claude-dev-env 7.4.1 → 7.6.0

package/scripts/tests/test_policy_document.py

@@ -0,0 +1,104 @@
+"""The shared policy-document reader and entry validator."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.policy_document import (
+    entry_path_and_digest,
+    read_policy_entries,
+)
+
+RELATIVE_PATH = "evidence/manifest.json"
+DIGEST = hashlib.sha256(b"frozen bytes").hexdigest()
+CONFIG_RELATIVE_PATH = "config/repository-policy.json"
+
+
+def _write_config(root: Path, document: object) -> None:
+    config_path = root / CONFIG_RELATIVE_PATH
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    config_path.write_text(json.dumps(document), encoding="utf-8")
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": RELATIVE_PATH,
+        "sha256": DIGEST,
+        "reason": "Frozen evidence file pinned by its consumers",
+        **changes,
+    }
+
+
+def test_reader_returns_the_recorded_entries_without_validating_them(
+    tmp_path: Path,
+) -> None:
+    """The reader validates the document, and the caller validates each entry."""
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [{"anything": 1}]})
+    assert read_policy_entries(tmp_path, "path_exemptions") == [{"anything": 1}]
+
+
+def test_reader_returns_no_entries_for_a_field_the_document_omits(
+    tmp_path: Path,
+) -> None:
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry()]})
+    assert read_policy_entries(tmp_path, "email_exemptions") == []
+
+
+def test_reader_rejects_a_configuration_symlinked_outside_the_repository(
+    tmp_path: Path,
+) -> None:
+    outside_path = tmp_path / "outside-policy.json"
+    outside_path.write_text(json.dumps({"version": 1}), encoding="utf-8")
+    repository_root = tmp_path / "repo"
+    (repository_root / "config").mkdir(parents=True)
+    (repository_root / CONFIG_RELATIVE_PATH).symlink_to(outside_path)
+    with pytest.raises(ValueError) as rejection:
+        read_policy_entries(repository_root, "path_exemptions")
+    assert (
+        str(rejection.value)
+        == "Repository policy configuration must remain inside the repository"
+    )
+
+
+def test_entry_validator_returns_the_path_and_digest_without_the_reason() -> None:
+    assert entry_path_and_digest(_entry(), "Path exemption") == (
+        RELATIVE_PATH,
+        DIGEST,
+    )
+
+
+@pytest.mark.parametrize(
+    ("entry", "expected_message"),
+    [
+        ({}, "Path exemptions require path, sha256, and reason"),
+        (_entry(path=1), "Path exemption path must name one repository file"),
+        (
+            _entry(path="../manifest.json"),
+            "Path exemption path must be a literal relative file path",
+        ),
+        (
+            _entry(sha256="F" * 64),
+            "Path exemption sha256 must contain 64 lowercase hex digits",
+        ),
+        (
+            _entry(reason=" "),
+            "Path exemption reason must explain why the exception is owned",
+        ),
+    ],
+)
+def test_entry_validator_names_the_subject_in_every_rejection(
+    entry: object, expected_message: str
+) -> None:
+    """One validator serves both families, so each message names its subject."""
+    with pytest.raises(ValueError) as rejection:
+        entry_path_and_digest(entry, "Path exemption")
+    assert str(rejection.value) == expected_message
+
+
+def test_entry_validator_uses_the_subject_it_is_given() -> None:
+    with pytest.raises(ValueError) as rejection:
+        entry_path_and_digest({}, "Email exemption")
+    assert str(rejection.value) == "Email exemptions require path, sha256, and reason"

