claude-dev-env 7.4.0 → 7.5.0

package/scripts/policy_lint/selection.py

@@ -18,6 +18,7 @@ from .model import (
     TextDocument,
 )
 from .selection_git import (
+    GitBlobItemBlocked,
     GitSelectionError,
     git_bytes_for,
     head_revision,
@@ -30,6 +31,10 @@ class SelectionRunFatal(ValueError):
     """Raised when a source selection cannot be resolved safely."""
 
 
+class SelectionItemBlocked(ValueError):
+    """Raised when one file holds bytes that are not a policy document."""
+
+
 SelectionError = SelectionRunFatal
 
 
@@ -54,9 +59,7 @@ def select_documents(request: LintRequest) -> DocumentSet:
 
 def _select_source(repository_root: Path, source: object) -> DocumentSet:
     if isinstance(source, ExplicitFiles):
-        all_documents = tuple(
-            _worktree_document(repository_root, each_path) for each_path in source.paths
-        )
+        all_documents = _explicit_documents(repository_root, source.paths)
         return DocumentSet(all_documents, SelectionKind.FILES, repository_root)
     if isinstance(source, StagedChanges):
         return _select_changes(repository_root, True, None)
@@ -89,13 +92,28 @@ def _validated_repository_root(repository_root: Path) -> Path:
     return resolved_root
 
 
+def _explicit_documents(
+    repository_root: Path, all_paths: tuple[Path, ...]
+) -> tuple[Document, ...]:
+    all_documents: list[Document] = []
+    for each_path in all_paths:
+        try:
+            all_documents.append(_worktree_document(repository_root, each_path))
+        except SelectionItemBlocked:
+            continue
+    return tuple(all_documents)
+
+
 def _select_repository_tree(repository_root: Path) -> DocumentSet:
-    all_documents = tuple(
-        _tracked_worktree_document(repository_root, each_path)
-        for each_path in _tracked_paths(repository_root)
-        if (repository_root / each_path).is_file()
-    )
-    return DocumentSet(all_documents, SelectionKind.REPOSITORY, repository_root)
+    all_documents: list[Document] = []
+    for each_path in _tracked_paths(repository_root):
+        if not (repository_root / each_path).is_file():
+            continue
+        try:
+            all_documents.append(_tracked_worktree_document(repository_root, each_path))
+        except SelectionItemBlocked:
+            continue
+    return DocumentSet(tuple(all_documents), SelectionKind.REPOSITORY, repository_root)
 
 
 def _tracked_worktree_document(repository_root: Path, raw_path: str) -> Document:
@@ -189,13 +207,16 @@ def _append_change(
     old_path, new_path = all_paths if status[:1] in {"R", "C"} else (all_paths[0], all_paths[0])
     normalized_old_path = _normalize_path(repository_root, old_path)
     normalized_new_path = _normalize_path(repository_root, new_path)
-    document = _change_document(
-        repository_root, old_path, new_path, normalized_old_path,
-        normalized_new_path, is_staged, base_revision, status,
-    )
-    if document is None:
+    if status == "D":
         all_deleted_paths.append(normalized_old_path)
         return
+    try:
+        document = _change_document(
+            repository_root, old_path, new_path, normalized_old_path,
+            normalized_new_path, is_staged, base_revision, status,
+        )
+    except (SelectionItemBlocked, GitBlobItemBlocked):
+        return
     all_documents.append(document)
     if document.prior_path is not None:
         all_renamed_paths.append((normalized_old_path, normalized_new_path))
@@ -210,9 +231,7 @@ def _change_document(
     is_staged: bool,
     base_revision: str | None,
     status: str,
-) -> Document | None:
-    if status == "D":
-        return None
+) -> Document:
     is_copy = status[:1] == "C"
     is_rename = status[:1] == "R"
     prior_text = _change_prior_text(
@@ -274,7 +293,7 @@ def _read_worktree_text(file_path: Path) -> str:
     try:
         return file_path.read_bytes().decode(constants.UTF8_ENCODING)
     except UnicodeDecodeError as error:
-        raise SelectionRunFatal(f"File is not UTF-8: {file_path}") from error
+        raise SelectionItemBlocked(f"File is not UTF-8: {file_path}") from error
     except OSError as error:
         raise SelectionRunFatal(f"File cannot be read: {file_path}") from error
 

package/scripts/policy_lint/selection_git.py

@@ -21,6 +21,10 @@ class GitSelectionError(ValueError):
     """Raised when Git cannot provide the requested source bytes."""
 
