claude-dev-env 8.3.0 → 8.4.1

package/hooks/blocking/test_precommit_code_rules_gate.py

@@ -1,63 +0,0 @@
-"""Behavior tests for the precommit_code_rules_gate library module.
-
-The module carries no hook entry point of its own; it exports
-``resolve_repository_root`` for its importers (``pii_prevention_blocker.py``,
-``pii_payload_scan.py``, ``session_edit_stage_gate.py``).
-"""
-
-import subprocess
-import sys
-from pathlib import Path
-
-try:
-    import precommit_code_rules_gate as gate_module
-    from precommit_code_rules_gate import resolve_repository_root
-except ModuleNotFoundError:
-    _BLOCKING_DIR = str(Path(__file__).resolve().parent)
-    if _BLOCKING_DIR not in sys.path:
-        sys.path.insert(0, _BLOCKING_DIR)
-    import precommit_code_rules_gate as gate_module
-    from precommit_code_rules_gate import resolve_repository_root
-
-
-def run_git(repository_root: Path, *git_arguments: str) -> None:
-    subprocess.run(
-        ["git", "-C", str(repository_root), *git_arguments],
-        check=True,
-        capture_output=True,
-    )
-
-
-def initialize_repository(repository_root: Path) -> None:
-    run_git(repository_root, "init")
-    run_git(repository_root, "config", "user.email", "tests@example.com")
-    run_git(repository_root, "config", "user.name", "Gate Tests")
-    run_git(repository_root, "commit", "--allow-empty", "-m", "initial")
-
-
-def test_resolve_repository_root_returns_root_for_directory_inside_repository(
-    tmp_path: Path,
-) -> None:
-    initialize_repository(tmp_path)
-    nested_directory = tmp_path / "nested"
-    nested_directory.mkdir()
-    resolved_root = resolve_repository_root(str(nested_directory))
-    assert resolved_root == tmp_path.resolve()
-
-
-def test_resolve_repository_root_returns_none_outside_a_repository(
-    tmp_path: Path,
-) -> None:
-    non_repository_directory = tmp_path / "not_a_repo"
-    non_repository_directory.mkdir()
-    assert resolve_repository_root(str(non_repository_directory)) is None
-
-
-def test_module_carries_no_main_entry_point() -> None:
-    """The module has no dispatcher-facing hook entry point."""
-    assert not hasattr(gate_module, "main")
-
-
-def test_module_carries_no_commit_invocation_detector() -> None:
-    """The commit-detection helper lives in block_main_commit, not duplicated here."""
-    assert not hasattr(gate_module, "is_git_commit_invocation")

