claude-dev-env 8.4.0 → 8.4.1

package/hooks/hooks_constants/precommit_code_rules_gate_constants.py

@@ -1,4 +1,4 @@
-"""Constants for the precommit_code_rules_gate library module.
+"""Constants for git-repository-root resolution.
 
 The git-repository-root resolution command and its timeout, used by
 ``resolve_repository_root`` to find the repository a directory belongs to.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.4.0",
+    "version": "8.4.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/hooks/blocking/pii_payload_scan.py

@@ -1,348 +0,0 @@
-#!/usr/bin/env python3
-"""Scan Write/Edit payloads and durable post bodies for high-confidence PII.
-
-Reused by ``pii_prevention_blocker``: ``build_deny_reason`` composes the deny
-message, and ``evaluate_write_edit_payload`` / ``evaluate_post_body_texts`` judge
-new file content and durable GitHub post bodies against the pure scanners in
-``pii_scanner``.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-try:
-    _blocking_directory = str(Path(__file__).resolve().parent)
-    _hooks_directory = str(Path(__file__).resolve().parent.parent)
-    for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-    from code_rules_shared import is_ephemeral_path
-    from codex_apply_patch import (
-        CodexPatchError,
-        parse_codex_apply_patch,
-        payload_patch_command,
-    )
-    from pii_prevention_blocker_parts.repository_exemption import (
-        repository_allowlisted_values,
-    )
-    from pii_scanner import (
-        PiiFinding,
-        is_path_exempt_from_pii_scan,
-        scan_text_for_pii,
-    )
-    from precommit_code_rules_gate import resolve_repository_root
-
-    from hooks_constants.local_identity import pii_allowlisted_values_by_repository
-    from hooks_constants.multi_edit_reconstruction import edits_for_tool
-    from hooks_constants.pii_prevention_constants import (
-        ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-        CORRECTIVE_MESSAGE_FOOTER,
-        CORRECTIVE_MESSAGE_HEADER,
-        EDIT_TOOL_NAME,
-        FINDING_LINE_TEMPLATE,
-        MESSAGE_LINE_SEPARATOR,
-        MULTI_EDIT_TOOL_NAME,
-        WRITE_TOOL_NAME,
-    )
-except ImportError as import_error:
-    raise ImportError(
-        "pii_payload_scan: cannot import its sibling modules; "
-        "ensure the blocking and hooks directories are importable."
-    ) from import_error
-
-
-def _apply_patch_post_contents(
-    command: str, working_directory: str | None
-) -> list[tuple[str, str]]:
-    """Return (file_path, post_content) pairs for a Codex apply_patch command."""
-    if not command:
-        return []
-    try:
-        all_patch_files = parse_codex_apply_patch(command, working_directory)
-    except CodexPatchError:
-        return []
-    return [
-        (each_patch_file.file_path, each_patch_file.post_content)
-        for each_patch_file in all_patch_files
-        if each_patch_file.post_content
-    ]
-
-
-def _apply_patch_target_deny_reason(
-    each_file_path: str,
-    each_post_content: str,
-    hook_payload: dict | None,
-) -> str | None:
-    """Return the deny reason for one apply_patch target, or None when it is clean or exempt."""
-    if is_path_exempt_from_pii_scan(each_file_path):
-        return None
-    if _target_is_ephemeral_outside_repository(each_file_path, hook_payload):
-        return None
-    return _write_deny_reason_for_texts([each_post_content], each_file_path, frozenset())
-
-
-def evaluate_apply_patch_payload(
-    all_tool_input: dict[str, object],
-    hook_payload: dict | None = None,
-) -> str | None:
-    """Return a deny reason when a Codex apply_patch payload's post content carries PII.
-
-    Args:
-        all_tool_input: The apply_patch payload's ``command`` and other input fields.
-        hook_payload: The PreToolUse payload carrying ``cwd`` and the session id.
-
-    Returns:
-        Deny reason text for the first target carrying non-allowlisted PII, or
-        None when every target is clean or out of scope.
-    """
-    command, working_directory = payload_patch_command(hook_payload, all_tool_input)
-    for each_file_path, each_post_content in _apply_patch_post_contents(
-        command, working_directory
-    ):
-        deny_reason = _apply_patch_target_deny_reason(
-            each_file_path, each_post_content, hook_payload
-        )
-        if deny_reason is not None:
-            return deny_reason
-    return None
-
-
-def _target_is_ephemeral_outside_repository(
-    file_path: str, hook_payload: dict | None
