claude-dev-env 7.0.0 → 7.1.0

package/scripts/local_verification/runner.py

@@ -0,0 +1,234 @@
+from __future__ import annotations
+
+import json
+from collections.abc import Callable
+from pathlib import Path
+from typing import TypeAlias
+
+from .check_runner import _execute_check
+from .config import (
+    JSON_INDENT_SPACES,
+    LOGS_DIRECTORY_SUFFIX,
+    PASSED_STATUS,
+    REPORT_NEWLINE,
+    RUN_CHECK_LOG_TEMPLATE,
+    RUN_LOG_FILENAME,
+    UTF8_ENCODING,
+)
+from .git_state import CandidateSnapshot, capture_candidate_snapshot
+from .manifest import compute_manifest_digest
+from .model import (
+    CheckRecord,
+    VerificationManifest,
+    VerificationReport,
+)
+
+ProgressCallback: TypeAlias = Callable[[str], None]
+
+
+def run_verification(
+    manifest: VerificationManifest,
+    repository_path: Path,
+    base_revision: str,
+    report_path: Path,
+    progress_callback: ProgressCallback | None = None,
+) -> VerificationReport:
+    """Execute checks and write the verification report.
+
+    Args:
+        manifest: Verification manifest.
+        repository_path: Repository checkout to verify.
+        base_revision: Base revision for selection and Git identity.
+        report_path: Output path for the verification report.
+        progress_callback: Optional receiver for progress lines.
+
+    Returns:
+        The written verification report.
+    """
+    resolved_repository_path = _require_repository_directory(repository_path)
+    logs_directory = _prepare_logs_directory(report_path)
+    verification_report = _verify_resolved_repository(
+        manifest,
+        resolved_repository_path,
+        base_revision,
+        logs_directory,
+        progress_callback,
+    )
+    _write_report_files(verification_report, logs_directory, report_path)
+    return verification_report
+
+
+def _verify_resolved_repository(
+    manifest: VerificationManifest,
+    resolved_repository_path: Path,
+    base_revision: str,
+    logs_directory: Path,
+    progress_callback: ProgressCallback | None,
+) -> VerificationReport:
+    before_snapshot = capture_candidate_snapshot(
+        resolved_repository_path, base_revision
+    )
+    all_records = _execute_manifest_checks(
+        manifest,
+        resolved_repository_path,
+        base_revision,
+        before_snapshot,
+        logs_directory,
+        progress_callback,
+    )
+    after_snapshot = capture_candidate_snapshot(resolved_repository_path, base_revision)
+    return _build_verification_report(
+        manifest, resolved_repository_path, before_snapshot, after_snapshot, all_records
+    )
+
+
+def _require_repository_directory(repository_path: Path) -> Path:
+    resolved_repository_path = repository_path.resolve()
+    if resolved_repository_path.is_dir():
+        return resolved_repository_path
+    raise ValueError("Repository path must name a directory")
+
+
+def _execute_manifest_checks(
+    manifest: VerificationManifest,
+    repository_path: Path,
+    base_revision: str,
+    before_snapshot: CandidateSnapshot,
+    logs_directory: Path,
+    progress_callback: ProgressCallback | None,
+) -> tuple[CheckRecord, ...]:
+    execution_base_revision = before_snapshot.base_revision or base_revision
+    return _execute_all_checks(
+        manifest,
+        repository_path,
+        execution_base_revision,
+        logs_directory,
+        progress_callback,
+    )
+
+
+def _write_report_files(
+    report: VerificationReport, logs_directory: Path, report_path: Path
+) -> None:
+    _write_run_log(report, logs_directory / RUN_LOG_FILENAME)
+    _write_report(report, report_path)
+
+
+def _prepare_logs_directory(report_path: Path) -> Path:
+    logs_directory = report_path.resolve().parent / (
+        report_path.stem + LOGS_DIRECTORY_SUFFIX
+    )
+    logs_directory.mkdir(parents=True, exist_ok=True)
+    return logs_directory
+
+
+def _build_verification_report(
+    manifest: VerificationManifest,
+    repository_path: Path,
+    before_snapshot: CandidateSnapshot,
+    after_snapshot: CandidateSnapshot,
+    all_records: tuple[CheckRecord, ...],
+) -> VerificationReport:
+    is_worktree_clean = before_snapshot.worktree_clean and after_snapshot.worktree_clean
+    is_inputs_unchanged = _inputs_unchanged(before_snapshot, after_snapshot)
+    return VerificationReport(
+        manifest.version,
+        repository_path,
+        before_snapshot.base_revision,
+        all_records,
+        manifest.exclusions,
+        before_snapshot.head_revision,
+        compute_manifest_digest(manifest),
+        is_worktree_clean,
+        is_inputs_unchanged,
+        _is_publishable(
+            all_records,
+            before_snapshot,
+            after_snapshot,
+            is_worktree_clean,
+            is_inputs_unchanged,
+        ),
+    )
+
+
+def _execute_all_checks(
+    manifest: VerificationManifest,
+    repository_path: Path,
+    base_revision: str,
+    logs_directory: Path,
+    progress_callback: ProgressCallback | None,
+) -> tuple[CheckRecord, ...]:
+    return tuple(
+        _execute_check(
+            each_check,
+            repository_path,
+            base_revision,
+            logs_directory,
+            progress_callback,
+        )
+        for each_check in manifest.checks
+    )
+
+
+def _inputs_unchanged(
+    before_snapshot: CandidateSnapshot, after_snapshot: CandidateSnapshot
+) -> bool:
+    return (
+        before_snapshot.input_digest is not None
+        and before_snapshot.input_digest == after_snapshot.input_digest
+    )
+
+
+def _is_publishable(
+    all_records: tuple[CheckRecord, ...],
+    before_snapshot: CandidateSnapshot,
+    after_snapshot: CandidateSnapshot,
+    is_worktree_clean: bool,
+    is_inputs_unchanged: bool,
+) -> bool:
+    if not all(each_record.status == PASSED_STATUS for each_record in all_records):
+        return False
+    return (
+        before_snapshot.is_git_repository
+        and after_snapshot.is_git_repository
+        and before_snapshot.head_revision is not None
+        and before_snapshot.head_revision == after_snapshot.head_revision
+        and before_snapshot.base_revision is not None
+        and before_snapshot.base_revision == after_snapshot.base_revision
+        and is_worktree_clean
+        and is_inputs_unchanged
+    )
+
+
+def _write_report(report: VerificationReport, report_path: Path) -> None:
+    report_mapping = report.as_dict()
+    report_path.parent.mkdir(parents=True, exist_ok=True)
+    report_path.write_text(
+        json.dumps(report_mapping, indent=JSON_INDENT_SPACES, sort_keys=True)
+        + REPORT_NEWLINE,
+        encoding=UTF8_ENCODING,
+    )
+
+
+def _write_run_log(report: VerificationReport, run_log_path: Path) -> None:
+    all_log_lines = [
+        RUN_CHECK_LOG_TEMPLATE.format(
+            check_id=each_record.check_id,
+            status=each_record.status,
+        )
+        for each_record in report.checks
+    ]
+    all_log_lines.extend(
+        (
+            f"aggregate: {report.aggregate_status}",
+            f"head: {report.head_revision}",
+            f"base: {report.base_revision}",
+            f"worktree_clean: {report.worktree_clean}",
+            f"inputs_unchanged: {report.inputs_unchanged}",
+            f"publishable: {report.publishable}",
+        )
+    )
+    run_log_path.write_text(
+        REPORT_NEWLINE.join(all_log_lines) + REPORT_NEWLINE,
+        encoding=UTF8_ENCODING,
+    )

package/scripts/policy_lint/adapter_pairing.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
+import ast
 from pathlib import PurePosixPath
 
 from . import adapter_support
 from .config import constants
+from .config.approved_test_pairs import APPROVED_TEST_PATHS_BY_PRODUCTION_PATH
 from .model import Diagnostic, Document, DocumentSet, Location, SelectionKind, Severity
 
 
@@ -28,6 +30,47 @@ def _is_constants_only_python_document(
     return analysis_module._is_constants_only_python_content(document.text)
 
 
+def _is_docstring_statement(statement: ast.stmt) -> bool:
+    return (
+        isinstance(statement, ast.Expr)
+        and isinstance(statement.value, ast.Constant)
+        and isinstance(statement.value.value, str)
+    )
+
+
+def _remove_docstrings(parsed_tree: ast.AST) -> None:
+    if (
+        isinstance(
+            parsed_tree,
+            (ast.Module, ast.ClassDef, ast.FunctionDef, ast.AsyncFunctionDef),
+        )
+        and parsed_tree.body
+        and _is_docstring_statement(parsed_tree.body[0])
+    ):
+        parsed_tree.body.pop(0)
+    for each_child in ast.iter_child_nodes(parsed_tree):
+        _remove_docstrings(each_child)
+
+
+def _ast_without_docstrings(source_text: str) -> str | None:
+    try:
+        parsed_tree = ast.parse(source_text)
+    except SyntaxError:
+        return None
+    _remove_docstrings(parsed_tree)
+    return ast.dump(parsed_tree, include_attributes=False)
+
+
+def _is_docstring_only_python_document(document: Document) -> bool:
+    if document.path.suffix.lower() != constants.PYTHON_SUFFIX:
+        return False
+    if document.prior_text is None:
+        return False
+    current_ast = _ast_without_docstrings(document.text)
+    prior_ast = _ast_without_docstrings(document.prior_text)
+    return current_ast is not None and current_ast == prior_ast
+
+
 def _candidate_test_names(path: PurePosixPath) -> frozenset[str]:
     stem = path.stem
     suffix = path.suffix.lower()
@@ -76,10 +119,22 @@ def _is_grouped_test_match(
     return _family_tokens(production_path) == _family_tokens(test_path)
 
 
+def _has_changed_approved_test(
+    production_path: PurePosixPath,
+    all_changed_test_paths: frozenset[PurePosixPath],
+) -> bool:
+    all_approved_test_paths = APPROVED_TEST_PATHS_BY_PRODUCTION_PATH.get(
+        production_path, frozenset()
+    )
+    return not all_approved_test_paths.isdisjoint(all_changed_test_paths)
+
+
 def _has_changed_test(
     production_path: PurePosixPath,
     all_changed_test_paths: frozenset[PurePosixPath],
 ) -> bool:
+    if _has_changed_approved_test(production_path, all_changed_test_paths):
+        return True
     all_candidate_names = _candidate_test_names(production_path)
     return any(
         each_test_path.name.lower() in all_candidate_names
@@ -100,6 +155,8 @@ def _is_unpaired_production(
         return False
     if _is_constants_only_python_document(production_document, load_module):
         return False
+    if _is_docstring_only_python_document(production_document):
+        return False
     return not _has_changed_test(production_path, all_changed_test_paths)
 
 
@@ -139,7 +196,5 @@ def test_pairing_diagnostics(
     return tuple(
         _pairing_diagnostic(each_document)
         for each_document in document_set.documents
-        if _is_unpaired_production(
-            each_document, all_changed_test_paths, load_module
-        )
+        if _is_unpaired_production(each_document, all_changed_test_paths, load_module)
     )

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -0,0 +1,323 @@
+from __future__ import annotations
+
+from pathlib import PurePosixPath
+
+APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
+    PurePosixPath, frozenset[PurePosixPath]
+] = {
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/git-hooks/verification_notice_context.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_verification_notice.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/git-hooks/verification_notice_state.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_verification_notice.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/hooks_constants/post_tool_use_dispatcher_constants.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/validation/test_post_tool_use_dispatcher.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/checkout.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/cli.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/configuration.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/execution.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/git.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/model.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/process_host.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/publisher.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_repairs.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_recovery.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/state.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_closed_pr_label.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/window_flags.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_window_flags.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/automatic_advisory/windows_job.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_automatic_advisory_job_cleanup.py"
+            ),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/scripts/local_report_cli.py"): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_report_publisher_cli.py"
+            ),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/scripts/local_report_core.py"): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_report_publisher.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_report_validation.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_report_publisher.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/check_runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/check_support.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/cli.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification_cli.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/command_runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/git_state.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/manifest.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/model.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/local_verification/runner.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_local_verification_cli.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/branch_refs.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/github_api.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/github_parsing.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/github.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+    PurePosixPath("packages/claude-dev-env/scripts/pr_verification/lock.py"): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_lock.py"
+            ),
+        }
+    ),
+    PurePosixPath(
+        "packages/claude-dev-env/scripts/pr_verification/model.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/scripts/tests/test_pr_verification_github.py"
+            ),
+        }
+    ),
+}

package/scripts/pr_verification/__init__.py

@@ -0,0 +1 @@
+"""Trusted host supervisor for local pull request verification."""