 
+class GitBlobItemBlocked(GitSelectionError):
+    """Raised when one Git blob holds bytes that are not UTF-8 text."""
+
+
 def git_bytes_for(repository_root: Path, all_arguments: tuple[str, ...]) -> bytes:
     """Run a fixed Git argument vector and return raw stdout bytes.
 
@@ -89,7 +93,7 @@ def read_blob(repository_root: Path, revision: str, relative_path: str) -> str |
         Decoded blob text, or None when the blob is absent.
 
     Raises:
-        GitSelectionError: If the blob is not UTF-8.
+        GitBlobItemBlocked: If the blob is not UTF-8.
     """
     blob_bytes = _read_blob_bytes(repository_root, revision, relative_path)
     if blob_bytes is None:
@@ -97,7 +101,7 @@ def read_blob(repository_root: Path, revision: str, relative_path: str) -> str |
     try:
         return blob_bytes.decode(UTF8_ENCODING)
     except UnicodeDecodeError as error:
-        raise GitSelectionError(f"Git blob is not UTF-8: {relative_path}") from error
+        raise GitBlobItemBlocked(f"Git blob is not UTF-8: {relative_path}") from error
 
 
 def _git_subprocess_environment() -> dict[str, str]:

package/scripts/pstack-adapters/common.md

@@ -4,7 +4,7 @@ Apply this mapping to the upstream workflow below. User instructions and host pe
 
 Determine the active host from the session's native tools. Read host-claude.md, host-codex.md, or host-cursor.md beside this file for the active host. Read pstack-host-mapping.md and pstack-models.md beside this file before delegation. Those files are copied from claude-dev-env's existing rules into this immutable release. Run the selectorPath recorded in release.json and supply its preferencesDirectory in the selector input. This overrides the old global selector path. Model preferences remain outside the release.
 
-Installed skill names have a component prefix. Read the installed inventory in release.json. A pstack request for how, /how, or pstack:how means pstack-how. A cursor-team-kit request for deslop means cursor-team-kit-deslop. Resolve all other skill names through that inventory. Read each leaf skill in full when it applies. Keep each skill's scripts, references, playbooks, and agent definitions at its recorded source root.
+Read the installed inventory in release.json for exact skill identities. Pstack skills use the `pstack:<slug>` plugin namespace. A pstack request for how, /how, or pstack:how means pstack:how. Cursor-team-kit skills keep flat component-prefixed names, so a request for deslop means cursor-team-kit-deslop. Resolve all other skill names through the inventory. Read each leaf skill in full when it applies. Keep each skill's scripts, references, playbooks, and agent definitions at its recorded source root.
 
 Every delegation prompt must include this compatibility file's absolute path, the active host file's absolute path, the selected skill's absolute path, and the requested upstream agent definition's absolute path when present. Tell the child to read them before working and to put the complete findings and evidence in its final message. The child receives the same host and model mapping as the parent.
 

package/scripts/repository_checks/config/constants.py

@@ -99,37 +99,27 @@ ALL_TRACKED_SECRET_EXACT_EXEMPTIONS: frozenset[tuple[str, str, str]] = frozenset
         (
             "packages/claude-dev-env/_shared/pr-loop/scripts/_claude_permissions_common.py",
             "home-path",
-            "9c48917645524d03ea0a4f4d8755aa8f0d59f3108e1aa976202a02e613c1444d",
-        ),
-        (
-            "packages/claude-dev-env/_shared/pr-loop/scripts/_claude_permissions_common.py",
-            "home-path",
-            "07ba214cb23325675bc68e5513c030e968eccf2760cb5917d932ae5da29d5af1",
-        ),
-        (
-            "packages/claude-dev-env/_shared/pr-loop/scripts/_claude_permissions_common.py",
-            "home-path",
-            "d41ce8d0f21de2d5320bdd8cd4e8693a2f3d6ea59db6df5ea102a7d2be4b2c22",
+            "f9e409c5c16ecfdd5883da4f3ad045b4af5677740c9e703ad2d47ba231718350",
         ),
         (
             "packages/claude-dev-env/audit-rubrics/prompts/category-n-test-name-scenario-verifier.md",
             "home-path",
-            "550c7b16a2a04e1d05a8a6b4f5b764b8d4fdef65e9d79d09e5dbb3a15a855812",
+            "6b98ff7f0398f06452f19c4a93f3d69186401dab40aaa7077b394ef59b3e730e",
         ),
         (
-            "packages/claude-dev-env/audit-rubrics/prompts/category-n-test-name-scenario-verifier.md",
+            "packages/claude-dev-env/bin/expand_home_directory_tokens.mjs",
             "home-path",
-            "b8bbdd1a7ebdad16f4e51377a3f21d05dd35992d89e35971b28b05f53245c69d",
+            "31e989aa0fbf83d6de5d2f0cd6f08b3cd8151592050b71794ffa180b80385ff2",
         ),
         (
             "packages/claude-dev-env/bin/expand_home_directory_tokens.mjs",
             "home-path",
-            "10d5571e7126d2018ee7fb06aa29c72a9d503cac79a4e52d6848602ee10e8832",
+            "73ff793e488241663bb0c075fd50bd3a18fca8dd79cbd11629c00d2ad7548a8a",
         ),
         (
             "packages/claude-dev-env/bin/expand_home_directory_tokens.mjs",
             "home-path",
-            "09f83c224a02c370d3d63de5c330e1a830fc92866330fc7963b5b5fd20ffcb91",
+            "fd9ba4ae930ef31ebdfc463b231a093656b8eaa1d8fe65f60715ec2b6fee04a9",
         ),
         (
             "packages/claude-dev-env/hooks/hooks_constants/hardcoded_user_path_constants.py",
@@ -139,7 +129,7 @@ ALL_TRACKED_SECRET_EXACT_EXEMPTIONS: frozenset[tuple[str, str, str]] = frozenset
         (
             "packages/claude-dev-env/hooks/hooks_constants/hardcoded_user_path_constants.py",
             "home-path",
-            "a541acfac2e649581bca0cd03e4c3dcf306344915017d9cd6be4ad57a8fd7379",
+            "5d956228802fbd4a65af8fa7fb4183f5a9f8793dbe218877aefe887b905f726d",
         ),
     )
 )

package/scripts/repository_checks/config/email_exemptions.py

@@ -0,0 +1,10 @@
+"""Repository public-email exception schema."""
+
+import re
+
+CONFIG_RELATIVE_PATH = "config/repository-policy.json"
+DIGEST_PATTERN = re.compile(r"[0-9a-f]{64}")
+FORBIDDEN_PATH_CHARACTERS = frozenset("\\:*?[]")
+ALL_ENTRY_FIELDS = frozenset({"path", "sha256", "reason"})
+ALL_FORBIDDEN_PATH_SEGMENTS = frozenset({"", ".", ".."})
+FIRST_PRINTABLE_CODEPOINT = 32

package/scripts/repository_checks/email_exemptions.py

@@ -0,0 +1,96 @@
+"""Load exact public-email exceptions owned by a repository."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from repository_checks.config.email_exemptions import (
+    ALL_ENTRY_FIELDS,
+    ALL_FORBIDDEN_PATH_SEGMENTS,
+    CONFIG_RELATIVE_PATH,
+    DIGEST_PATTERN,
+    FIRST_PRINTABLE_CODEPOINT,
+    FORBIDDEN_PATH_CHARACTERS,
+)
+
+
+class PolicyConfigurationRunFatal(ValueError):
+    """Reject the entire policy run when exception configuration is invalid."""
+
+
+def load_email_exemptions(repository_root: Path) -> frozenset[tuple[str, str, str]]:
+    """Read validated email exceptions.
+
+    Args:
+        repository_root: Repository containing the optional policy configuration.
+    Returns:
+        Exact path, email category, and digest identities.
+    Raises:
+        ValueError: Configuration contains invalid JSON or schema fields.
+        OSError: Configuration cannot be read.
+    """
+    exemptions: set[tuple[str, str, str]] = set()
+    for each_entry in _read_entries(repository_root):
+        identity = _entry_identity(each_entry)
+        if identity in exemptions:
+            raise PolicyConfigurationRunFatal("Duplicate repository email exemption")
+        exemptions.add(identity)
+    return frozenset(exemptions)
+
+
+def _read_entries(repository_root: Path) -> list[object]:
+    config_path = repository_root / CONFIG_RELATIVE_PATH
+    if not config_path.exists() and not config_path.is_symlink():
+        return []
+    if not config_path.resolve().is_relative_to(repository_root.resolve()):
+        raise ValueError(
+            "Repository policy configuration must remain inside the repository"
+        )
+    document = json.loads(
+        config_path.read_text(encoding="utf-8"), object_pairs_hook=_unique_fields
+    )
+    if (
+        not isinstance(document, dict)
+        or set(document) != {"version", "email_exemptions"}
+        or type(document["version"]) is not int
+        or document["version"] != 1
+        or not isinstance(document["email_exemptions"], list)
+    ):
+        raise ValueError("Invalid repository policy configuration schema")
+    return document["email_exemptions"]
+
+
+def _unique_fields(all_pairs: list[tuple[str, object]]) -> dict[str, object]:
+    fields: dict[str, object] = {}
+    for each_key, each_content in all_pairs:
+        if each_key in fields:
+            raise PolicyConfigurationRunFatal("Duplicate repository policy field")
+        fields[each_key] = each_content
+    return fields
+
+
+def _entry_identity(entry: object) -> tuple[str, str, str]:
+    if not isinstance(entry, dict) or set(entry) != ALL_ENTRY_FIELDS:
+        raise ValueError("Email exemptions require path, sha256, and reason")
+    relative_path, digest, reason = entry["path"], entry["sha256"], entry["reason"]
+    if not isinstance(relative_path, str) or not relative_path:
+        raise ValueError("Email exemption path must name one repository file")
+    if (
+        any(character in FORBIDDEN_PATH_CHARACTERS for character in relative_path)
+        or any(
+            segment in ALL_FORBIDDEN_PATH_SEGMENTS
+            for segment in relative_path.split("/")
+        )
+        or any(
+            ord(character) < FIRST_PRINTABLE_CODEPOINT for character in relative_path
+        )
+    ):
+        raise ValueError("Email exemption path must be a literal relative file path")
+    if not isinstance(digest, str) or DIGEST_PATTERN.fullmatch(digest) is None:
+        raise ValueError("Email exemption sha256 must contain 64 lowercase hex digits")
+    if not isinstance(reason, str) or not reason.strip():
+        raise ValueError(
+            "Email exemption reason must explain its public contact purpose"
+        )
+    return relative_path, "email", digest