package/hooks/validators/VALIDATION_REPORT.md

@@ -1,287 +0,0 @@
-# Test Safety Checks Validator - Comprehensive Validation Report
-
-## Executive Summary
-
-**Critical Gaps Found: 2**
-**Minor Issues: 1**
-**Tests Passed: 14/17**
-
----
-
-## Check 1: No Skip Decorators
-
-### Test Results
-
-| Test Case | Expected | Result | Status |
-|-----------|----------|--------|--------|
-| `@skip` | CAUGHT | CAUGHT | PASS |
-| `@pytest.mark.skipif(...)` | CAUGHT | CAUGHT | PASS |
-| `@unittest.skipIf(...)` | CAUGHT | CAUGHT | PASS |
-| `@skip()` with parentheses | CAUGHT | CAUGHT | PASS |
-| `@pytest.mark.xfail` | ALLOWED | ALLOWED | PASS |
-| `@skip_on_windows` custom | ALLOWED | ALLOWED | PASS |
-| `@Skip` (capital S) | CAUGHT | **ALLOWED** | **FAIL** |
-| `@unittest.skipUnless(...)` | CAUGHT | CAUGHT | PASS |
-| `@pytest.mark.skip` (no args) | CAUGHT | CAUGHT | PASS |
-
-### GAP #1: Case-Sensitive Decorator Matching
-
-**Severity: MEDIUM**
-
-**Issue:** The validator uses case-sensitive matching, so `@Skip` (capital S) is NOT caught.
-
-**Current Code (lines 16-22):**
-```python
-SKIP_DECORATOR_NAMES = frozenset([
-    "skip",
-    "skipif",
-    "skipunless",
-    "skipIf",
-    "skipUnless",
-])
-```
-
-**Problem:** This misses decorators with different capitalization like `@Skip`, `@SkipIf`, `@SKIP`, etc.
-
-**Recommended Fix:**
-```python
-def _get_decorator_name(decorator: ast.expr) -> str:
-    """Extract the name from a decorator node (lowercase for comparison)."""
-    # ... existing logic ...
-    return name.lower()  # Convert to lowercase for case-insensitive matching
-```
-
-Then update the frozenset to all lowercase:
-```python
-SKIP_DECORATOR_NAMES = frozenset([
-    "skip",
-    "skipif",
-    "skipunless",
-])
-```
-
-**Impact:** Currently allows `@Skip`, `@SkipIf`, `@SkipUnless` to slip through.
-
----
-
-## Check 2: DEBUG Guard in Management Commands
-
-### Test Results
-
-| Test Case | Expected | Result | Status |
-|-----------|----------|--------|--------|
-| No DEBUG check | CAUGHT | CAUGHT | PASS |
-| `if not settings.DEBUG: raise` | ALLOWED | ALLOWED | PASS |
-| `if not settings.DEBUG: return` | ALLOWED | ALLOWED | PASS |
-| Using imported `DEBUG` variable | CAUGHT | CAUGHT | PASS |
-| DEBUG check in helper function | CAUGHT | CAUGHT | PASS |
-| DEBUG check after 5 statements | CAUGHT | CAUGHT | PASS |
-| `if settings.DEBUG: ... else: raise` | ALLOWED | **CAUGHT** | **FAIL** |
-| `if not settings.DEBUG and X:` | DEBATABLE | CAUGHT | WARN |
-| File not in `management/commands/` | IGNORED | IGNORED | PASS |
-
-### GAP #2: Positive DEBUG Check Pattern Rejected
-
-**Severity: HIGH**
-
-**Issue:** The validator incorrectly rejects the pattern `if settings.DEBUG: ... else: raise`.
-
-**Test File:** `cmd_07_positive_debug_check.py`
-```python
-def handle(self, *args, **options):
-    if settings.DEBUG:
-        print("Running in DEBUG mode")
-    else:
-        raise CommandError("This command can only be run in DEBUG mode")
-```
-
-**Expected:** ALLOWED (this is a valid DEBUG guard)
-**Actual:** CAUGHT (flagged as violation)
-
-**Root Cause (lines 186-187):**
-```python
-if _is_debug_check(test) and stmt.orelse:
-    return False  # This returns False when it should return True!
-```
-
-**The Logic Flaw:**
-- Line 186: Detects `if settings.DEBUG:` and checks if there's an `else` clause
-- Line 187: Returns `False` (no DEBUG guard found)
-- **BUG:** This should return `True` because the pattern IS a valid guard!
-
-**Recommended Fix:**
-```python
-def _has_debug_guard(func: ast.FunctionDef) -> bool:
-    """Check if a function has a settings.DEBUG guard at the start."""
-    if not func.body:
-        return False
-
-    for stmt in func.body[:5]:
-        if isinstance(stmt, ast.If):
-            test = stmt.test
-
-            # Pattern 1: if not settings.DEBUG: raise/return
-            if isinstance(test, ast.UnaryOp) and isinstance(test.op, ast.Not):
-                if _is_debug_check(test.operand):
-                    return True
-
-            # Pattern 2: if settings.DEBUG: ... else: raise/return
-            if _is_debug_check(test):
-                if stmt.orelse:
-                    # Check if else clause has raise/return
-                    if _has_early_exit(stmt.orelse):
-                        return True
-                # if settings.DEBUG: with no else is also valid
-                return True
-
-    return False
-
-
-def _has_early_exit(statements: List[ast.stmt]) -> bool:
-    """Check if statements contain raise or return."""
-    for stmt in statements:
-        if isinstance(stmt, (ast.Raise, ast.Return)):
-            return True
-        # Check nested if/else
-        if isinstance(stmt, ast.If):
-            if _has_early_exit(stmt.body) or (stmt.orelse and _has_early_exit(stmt.orelse)):
-                return True
-    return False
-```
-
-**Impact:** Currently REJECTS valid DEBUG guard patterns, forcing developers to use only negative checks.
-
-### MINOR ISSUE: Complex Boolean Expressions
-
-**Severity: LOW**
-
-**Issue:** The validator rejects `if not settings.DEBUG and other_condition:`.
-
-**Test File:** `cmd_08_debug_with_and.py`
-```python
-if not settings.DEBUG and True:
-    raise CommandError("This command can only be run in DEBUG mode")
-```
-
-**Expected:** DEBATABLE (could be allowed if DEBUG is the primary condition)
-**Actual:** CAUGHT (flagged as violation)
-
-**Analysis:**
-- Current code only checks for simple `UnaryOp(Not)` with `settings.DEBUG`
-- Doesn't handle `BoolOp` (and/or) expressions
-- This is arguably correct behavior - keeps the check simple and strict
-
-**Recommendation:** Document this limitation. Developers should use:
-```python
-if not settings.DEBUG:
-    raise CommandError("...")
-# Then check other conditions separately
-```
-
----
-
-## Additional Edge Cases Tested
-
-### Nested Directory Structure
-- File in `management/commands/subdir/command.py` - NOT tested
-- **Recommendation:** Add test case to verify path matching works with subdirectories
-
-### File Encoding Issues
-- Files with syntax errors - Handled gracefully (returns empty violations)
-- Files that don't exist - Handled with error message
-
-### Multiple Commands in One File
-- NOT tested
-- **Recommendation:** Add test case with multiple Command classes in one file
-
----
-
-## Recommended Priority Fixes
-
-1. **HIGH PRIORITY:** Fix GAP #2 (positive DEBUG check pattern)
-   - Current behavior rejects valid code
-   - Breaking change for developers using this pattern
-
-2. **MEDIUM PRIORITY:** Fix GAP #1 (case-sensitive skip decorators)
-   - Low probability but easy to fix
-   - Prevents trivial evasion
-
-3. **LOW PRIORITY:** Add test for nested management commands
-   - Verify path matching works with subdirectories
-
----
-
-## Test Coverage Summary
-
-**Skip Decorators:**
-- Simple decorators: TESTED
-- Attribute decorators: TESTED
-- Called decorators: TESTED
-- Case variations: **GAP FOUND**
-- Custom decorators: TESTED (correctly allowed)
-
-**DEBUG Guards:**
-- No check: TESTED
-- Negative check (`if not`): TESTED
-- Positive check (`if ... else`): **GAP FOUND**
-- Imported DEBUG: TESTED (correctly rejected)
-- Helper function: TESTED (correctly rejected)
-- Late check (>5 statements): TESTED (correctly rejected)
-- Path matching: TESTED
-- Complex boolean: TESTED (debatable behavior)
-
----
-
-## Files Created for Testing
-
-### Skip Decorators (9 files)
-```
-test_files/skip_decorators/
-├── test_01_simple_skip.py
-├── test_02_pytest_skipif.py
-├── test_03_unittest_skipIf.py
-├── test_04_skip_with_parens.py
-├── test_05_xfail.py
-├── test_06_custom_skip.py
-├── test_07_capital_Skip.py (GAP)
-├── test_08_skipUnless.py
-└── test_09_pytest_mark_skip_simple.py
-```
-
-### Management Commands (9 files)
-```
-test_files/management/commands/
-├── cmd_01_no_debug_check.py
-├── cmd_02_proper_debug_check.py
-├── cmd_03_debug_check_with_return.py
-├── cmd_04_imported_DEBUG.py
-├── cmd_05_debug_check_in_helper.py
-├── cmd_06_debug_check_late.py
-├── cmd_07_positive_debug_check.py (GAP)
-├── cmd_08_debug_with_and.py
-test_files/
-└── not_management_command.py
-```
-
----
-
-## Conclusion
-
-The validator is **mostly effective** but has **2 critical gaps**:
-
-1. **Case-sensitive decorator matching** - Easy fix, low impact
-2. **Positive DEBUG check rejection** - HIGH PRIORITY, rejects valid code
-
-The implementation correctly handles:
-- Most skip decorator patterns
-- Simple DEBUG guard patterns
-- Path filtering for management commands
-- Graceful error handling
-
-**Overall Assessment: 82% effective (14/17 test cases passed)**
-
-**Action Required:**
-1. Fix GAP #2 immediately (breaking valid code)
-2. Fix GAP #1 for completeness
-3. Add test for nested management command directories
-4. Document the complex boolean limitation