-) -> bool:
-    """Report whether a write target is a throwaway draft outside every repo.
-
-    ::
-
-        ephemeral path, no repo tree  ->  True   (write scan skipped)
-        ephemeral path inside a repo  ->  False  (write scan kept)
-        ordinary path                 ->  False  (write scan kept)
-
-    A draft under the harness scratchpad or an ephemeral scratch root turns
-    durable only through a surface that keeps its own scan, so scanning it at
-    write time is a false positive. A draft that resolves inside a git tree
-    still carries that repository's own allowlist, so the scan stays.
-
-    Args:
-        file_path: The write target path to classify.
-        hook_payload: The PreToolUse payload carrying the session id, or None to
-            read the session id from the environment alone.
-
-    Returns:
-        True only when the path is ephemeral and no enclosing git repository
-        resolves.
-    """
-    if not file_path:
-        return False
-    if not is_ephemeral_path(file_path, hook_payload):
-        return False
-    resolution_directory = _existing_ancestor_directory(file_path)
-    if resolution_directory is None:
-        return True
-    return resolve_repository_root(resolution_directory) is None
-
-
-def build_deny_reason(all_findings: list[PiiFinding], gate_surface: str) -> str:
-    """Return the deny message listing each finding for *gate_surface*.
-
-    Args:
-        all_findings: Findings returned by ``scan_text_for_pii``.
-        gate_surface: Human-readable surface (write, post body, staged commit).
-
-    Returns:
-        Multi-line deny reason for ``permissionDecisionReason``.
-    """
-    all_lines = [
-        CORRECTIVE_MESSAGE_HEADER,
-        f"Surface: {gate_surface}",
-    ]
-    for each_finding in all_findings:
-        all_lines.append(
-            FINDING_LINE_TEMPLATE.format(
-                category=each_finding.category,
-                preview=each_finding.preview,
-            )
-        )
-    all_lines.append(CORRECTIVE_MESSAGE_FOOTER)
-    message_line_separator = MESSAGE_LINE_SEPARATOR
-    return message_line_separator.join(all_lines)
-
-
-def _new_strings_from_edits(
-    tool_name: str, all_tool_input: dict[str, object]
-) -> list[str]:
-    """Return each non-empty ``new_string`` from an Edit/MultiEdit payload."""
-    all_texts: list[str] = []
-    for each_edit in edits_for_tool(tool_name, all_tool_input):
-        if not isinstance(each_edit, dict):
-            continue
-        new_string = each_edit.get("new_string", "")
-        if isinstance(new_string, str) and new_string:
-            all_texts.append(new_string)
-    return all_texts
-
-
-def _collect_write_edit_texts(
-    tool_name: str, all_tool_input: dict[str, object]
-) -> tuple[str, list[str]]:
-    raw_file_path = all_tool_input.get("file_path", "")
-    file_path = raw_file_path if isinstance(raw_file_path, str) else ""
-    if is_path_exempt_from_pii_scan(file_path):
-        return file_path, []
-    if tool_name == WRITE_TOOL_NAME:
-        write_content = all_tool_input.get("content", "")
-        if isinstance(write_content, str) and write_content:
-            return file_path, [write_content]
-        return file_path, []
-    if tool_name in (EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME):
-        return file_path, _new_strings_from_edits(tool_name, all_tool_input)
-    return file_path, []
-
-
-def _findings_after_allowlist(
-    text: str, all_allowlisted_values: frozenset[str]
-) -> list[PiiFinding]:
-    """Return PII findings in *text* whose matched text is not allowlisted."""
-    return [
-        each_finding
-        for each_finding in scan_text_for_pii(text)
-        if each_finding.matched_text not in all_allowlisted_values
-    ]
-
-
-def _first_findings_in_texts(
-    all_texts: list[str], all_allowlisted_values: frozenset[str] = frozenset()
-) -> list[PiiFinding]:
-    for each_text in all_texts:
-        all_findings = _findings_after_allowlist(each_text, all_allowlisted_values)
-        if all_findings:
-            return all_findings
-    return []
-
-
-def _existing_ancestor_directory(file_path: str) -> str | None:
-    """Return the nearest existing ancestor directory of *file_path*, or None.
-
-    PreToolUse runs before Write creates nested parents, so the immediate parent
-    may not exist yet; git resolution needs a directory that is already on disk.
-    """
-    starting_directory = Path(file_path).parent
-    for each_ancestor in (starting_directory, *starting_directory.parents):
-        if each_ancestor.exists():
-            return str(each_ancestor)
-    return None
-
-
-def _write_path_allowlisted_values(file_path: str) -> frozenset[str]:
-    """Return the exact values allowlisted for the repository *file_path* sits in.
-
-    ::
-
-        no path, or no allowlist configured  ->  frozenset()  (no git call)
-        path inside an allowlisted repo tree  ->  that repo's frozenset of values
-
-    Args:
-        file_path: The write target path whose repository keys the allowlist.
-
-    Returns:
-        The exact values the repository allows past the scan, or an empty set.
-    """
-    if not file_path:
-        return frozenset()
-    if not pii_allowlisted_values_by_repository():
-        return frozenset()
-    resolution_directory = _existing_ancestor_directory(file_path)
-    if resolution_directory is None:
-        return frozenset()
-    repository_root = resolve_repository_root(resolution_directory)
-    if repository_root is None:
-        return frozenset()
-    return repository_allowlisted_values(repository_root)
-
-
-def _write_deny_reason_for_texts(
-    all_texts: list[str],
-    file_path: str,
-    all_allowlisted_values: frozenset[str],
-) -> str | None:
-    """Return the deny reason for the first text carrying non-allowlisted PII.
-
-    Repository allowlist resolution runs once, only after a raw PII hit, so a
-    clean payload triggers no git call.
-    """
-    resolved_allowlisted_values: frozenset[str] | None = None
-    for each_text in all_texts:
-        all_raw_findings = scan_text_for_pii(each_text)
-        if not all_raw_findings:
-            continue
-        if resolved_allowlisted_values is None:
-            resolved_allowlisted_values = (
-                all_allowlisted_values | _write_path_allowlisted_values(file_path)
-            )
-        all_findings = [
-            each_finding
-            for each_finding in all_raw_findings
-            if each_finding.matched_text not in resolved_allowlisted_values
-        ]
-        if all_findings:
-            gate_surface = f"file write ({file_path or 'unknown path'})"
-            return build_deny_reason(all_findings, gate_surface)
-    return None
-
-
-def evaluate_write_edit_payload(
-    tool_name: str,
-    all_tool_input: dict[str, object],
-    all_allowlisted_values: frozenset[str] = frozenset(),
-    hook_payload: dict | None = None,
-) -> str | None:
-    """Return a deny reason when Write/Edit/MultiEdit content carries PII.
-
-    A value in the target repository's PII allowlist is dropped from the
-    findings, so a write under that repository's tree may carry it. A draft
-    under an ephemeral scratch root outside every repository is skipped, since
-    it turns durable only through surfaces that keep their own scans.
-
-    Args:
-        tool_name: The intercepted tool name.
-        all_tool_input: The tool input mapping.
-        all_allowlisted_values: Extra exact values allowed past the scan,
-            unioned with the target repository's own allowlist.
-        hook_payload: The PreToolUse payload carrying the session id, threaded
-            to the ephemeral-path predicate; None reads the session id from the
-            environment alone.
-
-    Returns:
-        Deny reason text, or None when the write is clean or out of scope.
-    """
-    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
-        return None
-    file_path, all_texts = _collect_write_edit_texts(tool_name, all_tool_input)
-    if not all_texts:
-        return None
-    if _target_is_ephemeral_outside_repository(file_path, hook_payload):
-        return None
-    return _write_deny_reason_for_texts(all_texts, file_path, all_allowlisted_values)
-
-
-def evaluate_post_body_texts(
-    all_body_texts: list[str],
-    all_allowlisted_values: frozenset[str] = frozenset(),
-) -> str | None:
-    """Return a deny reason when any durable post body carries PII.
-
-    Args:
-        all_body_texts: Body strings extracted from a gh or MCP post tool.
-        all_allowlisted_values: Exact values the caller's repository allows;
-            a finding matching one is not a finding. Callers that pass
-            nothing keep every post fully scanned.
-
-    Returns:
-        Deny reason text, or None when every body is clean.
-    """
-    all_findings = _first_findings_in_texts(all_body_texts, all_allowlisted_values)
-    if not all_findings:
-        return None
-    return build_deny_reason(all_findings, "durable GitHub post body")

