claude-dev-env 7.5.0 → 7.6.0

package/scripts/tests/test_path_exemptions.py

@@ -0,0 +1,164 @@
+"""Frozen-file path exceptions preserve every other scanner finding."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.path_exemptions import load_path_exemptions
+from repository_checks.tracked_secrets import collect_tracked_secret_findings
+
+FROZEN_RELATIVE_PATH = "evidence/manifest.json"
+OTHER_RELATIVE_PATH = "evidence/other.json"
+HOME_PATH = "C:/Users/fixture-owner/source-document.md"
+FROZEN_CONTENT = f'{{"source": "{HOME_PATH}"}}\n'
+STALE_DIGEST = hashlib.sha256(b"different bytes").hexdigest()
+
+
+def _write_config(root: Path, document: dict[str, object]) -> None:
+    directory = root / "config"
+    directory.mkdir(exist_ok=True)
+    (directory / "repository-policy.json").write_text(
+        json.dumps(document), encoding="utf-8"
+    )
+
+
+def _write_frozen_file(root: Path, relative_path: str) -> str:
+    file_path = root / relative_path
+    file_path.parent.mkdir(parents=True, exist_ok=True)
+    file_path.write_text(FROZEN_CONTENT, encoding="utf-8")
+    return hashlib.sha256(file_path.read_bytes()).hexdigest()
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": FROZEN_RELATIVE_PATH,
+        "sha256": STALE_DIGEST,
+        "reason": "Frozen evidence file pinned by its consumers",
+        **changes,
+    }
+
+
+def test_matching_digest_removes_every_finding(tmp_path: Path) -> None:
+    digest = _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(sha256=digest)]})
+    assert collect_tracked_secret_findings(tmp_path, [FROZEN_RELATIVE_PATH]) == []
+
+
+def test_stale_digest_keeps_reporting_the_path(tmp_path: Path) -> None:
+    _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry()]})
+    findings = collect_tracked_secret_findings(tmp_path, [FROZEN_RELATIVE_PATH])
+    assert [finding.relative_path for finding in findings] == [FROZEN_RELATIVE_PATH]
+    assert all(finding.message.startswith("[home-path]") for finding in findings)
+
+
+def test_unlisted_path_keeps_reporting(tmp_path: Path) -> None:
+    digest = _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_frozen_file(tmp_path, OTHER_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(sha256=digest)]})
+    findings = collect_tracked_secret_findings(
+        tmp_path, [FROZEN_RELATIVE_PATH, OTHER_RELATIVE_PATH]
+    )
+    assert [finding.relative_path for finding in findings] == [OTHER_RELATIVE_PATH]
+
+
+def test_exempt_path_stays_out_of_the_email_exemption_identities(
+    tmp_path: Path,
+) -> None:
+    digest = _write_frozen_file(tmp_path, FROZEN_RELATIVE_PATH)
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(sha256=digest)]})
+    assert load_path_exemptions(tmp_path) == frozenset({(FROZEN_RELATIVE_PATH, digest)})
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/manifest.json",
+        "C:/manifest.json",
+        "../manifest.json",
+        "evidence/../manifest.json",
+        "*.json",
+        "evidence/?.json",
+        "evidence/[a].json",
+        "evidence\\manifest.json",
+        "evidence//manifest.json",
+        "./manifest.json",
+        "",
+    ],
+)
+def test_rejects_nonliteral_or_nonrelative_paths(tmp_path: Path, path: str) -> None:
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry(path=path)]})
+    with pytest.raises(ValueError):
+        load_path_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "entry",
+    [
+        None,
+        {},
+        _entry(reason=" "),
+        _entry(sha256="f" * 63),
+        _entry(sha256="z" * 64),
+        _entry(category="secret"),
+    ],
+)
+def test_rejects_invalid_entries(tmp_path: Path, entry: object) -> None:
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [entry]})
+    with pytest.raises(ValueError):
+        load_path_exemptions(tmp_path)
+
+
+def test_rejects_duplicate_entries(tmp_path: Path) -> None:
+    _write_config(
+        tmp_path,
+        {
+            "version": 1,
+            "path_exemptions": [_entry(), _entry(reason="Another explanation")],
+        },
+    )
+    with pytest.raises(ValueError):
+        load_path_exemptions(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        "{",
+        "[]",
+        '{"version":true,"path_exemptions":[]}',
+        '{"version":1,"path_exemptions":{}}',
+        '{"version":1,"path_exemptions":[],"extra":0}',
+        '{"version":1,"path_exemptions":[],"path_exemptions":[]}',
+    ],
+)
+def test_malformed_config_stops_scanning(tmp_path: Path, content: str) -> None:
+    (tmp_path / "config").mkdir()
+    (tmp_path / "config" / "repository-policy.json").write_text(
+        content, encoding="utf-8"
+    )
+    with pytest.raises(ValueError):
+        collect_tracked_secret_findings(tmp_path, [])
+
+
+@pytest.mark.parametrize(
+    "document",
+    [
+        {"version": 1},
+        {"version": 1, "email_exemptions": []},
+        {"version": 1, "path_exemptions": []},
+        {"version": 1, "email_exemptions": [], "path_exemptions": []},
+    ],
+)
+def test_documents_missing_one_list_still_load(
+    tmp_path: Path, document: dict[str, object]
+) -> None:
+    _write_config(tmp_path, document)
+    assert load_path_exemptions(tmp_path) == frozenset()
+
+
+def test_missing_config_has_no_exemptions(tmp_path: Path) -> None:
+    assert load_path_exemptions(tmp_path) == frozenset()

package/scripts/tests/test_policy_document.py

@@ -0,0 +1,104 @@
+"""The shared policy-document reader and entry validator."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+
+import pytest
+from repository_checks.policy_document import (
+    entry_path_and_digest,
+    read_policy_entries,
+)
+
+RELATIVE_PATH = "evidence/manifest.json"
+DIGEST = hashlib.sha256(b"frozen bytes").hexdigest()
+CONFIG_RELATIVE_PATH = "config/repository-policy.json"
+
+
+def _write_config(root: Path, document: object) -> None:
+    config_path = root / CONFIG_RELATIVE_PATH
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    config_path.write_text(json.dumps(document), encoding="utf-8")
+
+
+def _entry(**changes: object) -> dict[str, object]:
+    return {
+        "path": RELATIVE_PATH,
+        "sha256": DIGEST,
+        "reason": "Frozen evidence file pinned by its consumers",
+        **changes,
+    }
+
+
+def test_reader_returns_the_recorded_entries_without_validating_them(
+    tmp_path: Path,
+) -> None:
+    """The reader validates the document, and the caller validates each entry."""
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [{"anything": 1}]})
+    assert read_policy_entries(tmp_path, "path_exemptions") == [{"anything": 1}]
+
+
+def test_reader_returns_no_entries_for_a_field_the_document_omits(
+    tmp_path: Path,
+) -> None:
+    _write_config(tmp_path, {"version": 1, "path_exemptions": [_entry()]})
+    assert read_policy_entries(tmp_path, "email_exemptions") == []
+
+
+def test_reader_rejects_a_configuration_symlinked_outside_the_repository(
+    tmp_path: Path,
+) -> None:
+    outside_path = tmp_path / "outside-policy.json"
+    outside_path.write_text(json.dumps({"version": 1}), encoding="utf-8")
+    repository_root = tmp_path / "repo"
+    (repository_root / "config").mkdir(parents=True)
+    (repository_root / CONFIG_RELATIVE_PATH).symlink_to(outside_path)
+    with pytest.raises(ValueError) as rejection:
+        read_policy_entries(repository_root, "path_exemptions")
+    assert (
+        str(rejection.value)
+        == "Repository policy configuration must remain inside the repository"
+    )
+
+
+def test_entry_validator_returns_the_path_and_digest_without_the_reason() -> None:
+    assert entry_path_and_digest(_entry(), "Path exemption") == (
+        RELATIVE_PATH,
+        DIGEST,
+    )
+
+
+@pytest.mark.parametrize(
+    ("entry", "expected_message"),
+    [
+        ({}, "Path exemptions require path, sha256, and reason"),
+        (_entry(path=1), "Path exemption path must name one repository file"),
+        (
+            _entry(path="../manifest.json"),
+            "Path exemption path must be a literal relative file path",
+        ),
+        (
+            _entry(sha256="F" * 64),
+            "Path exemption sha256 must contain 64 lowercase hex digits",
+        ),
+        (
+            _entry(reason=" "),
+            "Path exemption reason must explain why the exception is owned",
+        ),
+    ],
+)
+def test_entry_validator_names_the_subject_in_every_rejection(
+    entry: object, expected_message: str
+) -> None:
+    """One validator serves both families, so each message names its subject."""
+    with pytest.raises(ValueError) as rejection:
+        entry_path_and_digest(entry, "Path exemption")
+    assert str(rejection.value) == expected_message
+
+
+def test_entry_validator_uses_the_subject_it_is_given() -> None:
+    with pytest.raises(ValueError) as rejection:
+        entry_path_and_digest({}, "Email exemption")
+    assert str(rejection.value) == "Email exemptions require path, sha256, and reason"

package/scripts/tests/test_policy_lint_rules_function_length_scope.py

@@ -0,0 +1,101 @@
+"""Function-length diagnostics report only functions the change is responsible for.
+
+The code-rule adapter runs the enforcer with ``defer_scope_to_caller`` set, so
+the enforcer hands back every over-long function in the document and the caller
+owns the scope decision. The engine's own changed-line filter keys on a
+diagnostic's start line, and a function-length message carries no ``Line N:``
+prefix, so before this scope pass a pre-existing long function blocked any
+change that touched its file.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapters
+from policy_lint.model import ContentOrigin, Diagnostic, Document
+from policy_lint.selection import _changed_lines
+
+FUNCTION_LENGTH_MESSAGE_FRAGMENT = "exceeds blocking threshold"
+PRODUCTION_RELATIVE_PATH = "packages/claude-dev-env/scripts/sample_long_module.py"
+OVER_THRESHOLD_BODY_LINE_COUNT = 70
+UNDER_THRESHOLD_BODY_LINE_COUNT = 40
+REPOSITORY_ROOT = Path(__file__).resolve().parents[4]
+
+
+def _counting_function_source(function_name: str, body_line_count: int) -> str:
+    all_body_lines = [
+        f"    running_total = running_total + {each_index}"
+        for each_index in range(body_line_count)
+    ]
+    signature_lines = [f"def {function_name}(running_total: int) -> int:"]
+    return (
+        "\n".join(signature_lines + all_body_lines + ["    return running_total"])
+        + "\n"
+    )
+
+
+def _messages_for_document(document: Document) -> tuple[str, ...]:
+    all_diagnostics: tuple[Diagnostic, ...] = adapters.code_rule_diagnostics(
+        document, REPOSITORY_ROOT
+    )
+    return tuple(
+        each_diagnostic.message
+        for each_diagnostic in all_diagnostics
+        if FUNCTION_LENGTH_MESSAGE_FRAGMENT in each_diagnostic.message
+    )
+
+
+def _function_length_messages(
+    prior_text: str | None, current_text: str
+) -> tuple[str, ...]:
+    return _messages_for_document(
+        Document(
+            PurePosixPath(PRODUCTION_RELATIVE_PATH),
+            current_text,
+            prior_text,
+            _changed_lines(prior_text, current_text),
+            ContentOrigin.REVISION_DIFF,
+        )
+    )
+
+
+def test_should_leave_an_untouched_long_function_alone() -> None:
+    prior_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = f"import os\nimport sys\n{prior_text}"
+    assert _function_length_messages(prior_text, current_text) == ()
+
+
+def test_should_report_a_function_the_change_grew_past_the_threshold() -> None:
+    prior_text = _counting_function_source("main", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(prior_text, current_text) != ()
+
+
+def test_should_report_an_over_long_function_the_change_adds() -> None:
+    prior_text = _counting_function_source("existing", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    added_text = _counting_function_source("added", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(prior_text, f"{prior_text}\n{added_text}") != ()
+
+
+def test_should_report_every_over_long_function_in_a_wholly_new_document() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(None, current_text) != ()
+
+
+def test_should_leave_a_long_function_alone_when_the_change_only_deletes() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    prior_text = f"REMOVED_CONSTANT = 1\n{current_text}"
+    assert _function_length_messages(prior_text, current_text) == ()
+
+
+def test_should_report_a_long_function_when_the_selection_names_no_changed_lines() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    document = Document(
+        PurePosixPath(PRODUCTION_RELATIVE_PATH),
+        current_text,
+        None,
+        None,
+        ContentOrigin.WORKTREE,
+    )
+    assert _messages_for_document(document) != ()