package/scripts/repository_checks/env_var_documentation.py

@@ -138,15 +138,7 @@ def _iter_env_var_code_references(
     drift_module: ModuleType,
     drift_constants: ModuleType,
 ) -> Iterator[str]:
-    is_inside_code_fence = False
-    for each_line in content.splitlines():
-        if drift_constants.CODE_FENCE_PATTERN.match(each_line) is not None:
-            is_inside_code_fence = not is_inside_code_fence
-            continue
-        if is_inside_code_fence:
-            continue
-        if drift_constants.TABLE_ROW_PATTERN.match(each_line) is None:
-            continue
+    for each_line in drift_module.iter_env_var_table_rows(content):
         maybe_code_reference = _code_reference_for_env_var_row(
             each_line,
             drift_module,

package/scripts/repository_checks/tracked_secrets.py

@@ -10,6 +10,7 @@ from types import ModuleType
 from policy_lint.config import constants as policy_constants
 
 from repository_checks.config import constants as repository_constants
+from repository_checks.email_exemptions import load_email_exemptions
 from repository_checks.hook_modules import load_hooks_module
 from repository_checks.models import RepositoryFinding
 
@@ -29,6 +30,8 @@ def collect_tracked_secret_findings(
     scanner = load_hooks_module(repository_constants.PII_SCANNER_MODULE_NAME)
     exemption = load_hooks_module(repository_constants.REPOSITORY_EXEMPTION_MODULE_NAME)
     all_allowlisted_literals = exemption.repository_allowlisted_values(repository_root)
+    all_exact_exemptions = load_email_exemptions(repository_root)
+    all_exact_exemptions |= repository_constants.ALL_TRACKED_SECRET_EXACT_EXEMPTIONS
     all_findings: list[RepositoryFinding] = []
     for each_relative_path in all_tracked_paths:
         all_findings.extend(
@@ -37,6 +40,7 @@ def collect_tracked_secret_findings(
                 each_relative_path,
                 scanner,
                 all_allowlisted_literals,
+                all_exact_exemptions,
             )
         )
     return all_findings
@@ -47,6 +51,7 @@ def _find_secrets_for_path(
     relative_path: str,
     scanner: ModuleType,
     all_allowlisted_literals: frozenset[str],
+    all_exact_exemptions: frozenset[tuple[str, str, str]],
 ) -> list[RepositoryFinding]:
     posix_relative_path = relative_path.replace(
         repository_constants.WINDOWS_PATH_SEPARATOR,
@@ -65,6 +70,7 @@ def _find_secrets_for_path(
         maybe_content,
         scanner,
         all_allowlisted_literals,
+        all_exact_exemptions,
     )
 
