claude-dev-env 7.7.1 → 8.0.0

package/scripts/Sync-RepoMain.ps1

@@ -11,7 +11,10 @@
   - Only runs when the checked-out branch is the named branch
   - Only runs when there are no tracked changes (untracked files are fine),
     unless -StashDirty is passed
-  - Uses merge --ff-only only (never force, never hard reset, never clean)
+  - Uses merge --ff-only (never force, never hard reset, never clean)
+  - When the fast-forward fails because the files were already copied in,
+    moves HEAD with a mixed reset, which writes no files. It keeps that move
+    only when every file the remote changed now matches the remote
   - Logs and exits non-zero on skip, diverge, or failure so a Task Scheduler
     history row can surface a problem instead of a silent no-op
 
@@ -128,6 +131,64 @@ function Invoke-GitOrExit {
     return $result.Output
 }
 
+function Get-NulSeparatedPaths {
+    param(
+        [Parameter(Mandatory)]
+        [AllowEmptyString()]
+        [string]$Output
+    )
+    return @($Output -split "`0" | Where-Object { $_ })
+}
+
+function Invoke-AdoptCopiedTree {
+    <#
+      Handles a mirror whose files are refreshed by copy while its HEAD stays
+      behind. The fast-forward then refuses to overwrite the copied files,
+      even though they already hold the remote content.
+
+      A mixed reset moves HEAD and the index to the remote tip and writes no
+      files. If any file the remote changed still differs afterwards, the
+      reset goes back to the old tip, so the tree ends as it started.
+    #>
+    param(
+        [Parameter(Mandatory)]
+        [string]$LocalTip,
+        [Parameter(Mandatory)]
+        [string]$RemoteRef
+    )
+    $stagedResult = Invoke-Git -Arguments @('diff', '--cached', '--quiet')
+    if ($stagedResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message 'adopt skipped: the index holds staged changes'
+        return $false
+    }
+    $changedResult = Invoke-Git -Arguments @('diff', '--name-only', '--no-renames', '-z', $LocalTip, $RemoteRef)
+    if ($changedResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "adopt skipped: cannot list remote changes: $($changedResult.Output)"
+        return $false
+    }
+    $allRemoteChangedPaths = [System.Collections.Generic.HashSet[string]]::new([string[]](Get-NulSeparatedPaths -Output $changedResult.Output))
+
+    $resetResult = Invoke-Git -Arguments @('reset', '-q', $RemoteRef)
+    if ($resetResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "adopt skipped: mixed reset failed: $($resetResult.Output)"
+        return $false
+    }
+    $differResult = Invoke-Git -Arguments @('diff', '--name-only', '--no-renames', '-z')
+    $allMismatchedPaths = @(Get-NulSeparatedPaths -Output $differResult.Output | Where-Object { $allRemoteChangedPaths.Contains($_) })
+    if ($differResult.ExitCode -eq 0 -and $allMismatchedPaths.Count -eq 0) {
+        return $true
+    }
+
+    $revertResult = Invoke-Git -Arguments @('reset', '-q', $LocalTip)
+    if ($revertResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "adopt revert to $LocalTip failed; HEAD is at $RemoteRef with no file changed: $($revertResult.Output)"
+        return $false
+    }
+    $shownPaths = ($allMismatchedPaths | Select-Object -First 20) -join '; '
+    Write-SyncLog -Level 'ERROR' -Message "adopt refused: $($allMismatchedPaths.Count) file(s) the remote changed differ from it; HEAD kept at ${LocalTip}: $shownPaths"
+    return $false
+}
+
 try {
     if (-not (Test-Path -LiteralPath $RepoPath)) {
         Write-SyncLog -Level 'ERROR' -Message "repo path missing: $RepoPath"
@@ -194,14 +255,18 @@ try {
         Write-SyncLog -Level 'ERROR' -Message "merge --ff-only failed: $($mergeResult.Output)"
         if ($didStash) {
             $popResult = Invoke-Git -Arguments @('stash', 'pop')
-            if ($popResult.ExitCode -eq 0) {
-                Write-SyncLog -Level 'OK' -Message "restored the stashed edits to the working tree after the failed fast-forward"
-            }
-            else {
+            if ($popResult.ExitCode -ne 0) {
                 Write-SyncLog -Level 'ERROR' -Message ("stash pop failed after the failed fast-forward; the edits are still stashed as '" + $stashMessage + "' — recover them with git stash list and git stash pop: " + $popResult.Output)
+                exit 1
             }
+            Write-SyncLog -Level 'OK' -Message "restored the stashed edits to the working tree after the failed fast-forward"
         }
-        exit 1
+        if (-not (Invoke-AdoptCopiedTree -LocalTip $localTip -RemoteRef "$Remote/$Branch")) {
+            exit 1
+        }
+        $subject = Get-GitDecoration -Arguments @('log', '-1', '--format=%h %s') -Placeholder '<subject unavailable>'
+        Write-SyncLog -Level 'OK' -Message "$Branch $localTip -> $remoteTip adopted (files already matched) | $subject"
+        exit 0
     }
 
     $subject = Get-GitDecoration -Arguments @('log', '-1', '--format=%h %s') -Placeholder '<subject unavailable>'

package/scripts/policy_lint/adapter_detectors.py

@@ -91,31 +91,137 @@ def _messages_for_validator_outcomes(
     )
 
 
+def _validator_messages_for_text(
+    document: Document,
+    absolute_path: Path,
+    text: str,
+    validator_module: ModuleType,
+) -> tuple[str, ...]:
+    all_validator_outcomes = validator_module.validate_proposed_file(
+        absolute_path.as_posix(),
+        text,
+        config_source_path=absolute_path,
+        include_ruff=False,
+        excluded_validator_names=constants.ALL_OVERLAPPING_VALIDATOR_NAMES,
+    )
+    return _messages_for_validator_outcomes(document, all_validator_outcomes)
+
+
+def _message_body(message: str) -> str:
+    _head, separator, body = message.partition(
+        constants.VALIDATOR_MESSAGE_PREFIX_SEPARATOR
+    )
+    return body if separator and body else message
+
+
+def _message_identity(message: str) -> str:
+    return constants.VALIDATOR_MESSAGE_DIGIT_PATTERN.sub(
+        constants.VALIDATOR_MESSAGE_DIGIT_PLACEHOLDER, _message_body(message)
+    )
+
+
+def _all_measured_sizes(message: str) -> tuple[int, ...]:
+    return tuple(
+        int(each_digit_run)
+        for each_digit_run in constants.VALIDATOR_MESSAGE_DIGIT_PATTERN.findall(
+            _message_body(message)
+        )
+    )
+
+
+def _has_grown_since(message: str, prior_message: str) -> bool:
+    return any(
+        each_size > each_prior_size
+        for each_size, each_prior_size in zip(
+            _all_measured_sizes(message), _all_measured_sizes(prior_message)
+        )
+    )
+
+
+def _prior_messages_by_identity(
+    all_prior_messages: tuple[str, ...],
+) -> dict[str, list[str]]:
+    all_prior_by_identity: dict[str, list[str]] = {}
+    for each_prior_message in all_prior_messages:
+        all_prior_by_identity.setdefault(
+            _message_identity(each_prior_message), []
+        ).append(each_prior_message)
+    return all_prior_by_identity
+
+
+def _is_introduced_message(
+    message: str, all_prior_by_identity: dict[str, list[str]]
+) -> bool:
+    all_matches = all_prior_by_identity.get(_message_identity(message))
+    if not all_matches:
+        return True
+    return _has_grown_since(message, all_matches.pop())
+
+
+def _messages_introduced_by_the_change(
+    all_candidate_messages: tuple[str, ...],
+    all_prior_messages: tuple[str, ...],
+) -> tuple[str, ...]:
+    """Keep the messages the prior text did not already carry.
+
+    ::
+
+        prior: Function 'main' is 47 lines (max 30)
+        now:   Function 'main' is 47 lines (max 30)   -> dropped, untouched debt
+        now:   Function 'main' is 61 lines (max 30)   -> kept, the change grew it
+        now:   Function 'added' is 47 lines (max 30)  -> kept, a new breach
+
+    A message keeps its identity when it moves down the file or its measured
+    size falls, so only a new breach or a worse one survives. Each prior message
+    covers one candidate.
+
+    Args:
+        all_candidate_messages: Messages the post-edit text produced.
+        all_prior_messages: Messages the prior text produced.
+
+    Returns:
+        The messages this change is answerable for.
+    """
+    all_prior_by_identity = _prior_messages_by_identity(all_prior_messages)
+    return tuple(
+        each_message
+        for each_message in all_candidate_messages
+        if _is_introduced_message(each_message, all_prior_by_identity)
+    )
+
+
 def validator_diagnostics(
     document: Document,
     repository_root: Path,
     load_module: adapter_support.HookModuleLoader,
 ) -> tuple[Diagnostic, ...]:
-    """Run the fast validator set on one document.
+    """Run the fast validator set on one document, scoped to the change.
+
+    A module already over the file-length cap reported that breach on every edit
+    it received, so a one-line change failed on debt it did not create. Grading
+    the prior text the same way and subtracting leaves the breaches this change
+    introduced or made worse.
 
     Args:
-        document: Current source text and path.
+        document: Current source text, prior text, and path.
         repository_root: Request repository root for configuration resolution.
         load_module: Hook module loader.
 
     Returns:
-        Path-normalized diagnostics for failed validators.
+        Path-normalized diagnostics for the failures this change is answerable for.
     """
     absolute_path = adapter_support._document_path(repository_root, document)
     validator_module = load_module("validators.run_all_validators")
-    all_validator_outcomes = validator_module.validate_proposed_file(
-        absolute_path.as_posix(),
-        document.text,
-        config_source_path=absolute_path,
-        include_ruff=False,
-        excluded_validator_names=constants.ALL_OVERLAPPING_VALIDATOR_NAMES,
+    all_messages = _validator_messages_for_text(
+        document, absolute_path, document.text, validator_module
     )
-    all_messages = _messages_for_validator_outcomes(document, all_validator_outcomes)
+    if document.prior_text is not None:
+        all_prior_messages = _validator_messages_for_text(
+            document, absolute_path, document.prior_text, validator_module
+        )
+        all_messages = _messages_introduced_by_the_change(
+            all_messages, all_prior_messages
+        )
     return adapter_support._diagnostics_for_messages(document, "validators", all_messages)
 
 

package/scripts/policy_lint/config/approved_test_pairs.py

@@ -30,6 +30,18 @@ APPROVED_TEST_PATHS_BY_PRODUCTION_PATH: dict[
             ),
         }
     ),
+    PurePosixPath(
+        "packages/claude-dev-env/hooks/blocking/code_rules_enforcer.py"
+    ): frozenset(
+        {
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_dispatch_wiring.py"
+            ),
+            PurePosixPath(
+                "packages/claude-dev-env/hooks/blocking/test_code_rules_enforcer_cap_meta.py"
+            ),
+        }
+    ),
     PurePosixPath(
         "packages/claude-dev-env/hooks/git-hooks/verification_notice_context.py"
     ): frozenset(

package/scripts/policy_lint/config/constants.py

@@ -72,6 +72,9 @@ FAST_SAVE_VALIDATORS_STEM = "fast_save_validators"
 ALL_OVERLAPPING_VALIDATOR_NAMES = frozenset(
     {"Python Style", "Magic Values", "Type Safety", "Test Safety", "React"}
 )
+VALIDATOR_MESSAGE_PREFIX_SEPARATOR = ": "
+VALIDATOR_MESSAGE_DIGIT_PATTERN = re.compile(r"\d+")
+VALIDATOR_MESSAGE_DIGIT_PLACEHOLDER = "#"
 ALL_PR_LOOP_SCRIPTS_PATH_SEGMENTS = ("_shared", "pr-loop", "scripts")
 TERMINOLOGY_SWEEP_MODULE_NAME = "terminology_sweep"
 TERMINOLOGY_SWEEP_RULE_ID = "terminology-sweep"

package/scripts/tests/Sync-RepoMain.Tests.ps1

@@ -0,0 +1,108 @@
+Set-StrictMode -Version Latest
+
+BeforeAll {
+    $scriptUnderTest = Join-Path (Split-Path -Parent $PSScriptRoot) 'Sync-RepoMain.ps1'
+
+    function Invoke-TestGit {
+        param(
+            [string]$RepoPath,
+            [string[]]$Arguments
+        )
+        $output = & git -C $RepoPath -c user.name=tester -c user.email=tester@example.com -c core.autocrlf=false @Arguments 2>&1
+        if ($LASTEXITCODE -ne 0) {
+            throw "git $($Arguments -join ' ') failed: $output"
+        }
+        return ($output | Out-String).Trim()
+    }
+
+    function Write-TestFile {
+        param(
+            [string]$RepoPath,
+            [string]$RelativePath,
+            [string]$Content
+        )
+        [System.IO.File]::WriteAllText((Join-Path $RepoPath $RelativePath), $Content)
+    }
+
+    function New-MirrorBehindRemote {
+        <#
+          Builds a bare remote plus a mirror clone one commit behind it. The
+          remote's newer commit edits tracked.txt and adds added.txt.
+        #>
+        param([string]$Name)
+        $rootPath = Join-Path $TestDrive $Name
+        $remotePath = Join-Path $rootPath 'remote.git'
+        $authorPath = Join-Path $rootPath 'author'
+        $mirrorPath = Join-Path $rootPath 'mirror'
+        New-Item -ItemType Directory -Force -Path $remotePath, $authorPath | Out-Null
+
+        Invoke-TestGit -RepoPath $remotePath -Arguments @('init', '-q', '--bare', '-b', 'main') | Out-Null
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('init', '-q', '-b', 'main') | Out-Null
+        Write-TestFile -RepoPath $authorPath -RelativePath 'tracked.txt' -Content "old`n"
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('add', '-A') | Out-Null
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('commit', '-q', '-m', 'first') | Out-Null
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('remote', 'add', 'origin', $remotePath) | Out-Null
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('push', '-q', 'origin', 'main') | Out-Null
+
+        & git -c core.autocrlf=false clone -q $remotePath $mirrorPath 2>&1 | Out-Null
+        Invoke-TestGit -RepoPath $mirrorPath -Arguments @('config', 'core.autocrlf', 'false') | Out-Null
+        $oldTip = Invoke-TestGit -RepoPath $mirrorPath -Arguments @('rev-parse', 'HEAD')
+
+        Write-TestFile -RepoPath $authorPath -RelativePath 'tracked.txt' -Content "new`n"
+        Write-TestFile -RepoPath $authorPath -RelativePath 'added.txt' -Content "added`n"
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('add', '-A') | Out-Null
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('commit', '-q', '-m', 'second') | Out-Null
+        Invoke-TestGit -RepoPath $authorPath -Arguments @('push', '-q', 'origin', 'main') | Out-Null
+        $remoteTip = Invoke-TestGit -RepoPath $authorPath -Arguments @('rev-parse', 'HEAD')
+
+        return [pscustomobject]@{
+            MirrorPath = $mirrorPath
+            LogPath    = Join-Path $rootPath 'sync.log'
+            OldTip     = $oldTip
+            RemoteTip  = $remoteTip
+        }
+    }
+
+    function Invoke-SyncScript {
+        param([pscustomobject]$Fixture)
+        & pwsh -NoProfile -File $scriptUnderTest -RepoPath $Fixture.MirrorPath -StashDirty -LogPath $Fixture.LogPath | Out-Null
+        return $LASTEXITCODE
+    }
+}
+
+Describe 'Sync-RepoMain' {
+    It 'fast-forwards a clean mirror that is behind the remote' {
+        $fixture = New-MirrorBehindRemote -Name 'clean-behind'
+
+        $exitCode = Invoke-SyncScript -Fixture $fixture
+
+        $exitCode | Should -Be 0
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('rev-parse', 'HEAD')) | Should -Be $fixture.RemoteTip
+    }
+
+    It 'adopts the remote tip when copied files already match the remote' {
+        $fixture = New-MirrorBehindRemote -Name 'copied-match'
+        Write-TestFile -RepoPath $fixture.MirrorPath -RelativePath 'tracked.txt' -Content "new`n"
+        Write-TestFile -RepoPath $fixture.MirrorPath -RelativePath 'added.txt' -Content "added`n"
+
+        $exitCode = Invoke-SyncScript -Fixture $fixture
+
+        $exitCode | Should -Be 0
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('rev-parse', 'HEAD')) | Should -Be $fixture.RemoteTip
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('status', '--porcelain')) | Should -BeNullOrEmpty
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('stash', 'list')) | Should -BeNullOrEmpty
+    }
+
+    It 'keeps the old tip and the copied file when a copied file differs from the remote' {
+        $fixture = New-MirrorBehindRemote -Name 'copied-differs'
+        Write-TestFile -RepoPath $fixture.MirrorPath -RelativePath 'tracked.txt' -Content "new`n"
+        Write-TestFile -RepoPath $fixture.MirrorPath -RelativePath 'added.txt' -Content "local only`n"
+
+        $exitCode = Invoke-SyncScript -Fixture $fixture
+
+        $exitCode | Should -Be 1
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('rev-parse', 'HEAD')) | Should -Be $fixture.OldTip
+        [System.IO.File]::ReadAllText((Join-Path $fixture.MirrorPath 'added.txt')) | Should -Be "local only`n"
+        [System.IO.File]::ReadAllText((Join-Path $fixture.MirrorPath 'tracked.txt')) | Should -Be "new`n"
+    }
+}

package/scripts/tests/test_policy_lint_rules_validator_baseline.py

@@ -0,0 +1,126 @@
+"""Validator diagnostics report only the findings a change introduces.
+
+The code-rule adapter already compares a document against its prior text, so a
+long function nobody touched stays quiet there. The validator adapter graded the
+post-edit text alone, so a single-line edit to a long module reported every
+pre-existing cap breach in it and failed the change on debt it did not create.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path, PurePosixPath
+
+from policy_lint import adapters
+from policy_lint.model import ContentOrigin, Diagnostic, Document
+from policy_lint.selection import _changed_lines
+
+FUNCTION_LENGTH_MESSAGE_FRAGMENT = "lines (max"
+FILE_LENGTH_MESSAGE_FRAGMENT = "File is"
+PRODUCTION_RELATIVE_PATH = "packages/claude-dev-env/scripts/sample_capped_module.py"
+OVER_THRESHOLD_BODY_LINE_COUNT = 45
+UNDER_THRESHOLD_BODY_LINE_COUNT = 10
+OVER_FILE_CAP_FUNCTION_COUNT = 12
+REPOSITORY_ROOT = Path(__file__).resolve().parents[4]
+
+
+def _counting_function_source(function_name: str, body_line_count: int) -> str:
+    all_body_lines = [
+        f"    running_total = running_total + {each_index}"
+        for each_index in range(body_line_count)
+    ]
+    return (
+        "\n".join(
+            [f"def {function_name}(running_total: int) -> int:"]
+            + all_body_lines
+            + ["    return running_total"]
+        )
+        + "\n"
+    )
+
+
+def _document(prior_text: str | None, current_text: str) -> Document:
+    return Document(
+        PurePosixPath(PRODUCTION_RELATIVE_PATH),
+        current_text,
+        prior_text,
+        _changed_lines(prior_text, current_text),
+        ContentOrigin.REVISION_DIFF,
+    )
+
+
+def _messages_carrying(document: Document, fragment: str) -> tuple[str, ...]:
+    all_diagnostics: tuple[Diagnostic, ...] = adapters.validator_diagnostics(
+        document, REPOSITORY_ROOT
+    )
+    return tuple(
+        each_diagnostic.message
+        for each_diagnostic in all_diagnostics
+        if fragment in each_diagnostic.message
+    )
+
+
+def _function_length_messages(
+    prior_text: str | None, current_text: str
+) -> tuple[str, ...]:
+    return _messages_carrying(
+        _document(prior_text, current_text), FUNCTION_LENGTH_MESSAGE_FRAGMENT
+    )
+
+
+def _over_file_cap_source(extra_line: str = "") -> str:
+    all_functions = [
+        _counting_function_source(
+            f"each_step_{each_index}", OVER_THRESHOLD_BODY_LINE_COUNT
+        )
+        for each_index in range(OVER_FILE_CAP_FUNCTION_COUNT)
+    ]
+    return extra_line + "\n".join(all_functions)
+
+
+def test_should_leave_an_untouched_long_function_alone() -> None:
+    prior_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = f"import os\nimport sys\n{prior_text}"
+    assert _function_length_messages(prior_text, current_text) == ()
+
+
+def test_should_report_an_over_long_function_the_change_adds() -> None:
+    prior_text = _counting_function_source("existing", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    added_text = _counting_function_source("added", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(prior_text, f"{prior_text}\n{added_text}") != ()
+
+
+def test_should_report_a_function_the_change_grew_past_the_cap() -> None:
+    prior_text = _counting_function_source("main", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(prior_text, current_text) != ()
+
+
+def test_should_report_every_cap_breach_in_a_wholly_new_document() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    assert _function_length_messages(None, current_text) != ()
+
+
+def test_should_report_a_cap_breach_when_the_selection_names_no_prior_text() -> None:
+    current_text = _counting_function_source("main", OVER_THRESHOLD_BODY_LINE_COUNT)
+    document = Document(
+        PurePosixPath(PRODUCTION_RELATIVE_PATH),
+        current_text,
+        None,
+        None,
+        ContentOrigin.WORKTREE,
+    )
+    assert _messages_carrying(document, FUNCTION_LENGTH_MESSAGE_FRAGMENT) != ()
+
+
+def test_should_leave_an_over_cap_file_alone_when_the_change_only_shrinks_it() -> None:
+    prior_text = _over_file_cap_source("REMOVED_SETTING = 1\n")
+    current_text = _over_file_cap_source()
+    document = _document(prior_text, current_text)
+    assert _messages_carrying(document, FILE_LENGTH_MESSAGE_FRAGMENT) == ()
+
+
+def test_should_report_a_file_the_change_pushed_over_the_cap() -> None:
+    prior_text = _counting_function_source("main", UNDER_THRESHOLD_BODY_LINE_COUNT)
+    current_text = _over_file_cap_source()
+    document = _document(prior_text, current_text)
+    assert _messages_carrying(document, FILE_LENGTH_MESSAGE_FRAGMENT) != ()

package/.agents/skills/session-continuity/AGENTS.md

@@ -1 +0,0 @@
-

package/.agents/skills/session-continuity/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md