claude-dev-env 7.4.1 → 7.5.0

package/scripts/tests/test_policy_lint_rules_retired_hook_prose.py

@@ -0,0 +1,197 @@
+"""Tests for the retired-hook-prose rule over rules Markdown."""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapter_retired_hook_prose, registry
+from policy_lint.model import ContentOrigin, Document, DocumentRule
+
+_RULE_ID = "retired-hook-prose"
+_RULES_DOCUMENT_PATH = "packages/claude-dev-env/rules/example.md"
+_INSTALLER_SOURCE = """
+export const RETIRED_HOOK_REGISTRATION_RELATIVE_PATHS = new Set([
+    'blocking/destructive_command_blocker.py',
+]);
+"""
+_HOOKS_CONFIGURATION = """
+{
+  "hooks": {
+    "PostToolUse": [
+      {"hooks": [{"command": "python hooks/observability/session_file_edit_tracker.py"}]}
+    ]
+  }
+}
+"""
+_DISPATCHER_ROSTER_SOURCE = """
+ALL_HOSTED_HOOK_ENTRIES = (
+    HostedHookEntry("advisory/refactor_guard.py", is_blocking=False),
+)
+"""
+
+
+def _build_package(repository_root: Path) -> None:
+    package_root = repository_root / "packages" / "claude-dev-env"
+    hooks_root = package_root / "hooks"
+    (hooks_root / "blocking").mkdir(parents=True)
+    (hooks_root / "advisory").mkdir(parents=True)
+    (hooks_root / "observability").mkdir(parents=True)
+    (hooks_root / "hooks_constants").mkdir(parents=True)
+    (package_root / "bin").mkdir(parents=True)
+    (package_root / "rules").mkdir(parents=True)
+    (hooks_root / "blocking" / "windows_rmtree_blocker.py").write_text("", "utf-8")
+    (hooks_root / "advisory" / "refactor_guard.py").write_text("", "utf-8")
+    (hooks_root / "observability" / "session_file_edit_tracker.py").write_text(
+        "", "utf-8"
+    )
+    (hooks_root / "blocking" / "content_hash_store.py").write_text("", "utf-8")
+    (hooks_root / "hooks.json").write_text(_HOOKS_CONFIGURATION, "utf-8")
+    (
+        hooks_root / "hooks_constants" / "pre_tool_use_dispatcher_constants.py"
+    ).write_text(_DISPATCHER_ROSTER_SOURCE, "utf-8")
+    (package_root / "bin" / "install.mjs").write_text(_INSTALLER_SOURCE, "utf-8")
+
+
+def _diagnostics_for(repository_root: Path, prose: str) -> tuple[str, ...]:
+    document = Document(
+        PurePosixPath(_RULES_DOCUMENT_PATH),
+        prose,
+        None,
+        None,
+        ContentOrigin.WORKTREE,
+    )
+    all_diagnostics = adapter_retired_hook_prose.retired_hook_prose_diagnostics(
+        document, repository_root
+    )
+    return tuple(each_diagnostic.message for each_diagnostic in all_diagnostics)
+
+
+def test_a_live_claim_for_a_surviving_unregistered_hook_is_reported(
+    tmp_path: Path,
+) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "The `windows_rmtree_blocker.py` PreToolUse hook blocks the unsafe pattern.\n",
+    )
+    assert len(all_messages) == 1
+    assert "windows_rmtree_blocker" in all_messages[0]
+
+
+def test_a_live_claim_for_a_roster_hook_absent_from_disk_is_reported(
+    tmp_path: Path,
+) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "The `destructive_command_blocker` hook watches every Bash-tool command.\n",
+    )
+    assert len(all_messages) == 1
+    assert "destructive_command_blocker" in all_messages[0]
+
+
+def test_a_registered_hook_described_in_the_present_tense_passes(
+    tmp_path: Path,
+) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "`session_file_edit_tracker` records each Write path, and `refactor_guard` reports a risk.\n",
+    )
+    assert all_messages == ()
+
+
+def test_a_past_tense_retirement_sentence_passes(tmp_path: Path) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "Commit `0f21faf8e` retired the blocking hooks. "
+        "`destructive_command_blocker` was one of them.\n",
+    )
+    assert all_messages == ()
+
+
+def test_a_sentence_crediting_the_staged_policy_lint_passes(tmp_path: Path) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "`windows_rmtree_blocker.py` reports the unsafe pattern, "
+        "and the staged policy lint runs it over each changed file.\n",
+    )
+    assert all_messages == ()
+
+
+def test_a_hook_directory_support_module_passes(tmp_path: Path) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "`content_hash_store.py` holds the full contract in its module docstring.\n",
+    )
+    assert all_messages == ()
+
+
+def test_a_verb_before_the_hook_name_passes(tmp_path: Path) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "The staged lint runs `windows_rmtree_blocker.py` over each changed file.\n",
+    )
+    assert all_messages == ()
+
+
+def test_a_code_span_between_the_name_and_its_verb_does_not_hide_the_claim(
+    tmp_path: Path,
+) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "`destructive_command_blocker` (PreToolUse on Bash `git commit`) "
+        "denies a commit that drops session edits.",
+    )
+    assert len(all_messages) == 1
+    assert "destructive_command_blocker" in all_messages[0]
+
+
+def test_a_second_hook_name_bounds_the_first_claim(tmp_path: Path) -> None:
+    _build_package(tmp_path)
+    all_messages = _diagnostics_for(
+        tmp_path,
+        "`destructive_command_blocker` was retired, and `refactor_guard` reports a risk.",
+    )
+    assert all_messages == ()
+
+
+def test_the_rule_is_registered_for_changed_and_repository_selections() -> None:
+    all_matching_rules = tuple(
+        each_rule
+        for each_rule in registry.default_registry()
+        if each_rule.rule_id == _RULE_ID
+    )
+    assert len(all_matching_rules) == 1
+    registered_rule = all_matching_rules[0]
+    assert isinstance(registered_rule, DocumentRule)
+    assert registered_rule.rule_sets == frozenset({"changed", "repository"})
+
+
+def test_the_committed_rules_directory_names_no_gate_that_stopped_running() -> None:
+    repository_root = Path(__file__).resolve().parents[4]
+    rules_root = repository_root / "packages" / "claude-dev-env" / "rules"
+    all_messages: list[str] = []
+    for each_path in sorted(rules_root.glob("*.md")):
+        relative_path = each_path.relative_to(repository_root).as_posix()
+        document = Document(
+            PurePosixPath(relative_path),
+            each_path.read_text(encoding="utf-8"),
+            None,
+            None,
+            ContentOrigin.WORKTREE,
+        )
+        all_messages.extend(
+            f"{relative_path}:{each_diagnostic.location.start_line}: {each_diagnostic.message}"
+            for each_diagnostic in (
+                adapter_retired_hook_prose.retired_hook_prose_diagnostics(
+                    document, repository_root
+                )
+            )
+        )
+    assert all_messages == []

