claude-dev-env 7.0.0 → 7.2.0

package/scripts/tests/test_closed_pr_label.py

@@ -0,0 +1,157 @@
+from __future__ import annotations
+
+import sys
+from pathlib import Path, PurePosixPath
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+from automatic_advisory.model import (
+    AdvisoryRegistration,
+    AdvisorySettings,
+    AdvisoryState,
+)
+from automatic_advisory.publisher import Publication
+from automatic_advisory.runner import AdvisoryGitHub, AutomaticAdvisoryRunner
+from automatic_advisory.state import read_state, write_state
+from pr_verification.config.constants import LOCAL_CHECKS_PASSED_LABEL
+from pr_verification.model import PullRequestCandidate, RepositorySettings
+
+
+class ClosedPullRequestGitHub(AdvisoryGitHub):
+    def __init__(self, state_path: Path, failed_removal_count: int) -> None:
+        self.state_path = state_path
+        self.failed_removal_count = failed_removal_count
+        self.removed_labels: list[str] = []
+        self.observed_statuses: list[str | None] = []
+
+    def list_open_candidates(
+        self,
+        repository: RepositorySettings,
+        *,
+        should_require_merge_commit: bool = True,
+    ) -> tuple[PullRequestCandidate, ...]:
+        return ()
+
+    def remove_label(
+        self, repository: RepositorySettings, pull_request_number: int, label: str
+    ) -> None:
+        maybe_state = read_state(self.state_path)
+        self.observed_statuses.append(maybe_state.status if maybe_state else None)
+        self.removed_labels.append(label)
+        if self.failed_removal_count:
+            self.failed_removal_count -= 1
+            raise RuntimeError("label service unavailable")
+
+
+def _build_registration(tmp_path: Path) -> AdvisoryRegistration:
+    return AdvisoryRegistration(
+        RepositorySettings("JonEcho/python-automation", "unused"),
+        3082,
+        tmp_path / "checkout",
+        PurePosixPath("manifest.json"),
+        tmp_path / "report.json",
+        tmp_path / "state.json",
+        "main",
+        "origin",
+    )
+
+
+def _build_runner(
+    registration: AdvisoryRegistration,
+    github: ClosedPullRequestGitHub,
+) -> AutomaticAdvisoryRunner:
+    settings = AdvisorySettings(
+        "https://api.github.com",
+        4841271,
+        159293880,
+        registration.state_path.with_name("private-key.pem"),
+        60.0,
+        30.0,
+        (registration,),
+    )
+    return AutomaticAdvisoryRunner(
+        settings,
+        github,
+        child_runner=_unexpected_child,
+        publisher=_unexpected_publisher,
+        clock=lambda: "2026-09-05T00:00:00+00:00",
+    )
+
+
+def _unexpected_child(
+    *all_arguments: object,
+    **all_keyword_arguments: object,
+) -> object:
+    raise AssertionError("closed pull requests must not run checks")
+
+
+def _unexpected_publisher(*all_arguments: object) -> Publication:
+    raise AssertionError("closed pull requests must not publish reports")
+
+
+def _write_passed_state(registration: AdvisoryRegistration) -> None:
+    write_state(
+        registration.state_path,
+        AdvisoryState(
+            registration.repository.slug,
+            registration.pull_request_number,
+            "passed",
+            "local checks passed",
+            "old-head",
+            "base-head",
+            "2026-09-04T00:00:00+00:00",
+            "2026-09-09T00:00:00+00:00",
+            str(registration.report_path),
+        ),
+    )
+
+
+def test_closed_pull_request_removes_stale_label_before_saving_closed_state(
+    tmp_path: Path,
+) -> None:
+    registration = _build_registration(tmp_path)
+    _write_passed_state(registration)
+    github = ClosedPullRequestGitHub(registration.state_path, 0)
+    runner = _build_runner(registration, github)
+
+    state = runner.run_once()[0]
+
+    assert state.status == "closed"
+    assert github.removed_labels == [LOCAL_CHECKS_PASSED_LABEL]
+    assert github.observed_statuses == ["passed"]
+    assert read_state(registration.state_path).status == "closed"
+
+
+def test_closed_pull_request_retries_failed_label_removal(
+    tmp_path: Path,
+) -> None:
+    registration = _build_registration(tmp_path)
+    _write_passed_state(registration)
+    github = ClosedPullRequestGitHub(registration.state_path, 1)
+    runner = _build_runner(registration, github)
+
+    error_state = runner.run_once()[0]
+    closed_state = runner.run_once()[0]
+
+    assert error_state.status == "error"
+    assert closed_state.status == "closed"
+    assert github.removed_labels == [
+        LOCAL_CHECKS_PASSED_LABEL,
+        LOCAL_CHECKS_PASSED_LABEL,
+    ]
+    assert github.observed_statuses == ["passed", "error"]
+
+
+def test_closed_pull_request_does_not_run_checks(
+    tmp_path: Path,
+) -> None:
+    registration = _build_registration(tmp_path)
+    github = ClosedPullRequestGitHub(registration.state_path, 0)
+    runner = _build_runner(registration, github)
+
+    state = runner.run_once()[0]
+
+    assert state.status == "closed"
+    assert github.removed_labels == [LOCAL_CHECKS_PASSED_LABEL]

