claude-dev-env 8.8.0 → 8.10.0

package/scripts/private_term_scan.py

@@ -0,0 +1,135 @@
+"""Fail a GitHub event whose text or commits name a private organization.
+
+The workflow ``private-terms.yml`` runs this on pull request, issue, comment,
+review, and release events. Each finding names where the text sits and its
+line number, never the name itself, so the public log stays clean::
+
+    pull request body: Line 4 names a private organization. ...
+    commit 3f2a9c1b77de identity: Line 1 names a private organization. ...
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+from collections.abc import Sequence
+from pathlib import Path
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_EVENT_TEXT_FIELDS,
+    ALL_PRIVATE_TERM_DIGESTS,
+    COMMIT_FIELD_SEPARATOR,
+    COMMIT_FIELD_SPLIT_LIMIT,
+    COMMIT_IDENTITY_PART,
+    COMMIT_LABEL_TEMPLATE,
+    COMMIT_LOG_FORMAT,
+    COMMIT_MESSAGE_PART,
+    COMMIT_RECORD_SEPARATOR,
+    FINDING_LINE_TEMPLATE,
+    PRIVATE_TERM_MESSAGE_TEMPLATE,
+    PRIVATE_TERM_TEXT_ENCODING,
+    SHORT_SHA_LENGTH,
+)
+from private_terms import private_term_line_numbers
+
+
+def _findings_for(label: str, text: str) -> list[str]:
+    return [
+        FINDING_LINE_TEMPLATE.format(
+            label=label,
+            message=PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
+        )
+        for each_line_number in private_term_line_numbers(
+            text, ALL_PRIVATE_TERM_DIGESTS
+        )
+    ]
+
+
+def scan_event(event_path: Path) -> list[str]:
+    """Return findings for the texts a GitHub event payload carries.
+
+    Args:
+        event_path: Path of the event JSON the runner writes.
+
+    Returns:
+        One finding per line that names a private organization.
+    """
+    event = json.loads(event_path.read_text(encoding=PRIVATE_TERM_TEXT_ENCODING))
+    all_findings: list[str] = []
+    for each_object_key, each_field, each_label in ALL_EVENT_TEXT_FIELDS:
+        event_object = event.get(each_object_key)
+        if not isinstance(event_object, dict):
+            continue
+        text = event_object.get(each_field)
+        if isinstance(text, str):
+            all_findings.extend(_findings_for(each_label, text))
+    return all_findings
+
+
+def _commit_findings(record: str) -> list[str]:
+    full_sha, identity, message = record.split(
+        COMMIT_FIELD_SEPARATOR, COMMIT_FIELD_SPLIT_LIMIT
+    )
+    short_sha = full_sha[:SHORT_SHA_LENGTH]
+    return [
+        *_findings_for(
+            COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_IDENTITY_PART),
+            identity,
+        ),
+        *_findings_for(
+            COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_MESSAGE_PART),
+            message,
+        ),
+    ]
+
+
+def scan_commits(repository_root: Path, commit_range: str) -> list[str]:
+    """Return findings for commit messages and identities in a range, oldest first.
+
+    Args:
+        repository_root: Git checkout holding the range.
+        commit_range: A ``base..head`` revision range.
+
+    Returns:
+        One finding per commit identity or message line that names a private
+        organization.
+    """
+    log_text = subprocess.run(
+        ["git", "-C", str(repository_root), "log", "--reverse", COMMIT_LOG_FORMAT, commit_range],
+        check=True,
+        capture_output=True,
+        encoding=PRIVATE_TERM_TEXT_ENCODING,
+    ).stdout
+    return [
+        each_finding
+        for each_record in log_text.split(COMMIT_RECORD_SEPARATOR)
+        if each_record.strip()
+        for each_finding in _commit_findings(each_record.strip())
+    ]
+
+
+def main(all_arguments: Sequence[str]) -> int:
+    """Print every finding and return 1 when any text names a private organization.
+
+    Args:
+        all_arguments: Command-line arguments after the script name.
+
+    Returns:
+        0 for a clean event, 1 when any finding printed.
+    """
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument("--event-path", type=Path, required=True)
+    parser.add_argument("--commit-range")
+    arguments = parser.parse_args(list(all_arguments))
+    all_findings = scan_event(arguments.event_path)
+    if arguments.commit_range:
+        all_findings.extend(scan_commits(Path.cwd(), arguments.commit_range))
+    for each_finding in all_findings:
+        print(each_finding)
+    return 1 if all_findings else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/scripts/private_terms.py

@@ -0,0 +1,87 @@
+"""Find private organization names in text without holding the names.
+
+``private_term_line_numbers`` reports where a name appears and never the
+name, so a caller can print its result in a public log.
+"""
+
+from __future__ import annotations
+
+import bisect
+import hashlib
+from collections.abc import Collection
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_TEXT_ENCODING,
+    PrivateTermDigest,
+)
+
+
+def _normalized_text_and_line_starts(text: str) -> tuple[str, list[int]]:
+    all_normalized_lines: list[str] = []
+    all_line_starts: list[int] = []
+    offset = 0
+    for each_line in text.split("\n"):
+        normalized_line = "".join(
+            each_character
+            for each_character in each_line.lower()
+            if each_character.isascii() and each_character.isalnum()
+        )
+        all_line_starts.append(offset)
+        all_normalized_lines.append(normalized_line)
+        offset += len(normalized_line)
+    return "".join(all_normalized_lines), all_line_starts
+
+
+def _matching_window_starts(
+    normalized_text: str, length: int, all_wanted_digests: set[str]
+) -> list[int]:
+    return [
+        each_start
+        for each_start in range(len(normalized_text) - length + 1)
+        if hashlib.sha256(
+            normalized_text[each_start : each_start + length].encode(
+                PRIVATE_TERM_TEXT_ENCODING
+            )
+        ).hexdigest()
+        in all_wanted_digests
+    ]
+
+
+def private_term_line_numbers(
+    text: str,
+    all_term_digests: Collection[PrivateTermDigest] = ALL_PRIVATE_TERM_DIGESTS,
+) -> tuple[int, ...]:
+    """Return the sorted one-based line numbers where a private name starts.
+
+    Args:
+        text: Text to scan.
+        all_term_digests: Digests of the normalized names to find.
+
+    Returns:
+        Each line number once. A name that wraps onto the next line reports
+        the line where it starts.
+    """
+    normalized_text, all_line_starts = _normalized_text_and_line_starts(text)
+    all_found_line_numbers: set[int] = set()
+    for each_length in {each_digest.length for each_digest in all_term_digests}:
+        all_wanted_digests = {
+            each_digest.sha256
+            for each_digest in all_term_digests
+            if each_digest.length == each_length
+        }
+        all_found_line_numbers.update(
+            bisect.bisect_right(all_line_starts, each_start)
+            for each_start in _matching_window_starts(
+                normalized_text, each_length, all_wanted_digests
+            )
+        )
+    return tuple(sorted(all_found_line_numbers))
+
+
+def names_private_term(
+    text: str,
+    all_term_digests: Collection[PrivateTermDigest] = ALL_PRIVATE_TERM_DIGESTS,
+) -> bool:
+    """Return whether the text names any private organization."""
+    return bool(private_term_line_numbers(text, all_term_digests))

package/scripts/repository_checks/config/constants.py

@@ -12,6 +12,7 @@ CHECK_ID_ENV_VAR_DOCUMENTATION = "env-var-documentation"
 CHECK_ID_PACKAGE_INVENTORY = "package-inventory"
 CHECK_ID_PYTEST_TESTPATHS = "pytest-testpaths"
 CHECK_ID_TRACKED_PERSONAL_DATA = "tracked-secrets"
+CHECK_ID_TRACKED_PRIVATE_TERMS = "tracked-private-terms"
 
 ALL_CHECK_IDS = (
     CHECK_ID_CLAUDE_MD_ORPHANS,
@@ -19,6 +20,7 @@ ALL_CHECK_IDS = (
     CHECK_ID_PACKAGE_INVENTORY,
     CHECK_ID_PYTEST_TESTPATHS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
 )
 