package/scripts/tests/test_policy_lint_selection.py

@@ -19,6 +19,10 @@ from policy_lint.model import (
 )
 from policy_lint.selection import SelectionRunFatal, select_documents
 
+NON_UTF8_PNG_BYTES = bytes(
+    (0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0xFF, 0xFE, 0xFF)
+)
+
 
 def _git_environment() -> dict[str, str]:
     return {
@@ -66,6 +70,22 @@ def _commit_text(repository_root: Path, relative_path: str, text: str) -> None:
     _run_git(repository_root, "commit", "--quiet", "-m", "selection fixture")
 
 
+def _write_bytes(repository_root: Path, relative_path: str, raw_bytes: bytes) -> None:
+    file_path = repository_root / relative_path
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_bytes(raw_bytes)
+
+
+def _commit_bytes(repository_root: Path, relative_path: str, raw_bytes: bytes) -> None:
+    _write_bytes(repository_root, relative_path, raw_bytes)
+    _run_git(repository_root, "add", "--", relative_path)
+    _run_git(repository_root, "commit", "--quiet", "-m", "selection binary fixture")
+
+
+def _all_selected_paths(document_set: DocumentSet) -> set[str]:
+    return {each_document.path.as_posix() for each_document in document_set.documents}
+
+
 def _document_for(document_set: DocumentSet, relative_path: str) -> Document:
     for each_document in document_set.documents:
         if each_document.path.as_posix() == relative_path:
@@ -394,3 +414,90 @@ def test_tracked_worktree_document_preserves_git_path_spelling(
         tmp_path, "MiXeD.py"
     )
     assert selected_document.path == PurePosixPath("MiXeD.py")
+
+
+def test_base_added_binary_file_should_be_left_out_of_the_selection(
+    tmp_path: Path,
+) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "file.py", "base-text\n")
+    _run_git(repository_root, "checkout", "--quiet", "-b", "feature")
+    _commit_text(repository_root, "file.py", "feature-text\n")
+    _commit_bytes(repository_root, "approved_design_overlay.png", NON_UTF8_PNG_BYTES)
+
+    document_set = select_documents(LintRequest.base(repository_root, "main"))
+
+    assert _all_selected_paths(document_set) == {"file.py"}
+    assert _document_for(document_set, "file.py").text == "feature-text\n"
+    assert document_set.deleted_paths == ()
+
+
+def test_base_modified_binary_file_should_be_left_out_of_the_selection(
+    tmp_path: Path,
+) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_bytes(repository_root, "approved_design_overlay.png", NON_UTF8_PNG_BYTES)
+    _run_git(repository_root, "checkout", "--quiet", "-b", "feature")
+    _commit_bytes(
+        repository_root,
+        "approved_design_overlay.png",
+        NON_UTF8_PNG_BYTES + bytes((0xFF, 0x00, 0xFE)),
+    )
+    _commit_text(repository_root, "file.py", "feature-text\n")
+
+    document_set = select_documents(LintRequest.base(repository_root, "main"))
+
+    assert _all_selected_paths(document_set) == {"file.py"}
+    assert _document_for(document_set, "file.py").text == "feature-text\n"
+    assert document_set.deleted_paths == ()
+
+
+def test_staged_binary_file_should_be_left_out_of_the_selection(tmp_path: Path) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "file.py", "committed\n")
+    _write_bytes(repository_root, "approved_design_overlay.png", NON_UTF8_PNG_BYTES)
+    _write_text(repository_root, "file.py", "staged\n")
+    _run_git(repository_root, "add", "--all", "--", ".")
+
+    document_set = select_documents(LintRequest.staged(repository_root))
+
+    assert _all_selected_paths(document_set) == {"file.py"}
+    assert _document_for(document_set, "file.py").text == "staged\n"
+    assert document_set.deleted_paths == ()
+
+
+def test_repository_source_should_leave_binary_tracked_files_out(
+    tmp_path: Path,
+) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "tracked.py", "tracked\n")
+    _commit_bytes(repository_root, "approved_design_overlay.png", NON_UTF8_PNG_BYTES)
+
+    document_set = select_documents(LintRequest.repository(repository_root))
+
+    assert _all_selected_paths(document_set) == {"tracked.py"}
+    assert _document_for(document_set, "tracked.py").text == "tracked\n"
+
+
+def test_files_source_should_leave_a_named_binary_path_out(tmp_path: Path) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "file.py", "committed\n")
+    _write_bytes(repository_root, "approved_design_overlay.png", NON_UTF8_PNG_BYTES)
+
+    document_set = select_documents(
+        LintRequest.files(
+            repository_root,
+            [Path("file.py"), Path("approved_design_overlay.png")],
+        )
+    )
+
+    assert _all_selected_paths(document_set) == {"file.py"}
+    assert _document_for(document_set, "file.py").text == "committed\n"
+
+
+def test_files_missing_path_should_still_raise(tmp_path: Path) -> None:
+    repository_root = _initialize_repository(tmp_path)
+    _commit_text(repository_root, "file.py", "committed\n")
+
+    with pytest.raises(SelectionRunFatal, match="does not exist"):
+        select_documents(LintRequest.files(repository_root, [Path("missing.py")]))

package/hooks/hooks_constants/convergence_branch_constants.py

@@ -1,8 +0,0 @@
-"""Convergence branch naming policy constants.
-
-Shared by destructive_command_blocker convergence-branch exemptions
-"""
-
-ALL_CONVERGENCE_BRANCH_PREFIXES: tuple[str, ...] = ("claude/", "worktree-")
-CONVERGENCE_BRANCH_SUFFIX_PATTERN: str = r"pr-.*-converge$"
-CONVERGENCE_FORCE_PUSH_DETECTION_PATTERN: str = r"\bgit\s+push\b\s+(.*(?:--force|-f)\b.*)"

package/hooks/hooks_constants/destructive_command_environment_constants.py

@@ -1,18 +0,0 @@
-"""Environment keys and values used by destructive-command hooks."""
-
-from __future__ import annotations
-
-ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
-    {
-        "TEMP",
-        "TMP",
-        "TMPDIR",
-        "CLAUDE_JOB_DIR",
-    }
-)
-ALL_TRUTHY_ENV_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})
-DESTRUCTIVE_DENY_MODE_ENV_VAR: str = "CLAUDE_DESTRUCTIVE_DENY_MODE"
-EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR: str = (
-    "CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW"
-)
-GH_REDIRECT_ACTIVE_ENV_VAR: str = "CLAUDE_GH_REDIRECT_ACTIVE"

package/hooks/hooks_constants/test_text_stripping.py

@@ -1,39 +0,0 @@
-"""Tests for the shared strip_code_and_quotes helper."""
-
-import pathlib
-import sys
-
-_HOOKS_ROOT = pathlib.Path(__file__).resolve().parent.parent
-if str(_HOOKS_ROOT) not in sys.path:
-    sys.path.insert(0, str(_HOOKS_ROOT))
-
-from hooks_constants.text_stripping import strip_code_and_quotes
-
-
-def test_removes_fenced_code_block() -> None:
-    text = "before\n```python\nshould I run this?\n```\nafter"
-    stripped = strip_code_and_quotes(text)
-    assert "should I run this?" not in stripped
-    assert "before" in stripped
-    assert "after" in stripped
-
-
-def test_removes_inline_code_span() -> None:
-    text = "the function `would you like` is named oddly"
-    stripped = strip_code_and_quotes(text)
-    assert "would you like" not in stripped
-    assert "the function" in stripped
-    assert "is named oddly" in stripped
-
-
-def test_removes_leading_blockquote_lines() -> None:
-    text = "real line\n> should I proceed?\nfinal line"
-    stripped = strip_code_and_quotes(text)
-    assert "should I proceed?" not in stripped
-    assert "real line" in stripped
-    assert "final line" in stripped
-
-
-def test_leaves_plain_prose_unchanged() -> None:
-    text = "This sentence carries no code or quotes."
-    assert strip_code_and_quotes(text) == text

package/hooks/hooks_constants/text_stripping.py

@@ -1,36 +0,0 @@
-"""Shared text-stripping helper for the Stop-hook prose blockers.
-
-Several Stop hooks judge the prose of an assistant message and must ignore
-fenced code blocks, inline code spans, and leading blockquotes so a phrase that
-appears only inside code or a quote never trips the detector. The stripping
-logic is identical across those blockers, so it lives here once and is imported
-from each.
-"""
-
-from __future__ import annotations
-
-import re
-
-__all__ = [
-    "strip_code_and_quotes",
-]
-
-CODE_BLOCK_PATTERN = re.compile(r"```[\s\S]*?```", re.MULTILINE)
-INLINE_CODE_PATTERN = re.compile(r"`[^`]+`")
-QUOTED_BLOCK_PATTERN = re.compile(r"^>.*$", re.MULTILINE)
-
-
-def strip_code_and_quotes(text: str) -> str:
-    """Remove fenced code blocks, inline code, and blockquotes from prose.
-
-    Args:
-        text: The raw assistant message to clean of code and quoted lines.
-
-    Returns:
-        The text with every fenced code block, inline code span, and leading
-        blockquote line removed, so only the prose a reader sees remains.
-    """
-    text = CODE_BLOCK_PATTERN.sub("", text)
-    text = INLINE_CODE_PATTERN.sub("", text)
-    text = QUOTED_BLOCK_PATTERN.sub("", text)
-    return text