claude-dev-env 7.0.0 → 7.1.0

package/scripts/tests/test_automatic_advisory_repairs.py

@@ -0,0 +1,400 @@
+from __future__ import annotations
+
+import json
+import os
+import signal
+import subprocess
+import sys
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(TESTS_DIRECTORY))
+
+import test_automatic_advisory as support
+from automatic_advisory import cli, git, publisher
+from pr_verification.model import RepositorySettings, StatusState
+
+PROCESS_RUNNER_TIMEOUT_SECONDS = 10.0
+PRODUCTION_CHILD_TIMEOUT_SECONDS = 3.0
+PROCESS_EXIT_WAIT_SECONDS = 2.0
+PROCESS_POLL_SECONDS = 0.05
+
+
+class _SuccessfulPublicationAdapter:
+    status = StatusState.SUCCESS
+    description = "passed"
+
+
+def _publisher_module_recording_paths(
+    all_published_manifest_paths: list[Path],
+) -> SimpleNamespace:
+    def record_publication(
+        _github: object,
+        _repository: RepositorySettings,
+        _pull_request_number: int,
+        _checkout_path: Path,
+        manifest_path: Path,
+        _report_path: Path,
+    ) -> _SuccessfulPublicationAdapter:
+        all_published_manifest_paths.append(manifest_path)
+        return _SuccessfulPublicationAdapter()
+
+    return SimpleNamespace(publish_local_report=record_publication)
+
+
+def _build_counted_runner(
+    registration: support.AdvisoryRegistration,
+    github: support.FakeGitHub,
+    child_calls: list[str],
+) -> support.AutomaticAdvisoryRunner:
+    def run_child(
+        child_registration: support.AdvisoryRegistration,
+        base_ref: str,
+        timeout_seconds: float,
+    ) -> support.ChildOutcome:
+        return support._run_counted_child(
+            child_calls,
+            child_registration,
+            base_ref,
+            timeout_seconds,
+        )
+
+    return support.AutomaticAdvisoryRunner(
+        support._build_settings(registration),
+        github,
+        child_runner=run_child,
+        clock=lambda: "2026-09-05T00:00:00+00:00",
+    )
+
+
+def _build_recovering_cli_runner(
+    monkeypatch: pytest.MonkeyPatch,
+    registration: support.AdvisoryRegistration,
+    github: support.FakeGitHub,
+    authentication_attempts: list[str],
+    child_calls: list[str],
+) -> support.AutomaticAdvisoryRunner:
+    def issue_repository_api(*arguments: object, **options: object) -> object:
+        authentication_attempts.append("attempt")
+        if len(authentication_attempts) == 1:
+            raise RuntimeError("offline")
+        return github
+
+    monkeypatch.setattr(cli, "_issue_repository_api", issue_repository_api)
+    runner = cli._build_runner(support._build_settings(registration))
+    counted_runner = _build_counted_runner(registration, github, child_calls)
+    runner.child_runner = counted_runner.child_runner
+    runner.publisher = support._publish_passed
+    return runner
+
+
+def _run_report_only_child(
+    registration: support.AdvisoryRegistration,
+) -> support.ChildOutcome:
+    registration.report_path.parent.mkdir(parents=True, exist_ok=True)
+    registration.report_path.write_text(
+        json.dumps({"exit_code": 0}),
+        encoding="utf-8",
+    )
+    return support.ChildOutcome(0, "", "", False)
+
+
+def _record_unexpected_publication(
+    publisher_calls: list[str],
+    *all_arguments: object,
+) -> support.Publication:
+    publisher_calls.append("publish")
+    return support.FakePublication("passed")
+
+
+def test_publisher_adapter_returns_github_status_text(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    class PublicationAdapter:
+        status = StatusState.SUCCESS
+        description = "passed"
+
+    class PublisherModule:
+        publish_local_report = staticmethod(lambda *arguments: PublicationAdapter())
+
+    monkeypatch.setattr(publisher, "import_module", lambda name: PublisherModule)
+    registration = support._build_registration(tmp_path, tmp_path)
+    publication = publisher._publish_report(
+        object(),
+        registration.repository,
+        registration.pull_request_number,
+        registration.checkout_path,
+        registration.manifest_absolute_path,
+        registration.report_path,
+    )
+
+    assert publication.status == "success"
+
+
