claude-dev-env 8.8.0 → 8.9.0

package/scripts/private_terms.py

@@ -0,0 +1,87 @@
+"""Find private organization names in text without holding the names.
+
+``private_term_line_numbers`` reports where a name appears and never the
+name, so a caller can print its result in a public log.
+"""
+
+from __future__ import annotations
+
+import bisect
+import hashlib
+from collections.abc import Collection
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_TEXT_ENCODING,
+    PrivateTermDigest,
+)
+
+
+def _normalized_text_and_line_starts(text: str) -> tuple[str, list[int]]:
+    all_normalized_lines: list[str] = []
+    all_line_starts: list[int] = []
+    offset = 0
+    for each_line in text.split("\n"):
+        normalized_line = "".join(
+            each_character
+            for each_character in each_line.lower()
+            if each_character.isascii() and each_character.isalnum()
+        )
+        all_line_starts.append(offset)
+        all_normalized_lines.append(normalized_line)
+        offset += len(normalized_line)
+    return "".join(all_normalized_lines), all_line_starts
+
+
+def _matching_window_starts(
+    normalized_text: str, length: int, all_wanted_digests: set[str]
+) -> list[int]:
+    return [
+        each_start
+        for each_start in range(len(normalized_text) - length + 1)
+        if hashlib.sha256(
+            normalized_text[each_start : each_start + length].encode(
+                PRIVATE_TERM_TEXT_ENCODING
+            )
+        ).hexdigest()
+        in all_wanted_digests
+    ]
+
+
+def private_term_line_numbers(
+    text: str,
+    all_term_digests: Collection[PrivateTermDigest] = ALL_PRIVATE_TERM_DIGESTS,
+) -> tuple[int, ...]:
+    """Return the sorted one-based line numbers where a private name starts.
+
+    Args:
+        text: Text to scan.
+        all_term_digests: Digests of the normalized names to find.
+
+    Returns:
+        Each line number once. A name that wraps onto the next line reports
+        the line where it starts.
+    """
+    normalized_text, all_line_starts = _normalized_text_and_line_starts(text)
+    all_found_line_numbers: set[int] = set()
+    for each_length in {each_digest.length for each_digest in all_term_digests}:
+        all_wanted_digests = {
+            each_digest.sha256
+            for each_digest in all_term_digests
+            if each_digest.length == each_length
+        }
+        all_found_line_numbers.update(
+            bisect.bisect_right(all_line_starts, each_start)
+            for each_start in _matching_window_starts(
+                normalized_text, each_length, all_wanted_digests
+            )
+        )
+    return tuple(sorted(all_found_line_numbers))
+
+
+def names_private_term(
+    text: str,
+    all_term_digests: Collection[PrivateTermDigest] = ALL_PRIVATE_TERM_DIGESTS,
+) -> bool:
+    """Return whether the text names any private organization."""
+    return bool(private_term_line_numbers(text, all_term_digests))

package/scripts/repository_checks/config/constants.py

@@ -12,6 +12,7 @@ CHECK_ID_ENV_VAR_DOCUMENTATION = "env-var-documentation"
 CHECK_ID_PACKAGE_INVENTORY = "package-inventory"
 CHECK_ID_PYTEST_TESTPATHS = "pytest-testpaths"
 CHECK_ID_TRACKED_PERSONAL_DATA = "tracked-secrets"
+CHECK_ID_TRACKED_PRIVATE_TERMS = "tracked-private-terms"
 
 ALL_CHECK_IDS = (
     CHECK_ID_CLAUDE_MD_ORPHANS,
@@ -19,6 +20,7 @@ ALL_CHECK_IDS = (
     CHECK_ID_PACKAGE_INVENTORY,
     CHECK_ID_PYTEST_TESTPATHS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
 )
 
 SEVERITY_BREAKING = "breaking"
@@ -29,6 +31,7 @@ SEVERITY_BY_CHECK_ID: dict[str, str] = {
     CHECK_ID_PACKAGE_INVENTORY: SEVERITY_SMELL,
     CHECK_ID_PYTEST_TESTPATHS: SEVERITY_BREAKING,
     CHECK_ID_TRACKED_PERSONAL_DATA: SEVERITY_BREAKING,
+    CHECK_ID_TRACKED_PRIVATE_TERMS: SEVERITY_BREAKING,
 }
 
 SUCCESS_EXIT_CODE = 0

package/scripts/repository_checks/runner.py

@@ -14,6 +14,9 @@ from repository_checks.env_var_documentation import (
 from repository_checks.models import RepositoryCheckReport, RepositoryFinding
 from repository_checks.package_inventory import collect_package_inventory_findings
 from repository_checks.pytest_testpaths import collect_pytest_testpath_findings
+from repository_checks.tracked_private_terms import (
+    collect_tracked_private_term_findings,
+)
 from repository_checks.tracked_secrets import collect_tracked_secret_findings
 
 RepositoryCollector = Callable[[Path, Sequence[str]], list[RepositoryFinding]]
@@ -90,4 +93,8 @@ def _all_collectors() -> tuple[tuple[str, RepositoryCollector], ...]:
             repository_constants.CHECK_ID_TRACKED_PERSONAL_DATA,
             collect_tracked_secret_findings,
         ),
+        (
+            repository_constants.CHECK_ID_TRACKED_PRIVATE_TERMS,
+            collect_tracked_private_term_findings,
+        ),
     )

package/scripts/repository_checks/tracked_private_terms.py

@@ -0,0 +1,57 @@
+"""Tracked-file check for private organization names."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from pathlib import Path
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_MESSAGE_TEMPLATE,
+)
+from policy_lint.config import constants as policy_constants
+from private_terms import private_term_line_numbers
+
+from repository_checks.config import constants as repository_constants
+from repository_checks.models import RepositoryFinding
+
+
+def _read_text_or_none(absolute_path: Path) -> str | None:
+    if not absolute_path.is_file():
+        return None
+    try:
+        return absolute_path.read_text(encoding=policy_constants.UTF8_ENCODING)
+    except UnicodeDecodeError:
+        return None
+
+
+def collect_tracked_private_term_findings(
+    repository_root: Path, all_tracked_paths: Sequence[str]
+) -> list[RepositoryFinding]:
+    """Return one finding for each tracked line that names a private organization.
+
+    Args:
+        repository_root: Git repository root.
+        all_tracked_paths: Repository-relative tracked paths.
+
+    Returns:
+        Findings that carry the path and line number, never the name.
+    """
+    all_findings: list[RepositoryFinding] = []
+    for each_relative_path in all_tracked_paths:
+        if (content := _read_text_or_none(repository_root / each_relative_path)) is None:
+            continue
+        posix_relative_path = each_relative_path.replace(
+            repository_constants.WINDOWS_PATH_SEPARATOR, policy_constants.PATH_SEPARATOR
+        )
+        all_findings.extend(
+            RepositoryFinding(
+                repository_constants.CHECK_ID_TRACKED_PRIVATE_TERMS,
+                posix_relative_path,
+                PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
+            )
+            for each_line_number in private_term_line_numbers(
+                content, ALL_PRIVATE_TERM_DIGESTS
+            )
+        )
+    return all_findings

