claude-dev-env 4.3.0 → 7.1.0

package/scripts/tests/test_pr_verification_github.py

@@ -0,0 +1,392 @@
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+from pr_verification.github import (
+    GitHubApi,
+    GitHubAppAuthenticator,
+    GitHubError,
+    HttpReply,
+)
+from pr_verification.model import RepositorySettings, StatusState
+
+
+class RecordingRequester:
+    def __init__(self, all_replies: list[HttpReply]) -> None:
+        self.all_replies = all_replies
+        self.all_requests: list[tuple[str, str, dict[str, str], bytes | None]] = []
+
+    def __call__(
+        self,
+        method: str,
+        url: str,
+        headers: dict[str, str],
+        body: bytes | None,
+    ) -> HttpReply:
+        self.all_requests.append((method, url, headers, body))
+        return self.all_replies.pop(0)
+
+
+def repository_settings() -> RepositorySettings:
+    return RepositorySettings(
+        slug="owner/repository",
+        clone_url="https://github.test/owner/repository.git",
+    )
+
+
+def pull_payload(
+    head_sha: str = "head",
+    base_ref: str = "main",
+) -> dict[str, object]:
+    return {
+        "number": 7,
+        "draft": True,
+        "merge_commit_sha": "merge",
+        "base": {"ref": base_ref, "sha": "base"},
+        "head": {"sha": head_sha},
+    }
+
+
+def branch_payload(branch_sha: str = "current-base") -> dict[str, object]:
+    return {
+        "ref": "refs/heads/main",
+        "object": {"sha": branch_sha, "type": "commit"},
+    }
+
+
+def _issue_repository_api(
+    tmp_path: Path,
+    requester: RecordingRequester,
+    all_claims: list[dict[str, int | str]],
+) -> GitHubApi:
+    private_key_path = tmp_path / "app.pem"
+    private_key_path.write_text("private-key", encoding="utf-8")
+
+    def encode_jwt(
+        claims: dict[str, int | str], private_key: str, algorithm: str
+    ) -> str:
+        all_claims.append(claims)
+        assert private_key == "private-key"
+        assert algorithm == "RS256"
+        return "app-jwt"
+
+    authenticator = GitHubAppAuthenticator(
+        "https://api.github.test",
+        42,
+        84,
+        private_key_path,
+        requester=requester,
+        jwt_encoder=encode_jwt,
+        clock=lambda: 1000.0,
+    )
+    return authenticator.issue_repository_api(repository_settings())
+
+
+def test_lists_draft_pull_requests() -> None:
+    requester = RecordingRequester(
+        [HttpReply(200, {}, json.dumps([pull_payload()]).encode("utf-8"))]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    all_candidates = github.list_open_candidates(repository_settings())
+
+    assert len(all_candidates) == 1
+    assert all_candidates[0].is_draft is True
+    assert "state=open" in requester.all_requests[0][1]
+
+
+def test_reads_merge_commit_parents_in_order() -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(
+                200,
+                {},
+                json.dumps(
+                    {"sha": "merge", "parents": [{"sha": "base"}, {"sha": "head"}]}
+                ).encode("utf-8"),
+            )
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    all_parent_shas = github.get_commit_parents(repository_settings(), "merge")
+
+    assert all_parent_shas == ("base", "head")
+
+
+def test_posts_status_to_recognized_merge_sha() -> None:
+    requester = RecordingRequester([HttpReply(201, {}, b"{}")])
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    github.post_status(
+        repository_settings(),
+        "merge",
+        StatusState.SUCCESS,
+        "local/verify",
+        "All required checks passed",
+    )
+
+    method, url, headers, body = requester.all_requests[0]
+    assert method == "POST"
+    assert url.endswith("/repos/owner/repository/statuses/merge")
+    assert headers["Authorization"] == "Bearer installation-token"
+    assert json.loads(body or b"{}")["context"] == "local/verify"
+
+
