claude-dev-env 8.54.9 → 8.55.0

package/profile-settings/session_title_status_gate.py

@@ -0,0 +1,77 @@
+"""Stop hook that blocks until the session title is set with a status emoji."""
+
+import json
+import sys
+from typing import TextIO
+
+from config.session_title_gate_constants import ALL_TITLE_TOOL_NAMES, INSTRUCTION
+
+
+def _content_blocks(entry: dict) -> list:
+    content = entry.get("message", {}).get("content")
+    if isinstance(content, str):
+        return [{"type": "text", "text": content}]
+    return content if isinstance(content, list) else []
+
+
+def _is_user_text(entry: dict) -> bool:
+    if entry.get("type") != "user":
+        return False
+    return any(
+        block.get("type") == "text" and block.get("text", "").strip()
+        for block in _content_blocks(entry)
+        if isinstance(block, dict)
+    )
+
+
+def _is_title_call(entry: dict) -> bool:
+    if entry.get("type") != "assistant":
+        return False
+    return any(
+        block.get("type") == "tool_use" and block.get("name") in ALL_TITLE_TOOL_NAMES
+        for block in _content_blocks(entry)
+        if isinstance(block, dict)
+    )
+
+
+def title_set_since_last_user_text(all_transcript_lines: list[str]) -> bool:
+    """Report whether a title call follows the newest user text in the transcript.
+
+    Args:
+        all_transcript_lines: The transcript's JSONL lines, oldest first.
+
+    Returns:
+        True when a set_session_title call comes after the last user text.
+    """
+    for each_line in reversed(all_transcript_lines):
+        if not each_line.strip():
+            continue
+        entry = json.loads(each_line)
+        if _is_title_call(entry):
+            return True
+        if _is_user_text(entry):
+            return False
+    return False
+
+
+def main(decision_stream: TextIO) -> None:
+    """Block the stop with the title instruction when no title follows the last user text.
+
+    Args:
+        decision_stream: The stream that receives the Stop hook decision.
+    """
+    try:
+        payload = json.load(sys.stdin)
+        if payload.get("stop_hook_active"):
+            return
+        with open(payload["transcript_path"], encoding="utf-8") as transcript_file:
+            all_transcript_lines = transcript_file.readlines()
+        if title_set_since_last_user_text(all_transcript_lines):
+            return
+    except (OSError, KeyError, ValueError):
+        return
+    decision_stream.write(json.dumps({"decision": "block", "reason": INSTRUCTION}))
+
+
+if __name__ == "__main__":
+    main(sys.stdout)

package/profile-settings/test_session_title_status_gate.py

@@ -0,0 +1,101 @@
+"""Run the installed session-title gate as the Stop hook runs it."""
+
+import json
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+GATE_SOURCE_DIRECTORY = Path(__file__).resolve().parent
+GATE_FILE_NAME = "session_title_status_gate.py"
+ALL_GATE_RELATIVE_PATHS = (
+    Path(GATE_FILE_NAME),
+    Path("config") / "__init__.py",
+    Path("config") / "session_title_gate_constants.py",
+)
+TITLE_TOOL_NAME = "mcp__claude-code-remote__set_session_title"
+
+
+def _install_gate(claude_directory: Path) -> Path:
+    for each_relative_path in ALL_GATE_RELATIVE_PATHS:
+        target_path = claude_directory / each_relative_path
+        target_path.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(GATE_SOURCE_DIRECTORY / each_relative_path, target_path)
+    return claude_directory / GATE_FILE_NAME
+
+
+def _user_text_entry(text: str) -> dict:
+    return {"type": "user", "message": {"content": text}}
+
+
+def _title_call_entry() -> dict:
+    return {
+        "type": "assistant",
+        "message": {
+            "content": [{"type": "tool_use", "name": TITLE_TOOL_NAME, "input": {}}]
+        },
+    }
+
+
+def _run_gate(
+    tmp_path: Path, all_entries: list[dict], is_stop_hook_active: bool = False
+) -> str:
+    gate_path = _install_gate(tmp_path / ".claude")
+    transcript_path = tmp_path / "transcript.jsonl"
+    transcript_path.write_text(
+        "\n".join(json.dumps(each_entry) for each_entry in all_entries) + "\n\n",
+        encoding="utf-8",
+    )
+    payload = {
+        "transcript_path": str(transcript_path),
+        "stop_hook_active": is_stop_hook_active,
+    }
+    gate_run = subprocess.run(
+        [sys.executable, str(gate_path)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        check=True,
+    )
+    return gate_run.stdout
+
+
+def should_allow_stop_when_title_follows_last_user_text(tmp_path: Path) -> None:
+    assert (
+        _run_gate(tmp_path, [_user_text_entry("fix the bug"), _title_call_entry()])
+        == ""
+    )
+
+
+def should_block_stop_when_user_text_follows_last_title(tmp_path: Path) -> None:
+    gate_output = _run_gate(
+        tmp_path, [_title_call_entry(), _user_text_entry("one more thing")]
+    )
+
+    decision = json.loads(gate_output)
+    assert decision["decision"] == "block"
+    assert "set_session_title" in decision["reason"]
+
+
+def should_allow_stop_when_stop_hook_is_already_active(tmp_path: Path) -> None:
+    assert (
+        _run_gate(tmp_path, [_user_text_entry("fix the bug")], is_stop_hook_active=True)
+        == ""
+    )
+
+
+def should_allow_stop_when_transcript_is_missing(tmp_path: Path) -> None:
+    gate_path = _install_gate(tmp_path / ".claude")
+    payload = {"transcript_path": str(tmp_path / "absent.jsonl")}
+
+    gate_run = subprocess.run(
+        [sys.executable, str(gate_path)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        check=True,
+    )
+
+    assert gate_run.stdout == ""

package/scripts/dev_env_scripts_constants/private_term_constants.py

@@ -26,6 +26,10 @@ class PrivateTermDigest:
     sha256: str
 
 
+OWNER_HANDLE_DIGEST = PrivateTermDigest(
+    length=7,
+    sha256="d526db5593d5986500e4770cb6018f2d33c459ed93657487958a6086e52e6147",
+)
 ALL_PRIVATE_TERM_DIGESTS: frozenset[PrivateTermDigest] = frozenset(
     {
         PrivateTermDigest(
@@ -36,16 +40,16 @@ ALL_PRIVATE_TERM_DIGESTS: frozenset[PrivateTermDigest] = frozenset(
             length=16,
             sha256="182cb82e3e973d041b8527659064153f8c4af79503bd198508d3655d9a932fdf",
         ),
-        PrivateTermDigest(
-            length=7,
-            sha256="d526db5593d5986500e4770cb6018f2d33c459ed93657487958a6086e52e6147",
-        ),
+        OWNER_HANDLE_DIGEST,
         PrivateTermDigest(
             length=7,
             sha256="968e2d5b08687bf42997461cbdef6c844eabbf04f440cee888c95b864c2a4bcc",
         ),
     }
 )
+ALL_COMMIT_IDENTITY_ACCEPTED_DIGESTS: frozenset[PrivateTermDigest] = frozenset(
+    {OWNER_HANDLE_DIGEST}
+)
 PRIVATE_TERM_TEXT_ENCODING = "utf-8"
 PRIVATE_TERM_FINDING_CODE = "private-term"
 PRIVATE_TERM_MESSAGE_TEMPLATE = (

package/scripts/private_term_scan.py

@@ -19,6 +19,7 @@ from collections.abc import Sequence
 from pathlib import Path
 
 from dev_env_scripts_constants.private_term_constants import (
+    ALL_COMMIT_IDENTITY_ACCEPTED_DIGESTS,
     ALL_EVENT_TEXT_FIELDS,
     ALL_PRIVATE_TERM_DIGESTS,
     COMMIT_FIELD_SEPARATOR,
@@ -34,18 +35,23 @@ from dev_env_scripts_constants.private_term_constants import (
     PRIVATE_TERM_MESSAGE_TEMPLATE,
     PRIVATE_TERM_TEXT_ENCODING,
     SHORT_SHA_LENGTH,
+    PrivateTermDigest,
 )
 from private_terms import private_term_line_numbers
 
 
-def _findings_for(label: str, text: str) -> list[str]:
+def _findings_for(
+    label: str,
+    text: str,
+    all_term_digests: frozenset[PrivateTermDigest],
+) -> list[str]:
     return [
         FINDING_LINE_TEMPLATE.format(
             label=label,
             message=PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
         )
         for each_line_number in private_term_line_numbers(
-            text, ALL_PRIVATE_TERM_DIGESTS
+            text, all_term_digests
         )
     ]
 
@@ -67,7 +73,9 @@ def scan_event(event_path: Path) -> list[str]:
             continue
         text = event_object.get(each_field)
         if isinstance(text, str):
-            all_findings.extend(_findings_for(each_label, text))
+            all_findings.extend(
+                _findings_for(each_label, text, ALL_PRIVATE_TERM_DIGESTS)
+            )
     return all_findings
 
 
@@ -80,10 +88,12 @@ def _commit_findings(record: str) -> list[str]:
         *_findings_for(
             COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_IDENTITY_PART),
             re.sub(GITHUB_NOREPLY_ADDRESS_PATTERN, MASKED_ADDRESS, identity, flags=re.IGNORECASE),
+            ALL_PRIVATE_TERM_DIGESTS - ALL_COMMIT_IDENTITY_ACCEPTED_DIGESTS,
         ),
         *_findings_for(
             COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_MESSAGE_PART),
             message,
+            ALL_PRIVATE_TERM_DIGESTS,
         ),
     ]
 
@@ -99,6 +109,8 @@ def scan_commits(repository_root: Path, commit_range: str) -> list[str]:
         One finding per commit identity or message line that names a private
         organization. An identity address ending in users.noreply.github.com
         is left out of the scan, since GitHub builds it from the account handle.
+        The owner's own handle passes in an identity and still fails in a
+        message.
     """
     log_text = subprocess.run(
         ["git", "-C", str(repository_root), "log", "--reverse", COMMIT_LOG_FORMAT, commit_range],

package/scripts/tests/test_private_term_scan.py

@@ -9,6 +9,7 @@ import sys
 from pathlib import Path
 
 import pytest
+from dev_env_scripts_constants import private_term_constants
 from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
 
 _SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
@@ -18,7 +19,16 @@ if str(_SCRIPTS_DIRECTORY) not in sys.path:
 import private_term_scan
 
 _FIXTURE_TERM = "acmewidget"
+_FIXTURE_OWNER_HANDLE = "patowner"
 _CLEAN_IDENTITY = ("Claude", "noreply@example.com")
+_OWNER_HANDLE = "ohcEnoJ"[::-1]
+_OWNER_IDENTITY = (_OWNER_HANDLE, f"24366590+{_OWNER_HANDLE}@users.noreply.github.com")
+
+
+def _fixture_digest(term: str) -> PrivateTermDigest:
+    return PrivateTermDigest(
+        length=len(term), sha256=hashlib.sha256(term.encode("utf-8")).hexdigest()
+    )
 
 
 @pytest.fixture(autouse=True)
@@ -26,14 +36,26 @@ def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(
         private_term_scan,
         "ALL_PRIVATE_TERM_DIGESTS",
-        frozenset(
-            {
-                PrivateTermDigest(
-                    length=len(_FIXTURE_TERM),
-                    sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
-                )
-            }
-        ),
+        frozenset({_fixture_digest(_FIXTURE_TERM), _fixture_digest(_FIXTURE_OWNER_HANDLE)}),
+    )
+    monkeypatch.setattr(
+        private_term_scan,
+        "ALL_COMMIT_IDENTITY_ACCEPTED_DIGESTS",
+        frozenset({_fixture_digest(_FIXTURE_OWNER_HANDLE)}),
+    )
+
+
+@pytest.fixture
+def shipped_private_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        private_term_scan,
+        "ALL_PRIVATE_TERM_DIGESTS",
+        private_term_constants.ALL_PRIVATE_TERM_DIGESTS,
+    )
+    monkeypatch.setattr(
+        private_term_scan,
+        "ALL_COMMIT_IDENTITY_ACCEPTED_DIGESTS",
+        private_term_constants.ALL_COMMIT_IDENTITY_ACCEPTED_DIGESTS,
     )
 
 
@@ -190,6 +212,57 @@ def test_should_flag_a_private_name_beside_a_github_noreply_address(
     assert " identity:" in all_findings[0]
 
 
+@pytest.mark.usefixtures("shipped_private_terms")
+def test_should_accept_the_owner_handle_as_a_commit_identity(tmp_path: Path) -> None:
+    repository_root, base, head = _repository_with_commits(
+        tmp_path, [("feat: clean change", *_OWNER_IDENTITY)]
+    )
+    assert private_term_scan.scan_commits(repository_root, f"{base}..{head}") == []
+
+
+@pytest.mark.usefixtures("shipped_private_terms")
+def test_should_flag_the_owner_handle_in_a_commit_message(tmp_path: Path) -> None:
+    repository_root, base, head = _repository_with_commits(
+        tmp_path, [(f"docs: note\n\nWritten by {_OWNER_HANDLE}.", *_OWNER_IDENTITY)]
+    )
+    all_findings = private_term_scan.scan_commits(repository_root, f"{base}..{head}")
+    assert len(all_findings) == 1
+    assert " message: Line 3 " in all_findings[0]
+
+
+def test_should_flag_a_private_name_in_the_message_of_an_owner_commit(
+    tmp_path: Path,
+) -> None:
+    repository_root, base, head = _repository_with_commits(
+        tmp_path,
+        [
+            (
+                "docs: note\n\nWritten for Acme Widgets.",
+                "Pat Owner",
+                "81234567+patowner@users.noreply.github.com",
+            )
+        ],
+    )
+    all_findings = private_term_scan.scan_commits(repository_root, f"{base}..{head}")
+    assert len(all_findings) == 1
+    assert " message: Line 3 " in all_findings[0]
+
+
+def test_should_flag_a_private_name_in_a_pull_request_body_beside_an_accepted_handle(
+    tmp_path: Path,
+) -> None:
+    event_path = _write_event(
+        tmp_path,
+        {"pull_request": {"title": "fix: one", "body": "By Pat Owner\nFor Acme Widgets\n"}},
+    )
+    assert private_term_scan.scan_event(event_path) == [
+        "pull request body: Line 1 names a private organization. "
+        "Describe it in general terms and drop any link to it.",
+        "pull request body: Line 2 names a private organization. "
+        "Describe it in general terms and drop any link to it.",
+    ]
+
+
 def test_should_print_findings_and_fail_from_the_command_line(
     tmp_path: Path, capsys: pytest.CaptureFixture[str]
 ) -> None: