claude-dev-env 7.4.1 → 7.6.0

package/scripts/tests/test_tracked_secrets.py

@@ -3,7 +3,9 @@
 from __future__ import annotations
 
 import hashlib
+import json
 import sys
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
@@ -12,6 +14,7 @@ from repository_checks.config.constants import (
     CHECK_ID_TRACKED_PERSONAL_DATA,
     FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
 )
 from repository_checks.hook_modules import load_hooks_module
 from repository_checks.tracked_secrets import collect_tracked_secret_findings
@@ -35,6 +38,8 @@ _OTHER_FIXTURE_EMAIL = "other-owner@company.io"
 _OTHER_FIXTURE_HOME_PATH = "C:/Users/realname/notes.txt"
 _FIXTURE_NOTES_RELATIVE_PATH = "src/notes.py"
 _OTHER_NOTES_RELATIVE_PATH = "src/other_notes.py"
+_FROZEN_RELATIVE_PATH = "evidence/manifest.json"
+_STALE_DIGEST = hashlib.sha256(b"different bytes").hexdigest()
 _PII_PREVENTION_CONSTANTS = load_hooks_module(
     "hooks_constants.pii_prevention_constants"
 )
@@ -151,6 +156,80 @@ def test_should_keep_owned_checker_modules_free_of_tracked_secret_findings() ->
     assert collect_tracked_secret_findings(_REPOSITORY_ROOT, all_relative_paths) == []
 
 
+def test_should_skip_every_category_in_a_frozen_file_whose_digest_matches(
+    tmp_path: Path,
+) -> None:
+    """One recorded digest silences the whole file, not one matched value."""
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_frozen_path_exemption_fixture(repository_root, _matching_digest)
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert _pii_categories_for_path(stdout_text, _FROZEN_RELATIVE_PATH) == []
+
+
+def test_should_keep_reporting_a_frozen_file_whose_digest_is_stale(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_frozen_path_exemption_fixture(repository_root, _stale_digest)
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert _pii_categories_for_path(stdout_text, _FROZEN_RELATIVE_PATH) == [
+        _PII_CATEGORY_HOME_PATH,
+        _PII_PREVENTION_CONSTANTS.CATEGORY_SECRET,
+    ]
+
+
+def test_should_exempt_a_frozen_file_named_by_a_windows_tracked_path(
+    tmp_path: Path,
+) -> None:
+    """Git on Windows can hand back backslashes, and the entry records slashes."""
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _write_frozen_path_exemption_fixture(repository_root, _matching_digest)
+    windows_tracked_path = _FROZEN_RELATIVE_PATH.replace("/", "\\")
+    assert (
+        collect_tracked_secret_findings(repository_root, [windows_tracked_path]) == []
+    )
+
+
+def _write_frozen_path_exemption_fixture(
+    repository_root: Path, choose_digest: Callable[[Path], str]
+) -> None:
+    frozen_path = repository_root / _FROZEN_RELATIVE_PATH
+    write_text(
+        frozen_path,
+        f"home = '{_OTHER_FIXTURE_HOME_PATH}'\ntoken = '{_SYNTHETIC_GITHUB_TOKEN}'\n",
+    )
+    write_text(
+        repository_root / "config" / "repository-policy.json",
+        json.dumps(
+            {
+                "version": 1,
+                "path_exemptions": [
+                    {
+                        "path": _FROZEN_RELATIVE_PATH,
+                        "sha256": choose_digest(frozen_path),
+                        "reason": "Frozen evidence file pinned by its consumers",
+                    }
+                ],
+            }
+        ),
+    )
+
+
+def _matching_digest(frozen_path: Path) -> str:
+    return hashlib.sha256(frozen_path.read_bytes()).hexdigest()
+
+
+def _stale_digest(_frozen_path: Path) -> str:
+    return _STALE_DIGEST
+
+
 def _write_exact_exemption_fixture(repository_root: Path) -> None:
     write_text(
         repository_root / _FIXTURE_NOTES_RELATIVE_PATH,