package/hooks/validators/validator_defaults.py

@@ -1,5 +0,0 @@
-"""Shared constants for the validators package."""
-
-# pragma: no-tdd-gate
-
-DEFAULT_BASE_BRANCH_WHEN_UNKNOWN = "main"

package/scripts/dev_env_scripts_constants/test_code_review_constants.py

@@ -1,12 +0,0 @@
-"""Behavioral tests for the host-aware code-review invoker constants module."""
-
-from __future__ import annotations
-
-from dev_env_scripts_constants import code_review_constants as review_constants
-
-
-def test_default_effort_is_a_known_token() -> None:
-    assert (
-        review_constants.DEFAULT_CODE_REVIEW_EFFORT
-        in review_constants.ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
-    )

package/scripts/tests/test_code_review_constants.py

@@ -1,80 +0,0 @@
-"""Specifications for the permission modes the review binary is asked for.
-
-The review binary accepts one permission mode for an ordinary caller and a
-different one for root. Naming the wrong mode means the binary refuses the
-call, no review runs, and no stamp is ever minted.
-"""
-
-from __future__ import annotations
-
-import importlib
-import os
-
-import pytest
-
-from dev_env_scripts_constants import code_review_constants
-
-
-BYPASS_MODE_TOKEN: str = "bypassPermissions"
-ACCEPT_EDITS_MODE_TOKEN: str = "acceptEdits"
-ROOT_USER_ID: int = 0
-UNPRIVILEGED_USER_ID: int = 1000
-
-
-def _permission_mode_seen_by(
-    monkeypatch: pytest.MonkeyPatch, effective_user_id: int
-) -> str:
-    """Read the review permission mode a caller with this user id resolves."""
-    monkeypatch.setattr(os, "geteuid", lambda: effective_user_id)
-    reloaded_constants = importlib.reload(code_review_constants)
-    return str(reloaded_constants.REVIEW_PERMISSION_MODE)
-
-
-def test_root_detection_agrees_with_this_process(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(os, "geteuid", lambda: ROOT_USER_ID)
-    reloaded_constants = importlib.reload(code_review_constants)
-
-    assert reloaded_constants.IS_ROOT_CALLER is True
-    assert reloaded_constants.ROOT_EFFECTIVE_USER_ID == ROOT_USER_ID
-
-
-def test_bypass_mode_names_the_token_the_binary_reads() -> None:
-    assert code_review_constants.PERMISSION_MODE_BYPASS == BYPASS_MODE_TOKEN
-
-
-def test_accept_edits_mode_names_the_token_the_binary_reads() -> None:
-    assert code_review_constants.PERMISSION_MODE_ACCEPT_EDITS == ACCEPT_EDITS_MODE_TOKEN
-
-
-def test_a_root_caller_resolves_the_mode_the_binary_accepts(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    assert _permission_mode_seen_by(monkeypatch, ROOT_USER_ID) == (
-        ACCEPT_EDITS_MODE_TOKEN
-    )
-
-
-def test_an_ordinary_caller_resolves_the_bypass_mode(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    assert _permission_mode_seen_by(monkeypatch, UNPRIVILEGED_USER_ID) == (
-        BYPASS_MODE_TOKEN
-    )
-
-
-def test_a_platform_without_a_user_id_still_loads_the_constants(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Windows exposes no ``os.geteuid``, and the module still imports.
-
-    Reading a missing ``os.geteuid`` raises, and every caller of the review
-    invoker dies at import. A platform that reports no user id is never the
-    root the review binary refuses, so it reads as an ordinary caller.
-    """
-    monkeypatch.delattr(os, "geteuid", raising=False)
-    reloaded_constants = importlib.reload(code_review_constants)
-
-    assert reloaded_constants.IS_ROOT_CALLER is False
-    assert reloaded_constants.REVIEW_PERMISSION_MODE == BYPASS_MODE_TOKEN