package/hooks/blocking/precommit_code_rules_gate.py

@@ -1,50 +0,0 @@
-"""Library helper that resolves a directory to its Git repository root.
-
-``pii_payload_scan.py`` imports ``resolve_repository_root`` for staged scans.
-This module has no hook entry point. Native ``git-hooks/pre_commit.py`` shows
-the local verification advisory and does not enforce CODE_RULES.
-"""
-
-import subprocess
-import sys
-from pathlib import Path
-
-_hooks_directory = str(Path(__file__).resolve().parent.parent)
-if _hooks_directory not in sys.path:
-    sys.path.insert(0, _hooks_directory)
-
-from hooks_constants.precommit_code_rules_gate_constants import (  # noqa: E402
-    ALL_GIT_REPOSITORY_ROOT_COMMAND,
-    GIT_COMMAND_TIMEOUT_SECONDS,
-)
-
-from hooks_constants.subprocess_window import hidden_window_creation_flags
-
-
-def resolve_repository_root(working_directory: str | None) -> Path | None:
-    """Resolve the Git repository root for a directory.
-
-    Args:
-        working_directory: Directory inside the repository.
-
-    Returns:
-        Repository root. Returns None when Git cannot resolve the directory.
-    """
-    try:
-        completed_process = subprocess.run(
-            list(ALL_GIT_REPOSITORY_ROOT_COMMAND),
-            check=False,
-            capture_output=True,
-            text=True,
-            timeout=GIT_COMMAND_TIMEOUT_SECONDS,
-            cwd=working_directory,
-            creationflags=hidden_window_creation_flags(),
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
-        return None
-    if completed_process.returncode != 0:
-        return None
-    top_level_text = completed_process.stdout.strip()
-    if not top_level_text:
-        return None
-    return Path(top_level_text)

package/hooks/blocking/test_pii_payload_scan.py

@@ -1,231 +0,0 @@
-"""Behavior tests for the Write/Edit payload PII evaluation."""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-_HOOK_DIR = Path(__file__).parent
-_HOOKS_DIR = _HOOK_DIR.parent
-
-try:
-    from pii_payload_scan import (
-        evaluate_apply_patch_payload,
-        evaluate_post_body_texts,
-        evaluate_write_edit_payload,
-    )
-except ImportError:
-    for each_bootstrap_directory in (str(_HOOK_DIR), str(_HOOKS_DIR)):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-    from pii_payload_scan import (
-        evaluate_apply_patch_payload,
-        evaluate_post_body_texts,
-        evaluate_write_edit_payload,
-    )
-
-pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
-
-_ALLOW_SLUG = "AllowOwner/allow-repo"
-_OTHER_SLUG = "OtherOwner/other-repo"
-
-
-def test_post_body_with_pii_is_blocked_by_default() -> None:
-    deny_reason = evaluate_post_body_texts([_assembled_fixture_email()])
-    assert deny_reason is not None
-    assert "post body" in deny_reason
-
-
-def test_post_body_allowlisted_values_plumb_through_to_the_scan() -> None:
-    allowed_value = _assembled_fixture_email()
-    deny_reason = evaluate_post_body_texts(
-        [allowed_value], all_allowlisted_values=frozenset({allowed_value})
-    )
-    assert deny_reason is None
-
-
-def test_post_body_unlisted_value_still_blocked_beside_allowlist() -> None:
-    deny_reason = evaluate_post_body_texts(
-        [_assembled_unlisted_email()],
-        all_allowlisted_values=frozenset({_assembled_fixture_email()}),
-    )
-    assert deny_reason is not None
-    assert "post body" in deny_reason
-
-
-def _assembled_fixture_email() -> str:
-    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
-
-
-def _assembled_unlisted_email() -> str:
-    return "other.person" + "@" + "different-co" + ".example" + ".io"
-
-
-def _write_allowlist_identity(identity_path: Path, slug: str, value: str) -> None:
-    identity_path.write_text(
-        json.dumps({"pii_allowlisted_values": {slug: [value]}}),
-        encoding="utf-8",
-    )
-
-
-def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
-    repository_root.mkdir(parents=True, exist_ok=True)
-    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
-    origin_url = "https://github.com/" + origin_slug + ".git"
-    subprocess.run(
-        ["git", "remote", "add", "origin", origin_url],
-        cwd=repository_root,
-        check=True,
-    )
-
-
-def _write_deny_reason(target_path: Path, value: str) -> str | None:
-    content = "owner email " + value + "\n"
-    return evaluate_write_edit_payload(
-        "Write", {"file_path": str(target_path), "content": content}
-    )
-
-
-def test_write_payload_with_a_fixture_email_is_flagged(tmp_path: Path) -> None:
-    deny_reason = _write_deny_reason(tmp_path / "notes.md", _assembled_fixture_email())
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_allowlisted_value_under_the_allowlisted_repo_is_allowed(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    allowed_value = _assembled_fixture_email()
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    assert _write_deny_reason(repository_root / "notes.md", allowed_value) is None
-
-
-def test_allowlisted_value_in_a_different_repo_is_blocked(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    allowed_value = _assembled_fixture_email()
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _OTHER_SLUG)
-    deny_reason = _write_deny_reason(repository_root / "notes.md", allowed_value)
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_unlisted_value_in_the_allowlisted_repo_is_blocked(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = _write_deny_reason(
-        repository_root / "notes.md", _assembled_unlisted_email()
-    )
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_clean_write_payload_skips_repository_resolution(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-
-    def _fail_if_called(_working_directory: str | None) -> None:
-        raise AssertionError(
-            "resolve_repository_root should not run for a payload with no PII"
-        )
-
-    monkeypatch.setattr(
-        sys.modules["pii_payload_scan"], "resolve_repository_root", _fail_if_called
-    )
-    deny_reason = evaluate_write_edit_payload(
-        "Write",
-        {
-            "file_path": str(repository_root / "notes.md"),
-            "content": "nothing sensitive here\n",
-        },
-    )
-    assert deny_reason is None
-
-
-def test_allowlisted_value_under_missing_nested_parent_is_allowed(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    allowed_value = _assembled_fixture_email()
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    nested_target = repository_root / "new_dir" / "deeper" / "notes.md"
-    assert not nested_target.parent.exists()
-    assert _write_deny_reason(nested_target, allowed_value) is None
-
-
-def test_apply_patch_add_with_pii_is_denied(tmp_path: Path) -> None:
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = evaluate_apply_patch_payload(
-        {
-            "command": (
-                "*** Begin Patch\n"
-                "*** Add File: notes.md\n"
-                f"+Reach me at {_assembled_fixture_email()}\n"
-                "*** End Patch"
-            )
-        },
-        hook_payload={"cwd": str(repository_root)},
-    )
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_apply_patch_add_with_clean_content_is_allowed(tmp_path: Path) -> None:
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = evaluate_apply_patch_payload(
-        {
-            "command": (
-                "*** Begin Patch\n"
-                "*** Add File: notes.md\n"
-                "+nothing sensitive here\n"
-                "*** End Patch"
-            )
-        },
-        hook_payload={"cwd": str(repository_root)},
-    )
-    assert deny_reason is None
-
-
-def test_apply_patch_payload_accepts_the_tool_input_keyword(tmp_path: Path) -> None:
-    """evaluate_apply_patch_payload's first parameter is named all_tool_input."""
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = evaluate_apply_patch_payload(
-        all_tool_input={
-            "command": (
-                "*** Begin Patch\n"
-                "*** Add File: notes.md\n"
-                "+nothing sensitive here\n"
-                "*** End Patch"
-            )
-        },
-        hook_payload={"cwd": str(repository_root)},
-    )
-    assert deny_reason is None

