claude-dev-env 7.5.0 → 7.6.0

package/scripts/tests/test_tracked_secrets.py

@@ -3,7 +3,9 @@
 from __future__ import annotations
 
 import hashlib
+import json
 import sys
+from collections.abc import Callable
 from pathlib import Path
 
 import pytest
@@ -12,6 +14,7 @@ from repository_checks.config.constants import (
     CHECK_ID_TRACKED_PERSONAL_DATA,
     FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
 )
 from repository_checks.hook_modules import load_hooks_module
 from repository_checks.tracked_secrets import collect_tracked_secret_findings
@@ -35,6 +38,8 @@ _OTHER_FIXTURE_EMAIL = "other-owner@company.io"
 _OTHER_FIXTURE_HOME_PATH = "C:/Users/realname/notes.txt"
 _FIXTURE_NOTES_RELATIVE_PATH = "src/notes.py"
 _OTHER_NOTES_RELATIVE_PATH = "src/other_notes.py"
+_FROZEN_RELATIVE_PATH = "evidence/manifest.json"
+_STALE_DIGEST = hashlib.sha256(b"different bytes").hexdigest()
 _PII_PREVENTION_CONSTANTS = load_hooks_module(
     "hooks_constants.pii_prevention_constants"
 )
@@ -151,6 +156,80 @@ def test_should_keep_owned_checker_modules_free_of_tracked_secret_findings() ->
     assert collect_tracked_secret_findings(_REPOSITORY_ROOT, all_relative_paths) == []
 
 
+def test_should_skip_every_category_in_a_frozen_file_whose_digest_matches(
+    tmp_path: Path,
+) -> None:
+    """One recorded digest silences the whole file, not one matched value."""
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_frozen_path_exemption_fixture(repository_root, _matching_digest)
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert _pii_categories_for_path(stdout_text, _FROZEN_RELATIVE_PATH) == []
+
+
+def test_should_keep_reporting_a_frozen_file_whose_digest_is_stale(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    _write_frozen_path_exemption_fixture(repository_root, _stale_digest)
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert _pii_categories_for_path(stdout_text, _FROZEN_RELATIVE_PATH) == [
+        _PII_CATEGORY_HOME_PATH,
+        _PII_PREVENTION_CONSTANTS.CATEGORY_SECRET,
+    ]
+
+
+def test_should_exempt_a_frozen_file_named_by_a_windows_tracked_path(
+    tmp_path: Path,
+) -> None:
+    """Git on Windows can hand back backslashes, and the entry records slashes."""
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _write_frozen_path_exemption_fixture(repository_root, _matching_digest)
+    windows_tracked_path = _FROZEN_RELATIVE_PATH.replace("/", "\\")
+    assert (
+        collect_tracked_secret_findings(repository_root, [windows_tracked_path]) == []
+    )
+
+
+def _write_frozen_path_exemption_fixture(
+    repository_root: Path, choose_digest: Callable[[Path], str]
+) -> None:
+    frozen_path = repository_root / _FROZEN_RELATIVE_PATH
+    write_text(
+        frozen_path,
+        f"home = '{_OTHER_FIXTURE_HOME_PATH}'\ntoken = '{_SYNTHETIC_GITHUB_TOKEN}'\n",
+    )
+    write_text(
+        repository_root / "config" / "repository-policy.json",
+        json.dumps(
+            {
+                "version": 1,
+                "path_exemptions": [
+                    {
+                        "path": _FROZEN_RELATIVE_PATH,
+                        "sha256": choose_digest(frozen_path),
+                        "reason": "Frozen evidence file pinned by its consumers",
+                    }
+                ],
+            }
+        ),
+    )
+
+
+def _matching_digest(frozen_path: Path) -> str:
+    return hashlib.sha256(frozen_path.read_bytes()).hexdigest()
+
+
+def _stale_digest(_frozen_path: Path) -> str:
+    return _STALE_DIGEST
+
+
 def _write_exact_exemption_fixture(repository_root: Path) -> None:
     write_text(
         repository_root / _FIXTURE_NOTES_RELATIVE_PATH,

package/scripts/validate_instruction_pairs.py

@@ -9,6 +9,8 @@ import stat
 import subprocess
 from pathlib import Path
 
+from subprocess_window_access import hidden_window_creation_flags
+
 git_directory_name = ".git"
 git_listing_commands = (
     (("git", "ls-files", "--stage", "-z"), True),
@@ -32,6 +34,7 @@ def _read_git_paths_and_modes(
             cwd=repository_root,
             capture_output=True,
             check=True,
+            creationflags=hidden_window_creation_flags(),
         )
         for each_record in completed_process.stdout.split(b"\0"):
             if not each_record:

package/scripts/verify_installable_package.py

@@ -68,6 +68,8 @@ from dev_env_scripts_constants.verify_installable_package_constants import (
     VERIFICATION_PASSED_MESSAGE,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def package_root_path() -> Path:
     """Return the claude-dev-env package root that holds package.json."""
@@ -303,6 +305,7 @@ def run_npm_pack(into_directory: Path, from_package_root: Path) -> Path:
         capture_output=True,
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     tarball_name = _npm_pack_filename_from_json(completed.stdout)
     return into_directory / tarball_name
@@ -439,6 +442,7 @@ def list_git_tracked_paths_under(
         capture_output=True,
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     return frozenset(
         each_line.replace("\\", "/")
@@ -520,6 +524,7 @@ def smoke_check_install_entrypoint(from_package_root: Path) -> str | None:
         capture_output=True,
         text=True,
         encoding=UTF8_ENCODING,
+        creationflags=hidden_window_creation_flags(),
     )
     if completed.returncode == 0:
         return None

package/scripts/automatic_advisory/window_flags.py

@@ -1,41 +0,0 @@
-"""Windows creation flags that hide the advisory poller and its children.
-
-A poller with no console makes each git call and each check open a fresh
-console window. A hidden console is inherited by descendants, so those
-children stay off the screen.
-"""
-
-from __future__ import annotations
-
-import subprocess
-import sys
-
-from .config.constants import (
-    CREATE_NEW_PROCESS_GROUP_ATTRIBUTE,
-    CREATE_NO_WINDOW_ATTRIBUTE,
-    WINDOWS_PLATFORM,
-)
-
-
-def hidden_window_creation_flags() -> int:
-    """Return the flag that runs a Windows child without a visible console.
-
-    Returns:
-        The hidden-console flag on Windows, zero elsewhere.
-    """
-    if sys.platform != WINDOWS_PLATFORM:
-        return 0
-    return getattr(subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0)
-
-
-def detached_poller_creation_flags() -> int:
-    """Return the flags for the long-running poller on Windows.
-
-    Returns:
-        A new process group plus a hidden console on Windows, zero elsewhere.
-    """
-    if sys.platform != WINDOWS_PLATFORM:
-        return 0
-    return getattr(subprocess, CREATE_NEW_PROCESS_GROUP_ATTRIBUTE, 0) | getattr(
-        subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0
-    )

package/scripts/repository_checks/config/email_exemptions.py

@@ -1,10 +0,0 @@
-"""Repository public-email exception schema."""
-
-import re
-
-CONFIG_RELATIVE_PATH = "config/repository-policy.json"
-DIGEST_PATTERN = re.compile(r"[0-9a-f]{64}")
-FORBIDDEN_PATH_CHARACTERS = frozenset("\\:*?[]")
-ALL_ENTRY_FIELDS = frozenset({"path", "sha256", "reason"})
-ALL_FORBIDDEN_PATH_SEGMENTS = frozenset({"", ".", ".."})
-FIRST_PRINTABLE_CODEPOINT = 32