BEFORE, frozenset({4}), ContentOrigin.REVISION_DIFF
+    )
+
+
+def _diagnostic_paths(
+    temporary_path: Path, *all_documents: Document
+) -> tuple[PurePosixPath, ...]:
+    document_set = DocumentSet(all_documents, SelectionKind.BASE, temporary_path)
+    return tuple(
+        each_diagnostic.location.path
+        for each_diagnostic in adapters.test_pairing_diagnostics(document_set)
+    )
+
+
+def test_pairing_accepts_an_approved_module_with_its_changed_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(
+        tmp_path,
+        _body_change_at(_APPROVED_PRODUCTION_PATH),
+        _body_change_at(_APPROVED_TEST_PATH),
+    )
+    assert all_paths == ()
+
+
+def test_pairing_rejects_an_approved_module_without_its_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(tmp_path, _body_change_at(_APPROVED_PRODUCTION_PATH))
+    assert all_paths == (_APPROVED_PRODUCTION_PATH,)
+
+
+def test_pairing_rejects_an_unrelated_module_beside_a_changed_approved_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(
+        tmp_path,
+        _body_change_at(_APPROVED_PRODUCTION_PATH),
+        _body_change_at(_UNRELATED_PRODUCTION_PATH),
+        _body_change_at(_APPROVED_TEST_PATH),
+    )
+    assert all_paths == (_UNRELATED_PRODUCTION_PATH,)

package/scripts/tests/test_policy_lint_rules_registry.py

@@ -15,6 +15,7 @@ from policy_lint.model import (
     Document,
     DocumentRule,
     DocumentSet,
+    LintReport,
     LintRequest,
     SelectionKind,
 )
@@ -96,6 +97,164 @@ def _terminology_rule() -> ChangeSetRule:
     return terminology_rule
 
 
+def _head_revision(repository_root: Path) -> str:
+    completed = subprocess.run(
+        ("git", "rev-parse", "HEAD"),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return completed.stdout.strip()
+
+
+def _git_add(repository_root: Path, *all_paths: str) -> None:
+    subprocess.run(
+        ("git", "add", *all_paths),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+
+
+def _quota_document_paths(
+    repository_root: Path,
+    source_name: str = "quota.py",
+    documentation_name: str = "README.md",
+) -> tuple[Path, Path]:
+    source_path = repository_root / "src" / source_name
+    documentation_path = repository_root / "docs" / documentation_name
+    source_path.parent.mkdir(parents=True, exist_ok=True)
+    documentation_path.parent.mkdir(parents=True, exist_ok=True)
+    return source_path, documentation_path
+
+
+def _write_text(file_path: Path, text: str) -> None:
+    file_path.write_text(text, encoding="utf-8")
+
+
+def _commit_quota_base(
+    repository_root: Path,
+    source_text: str,
+    documentation_text: str,
+    source_name: str = "quota.py",
+    documentation_name: str = "README.md",
+) -> tuple[Path, Path, str]:
+    _ensure_git_repository(repository_root)
+    source_path, documentation_path = _quota_document_paths(
+        repository_root, source_name, documentation_name
+    )
+    _write_text(source_path, source_text)
+    _write_text(documentation_path, documentation_text)
+    _commit_repository(repository_root, "base")
+    return source_path, documentation_path, _head_revision(repository_root)
+
+
+def _commit_identifier_then_documentation(
+    repository_root: Path,
+    source_path: Path,
+    documentation_path: Path,
+) -> None:
+    _write_text(source_path, "baseline = 1\npremium_request_interactions = 5\n")
+    _commit_repository(repository_root, "identifier")
+    _write_text(
+        documentation_path,
+        "The premium-request-budget field gates the run.\n",
+    )
+    _commit_repository(repository_root, "documentation")
+
+
+def _committed_near_miss_from_base(
+    repository_root: Path,
+) -> tuple[Path, Path, str]:
+    source_path, documentation_path, comparison_revision = _commit_quota_base(
+        repository_root,
+        "baseline = 1\n",
+        "Baseline quota text.\n",
+    )
+    _commit_identifier_then_documentation(
+        repository_root, source_path, documentation_path
+    )
+    return source_path, documentation_path, comparison_revision
+
+
+def _stage_unrelated_index_file(repository_root: Path) -> None:
+    _write_text(repository_root / "staged.txt", "unrelated index content\n")
+    _git_add(repository_root, "--", "staged.txt")
+
+
+def _worktree_and_index_near_miss_repository(repository_root: Path) -> str:
+    source_path, documentation_path, comparison_revision = (
+        _committed_near_miss_from_base(repository_root)
+    )
+    _write_text(
+        source_path,
+        "baseline = 1\npremium_request_interactions = 5\nanother_request_total = 2\n",
+    )
+    _write_text(
+        documentation_path,
+        "The another-request-budget field gates the run.\n",
+    )
+    _git_add(repository_root, "-A")
+    _write_text(
+        documentation_path,
+        "The another-request-total field gates the run.\n",
+    )
+    return comparison_revision
+
+
+def _existing_identifier_from_base(repository_root: Path) -> str:
+    source_path, documentation_path, comparison_revision = _commit_quota_base(
+        repository_root,
+        "premium_request_interactions = 5\n",
+        "Baseline quota text.\n",
+    )
+    _write_text(
+        source_path,
+        "premium_request_interactions = 5\npremium_request_interactions = 6\n",
+    )
+    _write_text(
+        documentation_path,
+        "The premium-request-budget field gates the run.\n",
+    )
+    _commit_repository(repository_root, "existing identifier")
+    return comparison_revision
+
+
+def _renamed_and_deleted_near_miss_from_base(repository_root: Path) -> str:
+    old_source_path, deleted_documentation_path, comparison_revision = (
+        _commit_quota_base(
+            repository_root,
+            "baseline = 1\n",
+            "Obsolete quota text.\n",
+            "old_quota.py",
+            "obsolete.md",
+        )
+    )
+    new_source_path = repository_root / "src" / "new_quota.py"
+    subprocess.run(
+        ("git", "mv", "--", str(old_source_path), str(new_source_path)),
+        cwd=repository_root,
+        check=True,
+        capture_output=True,
+    )
+    _write_text(new_source_path, "baseline = 1\npremium_request_interactions = 5\n")
+    deleted_documentation_path.unlink()
+    _write_text(
+        repository_root / "docs" / "README.md",
+        "The premium-request-budget field gates the run.\n",
+    )
+    _commit_repository(repository_root, "rename and delete")
+    return comparison_revision
+
+
+def _lint_base(repository_root: Path, comparison_revision: str) -> LintReport:
+    return lint(
+        LintRequest.base(repository_root, comparison_revision),
+        all_registry=(_terminology_rule(),),
+    )
+
+
 def test_hook_format_accepts_claude_settings() -> None:
     settings_document = Document.from_text(".claude/settings.json", "{}")
     hooks_document = Document.from_text("hooks/hooks.json", "{}")
@@ -161,7 +320,7 @@ def test_test_pairing_diagnostics_exempts_constants_only_python_modules(
         (
             Document.from_text(
                 "hooks_constants/tool_names.py",
-                "TOOL_NAME: str = \"tool\"\n",
+                'TOOL_NAME: str = "tool"\n',
             ),
         ),
         SelectionKind.STAGED,
@@ -244,9 +403,7 @@ def test_hook_configuration_diagnostics_rejects_registered_action_boundary_path(
         json.dumps(
             {
                 "hooks": {
-                    "PreToolUse": [
-                        {"hooks": [{"command": "hooks/blocking/deny.py"}]}
-                    ]
+                    "PreToolUse": [{"hooks": [{"command": "hooks/blocking/deny.py"}]}]
                 }
             }
         ),
@@ -263,7 +420,9 @@ def test_hook_configuration_diagnostics_ignore_description_text(tmp_path: Path)
         "hooks/hooks.json",
         json.dumps({"description": "blocking safety controls", "hooks": {}}),
     )
-    assert adapters.hook_configuration_diagnostics(configuration_document, tmp_path) == ()
+    assert (
+        adapters.hook_configuration_diagnostics(configuration_document, tmp_path) == ()
+    )
 
 
 def test_hook_configuration_diagnostics_ignore_task_path(tmp_path: Path) -> None:
@@ -271,7 +430,9 @@ def test_hook_configuration_diagnostics_ignore_task_path(tmp_path: Path) -> None
         "hooks/hooks.json",
         json.dumps({"hooks": {"PostToolUse": [{"command": "task_runner.py"}]}}),
     )
-    assert adapters.hook_configuration_diagnostics(configuration_document, tmp_path) == ()
+    assert (
+        adapters.hook_configuration_diagnostics(configuration_document, tmp_path) == ()
+    )
 
 
 def test_registry_omits_native_ruff_mypy_javascript_adapters() -> None:
@@ -291,7 +452,9 @@ def test_registry_registers_unique_python_validator_rule() -> None:
 def test_registry_registers_terminology_change_set_rule() -> None:
     terminology_rule = _terminology_rule()
     assert terminology_rule.rule_sets == _CHANGED_RULE_SETS
-    assert terminology_rule.selections == frozenset({SelectionKind.STAGED})
+    assert terminology_rule.selections == frozenset(
+        {SelectionKind.STAGED, SelectionKind.BASE}
+    )
 
 
 def test_registry_runs_test_pairing_for_staged_and_base_changes() -> None:
@@ -313,10 +476,11 @@ def test_terminology_rule_reports_cross_surface_path_and_line(
         tmp_path,
         "baseline = 1\n",
         "premium_request_interactions = 5\n",
-        "Quota fields use one name.\n"
-        "The premium-request-budget field gates the run.\n",
+        "Quota fields use one name.\nThe premium-request-budget field gates the run.\n",
+    )
+    lint_report = lint(
+        LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),)
     )
-    lint_report = lint(LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),))
 
     assert len(lint_report.diagnostics) == 1
     diagnostic = lint_report.diagnostics[0]
@@ -332,15 +496,65 @@ def test_terminology_rule_suppresses_identifier_present_in_prior_tree(
     _stage_terminology_change(
         tmp_path,
         "premium_request_interactions = 5\n",
-        "premium_request_interactions = 5\n"
-        "premium_request_interactions = 6\n",
+        "premium_request_interactions = 5\npremium_request_interactions = 6\n",
         "The premium-request-budget field gates the run.\n",
     )
-    lint_report = lint(LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),))
+    lint_report = lint(
+        LintRequest.staged(tmp_path), all_registry=(_terminology_rule(),)
+    )
+
+    assert lint_report.diagnostics == ()
+
+
+def test_terminology_rule_reports_committed_changes_from_base(
+    tmp_path: Path,
+) -> None:
+    _, _, comparison_revision = _committed_near_miss_from_base(tmp_path)
+    _stage_unrelated_index_file(tmp_path)
+    lint_report = _lint_base(tmp_path, comparison_revision)
+    assert lint_report.failed_rules == ()
+    assert len(lint_report.diagnostics) == 1
+    assert lint_report.diagnostics[0].location is not None
+    assert lint_report.diagnostics[0].location.path == PurePosixPath("docs/README.md")
+
+
+def test_terminology_base_uses_worktree_while_staged_uses_index(
+    tmp_path: Path,
+) -> None:
+    comparison_revision = _worktree_and_index_near_miss_repository(tmp_path)
+    base_report = _lint_base(tmp_path, comparison_revision)
+    staged_report = lint(
+        LintRequest.staged(tmp_path),
+        all_registry=(_terminology_rule(),),
+    )
+    assert base_report.failed_rules == ()
+    assert staged_report.failed_rules == ()
+    assert base_report.diagnostics == ()
+    assert len(staged_report.diagnostics) == 1
+    assert staged_report.diagnostics[0].location is not None
+    assert staged_report.diagnostics[0].location.path == PurePosixPath("docs/README.md")
 
+
+def test_terminology_base_suppresses_identifier_present_in_comparison_base(
+    tmp_path: Path,
+) -> None:
+    comparison_revision = _existing_identifier_from_base(tmp_path)
+    lint_report = _lint_base(tmp_path, comparison_revision)
+    assert lint_report.failed_rules == ()
     assert lint_report.diagnostics == ()
 
 
+def test_terminology_base_handles_renames_and_deletions(
+    tmp_path: Path,
+) -> None:
+    comparison_revision = _renamed_and_deleted_near_miss_from_base(tmp_path)
+    lint_report = _lint_base(tmp_path, comparison_revision)
+    assert lint_report.failed_rules == ()
+    assert len(lint_report.diagnostics) == 1
+    assert lint_report.diagnostics[0].location is not None
+    assert lint_report.diagnostics[0].location.path == PurePosixPath("docs/README.md")
+
+
 def test_terminology_rule_skips_file_selection(tmp_path: Path) -> None:
     document_set = DocumentSet(
         (Document.from_text("docs/README.md", "text\n"),),

package/scripts/tests/test_policy_lint_selection.py

@@ -28,7 +28,7 @@ def _git_environment() -> dict[str, str]:
     }
 
 
-def _run_git(repository_root: Path, *all_arguments: str) -> None:
+def _git_stdout(repository_root: Path, *all_arguments: str) -> str:
     completed = subprocess.run(
         [constants.GIT_EXECUTABLE, *all_arguments],
         cwd=repository_root,
@@ -38,6 +38,11 @@ def _run_git(repository_root: Path, *all_arguments: str) -> None:
         env=_git_environment(),
     )
     assert completed.returncode == 0, completed.stderr
+    return completed.stdout.strip()
+
+
+def _run_git(repository_root: Path, *all_arguments: str) -> None:
+    _git_stdout(repository_root, *all_arguments)
 
 
 def _initialize_repository(repository_root: Path) -> Path:
@@ -200,7 +205,9 @@ def test_staged_missing_non_delete_blob_should_raise(
 def test_git_blob_unexpected_failure_should_raise(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    def failed_git(*_all_arguments: object, **_all_keywords: object) -> subprocess.CompletedProcess[bytes]:
+    def failed_git(
+        *_all_arguments: object, **_all_keywords: object
+    ) -> subprocess.CompletedProcess[bytes]:
         return subprocess.CompletedProcess(
             args=[constants.GIT_EXECUTABLE],
             returncode=1,
@@ -254,6 +261,22 @@ def test_base_source_should_compare_merge_base_and_read_worktree_bytes(
     assert selected_document.origin == ContentOrigin.REVISION_DIFF
 
 
+def test_base_selection_records_merge_base_revision_and_staged_does_not(
+    tmp_path: Path,
+) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "file.py", "base-text\n")
+    _run_git(repository_root, "checkout", "--quiet", "-b", "feature")
+    _commit_text(repository_root, "file.py", "feature-committed\n")
+
+    merge_base = _git_stdout(repository_root, "merge-base", "main", "HEAD")
+    base_document_set = select_documents(LintRequest.base(repository_root, "main"))
+    staged_document_set = select_documents(LintRequest.staged(repository_root))
+
+    assert base_document_set.base_revision == merge_base
+    assert staged_document_set.base_revision is None
+
+
 def test_repository_source_should_read_tracked_worktree_files_only(
     tmp_path: Path,
 ) -> None:

package/scripts/tests/test_policy_lint_selection_native_index.py

@@ -0,0 +1,30 @@
+"""Preserve Git's active index without accepting repository-directory overrides."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from policy_lint import selection_git
+
+
+def test_active_git_index_survives_environment_sanitization(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    index_path = tmp_path / "index"
+    monkeypatch.setenv("GIT_INDEX_FILE", str(index_path))
+    monkeypatch.setenv("GIT_DIR", "foreign-repository")
+    monkeypatch.setenv("GIT_WORK_TREE", "foreign-worktree")
+    monkeypatch.setenv("PRESERVED_SETTING", "fixture")
+    active_environment = selection_git._git_subprocess_environment()
+    assert active_environment["GIT_INDEX_FILE"] == str(index_path)
+    assert "GIT_DIR" not in active_environment
+    assert "GIT_WORK_TREE" not in active_environment
+    assert active_environment["PRESERVED_SETTING"] == "fixture"
+
+
+def test_default_index_is_not_replaced_by_an_invented_path(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.delenv("GIT_INDEX_FILE", raising=False)
+    assert "GIT_INDEX_FILE" not in selection_git._git_subprocess_environment()