package/scripts/tests/test_policy_lint_rules_function_length_scope.py

@@ -0,0 +1,101 @@
+"""Function-length diagnostics report only functions the change is responsible for.
+
+The code-rule adapter runs the enforcer with ``defer_scope_to_caller`` set, so
+the enforcer hands back every over-long function in the document and the caller
+owns the scope decision. The engine's own changed-line filter keys on a
+diagnostic's start line, and a function-length message carries no ``Line N:``
+prefix, so before this scope pass a pre-existing long function blocked any
+change that touched its file.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapters
+from policy_lint.model import ContentOrigin, Diagnostic, Document
+from policy_lint.selection import _changed_lines
+
+FUNCTION_LENGTH_MESSAGE_FRAGMENT = "exceeds blocking threshold"
+PRODUCTION_RELATIVE_PATH = "packages/claude-dev-env/scripts/sample_long_module.py"
+OVER_THRESHOLD_BODY_LINE_COUNT = 70
+UNDER_THRESHOLD_BODY_LINE_COUNT = 40
+REPOSITORY_ROOT = Path(__file__).resolve().parents[4]
+
+
+def _counting_function_source(function_name: str, body_line_count: int) -> str:
+    all_body_lines = [
+        f"    running_total = running_total + {each_index}"
+        for each_index in range(body_line_count)
+    ]
+    signature_lines = [f"def {function_name}(running_total: int) -> int:"]
+    return (
+        "\n".join(signature_lines + all_body_lines + ["    return running_total"])
+        + "\n"
+    )
+
+
+def _messages_for_document(document: Document) -> tuple[str, ...]:
+    all_diagnostics: tuple[Diagnostic, ...] = adapters.code_rule_diagnostics(
+        document, REPOSITORY_ROOT
+    )
+    return tuple(
+        each_diagnostic.message
+        for each_diagnostic in all_diagnostics
+        if FUNCTION_LENGTH_MESSAGE_FRAGMENT in each_diagnostic.message
+    )
+
+
+def _function_length_messages(
+    prior_text: str | None, current_text: str
+) -> tuple[str, ...]:
+    return _messages_for_document(
+        Document(
+            PurePosixPath(PRODUCTION_RELATIVE_PATH),
+            current_text,
+            prior_text,
+            _changed_lines(prior_text, current_text),
+            ContentOrigin.REVISION_DIFF,
+        )
+    )
+
+
+def test_should_leave_an_untouched_long_function_alone() -> None:
+    prior_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = f"import os\nimport sys\n{prior_text}"
+    assert _function_length_messages(prior_text, current_text) == ()
+
+
+def test_should_report_a_function_the_change_grew_past_the_threshold() -> None:
+    prior_text = _counting_function_source("main", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(prior_text, current_text) != ()
+
+
+def test_should_report_an_over_long_function_the_change_adds() -> None:
+    prior_text = _counting_function_source("existing", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    added_text = _counting_function_source("added", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(prior_text, f"{prior_text}\n{added_text}") != ()
+
+
+def test_should_report_every_over_long_function_in_a_wholly_new_document() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(None, current_text) != ()
+
+
+def test_should_leave_a_long_function_alone_when_the_change_only_deletes() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    prior_text = f"REMOVED_CONSTANT = 1\n{current_text}"
+    assert _function_length_messages(prior_text, current_text) == ()
+
+
+def test_should_report_a_long_function_when_the_selection_names_no_changed_lines() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    document = Document(
+        PurePosixPath(PRODUCTION_RELATIVE_PATH),
+        current_text,
+        None,
+        None,
+        ContentOrigin.WORKTREE,
+    )
+    assert _messages_for_document(document) != ()

package/scripts/tests/test_policy_lint_rules_pairing.py

@@ -70,6 +70,37 @@ def test_approved_pairs_name_files_that_exist() -> None:
             assert (repository_root / each_test_path).is_file(), each_test_path
 
