claude-dev-env 7.0.0 → 7.1.0

package/hooks/blocking/test_shell_substitution_blocker.py

@@ -1,298 +0,0 @@
-"""Tests for shell_substitution_blocker hook."""
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-
-SCRIPT_PATH = Path(__file__).parent / "shell_substitution_blocker.py"
-
-
-def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-
-def test_denies_dollar_paren_substitution() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": 'echo "head: $(git rev-parse HEAD)"'},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-    assert (
-        "shell-substitution"
-        in response["hookSpecificOutput"]["permissionDecisionReason"]
-    )
-
-
-def test_denies_unescaped_backtick_substitution() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo `date`"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_allows_plain_command_without_substitution() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "git rev-parse HEAD"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_escaped_backtick_in_prose() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": r'echo "use \`foo\` like this"'},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_ignores_non_bash_tool() -> None:
-    payload = {
-        "tool_name": "Edit",
-        "tool_input": {"command": 'echo "$(date)"'},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_denies_double_backslash_backtick_bypass() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": r"echo \\`date`"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_allows_dollar_paren_inside_single_quotes() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo '$(not-executed)'"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_backtick_inside_single_quotes() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo '`not-executed`'"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_denies_input_process_substitution() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "diff <(cat a) <(cat b)"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_output_process_substitution() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "tee >(gzip > out.gz)"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_allows_process_substitution_inside_single_quotes() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo '<(not-executed)'"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_arithmetic_expansion() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $((2+2))"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_arithmetic_expansion_with_nested_parens() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $(( (1+2) * 3 ))"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_arithmetic_expansion_whose_body_bash_itself_rejects() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $((echo hi))"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_arithmetic_lookalike_inside_single_quotes() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo '$((cd /tmp) && pwd)'"},
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_denies_subshell_disguised_as_arithmetic_expansion() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $((cd /tmp) && pwd)"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_parenthesized_command_word_disguised_as_arithmetic() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $((1+2) )"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_command_substitution_nested_inside_arithmetic_expansion() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $(( $(id -u) + 1 ))"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_backtick_substitution_nested_inside_arithmetic_expansion() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $(( `id -u` + 1 ))"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_nested_command_substitution_without_arithmetic() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "echo $(echo $(whoami))"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_allows_backtick_inside_single_quoted_heredoc_body() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": (
-                "cat > notes.md <<'EOF'\n"
-                "reStructuredText markup: ``inert literal``\n"
-                "EOF"
-            )
-        },
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_allows_backtick_inside_tab_stripped_quoted_heredoc_body() -> None:
-    """A ``<<-`` opener closes on a tab-indented terminator, and stays inert.
-
-    The tab-strip rule decides which line ends the body. Getting it wrong
-    swallows the rest of the command or ends the body early, so the branch is
-    pinned here as well as in the shared pipeline that owns the rule.
-    """
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": (
-                "cat > notes.md <<-'EOF'\n"
-                "reStructuredText markup: ``inert literal``\n"
-                "\tEOF\n"
-                "echo done"
-            )
-        },
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_denies_backtick_inside_bare_heredoc_body() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "cat > notes.md <<EOF\nnow: `date`\nEOF"},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_command_substitution_inside_bare_heredoc_body() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": "cat > notes.md <<EOF\nhead: $(git rev-parse HEAD)\nEOF"
-        },
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_live_substitution_outside_a_quoted_heredoc() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": (
-                "cat > notes.md <<'EOF'\n"
-                "inert ``literal``\n"
-                "EOF\n"
-                'echo "$(git rev-parse HEAD)"'
-            )
-        },
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_allows_backslash_escaped_heredoc_delimiter_body() -> None:
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": "cat > notes.md <<\\EOF\ninert `text`\nEOF"
-        },
-    }
-    assert _run_hook(payload).stdout == ""
-
-
-def test_denies_a_substitution_below_an_opener_inside_a_quoted_string() -> None:
-    """An opener spelled inside a quoted string opens no heredoc.
-
-    Bash runs the second line here. Reading the first line as an opener and
-    dropping everything below it hides a live substitution from the scan.
-    """
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": 'echo "<<\'EOF\'"\necho $(whoami)'},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_denies_that_bypass_even_when_a_terminator_line_follows() -> None:
-    """A terminator line below the substitution does not make the strip safe."""
-    payload = {
-        "tool_name": "Bash",
-        "tool_input": {"command": 'echo "<<\'EOF\'"\necho $(whoami)\nEOF'},
-    }
-    response = json.loads(_run_hook(payload).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"

package/hooks/blocking/test_unscoped_search_blocker.py

@@ -1,102 +0,0 @@
-"""Tests for unscoped_search_blocker hook."""
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-
-SCRIPT_PATH = Path(__file__).parent / "unscoped_search_blocker.py"
-
-ALL_DENIED_COMMANDS = [
-    "find / -iname code_rules_gate.py",
-    "find /c -name '*.py'",
-    "find ~ -name README.md",
-    "find $HOME -type f",
-    "ls -R /",
-    "ls -laR /",
-    "ls -Rl /",
-    "find //server/share -name x",
-    "find \\\\server\\share -name x",
-    "bash -c 'find / -name x'",
-]
-
-ALL_ALLOWED_COMMANDS = [
-    "find . -iname '*.py'",
-    "find packages/claude-dev-env -name code_rules_gate.py",
-    "find /c/Users/example/repo -iname SKILL.md",
-    "ls -r /",
-    "ls -la /tmp/x",
-    "find //server/share/project/src -name x",
-    "es.exe path:C:\\dev\\repo ext:py gate",
-    "git status --short",
-]
-
-
-def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-
-
-def _bash_payload(command: str) -> dict:
-    return {"tool_name": "Bash", "tool_input": {"command": command}}
-
-
-def _powershell_payload(command: str) -> dict:
-    return {"tool_name": "PowerShell", "tool_input": {"command": command}}
-
-
-@pytest.mark.parametrize("each_command", ALL_DENIED_COMMANDS)
-def test_denies_unscoped_root_walk(each_command: str) -> None:
-    response = json.loads(_run_hook(_bash_payload(each_command)).stdout)
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-@pytest.mark.parametrize("each_command", ALL_ALLOWED_COMMANDS)
-def test_allows_scoped_search(each_command: str) -> None:
-    assert _run_hook(_bash_payload(each_command)).stdout == ""
-
-
-def test_denies_recursive_listing_on_windows_drive_root() -> None:
-    response = json.loads(
-        _run_hook(_powershell_payload("Get-ChildItem -Path C:\\ -Recurse")).stdout
-    )
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_allows_recursive_listing_under_project_directory() -> None:
-    assert _run_hook(_powershell_payload("Get-ChildItem -Path .\\src -Recurse")).stdout == ""
-
-
-def test_allows_recursive_listing_without_recurse_flag() -> None:
-    assert _run_hook(_powershell_payload("Get-ChildItem -Path C:\\")).stdout == ""
-
-
-def test_denies_find_root_in_a_chained_segment() -> None:
-    response = json.loads(
-        _run_hook(_bash_payload("cd /tmp && find / -name x.py")).stdout
-    )
-    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_ignores_unsupported_tool_name() -> None:
-    payload = {"tool_name": "Edit", "tool_input": {"command": "find / -name x"}}
-    assert _run_hook(payload).stdout == ""
-
-
-def test_ignores_payload_without_a_command() -> None:
-    payload = {"tool_name": "Bash", "tool_input": {}}
-    assert _run_hook(payload).stdout == ""
-
-
-def test_deny_message_names_the_scoped_alternative() -> None:
-    response = json.loads(_run_hook(_bash_payload("find / -name x.py")).stdout)
-    deny_reason = response["hookSpecificOutput"]["permissionDecisionReason"]
-    assert "scope" in deny_reason.lower()

package/hooks/blocking/test_write_existing_file_blocker.py

@@ -1,122 +0,0 @@
-"""Tests for the write_existing_file_blocker hook.
-
-Each case drives the real hook's ``main()`` through its production stdin path,
-feeding it the PreToolUse JSON payload Claude Code sends and reading the
-permission decision back off stdout.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import io
-import json
-from collections.abc import Mapping
-from pathlib import Path
-
-import pytest
-
-import write_existing_file_blocker
-
-
-def _run_payload(
-    payload: Mapping[str, object],
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
-) -> str:
-    """Run the real hook entry point and return its stdout."""
-    monkeypatch.setattr(write_existing_file_blocker.sys, "stdin", io.StringIO(json.dumps(payload)))
-    with contextlib.suppress(SystemExit):
-        write_existing_file_blocker.main()
-    return capsys.readouterr().out
-
-
-def _is_deny(stdout_text: str) -> bool:
-    if not stdout_text.strip():
-        return False
-    decision = json.loads(stdout_text)
-    return decision["hookSpecificOutput"]["permissionDecision"] == "deny"
-
-
-def test_write_denies_an_existing_target(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """A Write onto a path that already exists is denied."""
-    existing_path = tmp_path / "already_here.py"
-    existing_path.write_text("x = 1\n", encoding="utf-8")
-    payload = {
-        "tool_name": "Write",
-        "tool_input": {"file_path": str(existing_path), "content": "x = 2\n"},
-    }
-
-    stdout = _run_payload(payload, monkeypatch, capsys)
-
-    assert _is_deny(stdout), f"expected a deny, got {stdout!r}"
-
-
-def test_apply_patch_add_denies_an_existing_target(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """An apply_patch 'Add File' section targeting an existing path is denied."""
-    existing_path = tmp_path / "already_here.py"
-    existing_path.write_text("x = 1\n", encoding="utf-8")
-    payload = {
-        "tool_name": "apply_patch",
-        "cwd": str(tmp_path),
-        "tool_input": {
-            "command": ("*** Begin Patch\n*** Add File: already_here.py\n+x = 2\n*** End Patch")
-        },
-    }
-
-    stdout = _run_payload(payload, monkeypatch, capsys)
-
-    assert _is_deny(stdout), f"expected a deny, got {stdout!r}"
-
-
-def test_apply_patch_update_on_an_existing_target_is_allowed(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """An 'Update File' section on an existing path is not an unread overwrite."""
-    existing_path = tmp_path / "already_here.py"
-    existing_path.write_text("x = 1\n", encoding="utf-8")
-    payload = {
-        "tool_name": "apply_patch",
-        "cwd": str(tmp_path),
-        "tool_input": {
-            "command": (
-                "*** Begin Patch\n"
-                "*** Update File: already_here.py\n"
-                "@@\n"
-                "-x = 1\n"
-                "+x = 2\n"
-                "*** End Patch"
-            )
-        },
-    }
-
-    stdout = _run_payload(payload, monkeypatch, capsys)
-
-    assert not _is_deny(stdout), f"expected an allow, got {stdout!r}"
-
-
-def test_multi_edit_on_an_existing_target_is_allowed(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
-) -> None:
-    """A MultiEdit always targets a file already on disk, so it is never denied here.
-
-    Every MultiEdit edit must match an ``old_string`` already present in the
-    file, so MultiEdit carries no blind create-or-clobber path the way a Write
-    or an apply_patch 'Add File' does — this hook allows it unconditionally.
-    """
-    existing_path = tmp_path / "already_here.py"
-    existing_path.write_text("x = 1\n", encoding="utf-8")
-    payload = {
-        "tool_name": "MultiEdit",
-        "tool_input": {
-            "file_path": str(existing_path),
-            "edits": [{"old_string": "x = 1", "new_string": "x = 2"}],
-        },
-    }
-
-    stdout = _run_payload(payload, monkeypatch, capsys)
-
-    assert not _is_deny(stdout), f"expected an allow, got {stdout!r}"