 SEVERITY_BREAKING = "breaking"
@@ -29,6 +31,7 @@ SEVERITY_BY_CHECK_ID: dict[str, str] = {
     CHECK_ID_PACKAGE_INVENTORY: SEVERITY_SMELL,
     CHECK_ID_PYTEST_TESTPATHS: SEVERITY_BREAKING,
     CHECK_ID_TRACKED_PERSONAL_DATA: SEVERITY_BREAKING,
+    CHECK_ID_TRACKED_PRIVATE_TERMS: SEVERITY_BREAKING,
 }
 
 SUCCESS_EXIT_CODE = 0

package/scripts/repository_checks/runner.py

@@ -14,6 +14,9 @@ from repository_checks.env_var_documentation import (
 from repository_checks.models import RepositoryCheckReport, RepositoryFinding
 from repository_checks.package_inventory import collect_package_inventory_findings
 from repository_checks.pytest_testpaths import collect_pytest_testpath_findings
+from repository_checks.tracked_private_terms import (
+    collect_tracked_private_term_findings,
+)
 from repository_checks.tracked_secrets import collect_tracked_secret_findings
 
 RepositoryCollector = Callable[[Path, Sequence[str]], list[RepositoryFinding]]
@@ -90,4 +93,8 @@ def _all_collectors() -> tuple[tuple[str, RepositoryCollector], ...]:
             repository_constants.CHECK_ID_TRACKED_PERSONAL_DATA,
             collect_tracked_secret_findings,
         ),
+        (
+            repository_constants.CHECK_ID_TRACKED_PRIVATE_TERMS,
+            collect_tracked_private_term_findings,
+        ),
     )

package/scripts/repository_checks/tracked_private_terms.py

@@ -0,0 +1,57 @@
+"""Tracked-file check for private organization names."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from pathlib import Path
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_MESSAGE_TEMPLATE,
+)
+from policy_lint.config import constants as policy_constants
+from private_terms import private_term_line_numbers
+
+from repository_checks.config import constants as repository_constants
+from repository_checks.models import RepositoryFinding
+
+
+def _read_text_or_none(absolute_path: Path) -> str | None:
+    if not absolute_path.is_file():
+        return None
+    try:
+        return absolute_path.read_text(encoding=policy_constants.UTF8_ENCODING)
+    except UnicodeDecodeError:
+        return None
+
+
+def collect_tracked_private_term_findings(
+    repository_root: Path, all_tracked_paths: Sequence[str]
+) -> list[RepositoryFinding]:
+    """Return one finding for each tracked line that names a private organization.
+
+    Args:
+        repository_root: Git repository root.
+        all_tracked_paths: Repository-relative tracked paths.
+
+    Returns:
+        Findings that carry the path and line number, never the name.
+    """
+    all_findings: list[RepositoryFinding] = []
+    for each_relative_path in all_tracked_paths:
+        if (content := _read_text_or_none(repository_root / each_relative_path)) is None:
+            continue
+        posix_relative_path = each_relative_path.replace(
+            repository_constants.WINDOWS_PATH_SEPARATOR, policy_constants.PATH_SEPARATOR
+        )
+        all_findings.extend(
+            RepositoryFinding(
+                repository_constants.CHECK_ID_TRACKED_PRIVATE_TERMS,
+                posix_relative_path,
+                PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
+            )
+            for each_line_number in private_term_line_numbers(
+                content, ALL_PRIVATE_TERM_DIGESTS
+            )
+        )
+    return all_findings

package/scripts/test_claude_account_choice.py

@@ -158,6 +158,32 @@ class TestDecisionPayload:
         }
 
 
+class TestMetersPayload:
+    def should_name_no_meters_for_an_unread_account(self) -> None:
+        assert choice.meters_payload(None) is None
+
+    def should_carry_each_used_percent_and_reset_time(self) -> None:
+        read_meters = meters(
+            session_used=12.0,
+            weekly_used=34.0,
+            weekly_resets_in=timedelta(days=3),
+            session_resets_in=timedelta(hours=1),
+        )
+        assert choice.meters_payload(read_meters) == {
+            "session_used_percent": 12.0,
+            "session_resets_at": "2026-09-22T22:00:00+00:00",
+            "weekly_used_percent": 34.0,
+            "weekly_resets_at": "2026-09-25T21:00:00+00:00",
+        }
+
+    def should_name_no_reset_time_the_meter_left_out(self) -> None:
+        read_meters = meters(session_used=1.0, weekly_used=None, weekly_resets_in=None)
+        payload = choice.meters_payload(read_meters)
+        assert payload is not None
+        assert payload["weekly_used_percent"] is None
+        assert payload["weekly_resets_at"] is None
+
+
 class TestMain:
     def should_print_the_choice_and_the_config_directory_of_the_chosen_account(
         self,
@@ -190,6 +216,8 @@ class TestMain:
         assert exit_code == 0
         assert printed["account"] == choice.CHOICE_SECOND
         assert printed["config_dir"] == str(second_home)
+        assert printed["meters"]["main"] is None
+        assert printed["meters"]["second"]["weekly_used_percent"] == 10.0
 
     def should_print_no_config_directory_when_the_job_waits(
         self,

package/scripts/test_durable_post_lint.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import subprocess
 import sys
 from pathlib import Path
@@ -13,6 +14,7 @@ if str(_SCRIPTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
 
 import durable_post_lint
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
 
 SCRIPT_PATH = _SCRIPTS_DIRECTORY / "durable_post_lint.py"
 VALID_PR_BODY = """## Why
@@ -506,3 +508,91 @@ def test_a_release_body_carrying_a_contrast_stays_accepted() -> None:
     )
 
     assert all_findings == ()
+
+
+_PRIVATE_FIXTURE_TERM = "acmewidget"
+_ALL_PRIVATE_FIXTURE_DIGESTS = frozenset(
+    {
+        PrivateTermDigest(
+            length=len(_PRIVATE_FIXTURE_TERM),
+            sha256=hashlib.sha256(_PRIVATE_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+        )
+    }
+)
+
+
+@pytest.fixture
+def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        durable_post_lint, "ALL_PRIVATE_TERM_DIGESTS", _ALL_PRIVATE_FIXTURE_DIGESTS
+    )
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_body_naming_a_private_organization_reports_its_line() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-comment",
+        title=None,
+        body_text="Fixed.\nSee Acme-Widgets-Inc/tools#12.\n",
+    )
+
+    assert [each_finding.code for each_finding in all_findings] == ["private-term"]
+    assert "Line 2" in all_findings[0].message
+    assert "Acme" not in all_findings[0].message
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_title_naming_a_private_organization_reports() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="fix: handle the acme widgets upload",
+        body_text=VALID_PR_BODY,
+    )
+
+    assert [each_finding.code for each_finding in all_findings] == ["private-term"]
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_post_inside_the_private_organization_may_name_it() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-comment",
+        title=None,
+        body_text="See Acme-Widgets-Inc/tools#12.\n",
+        repository="Acme-Widgets-Inc/tools",
+    )
+
+    assert all_findings == ()
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_post_to_a_public_repository_may_not_name_it() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-comment",
+        title=None,
+        body_text="See Acme-Widgets-Inc/tools#12.\n",
+        repository="pat/public-tools",
+    )
+
+    assert [each_finding.code for each_finding in all_findings] == ["private-term"]
+
+
+def test_cli_accepts_a_repository(tmp_path: Path) -> None:
+    body_file = tmp_path / "body.md"
+    body_file.write_text("Comment body.\n", encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "pr-comment",
+            "--repository",
+            "pat/public-tools",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 0
+    assert completed_process.stderr == ""

package/scripts/tests/test_gh_artifact_upload.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import shutil
 import subprocess
 import sys
 import types
@@ -26,6 +27,15 @@ _DEFAULT_READBACK_ASSET = {
 }
 