+def test_real_publisher_adapter_runs_once_for_unchanged_identity(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    all_published_manifest_paths: list[Path] = []
+    publisher_module = _publisher_module_recording_paths(all_published_manifest_paths)
+    monkeypatch.setattr(publisher, "import_module", lambda name: publisher_module)
+    checkout_path, head_sha = support._build_checkout(tmp_path)
+    registration = support._build_registration(tmp_path, checkout_path)
+    github = support.FakeGitHub(support._build_candidate(head_sha))
+    child_calls: list[str] = []
+    runner = _build_counted_runner(registration, github, child_calls)
+    first_state = runner.run_once()[0]
+    second_state = runner.run_once()[0]
+
+    assert first_state.status == "passed"
+    assert second_state.status == "passed"
+    assert child_calls == ["child"]
+    assert all_published_manifest_paths == [registration.selected_manifest_path]
+
+
+def test_build_runner_run_once_persists_offline_then_recovers(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    checkout_path, head_sha = support._build_checkout(tmp_path)
+    registration = support._build_registration(tmp_path, checkout_path)
+    github = support.FakeGitHub(support._build_candidate(head_sha))
+    authentication_attempts: list[str] = []
+    child_calls: list[str] = []
+    runner = _build_recovering_cli_runner(
+        monkeypatch,
+        registration,
+        github,
+        authentication_attempts,
+        child_calls,
+    )
+
+    assert authentication_attempts == []
+    offline_state = runner.run_once()[0]
+    persisted_offline_state = json.loads(
+        registration.state_path.read_text(encoding="utf-8")
+    )
+    passed_state = runner.run_once()[0]
+
+    assert offline_state.status == "offline"
+    assert persisted_offline_state["status"] == "offline"
+    assert passed_state.status == "passed"
+    assert authentication_attempts == ["attempt", "attempt", "attempt"]
+    assert child_calls == ["child"]
+
+
+def test_runner_marks_missing_selected_manifest_incomplete(tmp_path: Path) -> None:
+    checkout_path, head_sha = support._build_checkout(tmp_path)
+    registration = support._build_registration(tmp_path, checkout_path)
+    github = support.FakeGitHub(support._build_candidate(head_sha))
+    publisher_calls: list[str] = []
+
+    runner = support.AutomaticAdvisoryRunner(
+        support._build_settings(registration),
+        github,
+        child_runner=lambda child_registration, _base_ref, _timeout_seconds: (
+            _run_report_only_child(child_registration)
+        ),
+        publisher=lambda *all_arguments: _record_unexpected_publication(
+            publisher_calls,
+            *all_arguments,
+        ),
+        clock=lambda: "2026-09-05T00:00:00+00:00",
+    )
+
+    state = runner.run_once()[0]
+
+    assert state.status == "error"
+    assert state.reason == "verification child did not produce a report"
+    assert publisher_calls == []
+
+
+def test_fetch_base_returns_false_after_git_timeout(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    registration = support._build_registration(tmp_path, tmp_path)
+    candidate = support._build_candidate("head")
+    captured_options: dict[str, object] = {}
+
+    def timeout_run(*arguments: object, **options: object) -> object:
+        captured_options.update(options)
+        raise subprocess.TimeoutExpired("git", 30.0)
+
+    monkeypatch.setattr(git.subprocess, "run", timeout_run)
+
+    assert git._fetch_base(registration, candidate) is False
+    assert captured_options["timeout"] == 30.0
+    captured_environment = captured_options["env"]
+    assert isinstance(captured_environment, dict)
+    assert captured_environment.get("GIT_TERMINAL_PROMPT") == "0"
+
+
+def test_fetch_base_updates_dedicated_and_remote_tracking_refs(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    registration = support._build_registration(tmp_path, tmp_path)
+    candidate = support._build_candidate("head")
+    all_fetch_arguments: list[tuple[str, ...]] = []
+
+    def record_fetch(
+        fetch_arguments: tuple[str, ...],
+        **options: object,
+    ) -> subprocess.CompletedProcess[bytes]:
+        all_fetch_arguments.append(fetch_arguments)
+        return subprocess.CompletedProcess(fetch_arguments, 0, b"", b"")
+
+    monkeypatch.setattr(git.subprocess, "run", record_fetch)
+
+    assert git._fetch_base(registration, candidate) is True
+    assert all_fetch_arguments == [
+        (
+            "git",
+            "fetch",
+            "--force",
+            "--no-tags",
+            "origin",
+            "+refs/heads/main:refs/cde/advisory-base/2985",
+            "+refs/heads/main:refs/remotes/origin/main",
+        )
+    ]
+
+
+def _build_descendant_parent_script(
+    descendant_identifier_path: Path,
+    parent_action: str,
+) -> str:
+    descendant_script = "import time; time.sleep(30)"
+    return (
+        "import subprocess,sys,time\n"
+        "from pathlib import Path\n"
+        f"child_process = subprocess.Popen((sys.executable, '-c', {descendant_script!r}))\n"
+        f"Path({str(descendant_identifier_path)!r}).write_text(str(child_process.pid), encoding='utf-8')\n"
+        f"{parent_action}\n"
+    )
+
+
+def _build_process_runner_script(
+    checkout_path: Path,
+    descendant_identifier_path: Path,
+    parent_action: str,
+) -> str:
+    parent_script = _build_descendant_parent_script(
+        descendant_identifier_path,
+        parent_action,
+    )
+    return (
+        "import os,sys\n"
+        "from pathlib import Path\n"
+        "from types import SimpleNamespace\n"
+        "from automatic_advisory import execution\n"
+        f"registration = SimpleNamespace(checkout_path=Path({str(checkout_path)!r}))\n"
+        "scripts_directory = Path(execution.__file__).resolve().parents[1]\n"
+        "child_environment = execution._build_child_environment(registration, scripts_directory)\n"
+        "child_process = execution._start_child_process(\n"
+        f"    (sys.executable, '-c', {parent_script!r}), registration, child_environment\n"
+        ")\n"
+        "if child_process is None:\n"
+        "    raise SystemExit(2)\n"
+        f"child_outcome = execution._collect_child_outcome(child_process, {PRODUCTION_CHILD_TIMEOUT_SECONDS!r})\n"
+        "if not child_outcome.timed_out:\n"
+        "    raise SystemExit(3)\n"
+    )
+
+
+def _is_process_running(process_identifier: int) -> bool:
+    if sys.platform == "win32":
+        completed_process = subprocess.run(
+            ("tasklist", "/FI", f"PID eq {process_identifier}", "/FO", "CSV", "/NH"),
+            capture_output=True,
+            check=False,
+            text=True,
+            timeout=PROCESS_EXIT_WAIT_SECONDS,
+        )
+        return f'"{process_identifier}"' in completed_process.stdout
+    try:
+        os.kill(process_identifier, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True
+    return True
+
+
+def _wait_for_process_exit(process_identifier: int) -> bool:
+    deadline = time.monotonic() + PROCESS_EXIT_WAIT_SECONDS
+    while time.monotonic() < deadline:
+        if not _is_process_running(process_identifier):
+            return True
+        time.sleep(PROCESS_POLL_SECONDS)
+    return not _is_process_running(process_identifier)
+
+
+def _end_process_for_test(process_identifier: int) -> None:
+    if not _is_process_running(process_identifier):
+        return
+    if sys.platform == "win32":
+        subprocess.run(
+            ("taskkill", "/T", "/F", "/PID", str(process_identifier)),
+            capture_output=True,
+            check=False,
+            timeout=PROCESS_EXIT_WAIT_SECONDS,
+        )
+        return
+    os.kill(process_identifier, signal.SIGKILL)
+
+
+@pytest.mark.parametrize(
+    "parent_action",
+    ("time.sleep(30)", "raise SystemExit(0)"),
+    ids=("timed-parent", "exited-parent"),
+)
+def test_production_launch_timeout_ends_descendant_and_keeps_runner_alive(
+    tmp_path: Path,
+    parent_action: str,
+) -> None:
+    descendant_identifier_path = tmp_path / "descendant.pid"
+    runner_script = _build_process_runner_script(
+        tmp_path,
+        descendant_identifier_path,
+        parent_action,
+    )
+    completed_runner = subprocess.run(
+        (sys.executable, "-c", runner_script),
+        cwd=support.SCRIPTS_DIRECTORY,
+        capture_output=True,
+        check=False,
+        text=True,