package/scripts/tests/test_codex_compat_materializer.py

@@ -462,13 +462,35 @@ def _apply_source_agent(source_root: Path, target_root: Path, description: str)
     return target_root / "Luna.toml"
 
 
-def _write_codex_hook_source(source_root: Path) -> None:
+def _register_source_codex_enforcer(hooks_path: Path) -> None:
+    all_manifest = cast(
+        dict[str, object], json.loads(hooks_path.read_text(encoding="utf-8"))
+    )
+    all_events = cast(dict[str, object], all_manifest["hooks"])
+    all_pre_tool_use = cast(list[object], all_events["PreToolUse"])
+    all_pre_tool_use.append(
+        {
+            "matcher": materializer.codex_hook_matcher,
+            "hooks": [
+                {
+                    "type": "command",
+                    "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/code_rules_enforcer.py",
+                    "timeout": materializer.codex_hook_timeout_seconds,
+                }
+            ],
+        }
+    )
+    hooks_path.write_text(json.dumps(all_manifest), encoding="utf-8")
+
+
+def _write_codex_hook_source(source_root: Path, has_enforcer: bool) -> None:
     package_root = Path(__file__).parents[2]
     source_hooks = source_root / "hooks"
     source_hooks.mkdir(parents=True, exist_ok=True)
-    (source_hooks / "hooks.json").write_bytes(
-        (package_root / "hooks" / "hooks.json").read_bytes()
-    )
+    hooks_path = source_hooks / "hooks.json"
+    hooks_path.write_bytes((package_root / "hooks" / "hooks.json").read_bytes())
+    if has_enforcer:
+        _register_source_codex_enforcer(hooks_path)
     for each_relative_path in materializer.codex_hook_dependency_manifest:
         source_path = source_root / each_relative_path
         source_path.parent.mkdir(parents=True, exist_ok=True)
@@ -479,7 +501,7 @@ def test_build_plan_rejects_reparse_hook_dependencies(
     tmp_path: Path,
 ) -> None:
     source = tmp_path / "source"
-    _write_codex_hook_source(source)
+    _write_codex_hook_source(source, has_enforcer=True)
     dependency_path = source / materializer.codex_enforcer_script_relative_path
     outside_path = tmp_path / "outside.py"
     outside_path.write_text("secret", encoding="utf-8")
@@ -498,7 +520,7 @@ def test_publish_plan_preserves_modified_enforcer_hook_as_conflict(
 ) -> None:
     source = tmp_path / "source"
     target = tmp_path / "target"
-    _write_codex_hook_source(source)
+    _write_codex_hook_source(source, has_enforcer=True)
     target.mkdir()
     modified_command = f'python3 "{target / materializer.codex_enforcer_script_relative_path}" --custom'
     existing_manifest = {
@@ -892,6 +914,7 @@ def _prepare_projection_fixture(
         (Path(__file__).parents[2] / "hooks" / "hooks.json").read_text(encoding="utf-8"),
         encoding="utf-8",
     )
+    _register_source_codex_enforcer(source_hooks)
     package_root = Path(__file__).parents[2]
     for each_relative_path in materializer.codex_hook_dependency_manifest:
         target_dependency = source / each_relative_path
@@ -1082,6 +1105,166 @@ def _assert_detached_enforcer_behavior(target: Path) -> None:
     assert target_entrypoint.is_file()
 
 
+def _managed_enforcer_hook(target: Path) -> dict[str, object]:
+    return {
+        "type": "command",
+        "command": (
+            f'python3 "{target / materializer.codex_enforcer_script_relative_path}"'
+        ),
+        "timeout": materializer.codex_hook_timeout_seconds,
+    }
+
+
+def _foreign_same_basename_hook() -> dict[str, object]:
+    return {
+        "type": "command",
+        "command": "python D:/custom/hooks/blocking/code_rules_enforcer.py",
+    }
+
+
+def _codex_hook_group(
+    *all_hook_records: dict[str, object],
+) -> dict[str, object]:
+    return {
+        "matcher": materializer.codex_hook_matcher,
+        "hooks": list(all_hook_records),
+    }
+
+
+def _codex_hook_manifest(
+    *all_hook_groups: dict[str, object],
+) -> dict[str, object]:
+    return {"hooks": {"PreToolUse": list(all_hook_groups)}}
+
+
+def _write_current_source_without_enforcer(source: Path) -> None:
+    _write_codex_hook_source(source, has_enforcer=False)
+    source_manifest = json.loads(
+        (source / "hooks" / "hooks.json").read_text(encoding="utf-8")
+    )
+    all_source_commands = _hook_commands(source_manifest, "PreToolUse")
+    assert not any(
+        "code_rules_enforcer.py" in each_command
+        for each_command in all_source_commands
+    )
+
+
+def _publish_codex_hook_fixture(
+    source: Path, target: Path, target_manifest: dict[str, object]
+) -> tuple[dict[str, Any], MaterializationReport, list[PlannedFile]]:
+    target.mkdir()
+    target_hooks_path = target / materializer.codex_hook_manifest_target_path
+    target_hooks_path.write_text(json.dumps(target_manifest), encoding="utf-8")
+    config = MaterializerConfig(source, target, should_apply=True)
+    planned, report = build_plan(config, all_agents=[])
+    publication = publish_plan(config, planned, report)
+    projected_manifest = json.loads(target_hooks_path.read_text(encoding="utf-8"))
+    return projected_manifest, publication, planned
+
+
+def test_current_source_manifest_retires_the_managed_codex_enforcer(
+    tmp_path: Path,
+) -> None:
+    source = tmp_path / "source"
+    target = tmp_path / "target"
+    _write_current_source_without_enforcer(source)
+    foreign_hook: dict[str, object] = {
+        "type": "command",
+        "command": "python foreign_advisory.py",
+    }
+    foreign_named_hook = _foreign_same_basename_hook()
+    target_manifest = _codex_hook_manifest(
+        _codex_hook_group(_managed_enforcer_hook(target)),
+        _codex_hook_group(foreign_hook, foreign_named_hook),
+    )
+
+    projected_manifest, _, planned = _publish_codex_hook_fixture(
+        source, target, target_manifest
+    )
+    assert projected_manifest["hooks"]["PreToolUse"] == [
+        {
+            "matcher": "apply_patch",
+            "hooks": [foreign_hook, foreign_named_hook],
+        }
+    ]
+    all_planned_paths = {each_file.target_relative_path for each_file in planned}
+    assert all_planned_paths.isdisjoint(materializer.codex_hook_dependency_manifest)
+
+
+def test_explicit_source_enforcer_preserves_foreign_same_basename_hook(
+    tmp_path: Path,
+) -> None:
+    source = tmp_path / "source"
+    target = tmp_path / "target"
+    _write_codex_hook_source(source, has_enforcer=True)
+    managed_hook = _managed_enforcer_hook(target)
+    foreign_hook = _foreign_same_basename_hook()
+    target_manifest = _codex_hook_manifest(
+        _codex_hook_group(managed_hook, foreign_hook)
+    )
+    projected_manifest, publication, _ = _publish_codex_hook_fixture(
+        source, target, target_manifest
+    )
+    projected_hooks = projected_manifest["hooks"]["PreToolUse"][0]["hooks"]
+    assert publication.conflicted == 0
+    assert projected_hooks == [foreign_hook, managed_hook]
+
+
+@pytest.mark.parametrize("has_source_enforcer", [False, True])
+def test_posix_case_distinct_enforcer_path_remains_foreign(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    has_source_enforcer: bool,
+) -> None:
+    source = tmp_path / "source"
+    target = tmp_path / "target"
+    if has_source_enforcer:
+        _write_codex_hook_source(source, has_enforcer=True)
+    if not has_source_enforcer:
+        _write_current_source_without_enforcer(source)
+    managed_hook = _managed_enforcer_hook(target)
+    managed_command = cast(str, managed_hook["command"])
+    foreign_command = managed_command.replace(str(target), str(target).upper())
+    assert foreign_command != managed_command
+    assert foreign_command.casefold() == managed_command.casefold()
+    foreign_hook = {**managed_hook, "command": foreign_command}
+    target_manifest = _codex_hook_manifest(
+        _codex_hook_group(managed_hook, foreign_hook)
+    )
+    monkeypatch.setattr(materializer.os, "name", "posix")
+
+    projected_manifest, _, _ = _publish_codex_hook_fixture(
+        source, target, target_manifest
+    )
+
+    all_expected_commands = [foreign_command]
+    if has_source_enforcer:
+        all_expected_commands.append(managed_command)
+    assert _hook_commands(projected_manifest, "PreToolUse") == all_expected_commands
+
+
+def test_windows_case_variant_enforcer_path_is_managed(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    source = tmp_path / "source"
+    target = tmp_path / "target"
+    _write_current_source_without_enforcer(source)
+    managed_hook = _managed_enforcer_hook(target)
+    managed_command = cast(str, managed_hook["command"])
+    case_variant_command = managed_command.replace(str(target), str(target).upper())
+    target_manifest = _codex_hook_manifest(
+        _codex_hook_group({**managed_hook, "command": case_variant_command})
+    )
+    monkeypatch.setattr(materializer.os, "name", "nt")
+
+    projected_manifest, _, _ = _publish_codex_hook_fixture(
+        source, target, target_manifest
+    )
+
+    assert projected_manifest["hooks"] == {}
+
+
 def test_exact_cli_publishes_instruction_and_additive_hook_projection(
     tmp_path: Path, capsys: pytest.CaptureFixture[str]
 ) -> None:

package/scripts/tests/test_github_labels.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+from pr_verification.github_labels import remove_label_if_present
+from pr_verification.model import RepositorySettings
+
+PASS_LABEL = "local-checks:passed"
+FULL_PAGE_SIZE = 100
+
+
+def repository_settings() -> RepositorySettings:
+    return RepositorySettings(
+        slug="owner/repository",
+        clone_url="https://github.test/owner/repository.git",
+    )
+
+
+def label_page(all_label_names: list[str]) -> list[dict[str, str]]:
+    return [{"name": each_label_name} for each_label_name in all_label_names]
+
+
+class RecordingLabelReader:
+    def __init__(self, all_pages: list[object]) -> None:
+        self.all_pages = all_pages
+        self.all_endpoints: list[str] = []
+
+    def __call__(self, endpoint: str) -> object:
+        self.all_endpoints.append(endpoint)
+        return self.all_pages.pop(0)
+
+
+class RecordingLabelDeleter:
+    def __init__(self) -> None:
+        self.all_endpoints: list[str] = []
+
+    def __call__(self, endpoint: str) -> None:
+        self.all_endpoints.append(endpoint)
+
+
+def test_removes_a_label_a_later_page_holds() -> None:
+    all_first_page_names = [
+        f"topic-{each_index}" for each_index in range(FULL_PAGE_SIZE)
+    ]
+    read_labels_page = RecordingLabelReader(
+        [label_page(all_first_page_names), label_page([PASS_LABEL])]
+    )
+    delete_label = RecordingLabelDeleter()
+
+    remove_label_if_present(
+        read_labels_page, delete_label, repository_settings(), 7, PASS_LABEL
+    )
+
+    assert read_labels_page.all_endpoints == [
+        "/repos/owner/repository/issues/7/labels?per_page=100&page=1",
+        "/repos/owner/repository/issues/7/labels?per_page=100&page=2",
+    ]
+    assert delete_label.all_endpoints == [
+        "/repos/owner/repository/issues/7/labels/local-checks%3Apassed"
+    ]
+
+
+def test_reads_one_page_when_a_short_page_lacks_the_label() -> None:
+    read_labels_page = RecordingLabelReader([label_page(["topic"])])
+    delete_label = RecordingLabelDeleter()
+
+    remove_label_if_present(
+        read_labels_page, delete_label, repository_settings(), 7, PASS_LABEL
+    )
+
+    assert len(read_labels_page.all_endpoints) == 1
+    assert delete_label.all_endpoints == []
+
+
+def test_reads_one_page_when_the_first_page_holds_the_label() -> None:
+    read_labels_page = RecordingLabelReader([label_page([PASS_LABEL])])
+    delete_label = RecordingLabelDeleter()
+
+    remove_label_if_present(
+        read_labels_page, delete_label, repository_settings(), 7, PASS_LABEL
+    )
+
+    assert len(read_labels_page.all_endpoints) == 1
+    assert len(delete_label.all_endpoints) == 1
+
+
+def test_reads_no_further_page_when_a_page_is_not_a_list() -> None:
+    read_labels_page = RecordingLabelReader([{"message": "Not Found"}])
+    delete_label = RecordingLabelDeleter()
+
+    remove_label_if_present(
+        read_labels_page, delete_label, repository_settings(), 7, PASS_LABEL
+    )
+
+    assert len(read_labels_page.all_endpoints) == 1
+    assert delete_label.all_endpoints == []

package/scripts/tests/test_github_transport.py

@@ -0,0 +1,125 @@
+from __future__ import annotations
+
+import io
+import sys
+import urllib.error
+import urllib.request
+from collections.abc import Iterator
+from contextlib import AbstractContextManager, contextmanager
+from email.message import Message
+from pathlib import Path
+from unittest.mock import Mock
+
+import jwt
+import pytest
+
+SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIRECTORY))
+
+from pr_verification.config.timing import HTTP_TIMEOUT_SECONDS
+from pr_verification.github_parsing import GitHubError
+from pr_verification.github_transport import HttpReply, encode_app_jwt, request_http
+
+
+@contextmanager
+def reply_context(http_reply_mock: Mock) -> Iterator[Mock]:
+    yield http_reply_mock
+
+
+def make_http_reply_mock(
+    status_code: int, headers: dict[str, str], body: bytes
+) -> Mock:
+    http_reply_mock = Mock()
+    http_reply_mock.status = status_code
+    http_reply_mock.headers.items.return_value = list(headers.items())
+    http_reply_mock.read.return_value = body
+    return http_reply_mock
+
+
+def test_request_http_returns_success_reply_and_request_details(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    http_reply_mock = make_http_reply_mock(
+        200, {"Content-Type": "application/json"}, b'{"ok":true}'
+    )
+    all_requests: list[tuple[urllib.request.Request, float]] = []
+
+    def open_url(
+        request: urllib.request.Request, timeout: float
+    ) -> AbstractContextManager[Mock]:
+        all_requests.append((request, timeout))
+        return reply_context(http_reply_mock)
+
+    monkeypatch.setattr(urllib.request, "urlopen", open_url)
+
+    reply = request_http(
+        "GET",
+        "https://github.test/resource",
+        {"Accept": "application/json"},
+        None,
+    )
+
+    assert reply == HttpReply(200, {"Content-Type": "application/json"}, b'{"ok":true}')
+    assert all_requests[0][0].full_url == "https://github.test/resource"
+    assert all_requests[0][0].get_method() == "GET"
+    assert all_requests[0][1] == HTTP_TIMEOUT_SECONDS
+
+
+def test_request_http_returns_http_error_reply(monkeypatch: pytest.MonkeyPatch) -> None:
+    http_headers = Message()
+    http_headers["X-Request-Id"] = "request-id"
+    http_error = urllib.error.HTTPError(
+        "https://github.test/resource",
+        404,
+        "missing",
+        http_headers,
+        io.BytesIO(b"not found"),
+    )
+
+    def open_url(request: urllib.request.Request, timeout: float) -> Mock:
+        raise http_error
+
+    monkeypatch.setattr(urllib.request, "urlopen", open_url)
+
+    reply = request_http("GET", "https://github.test/resource", {}, None)
+
+    assert reply == HttpReply(404, {"X-Request-Id": "request-id"}, b"not found")
+
+
+def test_request_http_propagates_url_error_as_github_error(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    def open_url(request: urllib.request.Request, timeout: float) -> Mock:
+        raise urllib.error.URLError("offline")
+
+    monkeypatch.setattr(urllib.request, "urlopen", open_url)
+
+    with pytest.raises(GitHubError, match="offline"):
+        request_http("GET", "https://github.test/resource", {}, None)
+
+
+def test_encode_app_jwt_preserves_arguments_and_normalizes_bytes_and_strings(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_calls: list[tuple[dict[str, int | str], str, str]] = []
+    encoded_tokens = iter((b"encoded-bytes", "encoded-string"))
+
+    def encode_jwt(
+        claims: dict[str, int | str], private_key: str, algorithm: str
+    ) -> bytes | str:
+        all_calls.append((claims, private_key, algorithm))
+        return next(encoded_tokens)
+
+    monkeypatch.setattr(jwt, "encode", encode_jwt)
+    claims: dict[str, int | str] = {"iss": "42", "iat": 940, "exp": 1540}
+
+    bytes_token = encode_app_jwt(claims, "private-key", "RS256")
+    string_token = encode_app_jwt(claims, "private-key", "RS256")
+
+    assert bytes_token == "encoded-bytes"
+    assert string_token == "encoded-string"
+    assert all_calls == [
+        (claims, "private-key", "RS256"),
+        (claims, "private-key", "RS256"),
+    ]