+def test_adds_and_removes_one_label_without_replacing_other_labels() -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(200, {}, b"[]"),
+            HttpReply(200, {}, json.dumps([{"name": "local-checks:passed"}]).encode()),
+            HttpReply(204, {}, b""),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    github.add_label(repository_settings(), 7, "local-checks:passed")
+    github.remove_label(repository_settings(), 7, "local-checks:passed")
+
+    add_method, add_url, _, add_body = requester.all_requests[0]
+    read_method, read_url, _, read_body = requester.all_requests[1]
+    remove_method, remove_url, _, remove_body = requester.all_requests[2]
+    assert add_method == "POST"
+    assert add_url.endswith("/repos/owner/repository/issues/7/labels")
+    assert json.loads(add_body or b"{}") == {"labels": ["local-checks:passed"]}
+    assert read_method == "GET"
+    assert read_url.endswith(
+        "/repos/owner/repository/issues/7/labels?per_page=100&page=1"
+    )
+    assert read_body is None
+    assert remove_method == "DELETE"
+    assert remove_url.endswith(
+        "/repos/owner/repository/issues/7/labels/local-checks%3Apassed"
+    )
+    assert remove_body is None
+
+
+def test_removes_label_when_github_returns_ok() -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(200, {}, json.dumps([{"name": "local-checks:passed"}]).encode()),
+            HttpReply(200, {}, b"{}"),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    github.remove_label(repository_settings(), 7, "local-checks:passed")
+
+    assert requester.all_requests[1][0] == "DELETE"
+
+
+def test_ignores_label_that_is_already_absent() -> None:
+    requester = RecordingRequester([HttpReply(200, {}, b"[]")])
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    github.remove_label(repository_settings(), 7, "local-checks:passed")
+
+    assert len(requester.all_requests) == 1
+
+
+def test_raises_when_label_delete_is_forbidden() -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(200, {}, json.dumps([{"name": "local-checks:passed"}]).encode()),
+            HttpReply(403, {}, b"{}"),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    try:
+        github.remove_label(repository_settings(), 7, "local-checks:passed")
+    except GitHubError as error:
+        assert "403" in str(error)
+    else:
+        raise AssertionError("Expected forbidden label deletion to fail")
+
+
+def test_app_token_is_scoped_to_one_repository_and_required_permissions(
+    tmp_path: Path,
+) -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(
+                201, {}, json.dumps({"token": "installation-token"}).encode("utf-8")
+            )
+        ]
+    )
+    all_claims: list[dict[str, int | str]] = []
+    github = _issue_repository_api(tmp_path, requester, all_claims)
+
+    request_body = json.loads(requester.all_requests[0][3] or b"{}")
+    assert github.installation_token == "installation-token"
+    assert request_body == {
+        "repositories": ["repository"],
+        "permissions": {
+            "contents": "read",
+            "pull_requests": "read",
+            "statuses": "write",
+        },
+    }
+    assert all_claims == [{"iss": "42", "iat": 940, "exp": 1540}]
+
+
+def test_app_token_opt_in_adds_issue_write_permission(tmp_path: Path) -> None:
+    private_key_path = tmp_path / "app.pem"
+    private_key_path.write_text("private-key", encoding="utf-8")
+    requester = RecordingRequester(
+        [HttpReply(201, {}, json.dumps({"token": "token"}).encode("utf-8"))]
+    )
+    authenticator = GitHubAppAuthenticator(
+        "https://api.github.test",
+        42,
+        84,
+        private_key_path,
+        requester=requester,
+        jwt_encoder=lambda claims, private_key, algorithm: "app-jwt",
+    )
+
+    authenticator.issue_repository_api(
+        repository_settings(), should_write_issue_labels=True
+    )
+
+    request_body = json.loads(requester.all_requests[0][3] or b"{}")
+    assert request_body == {
+        "repositories": ["repository"],
+        "permissions": {
+            "contents": "read",
+            "pull_requests": "write",
+            "statuses": "write",
+            "issues": "write",
+        },
+    }
+
+
+def test_ignores_pull_until_github_recognizes_merge_sha() -> None:
+    unrecognized_pull = pull_payload()
+    unrecognized_pull["merge_commit_sha"] = None
+    requester = RecordingRequester(
+        [HttpReply(200, {}, json.dumps([unrecognized_pull]).encode("utf-8"))]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    all_candidates = github.list_open_candidates(repository_settings())
+
+    assert all_candidates == ()
+
+
+def test_lists_pull_without_merge_sha_for_advisory_reads() -> None:
+    unrecognized_pull = pull_payload()
+    unrecognized_pull["merge_commit_sha"] = None
+    requester = RecordingRequester(
+        [
+            HttpReply(200, {}, json.dumps([unrecognized_pull]).encode("utf-8")),
+            HttpReply(200, {}, json.dumps(branch_payload()).encode("utf-8")),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    all_candidates = github.list_open_candidates(
+        repository_settings(), should_require_merge_commit=False
+    )
+
+    assert len(all_candidates) == 1
+    assert all_candidates[0].merge_sha == ""
+    assert all_candidates[0].base_sha == "current-base"
+
+
+def test_get_candidate_uses_current_branch_sha_for_advisory_reads() -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(
+                200,
+                {},
+                json.dumps(pull_payload(base_ref="release/#7")).encode("utf-8"),
+            ),
+            HttpReply(
+                200,
+                {},
+                json.dumps(branch_payload("new-base")).encode("utf-8"),
+            ),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    candidate = github.get_candidate(
+        repository_settings(),
+        7,
+        should_require_merge_commit=False,
+    )
+
+    assert candidate.base_sha == "new-base"
+    assert requester.all_requests[1][1].endswith(
+        "/repos/owner/repository/git/ref/heads/release/%237"
+    )
+
+
+def test_list_resolves_each_unique_base_ref_once() -> None:
+    second_pull = pull_payload("second-head")
+    second_pull["number"] = 8
+    requester = RecordingRequester(
+        [
+            HttpReply(
+                200,
+                {},
+                json.dumps([pull_payload(), second_pull]).encode("utf-8"),
+            ),
+            HttpReply(200, {}, json.dumps(branch_payload()).encode("utf-8")),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    all_candidates = github.list_open_candidates(
+        repository_settings(),
+        should_require_merge_commit=False,
+    )
+    all_branch_requests = [
+        each_request
+        for each_request in requester.all_requests
+        if "/git/ref/heads/" in each_request[1]
+    ]
+
+    assert [each_candidate.base_sha for each_candidate in all_candidates] == [
+        "current-base",
+        "current-base",
+    ]
+    assert len(all_branch_requests) == 1
+
+
+def test_advisory_candidate_propagates_branch_read_failure() -> None:
+    requester = RecordingRequester(
+        [
+            HttpReply(200, {}, json.dumps(pull_payload()).encode("utf-8")),
+            HttpReply(500, {}, b"{}"),
+        ]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    with pytest.raises(GitHubError, match="500"):
+        github.get_candidate(
+            repository_settings(),
+            7,
+            should_require_merge_commit=False,
+        )
+
+
+def test_strict_candidate_keeps_pull_base_without_branch_read() -> None:
+    requester = RecordingRequester(
+        [HttpReply(200, {}, json.dumps(pull_payload()).encode("utf-8"))]
+    )
+    github = GitHubApi("https://api.github.test", "installation-token", requester)
+
+    candidate = github.get_candidate(repository_settings(), 7)
+
+    assert candidate.base_sha == "base"
+    assert len(requester.all_requests) == 1

package/scripts/tests/test_pr_verification_lock.py

@@ -0,0 +1,168 @@
+from __future__ import annotations
+
+import subprocess
+import sys
+import time
+from pathlib import Path
+from typing import cast
+
+import pytest
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+from pr_verification import lock as lock_module
+from pr_verification.lock import SupervisorLock, SupervisorLockError
+
+LOCK_CONTENDER_SCRIPT = """
+import sys
+import time
+from pathlib import Path
+
+scripts_directory = Path(sys.argv[1])
+cache_root = Path(sys.argv[2])
+result_path = Path(sys.argv[3])
+start_path = Path(sys.argv[4])
+sys.path.insert(0, str(scripts_directory))
+
+from pr_verification.lock import SupervisorLock, SupervisorLockError
+
+while not start_path.exists():
+    time.sleep(0.01)
+
+try:
+    with SupervisorLock(cache_root):
+        result_path.write_text("acquired", encoding="utf-8")
+        while True:
+            time.sleep(1)
+except SupervisorLockError:
+    result_path.write_text("contended", encoding="utf-8")
+"""
+RESULT_WAIT_SECONDS = 5
+PROCESS_WAIT_SECONDS = 10
+POLL_INTERVAL_SECONDS = 0.01
+LEGACY_LOCK_CONTENT = "legacy owner metadata"
+BASE_PYTHON_EXECUTABLE = cast(str, getattr(sys, "_base_executable", sys.executable))
+
+
+def _start_lock_contender(
+    cache_root: Path, result_path: Path, start_path: Path
+) -> subprocess.Popen[str]:
+    return subprocess.Popen(
+        [
+            BASE_PYTHON_EXECUTABLE,
+            "-c",
+            LOCK_CONTENDER_SCRIPT,
+            str(SCRIPTS_DIRECTORY),
+            str(cache_root),
+            str(result_path),
+            str(start_path),
+        ],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+
+def _wait_for_lock_outcomes(all_result_paths: list[Path]) -> list[str]:
+    deadline = time.monotonic() + RESULT_WAIT_SECONDS
+    while time.monotonic() < deadline:
+        if all(each_path.is_file() for each_path in all_result_paths):
+            return [
+                each_path.read_text(encoding="utf-8") for each_path in all_result_paths
+            ]
+        time.sleep(POLL_INTERVAL_SECONDS)
+    raise AssertionError("lock contenders did not report within five seconds")
+
+
+def _terminate_owned_child(child_process: subprocess.Popen[str]) -> None:
+    if child_process.poll() is None:
+        child_process.terminate()
+    child_process.wait(timeout=PROCESS_WAIT_SECONDS)
+
+
+def _start_simultaneous_lock_contenders(
+    cache_root: Path, all_result_paths: list[Path], start_path: Path
+) -> list[subprocess.Popen[str]]:
+    all_child_processes = [
+        _start_lock_contender(cache_root, each_result_path, start_path)
+        for each_result_path in all_result_paths
+    ]
+    start_path.touch()
+    return all_child_processes
+
+
+def _stop_initial_lock_processes(
+    all_child_processes: list[subprocess.Popen[str]], all_outcomes: list[str]
+) -> None:
+    contender_index = all_outcomes.index("contended")
+    all_child_processes[contender_index].wait(timeout=PROCESS_WAIT_SECONDS)
+    owner_index = all_outcomes.index("acquired")
+    _terminate_owned_child(all_child_processes[owner_index])
+
+
+def test_second_supervisor_cannot_own_same_cache_root(tmp_path: Path) -> None:
+    first_lock = SupervisorLock(tmp_path)
+    second_lock = SupervisorLock(tmp_path)
+
+    with first_lock, pytest.raises(SupervisorLockError):
+        second_lock.acquire()
+
+
+def test_process_lock_survives_contention_and_owner_termination(
+    tmp_path: Path,
+) -> None:
+    lock_path = tmp_path / "supervisor.lock"
+    lock_path.write_text(LEGACY_LOCK_CONTENT, encoding="utf-8")
+    start_path = tmp_path / "start"
+    all_result_paths = [tmp_path / "first.result", tmp_path / "second.result"]
+    all_child_processes = _start_simultaneous_lock_contenders(
+        tmp_path, all_result_paths, start_path
+    )
+    try:
+        all_outcomes = _wait_for_lock_outcomes(all_result_paths)
+        assert sorted(all_outcomes) == ["acquired", "contended"]
+        _stop_initial_lock_processes(all_child_processes, all_outcomes)
+
+        recovery_result_path = tmp_path / "recovery.result"
+        recovery_process = _start_lock_contender(
+            tmp_path, recovery_result_path, start_path
+        )
+        all_child_processes.append(recovery_process)
+        assert _wait_for_lock_outcomes([recovery_result_path]) == ["acquired"]
+        assert lock_path.is_file()
+        _terminate_owned_child(recovery_process)
+        assert lock_path.read_text(encoding="utf-8") == LEGACY_LOCK_CONTENT
+    finally:
+        for each_child_process in all_child_processes:
+            _terminate_owned_child(each_child_process)
+
+
+def test_lock_io_error_is_presented_as_supervisor_lock_error(
+    tmp_path: Path,
+) -> None:
+    (tmp_path / "supervisor.lock").mkdir()
+
+    with pytest.raises(
+        SupervisorLockError,
+        match="Verification supervisor lock file is unavailable",
+    ) as raised_error:
+        SupervisorLock(tmp_path).acquire()
+
+    assert isinstance(raised_error.value.__cause__, OSError)
+
+
+def test_contention_error_survives_a_failing_descriptor_close(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    def close_fails(file_descriptor: int) -> None:
+        raise OSError("close failed")
+
+    first_lock = SupervisorLock(tmp_path)
+    with first_lock:
+        monkeypatch.setattr(lock_module.os, "close", close_fails)
+        with pytest.raises(SupervisorLockError) as raised:
+            SupervisorLock(tmp_path).acquire()
+        monkeypatch.undo()
+    assert str(raised.value) == lock_module.SUPERVISOR_LOCK_ERROR

package/scripts/tests/test_rules.py

@@ -96,7 +96,6 @@ def _comment_policy_surfaces(package_root: Path) -> tuple[Path, ...]:
         package_root / "system-prompts" / "software-engineer.xml",
         package_root / ".agents" / "agents" / "clean-coder.md",
         package_root / ".agents" / "agents" / "code-quality-agent.md",
-        package_root / "_shared" / "pr-loop" / "code-rules-gate.md",
         package_root / "audit-rubrics" / "category_rubrics" / "category-j-code-rules-compliance.md",
         package_root / "audit-rubrics" / "prompts" / "category-j-code-rules-compliance.md",
         package_root / "audit-rubrics" / "category_rubrics" / "category-l-behavior-equivalence.md",
@@ -160,7 +159,7 @@ def _category_l_policy_texts() -> tuple[str, str, str]:
     )
 
 
-def _comment_policy_summary_texts() -> tuple[str, str, str, str]:
+def _comment_policy_summary_texts() -> tuple[str, str, str]:
     clean_coder = _PACKAGE_ROOT / ".agents" / "agents" / "clean-coder.md"
     category_j = (
         _PACKAGE_ROOT
@@ -169,24 +168,21 @@ def _comment_policy_summary_texts() -> tuple[str, str, str, str]:
         / "category-j-code-rules-compliance.md"
     )
     code_quality = _PACKAGE_ROOT / ".agents" / "agents" / "code-quality-agent.md"
-    gate = _PACKAGE_ROOT / "_shared" / "pr-loop" / "code-rules-gate.md"
     return tuple(
         each_path.read_text(encoding="utf-8").lower()
-        for each_path in (clean_coder, category_j, code_quality, gate)
+        for each_path in (clean_coder, category_j, code_quality)
     )
 
 
 def test_comment_policy_uses_changed_comment_names_and_type_directives() -> None:
     category_l_rubric, category_l_prompt, audit_categories = _category_l_policy_texts()
-    clean_coder, category_j, code_quality, gate = _comment_policy_summary_texts()
+    clean_coder, category_j, code_quality = _comment_policy_summary_texts()
     assert "| l7 | changed-comment handling" in category_l_rubric
     assert "**l7. changed-comment handling**" in category_l_prompt
     assert '"axis_name": "changed-comment handling"' in audit_categories
     assert "no type-ignore directives" in clean_coder
     assert "no `# type: ignore` directives" in category_j
     assert "production and test code" in code_quality
-    assert "comments tied to touched code are removed" in gate
-    assert "comments tied to untouched code remain unchanged" in gate
 
 
 def test_comment_policy_removes_directive_justification_guidance() -> None: