claude-dev-env 7.3.0 → 7.4.1

package/scripts/tests/test_env_var_documentation.py

@@ -17,6 +17,9 @@ from repository_checks.config.constants import (
     FINDINGS_EXIT_CODE,
     SUCCESS_EXIT_CODE,
 )
+from repository_checks.env_var_documentation import (
+    collect_env_var_documentation_findings,
+)
 from repository_policy_test_support import (
     commit_tracked_files,
     initialize_repository,
@@ -131,3 +134,26 @@ def record_read_paths(monkeypatch: pytest.MonkeyPatch) -> list[Path]:
 
     monkeypatch.setattr(Path, "read_text", record_read_path)
     return all_read_paths
+
+
+@pytest.mark.parametrize("header", ["Symbol", "Component", "Constant"])
+def test_should_ignore_source_tables_before_reading_named_code(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, header: str
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "workflow.py", "def run():\n    return\n")
+    write_text(
+        repository_root / "docs" / "source-map.md",
+        f"| {header} | Source |\n"
+        "| --- | --- |\n"
+        "| `PROCESSING_VISIBLE` | `workflow.py` |\n",
+    )
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(
+        monkeypatch, "workflow.py", "unrelated source unreadable"
+    )
+    assert (
+        collect_env_var_documentation_findings(repository_root, ["docs/source-map.md"])
+        == []
+    )

package/scripts/tests/test_rules.py

@@ -125,6 +125,31 @@ def _worker_policy_surfaces(package_root: Path) -> tuple[Path, ...]:
     )
 
 
+def _banned_word_real_phrases() -> tuple[str, ...]:
+    return (
+        "banned word: real",
+        "never write real, really, or real-world",
+        "this ban has no exception",
+        "swapping in actual, actually, genuine, or true is the same move",
+    )
+
+
+def _banned_word_real_surfaces(package_root: Path) -> tuple[Path, ...]:
+    return (
+        package_root.parent.parent / "AGENTS.md",
+        package_root / "AGENTS.md",
+    )
+
+
+def test_banned_word_real_reaches_installed_instruction_surfaces() -> None:
+    all_expected_phrases = _banned_word_real_phrases()
+
+    for each_surface_path in _banned_word_real_surfaces(_PACKAGE_ROOT):
+        surface_text = each_surface_path.read_text(encoding="utf-8").lower()
+        for each_phrase in all_expected_phrases:
+            assert each_phrase in surface_text, each_surface_path
+
+
 def test_comment_guidance_reaches_installed_instruction_surfaces() -> None:
     expected_phrases = _comment_policy_phrases()
     all_surface_paths = _comment_policy_surfaces(_PACKAGE_ROOT)

package/scripts/tests/test_tracked_secrets.py

@@ -10,6 +10,7 @@ import pytest
 from repository_checks.config.constants import (
     ALL_TRACKED_SECRET_EXACT_EXEMPTIONS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
 )
 from repository_checks.hook_modules import load_hooks_module
@@ -55,6 +56,18 @@ def test_should_flag_a_tracked_secret(tmp_path: Path) -> None:
     assert _SYNTHETIC_GITHUB_TOKEN not in stdout_text
 
 
+def test_should_fail_closed_for_malformed_repository_email_policy(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "config" / "repository-policy.json", "{")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert f"error: rule failed: {CHECK_ID_TRACKED_PERSONAL_DATA}" in stdout_text
+
+
 def test_should_fail_closed_before_reading_a_tracked_symlink_outside_repository(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None: