claude-dev-env 8.10.0 → 8.11.0

package/hooks/blocking/test_tdd_enforcer_restore.py

@@ -1,108 +0,0 @@
-"""End-to-end tests for the absent-but-tracked restore exemption.
-
-Drives the real ``tdd_enforcer.py`` entry hook over a Write payload in a temp
-git repository, proving a remove-then-Write rewrite of committed code is allowed
-even when the paired test's freshness window has lapsed, while new untracked
-code and real edits to a present file stay gated.
-"""
-
-import json
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
-STALE_MTIME_OFFSET_SECONDS = 700
-DISABLE_EPHEMERAL_ENVIRONMENT = {"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"}
-
-
-def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
-        text=True,
-        capture_output=True,
-        check=False,
-        env={**os.environ, **DISABLE_EPHEMERAL_ENVIRONMENT},
-    )
-
-
-def _write_payload(file_path: Path, content: str) -> dict:
-    return {"tool_name": "Write", "tool_input": {"file_path": str(file_path), "content": content}}
-
-
-def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
-    if not completed.stdout:
-        return None
-    hook_output = json.loads(completed.stdout).get("hookSpecificOutput", {})
-    return hook_output.get("permissionDecision")
-
-
-def _run_git(repository_root: Path, *arguments: str) -> None:
-    subprocess.run(
-        ["git", *arguments],
-        cwd=str(repository_root),
-        check=True,
-        capture_output=True,
-        env={**os.environ, "GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_SYSTEM": os.devnull},
-    )
-
-
-def _init_git_repository(repository_root: Path) -> None:
-    _run_git(repository_root, "init", "-q")
-    _run_git(repository_root, "config", "user.email", "test@example.com")
-    _run_git(repository_root, "config", "user.name", "Test")
-    _run_git(repository_root, "config", "commit.gpgsign", "false")
-
-
-def _commit_tracked_service(repository_root: Path) -> tuple[Path, Path]:
-    production_file = repository_root / "service.py"
-    production_file.write_text("def serve(): return 1\n")
-    sibling_test = repository_root / "test_service.py"
-    sibling_test.write_text("def test_serve(): pass\n")
-    _run_git(repository_root, "add", "-A")
-    _run_git(repository_root, "commit", "-q", "-m", "init")
-    return production_file, sibling_test
-
-
-def test_should_allow_restore_write_of_absent_but_tracked_file_despite_stale_window(
-    tmp_path: Path,
-) -> None:
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    _init_git_repository(repository_root)
-    production_file, sibling_test = _commit_tracked_service(repository_root)
-    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
-    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
-    production_file.unlink()
-
-    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
-
-    assert _decision_from(completed) == "allow"
-
-
-def test_should_still_deny_write_of_absent_untracked_file_without_fresh_test(
-    tmp_path: Path,
-) -> None:
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    _init_git_repository(repository_root)
-    untracked_file = repository_root / "brand_new.py"
-
-    completed = _run_hook(_write_payload(untracked_file, "def fresh(): return 1\n"))
-
-    assert _decision_from(completed) == "deny"
-
-
-def test_should_still_deny_write_of_present_file_with_stale_test(tmp_path: Path) -> None:
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    _init_git_repository(repository_root)
-    production_file, sibling_test = _commit_tracked_service(repository_root)
-    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
-    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
-
-    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
-
-    assert _decision_from(completed) == "deny"

package/hooks/blocking/test_tdd_enforcer_scratchpad.py

@@ -1,105 +0,0 @@
-"""Tests for the session-scratchpad exemption wired into tdd_enforcer.main."""
-
-import importlib.util
-import io
-import json
-import os
-import sys
-import tempfile
-from pathlib import Path
-from types import ModuleType
-
-import pytest
-
-TDD_ENFORCER_PATH = Path(__file__).parent / "tdd_enforcer.py"
-FIXED_USER_ID = 5150
-WORKING_DIRECTORY = "/home/user/project"
-SESSION_ID = "tdd-session-987"
-PRODUCTION_CONTENT = "def fulfill_order():\n    return True\n"
-
-
-def _load_tdd_enforcer() -> ModuleType:
-    module_spec = importlib.util.spec_from_file_location(
-        "tdd_enforcer_scratchpad_under_test", TDD_ENFORCER_PATH
-    )
-    assert module_spec is not None and module_spec.loader is not None
-    loaded_module = importlib.util.module_from_spec(module_spec)
-    module_spec.loader.exec_module(loaded_module)
-    return loaded_module
-
-
-_TDD_ENFORCER = _load_tdd_enforcer()
-
-
-def _install_scratchpad_signals(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> Path:
-    monkeypatch.setattr(os, "getuid", lambda: FIXED_USER_ID, raising=False)
-    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
-    mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
-    scratchpad_directory = (
-        temporary_root
-        / f"claude-{FIXED_USER_ID}"
-        / mangled_working_directory
-        / SESSION_ID
-        / "scratchpad"
-    )
-    scratchpad_directory.mkdir(parents=True)
-    return scratchpad_directory
-
-
-def _write_payload(target: Path) -> dict[str, object]:
-    return {
-        "tool_name": "Write",
-        "cwd": WORKING_DIRECTORY,
-        "session_id": SESSION_ID,
-        "tool_input": {"file_path": str(target), "content": PRODUCTION_CONTENT},
-    }
-
-
-def _run_main(
-    monkeypatch: pytest.MonkeyPatch, payload: dict[str, object]
-) -> tuple[int | None, str]:
-    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
-    captured_stdout = io.StringIO()
-    monkeypatch.setattr(sys, "stdout", captured_stdout)
-    exit_code: int | None = None
-    try:
-        _TDD_ENFORCER.main()
-    except SystemExit as raised_exit:
-        raw_code = raised_exit.code
-        exit_code = raw_code if isinstance(raw_code, int) else None
-    return exit_code, captured_stdout.getvalue()
-
-
-def _decision_from(stdout_text: str) -> str | None:
-    if not stdout_text.strip():
-        return None
-    parsed = json.loads(stdout_text)
-    return parsed.get("hookSpecificOutput", {}).get("permissionDecision")
-
-
-def test_scratchpad_production_write_is_exempt_from_tdd_gate(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    scratchpad_directory = _install_scratchpad_signals(monkeypatch, tmp_path)
-    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
-    throwaway_script = scratchpad_directory / "one_off_probe.py"
-
-    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(throwaway_script))
-
-    assert exit_code == 0
-    assert _decision_from(stdout_text) != "deny"
-
-
-def test_identical_non_scratchpad_write_is_still_blocked(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    _install_scratchpad_signals(monkeypatch, tmp_path)
-    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
-    outside_directory = tmp_path / "project" / "orders"
-    outside_directory.mkdir(parents=True)
-    production_module = outside_directory / "one_off_probe.py"
-
-    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(production_module))
-
-    assert exit_code == 0
-    assert _decision_from(stdout_text) == "deny"