 
@@ -73,6 +79,7 @@ def _find_secret_matches(
     content: str,
     scanner: ModuleType,
     all_allowlisted_literals: frozenset[str],
+    all_exact_exemptions: frozenset[tuple[str, str, str]],
 ) -> list[RepositoryFinding]:
     return [
         _build_finding(
@@ -86,6 +93,7 @@ def _find_secret_matches(
             each_match.category,
             each_match.matched_text,
             all_allowlisted_literals,
+            all_exact_exemptions,
         )
     ]
 
@@ -127,16 +135,14 @@ def _should_report_match(
     category: str,
     matched_text: str,
     all_allowlisted_literals: frozenset[str],
+    all_exact_exemptions: frozenset[tuple[str, str, str]],
 ) -> bool:
     exact_exemption_identity = (
         posix_relative_path,
         category,
         _secret_digest(matched_text),
     )
-    if (
-        exact_exemption_identity
-        in repository_constants.ALL_TRACKED_SECRET_EXACT_EXEMPTIONS
-    ):
+    if exact_exemption_identity in all_exact_exemptions:
         return False
     return matched_text not in all_allowlisted_literals
 

package/scripts/test_durable_post_lint.py

@@ -15,21 +15,29 @@ if str(_SCRIPTS_DIRECTORY) not in sys.path:
 import durable_post_lint
 
 SCRIPT_PATH = _SCRIPTS_DIRECTORY / "durable_post_lint.py"
-VALID_PR_BODY = """## Summary
+VALID_PR_BODY = """## Why
 
-Summary text.
+Why text.
 
-## Description
+## Scope
 
-Description text.
+Scope text.
 
-## Why
+## Tradeoffs
 
-Why text.
+Tradeoffs text.
+
+## Blast Radius
+
+Blast radius text.
+
+## Verification
 
-## How
+Verification text.
+"""
+MINIMAL_PR_BODY = """## Why
 
-How text.
+Why text.
 
 ## Verification
 
@@ -156,7 +164,7 @@ def test_pr_titles_reject_nonconventional_forms(title: str) -> None:
 
 @pytest.mark.parametrize(
     "missing_heading",
-    ["Summary", "Description", "Why", "How", "Verification"],
+    durable_post_lint.ALL_REQUIRED_PR_DESCRIPTION_HEADINGS,
 )
 def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     body_text = VALID_PR_BODY.replace(f"## {missing_heading}\n", "")
@@ -170,6 +178,31 @@ def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     ]
 
 
+@pytest.mark.parametrize("action", ["pr-create", "pr-edit"])
+def should_accept_a_body_carrying_only_the_two_required_headings(action: str) -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action=action,
+        title="fix(cli): tighten input handling",
+        body_text=MINIMAL_PR_BODY,
+    )
+    assert all_findings == ()
+
+
+def should_still_accept_a_body_published_under_the_superseded_heading_set() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text=(
+            "## Summary\n\nSummary text.\n\n"
+            "## Description\n\nDescription text.\n\n"
+            "## Why\n\nWhy text.\n\n"
+            "## How\n\nHow text.\n\n"
+            "## Verification\n\nVerification text.\n"
+        ),
+    )
+    assert all_findings == ()
+
+
 def test_non_pr_body_needs_no_pr_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
         action="issue-comment",

package/scripts/tests/test_adapter_configuration.py

@@ -42,6 +42,14 @@ def test_incremental_blocker_removal_is_clean(tmp_path: Path) -> None:
     assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
 
 
+def test_new_bash_pre_tool_use_dispatcher_registration_is_clean(tmp_path: Path) -> None:
+    current_document = _hook_document(
+        ["hooks/blocking/bash_pre_tool_use_dispatcher.py"],
+        '{"hooks": {}}',
+    )
+    assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
+
+
 def test_new_blocker_in_staged_change_is_rejected(tmp_path: Path) -> None:
     current_document = _hook_document(
         ["hooks/blocking/new.py"],