package/scripts/test_claude_account_choice.py

@@ -158,6 +158,32 @@ class TestDecisionPayload:
         }
 
 
+class TestMetersPayload:
+    def should_name_no_meters_for_an_unread_account(self) -> None:
+        assert choice.meters_payload(None) is None
+
+    def should_carry_each_used_percent_and_reset_time(self) -> None:
+        read_meters = meters(
+            session_used=12.0,
+            weekly_used=34.0,
+            weekly_resets_in=timedelta(days=3),
+            session_resets_in=timedelta(hours=1),
+        )
+        assert choice.meters_payload(read_meters) == {
+            "session_used_percent": 12.0,
+            "session_resets_at": "2026-09-22T22:00:00+00:00",
+            "weekly_used_percent": 34.0,
+            "weekly_resets_at": "2026-09-25T21:00:00+00:00",
+        }
+
+    def should_name_no_reset_time_the_meter_left_out(self) -> None:
+        read_meters = meters(session_used=1.0, weekly_used=None, weekly_resets_in=None)
+        payload = choice.meters_payload(read_meters)
+        assert payload is not None
+        assert payload["weekly_used_percent"] is None
+        assert payload["weekly_resets_at"] is None
+
+
 class TestMain:
     def should_print_the_choice_and_the_config_directory_of_the_chosen_account(
         self,
@@ -190,6 +216,8 @@ class TestMain:
         assert exit_code == 0
         assert printed["account"] == choice.CHOICE_SECOND
         assert printed["config_dir"] == str(second_home)
+        assert printed["meters"]["main"] is None
+        assert printed["meters"]["second"]["weekly_used_percent"] == 10.0
 
     def should_print_no_config_directory_when_the_job_waits(
         self,

package/scripts/test_durable_post_lint.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import hashlib
 import subprocess
 import sys
 from pathlib import Path
@@ -13,6 +14,7 @@ if str(_SCRIPTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
 
 import durable_post_lint
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
 
 SCRIPT_PATH = _SCRIPTS_DIRECTORY / "durable_post_lint.py"
 VALID_PR_BODY = """## Why
@@ -506,3 +508,91 @@ def test_a_release_body_carrying_a_contrast_stays_accepted() -> None:
     )
 
     assert all_findings == ()
+
+
+_PRIVATE_FIXTURE_TERM = "acmewidget"
+_ALL_PRIVATE_FIXTURE_DIGESTS = frozenset(
+    {
+        PrivateTermDigest(
+            length=len(_PRIVATE_FIXTURE_TERM),
+            sha256=hashlib.sha256(_PRIVATE_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+        )
+    }
+)
+
+
+@pytest.fixture
+def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        durable_post_lint, "ALL_PRIVATE_TERM_DIGESTS", _ALL_PRIVATE_FIXTURE_DIGESTS
+    )
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_body_naming_a_private_organization_reports_its_line() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-comment",
+        title=None,
+        body_text="Fixed.\nSee Acme-Widgets-Inc/tools#12.\n",
+    )
+
+    assert [each_finding.code for each_finding in all_findings] == ["private-term"]
+    assert "Line 2" in all_findings[0].message
+    assert "Acme" not in all_findings[0].message
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_title_naming_a_private_organization_reports() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="fix: handle the acme widgets upload",
+        body_text=VALID_PR_BODY,
+    )
+
+    assert [each_finding.code for each_finding in all_findings] == ["private-term"]
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_post_inside_the_private_organization_may_name_it() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-comment",
+        title=None,
+        body_text="See Acme-Widgets-Inc/tools#12.\n",
+        repository="Acme-Widgets-Inc/tools",
+    )
+
+    assert all_findings == ()
+
+
+@pytest.mark.usefixtures("private_fixture_terms")
+def test_a_post_to_a_public_repository_may_not_name_it() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-comment",
+        title=None,
+        body_text="See Acme-Widgets-Inc/tools#12.\n",
+        repository="pat/public-tools",
+    )
+
+    assert [each_finding.code for each_finding in all_findings] == ["private-term"]
+
+
+def test_cli_accepts_a_repository(tmp_path: Path) -> None:
+    body_file = tmp_path / "body.md"
+    body_file.write_text("Comment body.\n", encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "pr-comment",
+            "--repository",
+            "pat/public-tools",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 0
+    assert completed_process.stderr == ""

package/scripts/tests/test_gh_artifact_upload.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import shutil
 import subprocess
 import sys
 import types
@@ -26,6 +27,15 @@ _DEFAULT_READBACK_ASSET = {
 }
 
 
+_REAL_WHICH = shutil.which
+_REAL_RUN = subprocess.run
+
+
+@pytest.fixture(autouse=True)
+def oxipng_on_path(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(shutil, "which", lambda _name: "oxipng")
+
+
 def _make_gh_stub(
     recorded_calls: list[list[str]],
     view_return_code: int,
@@ -203,3 +213,68 @@ def test_upload_artifact_missing_file_raises(monkeypatch: pytest.MonkeyPatch) ->
     monkeypatch.setattr(subprocess, "run", _make_gh_stub([], view_return_code=0))
     with pytest.raises(mod.ArtifactUploadError):
         mod.upload_artifact("does_not_exist_9f3a.png", "owner/repo")
+
+
+def test_upload_artifact_sends_the_oxipng_shrunk_png(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    image_module = pytest.importorskip("PIL.Image")
+    if _REAL_WHICH("oxipng") is None:
+        pytest.skip("oxipng is not on PATH")
+    monkeypatch.setattr(shutil, "which", _REAL_WHICH)
+    source_file = tmp_path / "contact_sheet.png"
+    image_module.new("RGB", (64, 64), (200, 40, 40)).save(
+        source_file, format="PNG", compress_level=0
+    )
+    source_bytes = source_file.read_bytes()
+    all_uploaded_sizes: list[int] = []
+    gh_stub = _make_gh_stub([], view_return_code=0)
+
+    def gh_stub_beside_live_oxipng(
+        all_command_arguments: list[str], **keyword_arguments: object
+    ) -> object:
+        if all_command_arguments[0] != "gh":
+            return _REAL_RUN(all_command_arguments, **keyword_arguments)
+        if "upload" in all_command_arguments:
+            staged_path = Path(all_command_arguments[4])
+            all_uploaded_sizes.append(staged_path.stat().st_size)
+            with image_module.open(staged_path) as uploaded:
+                assert uploaded.convert("RGB").tobytes() == bytes((200, 40, 40)) * 4096
+        return gh_stub(all_command_arguments, **keyword_arguments)
+
+    monkeypatch.setattr(subprocess, "run", gh_stub_beside_live_oxipng)
+
+    mod.upload_artifact(str(source_file), "owner/repo")
+
+    assert all_uploaded_sizes and all_uploaded_sizes[0] < len(source_bytes)
+    assert source_file.read_bytes() == source_bytes
+
+
+def test_upload_artifact_refuses_a_png_when_oxipng_is_missing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_file = tmp_path / "out.png"
+    source_file.write_bytes(b"binary")
+    recorded_calls: list[list[str]] = []
+    monkeypatch.setattr(shutil, "which", lambda _name: None)
+    monkeypatch.setattr(subprocess, "run", _make_gh_stub(recorded_calls, view_return_code=0))
+
+    with pytest.raises(mod.ArtifactUploadError, match="oxipng"):
+        mod.upload_artifact(str(source_file), "owner/repo")
+
+    assert not any("upload" in call for call in recorded_calls)
+
+
+def test_optimize_png_losslessly_leaves_other_formats_alone(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_file = tmp_path / "trace.zip"
+    source_file.write_bytes(b"PK archive")
+    recorded_calls: list[list[str]] = []
+    monkeypatch.setattr(shutil, "which", lambda _name: None)
+    monkeypatch.setattr(subprocess, "run", _make_gh_stub(recorded_calls, view_return_code=0))
+
+    mod.optimize_png_losslessly(source_file)
+
+    assert source_file.read_bytes() == b"PK archive"
+    assert recorded_calls == []

package/scripts/tests/test_match_exemptions.py

@@ -21,8 +21,8 @@ from repository_checks.tracked_secrets import collect_tracked_secret_findings
 CONTACT = "fixture-contact@company.io"
 CHANGED_CONTACT = "changed-contact@company.io"
 DIGEST = hashlib.sha256(CONTACT.encode()).hexdigest()
-RUNNER_ADDRESS = "10.83.21.14"
-CHANGED_RUNNER_ADDRESS = "10.83.21.15"
+RUNNER_ADDRESS = "10.0.0.14"
+CHANGED_RUNNER_ADDRESS = "10.0.0.15"
 RUNNER_ADDRESS_DIGEST = hashlib.sha256(RUNNER_ADDRESS.encode()).hexdigest()
 
 

package/scripts/tests/test_private_term_scan.py

@@ -0,0 +1,176 @@
+"""Behavior tests for the GitHub event private-term scan."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+import private_term_scan
+
+_FIXTURE_TERM = "acmewidget"
+_CLEAN_IDENTITY = ("Claude", "noreply@example.com")
+
+
+@pytest.fixture(autouse=True)
+def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        private_term_scan,
+        "ALL_PRIVATE_TERM_DIGESTS",
+        frozenset(
+            {
+                PrivateTermDigest(
+                    length=len(_FIXTURE_TERM),
+                    sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+                )
+            }
+        ),
+    )
+
+
+def _write_event(tmp_path: Path, event: dict[str, object]) -> Path:
+    event_path = tmp_path / "event.json"
+    event_path.write_text(json.dumps(event), encoding="utf-8")
+    return event_path
+
+
+def _git(repository_root: Path, *all_arguments: str, name: str, email: str) -> str:
+    completed = subprocess.run(
+        ["git", "-C", str(repository_root), *all_arguments],
+        check=True,
+        capture_output=True,
+        text=True,
+        env={
+            "GIT_AUTHOR_NAME": name,
+            "GIT_AUTHOR_EMAIL": email,
+            "GIT_COMMITTER_NAME": name,
+            "GIT_COMMITTER_EMAIL": email,
+            "GIT_CONFIG_GLOBAL": "/dev/null",
+            "GIT_CONFIG_NOSYSTEM": "1",
+            "HOME": str(repository_root),
+        },
+    )
+    return completed.stdout.strip()
+
+
+def _repository_with_commits(
+    tmp_path: Path, all_commits: list[tuple[str, str, str]]
+) -> tuple[Path, str, str]:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _git(
+        repository_root, "init", "-q", name=_CLEAN_IDENTITY[0], email=_CLEAN_IDENTITY[1]
+    )
+    _git(
+        repository_root,
+        "commit",
+        "-q",
+        "--allow-empty",
+        "-m",
+        "base",
+        name=_CLEAN_IDENTITY[0],
+        email=_CLEAN_IDENTITY[1],
+    )
+    base = _git(repository_root, "rev-parse", "HEAD", name="x", email="x@example.com")
+    for each_message, each_name, each_email in all_commits:
+        _git(
+            repository_root,
+            "commit",
+            "-q",
+            "--allow-empty",
+            "-m",
+            each_message,
+            name=each_name,
+            email=each_email,
+        )
+    head = _git(repository_root, "rev-parse", "HEAD", name="x", email="x@example.com")
+    return repository_root, base, head
+
+
+def test_should_flag_a_pull_request_body_line(tmp_path: Path) -> None:
+    event_path = _write_event(
+        tmp_path,
+        {
+            "pull_request": {
+                "title": "fix: one",
+                "body": "Why\nSee Acme-Widgets-Inc/x#1\n",
+            }
+        },
+    )
+    all_findings = private_term_scan.scan_event(event_path)
+    assert all_findings == [
+        "pull request body: Line 2 names a private organization. "
+        "Describe it in general terms and drop any link to it."
+    ]
+
+
+def test_should_flag_a_pull_request_title(tmp_path: Path) -> None:
+    event_path = _write_event(
+        tmp_path, {"pull_request": {"title": "fix: acme widget upload", "body": None}}
+    )
+    assert private_term_scan.scan_event(event_path)[0].startswith("pull request title:")
+
+
+@pytest.mark.parametrize(
+    ("event", "label"),
+    [
+        ({"comment": {"body": "by acme widgets"}}, "comment body"),
+        ({"review": {"body": "by acme widgets"}}, "review body"),
+        ({"issue": {"title": "clean", "body": "by acme widgets"}}, "issue body"),
+        ({"release": {"name": "v1", "body": "by acme widgets"}}, "release body"),
+    ],
+)
+def test_should_flag_each_event_text(
+    tmp_path: Path, event: dict[str, object], label: str
+) -> None:
+    all_findings = private_term_scan.scan_event(_write_event(tmp_path, event))
+    assert len(all_findings) == 1
+    assert all_findings[0].startswith(f"{label}: Line 1")
+
+
+def test_should_pass_a_clean_event(tmp_path: Path) -> None:
+    event_path = _write_event(
+        tmp_path,
+        {"comment": {"body": "Looks good."}, "issue": {"title": "t", "body": None}},
+    )
+    assert private_term_scan.scan_event(event_path) == []
+
+
+def test_should_flag_a_commit_message_and_a_commit_identity(tmp_path: Path) -> None:
+    repository_root, base, head = _repository_with_commits(
+        tmp_path,
+        [
+            ("fix: clean change", "Pat", "pat@acmewidgets.example.com"),
+            ("docs: note\n\nWritten for Acme Widgets.", *_CLEAN_IDENTITY),
+            ("chore: clean", *_CLEAN_IDENTITY),
+        ],
+    )
+    all_findings = private_term_scan.scan_commits(repository_root, f"{base}..{head}")
+    assert len(all_findings) == 2
+    assert all_findings[0].startswith("commit ")
+    assert " identity:" in all_findings[0]
+    assert " message: Line 3 " in all_findings[1]
+    assert all("acme" not in each_finding.lower() for each_finding in all_findings)
+
+
+def test_should_print_findings_and_fail_from_the_command_line(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
+    event_path = _write_event(tmp_path, {"comment": {"body": "by acme widgets"}})
+    exit_code = private_term_scan.main(["--event-path", str(event_path)])
+    assert exit_code == 1
+    assert "comment body: Line 1" in capsys.readouterr().out
+
+
+def test_should_pass_from_the_command_line_on_a_clean_event(tmp_path: Path) -> None:
+    event_path = _write_event(tmp_path, {"comment": {"body": "fine"}})
+    assert private_term_scan.main(["--event-path", str(event_path)]) == 0

package/scripts/tests/test_private_terms.py

@@ -0,0 +1,59 @@
+"""Behavior tests for the hashed private-term matcher."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+from pathlib import Path
+
+_SCRIPTS_DIRECTORY = Path(__file__).resolve().parents[1]
+if str(_SCRIPTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_SCRIPTS_DIRECTORY))
+
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+from private_terms import names_private_term, private_term_line_numbers
+
+_FIXTURE_TERM = "acmewidget"
+_ALL_FIXTURE_DIGESTS = frozenset(
+    {
+        PrivateTermDigest(
+            length=len(_FIXTURE_TERM),
+            sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+        )
+    }
+)
+
+
+def test_should_report_the_line_of_a_spaced_spelling() -> None:
+    text = "first line\nBuilt for Acme Widgets, Inc. last year\nthird line\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (2,)
+
+
+def test_should_report_a_hyphenated_owner_in_a_link() -> None:
+    text = "See https://github.com/Acme-Widgets-Inc/tools/pull/12 for detail."
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (1,)
+
+
+def test_should_report_an_email_domain() -> None:
+    text = "Co-authored-by: Pat <pat@ACMEWIDGETS.EXAMPLE.COM>"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (1,)
+
+
+def test_should_report_a_term_split_across_a_line_break_at_its_first_line() -> None:
+    text = "one\nsold by Acme\nWidgets today\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (2,)
+
+
+def test_should_report_each_line_once() -> None:
+    text = "acme widget and acme-widget\nclean\nAcmeWidget\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == (1, 3)
+
+
+def test_should_report_nothing_for_clean_text() -> None:
+    text = "An acme of widgets.\nWidget acme.\n"
+    assert private_term_line_numbers(text, _ALL_FIXTURE_DIGESTS) == ()
+    assert not names_private_term(text, _ALL_FIXTURE_DIGESTS)
+
+
+def test_should_answer_whether_text_names_a_term() -> None:
+    assert names_private_term("Acme-Widgets-Inc", _ALL_FIXTURE_DIGESTS)