package/hooks/blocking/test_precommit_code_rules_gate.py

@@ -1,63 +0,0 @@
-"""Behavior tests for the precommit_code_rules_gate library module.
-
-The module carries no hook entry point of its own; it exports
-``resolve_repository_root`` for its importers (``pii_prevention_blocker.py``,
-``pii_payload_scan.py``, ``session_edit_stage_gate.py``).
-"""
-
-import subprocess
-import sys
-from pathlib import Path
-
-try:
-    import precommit_code_rules_gate as gate_module
-    from precommit_code_rules_gate import resolve_repository_root
-except ModuleNotFoundError:
-    _BLOCKING_DIR = str(Path(__file__).resolve().parent)
-    if _BLOCKING_DIR not in sys.path:
-        sys.path.insert(0, _BLOCKING_DIR)
-    import precommit_code_rules_gate as gate_module
-    from precommit_code_rules_gate import resolve_repository_root
-
-
-def run_git(repository_root: Path, *git_arguments: str) -> None:
-    subprocess.run(
-        ["git", "-C", str(repository_root), *git_arguments],
-        check=True,
-        capture_output=True,
-    )
-
-
-def initialize_repository(repository_root: Path) -> None:
-    run_git(repository_root, "init")
-    run_git(repository_root, "config", "user.email", "tests@example.com")
-    run_git(repository_root, "config", "user.name", "Gate Tests")
-    run_git(repository_root, "commit", "--allow-empty", "-m", "initial")
-
-
-def test_resolve_repository_root_returns_root_for_directory_inside_repository(
-    tmp_path: Path,
-) -> None:
-    initialize_repository(tmp_path)
-    nested_directory = tmp_path / "nested"
-    nested_directory.mkdir()
-    resolved_root = resolve_repository_root(str(nested_directory))
-    assert resolved_root == tmp_path.resolve()
-
-
-def test_resolve_repository_root_returns_none_outside_a_repository(
-    tmp_path: Path,
-) -> None:
-    non_repository_directory = tmp_path / "not_a_repo"
-    non_repository_directory.mkdir()
-    assert resolve_repository_root(str(non_repository_directory)) is None
-
-
-def test_module_carries_no_main_entry_point() -> None:
-    """The module has no dispatcher-facing hook entry point."""
-    assert not hasattr(gate_module, "main")
-
-
-def test_module_carries_no_commit_invocation_detector() -> None:
-    """The commit-detection helper lives in block_main_commit, not duplicated here."""
-    assert not hasattr(gate_module, "is_git_commit_invocation")