package/scripts/tests/test_email_exemptions.py

@@ -0,0 +1,121 @@
+"""Exact public-contact exceptions preserve all other scanner findings."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.email_exemptions import load_email_exemptions
+from repository_checks.tracked_secrets import collect_tracked_secret_findings
+
+CONTACT = "fixture-contact@company.io"
+CHANGED_CONTACT = "changed-contact@company.io"
+DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
+
+
+def _write_config(root: Path, entries: list[object]) -> None:
+    directory = root / "config"
+    directory.mkdir(exist_ok=True)
+    (directory / "repository-policy.json").write_text(
+        json.dumps({"version": 1, "email_exemptions": entries}), encoding="utf-8"
+    )
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": "contacts.py",
+        "sha256": DIGEST,
+        "reason": "Published support contact",
+        **changes,
+    }
+
+
+def test_only_matching_email_and_path_are_exempt(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry()])
+    (tmp_path / "contacts.py").write_text(
+        f"contact = '{CONTACT}'\nchanged = '{CHANGED_CONTACT}'\n", encoding="utf-8"
+    )
+    (tmp_path / "other.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
+    findings = collect_tracked_secret_findings(tmp_path, ["contacts.py", "other.py"])
+    assert [finding.relative_path for finding in findings] == [
+        "contacts.py",
+        "other.py",
+    ]
+    assert all(finding.message.startswith("[email]") for finding in findings)
+
+
+def test_matching_contact_has_no_findings(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry()])
+    (tmp_path / "contacts.py").write_text(f"contact = '{CONTACT}'\n", encoding="utf-8")
+    assert collect_tracked_secret_findings(tmp_path, ["contacts.py"]) == []
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/contacts.py",
+        "C:/contacts.py",
+        "../contacts.py",
+        "src/../contacts.py",
+        "*.py",
+        "src/?.py",
+        "src/[a].py",
+        "src\\contacts.py",
+        "src//contacts.py",
+        "./contacts.py",
+        "",
+    ],
+)
+def test_rejects_nonliteral_or_nonrelative_paths(tmp_path: Path, path: str) -> None:
+    _write_config(tmp_path, [_entry(path=path)])
+    with pytest.raises(ValueError):
+        load_email_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "entry",
+    [
+        None,
+        {},
+        _entry(reason=" "),
+        _entry(sha256="f" * 63),
+        _entry(sha256="z" * 64),
+        _entry(category="secret"),
+    ],
+)
+def test_rejects_invalid_entries(tmp_path: Path, entry: object) -> None:
+    _write_config(tmp_path, [entry])
+    with pytest.raises(ValueError):
+        load_email_exemptions(tmp_path)
+
+
+def test_rejects_duplicate_entries(tmp_path: Path) -> None:
+    _write_config(tmp_path, [_entry(), _entry(reason="Another explanation")])
+    with pytest.raises(ValueError):
+        load_email_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        "{",
+        "[]",
+        '{"version":true,"email_exemptions":[]}',
+        '{"version":1,"email_exemptions":{}}',
+        '{"version":1,"email_exemptions":[],"extra":0}',
+        '{"version":1,"version":1,"email_exemptions":[]}',
+    ],
+)
+def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
+    (tmp_path / "config").mkdir()
+    (tmp_path / "config" / "repository-policy.json").write_text(
+        content, encoding="utf-8"
+    )
+    with pytest.raises(ValueError):
+        collect_tracked_secret_findings(tmp_path, [])
+
+
+def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
+    assert load_email_exemptions(tmp_path) == frozenset()

package/scripts/tests/test_env_var_documentation.py

@@ -17,6 +17,9 @@ from repository_checks.config.constants import (
     FINDINGS_EXIT_CODE,
     SUCCESS_EXIT_CODE,
 )
+from repository_checks.env_var_documentation import (
+    collect_env_var_documentation_findings,
+)
 from repository_policy_test_support import (
     commit_tracked_files,
     initialize_repository,
@@ -131,3 +134,26 @@ def record_read_paths(monkeypatch: pytest.MonkeyPatch) -> list[Path]:
 
     monkeypatch.setattr(Path, "read_text", record_read_path)
     return all_read_paths
+
+
+@pytest.mark.parametrize("header", ["Symbol", "Component", "Constant"])
+def test_should_ignore_source_tables_before_reading_named_code(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, header: str
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "workflow.py", "def run():\n    return\n")
+    write_text(
+        repository_root / "docs" / "source-map.md",
+        f"| {header} | Source |\n"
+        "| --- | --- |\n"
+        "| `PROCESSING_VISIBLE` | `workflow.py` |\n",
+    )
+    commit_tracked_files(repository_root)
+    patch_unreadable_named_file(
+        monkeypatch, "workflow.py", "unrelated source unreadable"
+    )
+    assert (
+        collect_env_var_documentation_findings(repository_root, ["docs/source-map.md"])
+        == []
+    )