 
+def test_every_approved_pair_actually_waives_its_production_file(tmp_path: Path) -> None:
+    """Each mapping entry must silence the rule when its production file changes.
+
+    File existence alone leaves an entry inert when its key carries a suffix the
+    rule skips, or when its value is not a name the rule reads as a test.
+    """
+    for (
+        production_path,
+        all_test_paths,
+    ) in APPROVED_TEST_PATHS_BY_PRODUCTION_PATH.items():
+        production_document = Document(
+            production_path,
+            _BODY_AFTER,
+            _BODY_BEFORE,
+            frozenset({1}),
+            ContentOrigin.REVISION_DIFF,
+        )
+        for each_test_path in all_test_paths:
+            test_document = Document(
+                each_test_path,
+                _BODY_AFTER,
+                _BODY_BEFORE,
+                frozenset({1}),
+                ContentOrigin.REVISION_DIFF,
+            )
+            document_set = DocumentSet(
+                (production_document, test_document), SelectionKind.BASE, tmp_path
+            )
+            assert adapters.test_pairing_diagnostics(document_set) == (), production_path
+
+
 def test_pairing_ignores_python_docstring_only_changes(tmp_path: Path) -> None:
     all_diagnostics = _pairing_diagnostics(
         tmp_path,
@@ -161,3 +192,347 @@ def test_pairing_rejects_an_unrelated_module_beside_a_changed_approved_suite(
         _body_change_at(_APPROVED_TEST_PATH),
     )
     assert all_paths == (_UNRELATED_PRODUCTION_PATH,)
+
+
+_MECHANICAL_BEFORE = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(command, timeout=TIMEOUT_SECONDS, check=False)
+        return completed.returncode
+    return 1
+'''
+_KEYWORD_ADDED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        return completed.returncode
+    return 1
+'''
+_IMPORT_AND_KEYWORD_ADDED = '''"""Before."""
+
+import os
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=os.O_RDONLY
+        )
+        return completed.returncode
+    return 1
+'''
+_DOCSTRING_AND_KEYWORD_CHANGED = '''"""After."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command and report its exit status."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        return completed.returncode
+    return 1
+'''
+_KEYWORD_ADDED_AND_LITERAL_CHANGED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 6
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        return completed.returncode
+    return 1
+'''
+_KEYWORD_VALUE_CHANGED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(command, timeout=TIMEOUT_SECONDS, check=True)
+        return completed.returncode
+    return 1
+'''
+_KEYWORD_VALUE_TYPE_CHANGED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(command, timeout=TIMEOUT_SECONDS, check=0)
+        return completed.returncode
+    return 1
+'''
+_KEYWORD_REMOVED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(command, timeout=TIMEOUT_SECONDS)
+        return completed.returncode
+    return 1
+'''
+_POSITIONAL_CHANGED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command[:1], timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        return completed.returncode
+    return 1
+'''
+_STATEMENT_ADDED_IN_BODY = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        completed.check_returncode()
+        return completed.returncode
+    return 1
+'''
+_CONDITION_CHANGED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 1:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        return completed.returncode
+    return 1
+'''
+_IMPORT_REMOVED = '''"""Before."""
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, creationflags=0
+        )
+        return completed.returncode
+    return 1
+'''
+_UNPARSEABLE = "def work(:\n    return None\n"
+
+
+def _mechanical_diagnostics(
+    temporary_path: Path, current_source: str, suffix: str = ".py"
+) -> tuple[Diagnostic, ...]:
+    return _pairing_diagnostics(
+        temporary_path,
+        _changed_document(current_source, _MECHANICAL_BEFORE, suffix),
+    )
+
+
+def test_pairing_waives_one_added_keyword_argument(tmp_path: Path) -> None:
+    assert _mechanical_diagnostics(tmp_path, _KEYWORD_ADDED) == ()
+
+
+def test_pairing_waives_an_added_import_beside_an_added_keyword(
+    tmp_path: Path,
+) -> None:
+    assert _mechanical_diagnostics(tmp_path, _IMPORT_AND_KEYWORD_ADDED) == ()
+
+
+def test_pairing_waives_a_docstring_edit_beside_an_added_keyword(
+    tmp_path: Path,
+) -> None:
+    assert _mechanical_diagnostics(tmp_path, _DOCSTRING_AND_KEYWORD_CHANGED) == ()
+
+
+def test_pairing_reports_an_added_keyword_beside_a_changed_literal(
+    tmp_path: Path,
+) -> None:
+    assert (
+        len(_mechanical_diagnostics(tmp_path, _KEYWORD_ADDED_AND_LITERAL_CHANGED)) == 1
+    )
+
+
+def test_pairing_reports_a_changed_keyword_value(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _KEYWORD_VALUE_CHANGED)) == 1
+
+
+def test_pairing_reports_a_keyword_value_that_changed_literal_type(
+    tmp_path: Path,
+) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _KEYWORD_VALUE_TYPE_CHANGED)) == 1
+
+
+def test_pairing_reports_a_removed_keyword(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _KEYWORD_REMOVED)) == 1
+
+
+def test_pairing_reports_a_changed_positional_argument(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _POSITIONAL_CHANGED)) == 1
+
+
+def test_pairing_reports_a_statement_added_inside_a_function(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _STATEMENT_ADDED_IN_BODY)) == 1
+
+
+def test_pairing_reports_a_changed_if_condition(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _CONDITION_CHANGED)) == 1
+
+
+def test_pairing_reports_a_removed_import(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _IMPORT_REMOVED)) == 1
+
+
+def test_pairing_reports_a_non_python_document_with_the_same_shape(
+    tmp_path: Path,
+) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _KEYWORD_ADDED, ".ts")) == 1
+
+
+def test_pairing_reports_unparseable_current_source(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _UNPARSEABLE)) == 1
+
+
+def test_pairing_reports_unparseable_prior_source(tmp_path: Path) -> None:
+    all_diagnostics = _pairing_diagnostics(
+        tmp_path, _changed_document(_KEYWORD_ADDED, _UNPARSEABLE)
+    )
+    assert len(all_diagnostics) == 1
+
+
+def test_pairing_reports_an_added_document_without_prior_text(tmp_path: Path) -> None:
+    added_document = Document(
+        PurePosixPath("src/feature.py"),
+        _KEYWORD_ADDED,
+        None,
+        frozenset({1}),
+        ContentOrigin.REVISION_DIFF,
+    )
+    assert len(_pairing_diagnostics(tmp_path, added_document)) == 1
+
+
+_MAPPING_UNPACKING_ADDED = '''"""Before."""
+
+import subprocess
+
+TIMEOUT_SECONDS = 5
+
+
+def work(command: list[str]) -> int:
+    """Run one command."""
+    if TIMEOUT_SECONDS > 0:
+        completed = subprocess.run(
+            command, timeout=TIMEOUT_SECONDS, check=False, **{"creationflags": 0}
+        )
+        return completed.returncode
+    return 1
+'''
+
+
+def test_pairing_reports_added_mapping_unpacking_on_a_call(tmp_path: Path) -> None:
+    assert len(_mechanical_diagnostics(tmp_path, _MAPPING_UNPACKING_ADDED)) == 1
+_INSTALLER_PRODUCTION_PATHS = (
+    PurePosixPath("packages/claude-dev-env/bin/install-constants.mjs"),
+    PurePosixPath("packages/claude-dev-env/bin/install.mjs"),
+)
+_INSTALLER_SUITE_PATH = PurePosixPath(
+    "packages/claude-dev-env/bin/install.cursor-rules.test.mjs"
+)
+
+
+def test_pairing_accepts_installer_modules_with_the_cursor_rules_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(
+        tmp_path,
+        *(_body_change_at(each_path) for each_path in _INSTALLER_PRODUCTION_PATHS),
+        _body_change_at(_INSTALLER_SUITE_PATH),
+    )
+    assert all_paths == ()
+
+
+_COMMENT_RULES_PRODUCTION_PATH = PurePosixPath(
+    "packages/claude-dev-env/hooks/blocking/code_rules_comments.py"
+)
+_COMMENT_RULES_SUITE_PATH = PurePosixPath(
+    "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_comment_string_awareness.py"
+)
+
+
+def test_pairing_accepts_comment_rules_module_with_one_approved_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(
+        tmp_path,
+        _body_change_at(_COMMENT_RULES_PRODUCTION_PATH),
+        _body_change_at(_COMMENT_RULES_SUITE_PATH),
+    )
+    assert all_paths == ()
+
+
+def test_pairing_rejects_comment_rules_module_without_any_approved_suite(
+    tmp_path: Path,
+) -> None:
+    all_paths = _diagnostic_paths(tmp_path, _body_change_at(_COMMENT_RULES_PRODUCTION_PATH))
+    assert all_paths == (_COMMENT_RULES_PRODUCTION_PATH,)