+        timeout=PROCESS_RUNNER_TIMEOUT_SECONDS,
+    )
+    assert descendant_identifier_path.is_file(), completed_runner.stderr
+    descendant_identifier = int(descendant_identifier_path.read_text(encoding="utf-8"))
+
+    try:
+        assert completed_runner.returncode == 0, completed_runner.stderr
+        assert _wait_for_process_exit(descendant_identifier)
+    finally:
+        _end_process_for_test(descendant_identifier)
+
+
+def test_detached_start_resolves_relative_settings_before_spawn(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    all_launches: list[tuple[tuple[str, ...], dict[str, object]]] = []
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(
+        cli.subprocess,
+        "Popen",
+        lambda arguments, **options: all_launches.append((tuple(arguments), options)),
+    )
+
+    assert cli.start_polling(Path("settings.json")) == 0
+
+    launch_arguments = all_launches[0][0]
+    assert launch_arguments[launch_arguments.index("--settings") + 1] == str(
+        tmp_path / "settings.json"
+    )

package/scripts/tests/test_automatic_advisory_settings.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+TEST_DIRECTORY = Path(__file__).resolve().parent
+if str(TEST_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(TEST_DIRECTORY))
+
+import test_automatic_advisory as support
+from automatic_advisory import configuration as advisory_configuration
+
+
+@pytest.mark.parametrize("field_name", ["poll_seconds", "child_timeout_seconds"])
+@pytest.mark.parametrize("invalid_seconds", [float("nan"), float("inf"), float("-inf")])
+def test_configuration_rejects_nonfinite_timing(
+    tmp_path: Path, field_name: str, invalid_seconds: float
+) -> None:
+    settings_path = tmp_path / "settings.json"
+    all_settings = support._valid_advisory_settings_fields(tmp_path)
+    settings_path.write_text(json.dumps(all_settings), encoding="utf-8")
+    valid_settings = advisory_configuration.load_advisory_settings(settings_path)
+    assert valid_settings.poll_seconds == 0.25
+    assert valid_settings.child_timeout_seconds == 45.5
+    all_settings[field_name] = invalid_seconds
+    settings_path.write_text(json.dumps(all_settings), encoding="utf-8")
+
+    with pytest.raises(
+        advisory_configuration.AdvisoryConfigurationError,
+        match=f"{field_name} must be positive",
+    ):
+        advisory_configuration.load_advisory_settings(settings_path)
+
+
+def test_poll_error_log_sits_beside_the_registration_state_file(tmp_path: Path) -> None:
+    checkout_path = tmp_path / "checkout"
+    checkout_path.mkdir()
+    registration = support._build_registration(tmp_path, checkout_path)
+    settings = support._build_settings(registration)
+
+    assert (
+        settings.poll_error_log_path
+        == registration.state_path.parent / "poll-errors.log"
+    )
+    assert settings.poll_error_log_path.parent == settings.poll_lock_root.parent

package/scripts/tests/test_automatic_advisory_window_flags.py

@@ -0,0 +1,163 @@
+"""The advisory poller and every process it starts stay off the screen on Windows."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+import pytest
+
+TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(TESTS_DIRECTORY))
+
+import test_automatic_advisory as support
+from automatic_advisory import checkout, cli, execution, git, window_flags
+
+WINDOWS_ONLY = pytest.mark.skipif(
+    sys.platform != "win32", reason="Windows console flags"
+)
+PROBE_WAIT_SECONDS = 10.0
+PROBE_POLL_SECONDS = 0.1
+
+CHILD_REPORT_SCRIPT = (
+    "import ctypes, json, sys;"
+    "handle = ctypes.windll.kernel32.GetConsoleWindow();"
+    "visible = bool(ctypes.windll.user32.IsWindowVisible(handle)) if handle else False;"
+    "sys.stdout.write(json.dumps({'visible': visible}))"
+)
+
+PARENT_PROBE_SCRIPT = """
+import json, subprocess, sys
+from pathlib import Path
+completed = subprocess.run(
+    [sys.executable, "-c", {child_script!r}], capture_output=True, text=True, check=False
+)
+Path(sys.argv[1]).write_text(completed.stdout, encoding="utf-8")
+"""
+
+
+def test_flags_are_zero_off_windows(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(window_flags.sys, "platform", "linux")
+    assert window_flags.hidden_window_creation_flags() == 0