package/scripts/dev_env_scripts_constants/test_code_review_constants.py

@@ -1,12 +0,0 @@
-"""Behavioral tests for the host-aware code-review invoker constants module."""
-
-from __future__ import annotations
-
-from dev_env_scripts_constants import code_review_constants as review_constants
-
-
-def test_default_effort_is_a_known_token() -> None:
-    assert (
-        review_constants.DEFAULT_CODE_REVIEW_EFFORT
-        in review_constants.ALL_EFFORT_TOKENS_IN_ASCENDING_ORDER
-    )

package/scripts/tests/test_code_review_constants.py

@@ -1,80 +0,0 @@
-"""Specifications for the permission modes the review binary is asked for.
-
-The review binary accepts one permission mode for an ordinary caller and a
-different one for root. Naming the wrong mode means the binary refuses the
-call, no review runs, and no stamp is ever minted.
-"""
-
-from __future__ import annotations
-
-import importlib
-import os
-
-import pytest
-
-from dev_env_scripts_constants import code_review_constants
-
-
-BYPASS_MODE_TOKEN: str = "bypassPermissions"
-ACCEPT_EDITS_MODE_TOKEN: str = "acceptEdits"
-ROOT_USER_ID: int = 0
-UNPRIVILEGED_USER_ID: int = 1000
-
-
-def _permission_mode_seen_by(
-    monkeypatch: pytest.MonkeyPatch, effective_user_id: int
-) -> str:
-    """Read the review permission mode a caller with this user id resolves."""
-    monkeypatch.setattr(os, "geteuid", lambda: effective_user_id)
-    reloaded_constants = importlib.reload(code_review_constants)
-    return str(reloaded_constants.REVIEW_PERMISSION_MODE)
-
-
-def test_root_detection_agrees_with_this_process(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(os, "geteuid", lambda: ROOT_USER_ID)
-    reloaded_constants = importlib.reload(code_review_constants)
-
-    assert reloaded_constants.IS_ROOT_CALLER is True
-    assert reloaded_constants.ROOT_EFFECTIVE_USER_ID == ROOT_USER_ID
-
-
-def test_bypass_mode_names_the_token_the_binary_reads() -> None:
-    assert code_review_constants.PERMISSION_MODE_BYPASS == BYPASS_MODE_TOKEN
-
-
-def test_accept_edits_mode_names_the_token_the_binary_reads() -> None:
-    assert code_review_constants.PERMISSION_MODE_ACCEPT_EDITS == ACCEPT_EDITS_MODE_TOKEN
-
-
-def test_a_root_caller_resolves_the_mode_the_binary_accepts(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    assert _permission_mode_seen_by(monkeypatch, ROOT_USER_ID) == (
-        ACCEPT_EDITS_MODE_TOKEN
-    )
-
-
-def test_an_ordinary_caller_resolves_the_bypass_mode(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    assert _permission_mode_seen_by(monkeypatch, UNPRIVILEGED_USER_ID) == (
-        BYPASS_MODE_TOKEN
-    )
-
-
-def test_a_platform_without_a_user_id_still_loads_the_constants(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Windows exposes no ``os.geteuid``, and the module still imports.
-
-    Reading a missing ``os.geteuid`` raises, and every caller of the review
-    invoker dies at import. A platform that reports no user id is never the
-    root the review binary refuses, so it reads as an ordinary caller.
-    """
-    monkeypatch.delattr(os, "geteuid", raising=False)
-    reloaded_constants = importlib.reload(code_review_constants)
-
-    assert reloaded_constants.IS_ROOT_CALLER is False
-    assert reloaded_constants.REVIEW_PERMISSION_MODE == BYPASS_MODE_TOKEN