package/scripts/validate_instruction_pairs.py

@@ -9,6 +9,8 @@ import stat
 import subprocess
 from pathlib import Path
 
+from subprocess_window_access import hidden_window_creation_flags
+
 git_directory_name = ".git"
 git_listing_commands = (
     (("git", "ls-files", "--stage", "-z"), True),
@@ -32,6 +34,7 @@ def _read_git_paths_and_modes(
             cwd=repository_root,
             capture_output=True,
             check=True,
+            creationflags=hidden_window_creation_flags(),
         )
         for each_record in completed_process.stdout.split(b"\0"):
             if not each_record:

package/scripts/verify_installable_package.py

@@ -68,6 +68,8 @@ from dev_env_scripts_constants.verify_installable_package_constants import (
     VERIFICATION_PASSED_MESSAGE,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def package_root_path() -> Path:
     """Return the claude-dev-env package root that holds package.json."""
@@ -303,6 +305,7 @@ def run_npm_pack(into_directory: Path, from_package_root: Path) -> Path:
         capture_output=True,
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     tarball_name = _npm_pack_filename_from_json(completed.stdout)
     return into_directory / tarball_name
@@ -439,6 +442,7 @@ def list_git_tracked_paths_under(
         capture_output=True,
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     return frozenset(
         each_line.replace("\\", "/")
@@ -520,6 +524,7 @@ def smoke_check_install_entrypoint(from_package_root: Path) -> str | None:
         capture_output=True,
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode == 0:
         return None

package/hooks/hooks_constants/convergence_branch_constants.py

@@ -1,8 +0,0 @@
-"""Convergence branch naming policy constants.
-
-Shared by destructive_command_blocker convergence-branch exemptions
-"""
-
-ALL_CONVERGENCE_BRANCH_PREFIXES: tuple[str, ...] = ("claude/", "worktree-")
-CONVERGENCE_BRANCH_SUFFIX_PATTERN: str = r"pr-.*-converge$"
-CONVERGENCE_FORCE_PUSH_DETECTION_PATTERN: str = r"\bgit\s+push\b\s+(.*(?:--force|-f)\b.*)"

package/hooks/hooks_constants/destructive_command_environment_constants.py

@@ -1,18 +0,0 @@
-"""Environment keys and values used by destructive-command hooks."""
-
-from __future__ import annotations
-
-ALL_KNOWN_TEMPORARY_ENVIRONMENT_VARIABLE_NAMES: frozenset[str] = frozenset(
-    {
-        "TEMP",
-        "TMP",
-        "TMPDIR",
-        "CLAUDE_JOB_DIR",
-    }
-)
-ALL_TRUTHY_ENV_VALUES: frozenset[str] = frozenset({"1", "true", "yes", "on"})
-DESTRUCTIVE_DENY_MODE_ENV_VAR: str = "CLAUDE_DESTRUCTIVE_DENY_MODE"
-EPHEMERAL_AUTO_ALLOW_DISABLE_ENV_VAR: str = (
-    "CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW"
-)
-GH_REDIRECT_ACTIVE_ENV_VAR: str = "CLAUDE_GH_REDIRECT_ACTIVE"

package/hooks/hooks_constants/test_text_stripping.py

@@ -1,39 +0,0 @@
-"""Tests for the shared strip_code_and_quotes helper."""
-
-import pathlib
-import sys
-
-_HOOKS_ROOT = pathlib.Path(__file__).resolve().parent.parent
-if str(_HOOKS_ROOT) not in sys.path:
-    sys.path.insert(0, str(_HOOKS_ROOT))
-
-from hooks_constants.text_stripping import strip_code_and_quotes
-
-
-def test_removes_fenced_code_block() -> None:
-    text = "before\n```python\nshould I run this?\n```\nafter"
-    stripped = strip_code_and_quotes(text)
-    assert "should I run this?" not in stripped
-    assert "before" in stripped
-    assert "after" in stripped
-
-
-def test_removes_inline_code_span() -> None:
-    text = "the function `would you like` is named oddly"
-    stripped = strip_code_and_quotes(text)
-    assert "would you like" not in stripped
-    assert "the function" in stripped
-    assert "is named oddly" in stripped
-
-
-def test_removes_leading_blockquote_lines() -> None:
-    text = "real line\n> should I proceed?\nfinal line"
-    stripped = strip_code_and_quotes(text)
-    assert "should I proceed?" not in stripped
-    assert "real line" in stripped
-    assert "final line" in stripped
-
-
-def test_leaves_plain_prose_unchanged() -> None:
-    text = "This sentence carries no code or quotes."
-    assert strip_code_and_quotes(text) == text

package/hooks/hooks_constants/text_stripping.py

@@ -1,36 +0,0 @@
-"""Shared text-stripping helper for the Stop-hook prose blockers.
-
-Several Stop hooks judge the prose of an assistant message and must ignore
-fenced code blocks, inline code spans, and leading blockquotes so a phrase that
-appears only inside code or a quote never trips the detector. The stripping
-logic is identical across those blockers, so it lives here once and is imported
-from each.
-"""
-
-from __future__ import annotations
-
-import re
-
-__all__ = [
-    "strip_code_and_quotes",
-]
-
-CODE_BLOCK_PATTERN = re.compile(r"```[\s\S]*?```", re.MULTILINE)
-INLINE_CODE_PATTERN = re.compile(r"`[^`]+`")
-QUOTED_BLOCK_PATTERN = re.compile(r"^>.*$", re.MULTILINE)
-
-
-def strip_code_and_quotes(text: str) -> str:
-    """Remove fenced code blocks, inline code, and blockquotes from prose.
-
-    Args:
-        text: The raw assistant message to clean of code and quoted lines.
-
-    Returns:
-        The text with every fenced code block, inline code span, and leading
-        blockquote line removed, so only the prose a reader sees remains.
-    """
-    text = CODE_BLOCK_PATTERN.sub("", text)
-    text = INLINE_CODE_PATTERN.sub("", text)
-    text = QUOTED_BLOCK_PATTERN.sub("", text)
-    return text

package/scripts/automatic_advisory/window_flags.py

@@ -1,41 +0,0 @@
-"""Windows creation flags that hide the advisory poller and its children.
-
-A poller with no console makes each git call and each check open a fresh
-console window. A hidden console is inherited by descendants, so those
-children stay off the screen.
-"""
-
-from __future__ import annotations
-
-import subprocess
-import sys
-
-from .config.constants import (
-    CREATE_NEW_PROCESS_GROUP_ATTRIBUTE,
-    CREATE_NO_WINDOW_ATTRIBUTE,
-    WINDOWS_PLATFORM,
-)
-
-
-def hidden_window_creation_flags() -> int:
-    """Return the flag that runs a Windows child without a visible console.
-
-    Returns:
-        The hidden-console flag on Windows, zero elsewhere.
-    """
-    if sys.platform != WINDOWS_PLATFORM:
-        return 0
-    return getattr(subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0)
-
-
-def detached_poller_creation_flags() -> int:
-    """Return the flags for the long-running poller on Windows.
-
-    Returns:
-        A new process group plus a hidden console on Windows, zero elsewhere.
-    """
-    if sys.platform != WINDOWS_PLATFORM:
-        return 0
-    return getattr(subprocess, CREATE_NEW_PROCESS_GROUP_ATTRIBUTE, 0) | getattr(
-        subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0
-    )

package/scripts/repository_checks/config/email_exemptions.py

@@ -1,10 +0,0 @@
-"""Repository public-email exception schema."""
-
-import re
-
-CONFIG_RELATIVE_PATH = "config/repository-policy.json"
-DIGEST_PATTERN = re.compile(r"[0-9a-f]{64}")
-FORBIDDEN_PATH_CHARACTERS = frozenset("\\:*?[]")
-ALL_ENTRY_FIELDS = frozenset({"path", "sha256", "reason"})
-ALL_FORBIDDEN_PATH_SEGMENTS = frozenset({"", ".", ".."})
-FIRST_PRINTABLE_CODEPOINT = 32