+    assert window_flags.detached_poller_creation_flags() == 0
+
+
+@WINDOWS_ONLY
+def test_hidden_window_creation_flags_is_create_no_window() -> None:
+    assert window_flags.hidden_window_creation_flags() == subprocess.CREATE_NO_WINDOW
+
+
+@WINDOWS_ONLY
+def test_poller_flags_keep_a_hidden_console_instead_of_none() -> None:
+    poller_flags = window_flags.detached_poller_creation_flags()
+    assert poller_flags & subprocess.DETACHED_PROCESS == 0
+    assert poller_flags & subprocess.CREATE_NO_WINDOW
+    assert poller_flags & subprocess.CREATE_NEW_PROCESS_GROUP
+
+
+@WINDOWS_ONLY
+def test_poller_grandchild_gets_no_visible_console(tmp_path: Path) -> None:
+    parent_script_path = tmp_path / "parent_probe.py"
+    parent_script_path.write_text(
+        PARENT_PROBE_SCRIPT.format(child_script=CHILD_REPORT_SCRIPT), encoding="utf-8"
+    )
+    report_path = tmp_path / "grandchild.json"
+    subprocess.Popen(
+        [sys.executable, str(parent_script_path), str(report_path)],
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        creationflags=window_flags.detached_poller_creation_flags(),
+    )
+    assert _read_probe_report(report_path) == {"visible": False}
+
+
+def _read_probe_report(report_path: Path) -> dict[str, bool]:
+    deadline = time.monotonic() + PROBE_WAIT_SECONDS
+    while time.monotonic() < deadline:
+        if report_path.exists():
+            return json.loads(report_path.read_text(encoding="utf-8"))
+        time.sleep(PROBE_POLL_SECONDS)
+    raise AssertionError("the probe parent never wrote its report")
+
+
+def test_git_fetch_hides_its_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    registration = support._build_registration(tmp_path, tmp_path)
+    candidate = support._build_candidate("head")
+    captured_options: dict[str, object] = {}
+
+    def record_run(
+        *arguments: object, **options: object
+    ) -> subprocess.CompletedProcess[bytes]:
+        captured_options.update(options)
+        return subprocess.CompletedProcess(arguments, 0, b"", b"")
+
+    monkeypatch.setattr(git.subprocess, "run", record_run)
+
+    assert git._fetch_base(registration, candidate) is True
+    assert (
+        captured_options["creationflags"] == window_flags.hidden_window_creation_flags()
+    )
+
+
+def test_checkout_inspection_hides_its_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    all_captured_flags: list[object] = []
+
+    def record_run(
+        *arguments: object, **options: object
+    ) -> subprocess.CompletedProcess[str]:
+        all_captured_flags.append(options["creationflags"])
+        return subprocess.CompletedProcess(arguments, 0, "abc123\n", "")
+
+    monkeypatch.setattr(checkout.subprocess, "run", record_run)
+
+    local_checkout = checkout.read_local_checkout(tmp_path)
+
+    assert local_checkout.head_sha == "abc123"
+    assert all_captured_flags == [window_flags.hidden_window_creation_flags()] * 2
+
+
+def test_windows_process_host_spawn_hides_its_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    registration = support._build_registration(tmp_path, tmp_path)
+    captured_options: dict[str, object] = {}
+
+    def record_popen(*arguments: object, **options: object) -> object:
+        captured_options.update(options)
+        return object()
+
+    monkeypatch.setattr(execution.subprocess, "Popen", record_popen)
+
+    execution._spawn_windows_process_host(("python", "-c", "pass"), registration, {})
+
+    expected_flags = window_flags.hidden_window_creation_flags() | getattr(
+        subprocess, "BELOW_NORMAL_PRIORITY_CLASS", 0
+    )
+    assert captured_options["creationflags"] == expected_flags
+
+
+def test_start_polling_launches_with_the_poller_flags(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    captured_options: dict[str, object] = {}
+
+    def record_popen(*arguments: object, **options: object) -> object:
+        captured_options.update(options)
+        return object()
+
+    monkeypatch.setattr(cli.subprocess, "Popen", record_popen)
+
+    assert cli.start_polling(tmp_path / "settings.json") == 0
+    assert (
+        captured_options["creationflags"]
+        == window_flags.detached_poller_creation_flags()
+    )