 
+_REAL_WHICH = shutil.which
+_REAL_RUN = subprocess.run
+
+
+@pytest.fixture(autouse=True)
+def oxipng_on_path(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(shutil, "which", lambda _name: "oxipng")
+
+
 def _make_gh_stub(
     recorded_calls: list[list[str]],
     view_return_code: int,
@@ -203,3 +213,68 @@ def test_upload_artifact_missing_file_raises(monkeypatch: pytest.MonkeyPatch) ->
     monkeypatch.setattr(subprocess, "run", _make_gh_stub([], view_return_code=0))
     with pytest.raises(mod.ArtifactUploadError):
         mod.upload_artifact("does_not_exist_9f3a.png", "owner/repo")
+
+
+def test_upload_artifact_sends_the_oxipng_shrunk_png(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    image_module = pytest.importorskip("PIL.Image")
+    if _REAL_WHICH("oxipng") is None:
+        pytest.skip("oxipng is not on PATH")
+    monkeypatch.setattr(shutil, "which", _REAL_WHICH)
+    source_file = tmp_path / "contact_sheet.png"
+    image_module.new("RGB", (64, 64), (200, 40, 40)).save(
+        source_file, format="PNG", compress_level=0
+    )
+    source_bytes = source_file.read_bytes()
+    all_uploaded_sizes: list[int] = []
+    gh_stub = _make_gh_stub([], view_return_code=0)
+
+    def gh_stub_beside_live_oxipng(
+        all_command_arguments: list[str], **keyword_arguments: object
+    ) -> object:
+        if all_command_arguments[0] != "gh":
+            return _REAL_RUN(all_command_arguments, **keyword_arguments)
+        if "upload" in all_command_arguments:
+            staged_path = Path(all_command_arguments[4])
+            all_uploaded_sizes.append(staged_path.stat().st_size)
+            with image_module.open(staged_path) as uploaded:
+                assert uploaded.convert("RGB").tobytes() == bytes((200, 40, 40)) * 4096
+        return gh_stub(all_command_arguments, **keyword_arguments)
+
+    monkeypatch.setattr(subprocess, "run", gh_stub_beside_live_oxipng)
+
+    mod.upload_artifact(str(source_file), "owner/repo")
+
+    assert all_uploaded_sizes and all_uploaded_sizes[0] < len(source_bytes)
+    assert source_file.read_bytes() == source_bytes
+
+
+def test_upload_artifact_refuses_a_png_when_oxipng_is_missing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_file = tmp_path / "out.png"
+    source_file.write_bytes(b"binary")
+    recorded_calls: list[list[str]] = []
+    monkeypatch.setattr(shutil, "which", lambda _name: None)
+    monkeypatch.setattr(subprocess, "run", _make_gh_stub(recorded_calls, view_return_code=0))
+
+    with pytest.raises(mod.ArtifactUploadError, match="oxipng"):
+        mod.upload_artifact(str(source_file), "owner/repo")
+
+    assert not any("upload" in call for call in recorded_calls)
+
+
+def test_optimize_png_losslessly_leaves_other_formats_alone(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_file = tmp_path / "trace.zip"
+    source_file.write_bytes(b"PK archive")
+    recorded_calls: list[list[str]] = []
+    monkeypatch.setattr(shutil, "which", lambda _name: None)
+    monkeypatch.setattr(subprocess, "run", _make_gh_stub(recorded_calls, view_return_code=0))
+
+    mod.optimize_png_losslessly(source_file)
+
+    assert source_file.read_bytes() == b"PK archive"
+    assert recorded_calls == []

package/scripts/tests/test_match_exemptions.py

@@ -21,8 +21,8 @@ from repository_checks.tracked_secrets import collect_tracked_secret_findings
 CONTACT = "fixture-contact@company.io"
 CHANGED_CONTACT = "changed-contact@company.io"
 DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
-RUNNER_ADDRESS = "10.83.21.14"
-CHANGED_RUNNER_ADDRESS = "10.83.21.15"
+RUNNER_ADDRESS = "10.0.0.14"
+CHANGED_RUNNER_ADDRESS = "10.0.0.15"
 RUNNER_ADDRESS_DIGEST = hashlib.sha256(RUNNER_ADDRESS.encode()).hexdigest()