claude-dev-env 8.8.0 → 8.9.0

package/scripts/tests/test_repository_policy.py

@@ -20,6 +20,7 @@ from repository_checks.config.constants import (
     CHECK_ID_PACKAGE_INVENTORY,
     CHECK_ID_PYTEST_TESTPATHS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
     FOLLOWUP_LEDGER_MODULE_NAME,
     SUCCESS_EXIT_CODE,
 )
@@ -52,6 +53,7 @@ def test_should_keep_stable_check_identifiers() -> None:
         CHECK_ID_PACKAGE_INVENTORY,
         CHECK_ID_PYTEST_TESTPATHS,
         CHECK_ID_TRACKED_PERSONAL_DATA,
+        CHECK_ID_TRACKED_PRIVATE_TERMS,
     )
 
 

package/scripts/tests/test_runner.py

@@ -12,6 +12,7 @@ if str(_TESTS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_TESTS_DIRECTORY))
 
 from repository_checks.config.constants import (
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
     FAILED_CHECK_EXIT_CODE,
     FINDINGS_EXIT_CODE,
 )
@@ -57,3 +58,22 @@ def test_should_emit_stable_sorted_findings(tmp_path: Path) -> None:
     assert first_exit_code == FINDINGS_EXIT_CODE
     assert first_stdout == second_stdout
     assert first_stdout.index("alpha/CLAUDE.md") < first_stdout.index("zeta/CLAUDE.md")
+
+
+def test_should_fail_closed_when_the_private_term_check_cannot_read_a_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    repository_root = seed_clean_repository(tmp_path / "repo")
+
+    def fail_private_term_scan(
+        _repository_root: Path, _all_tracked_paths: object
+    ) -> list[object]:
+        raise OSError("tracked file unreadable")
+
+    monkeypatch.setattr(
+        "repository_checks.runner.collect_tracked_private_term_findings",
+        fail_private_term_scan,
+    )
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FAILED_CHECK_EXIT_CODE
+    assert f"error: rule failed: {CHECK_ID_TRACKED_PRIVATE_TERMS}" in stdout_text

package/scripts/tests/test_tracked_private_terms.py

@@ -0,0 +1,71 @@
+"""Behavior tests for the tracked private-term check."""
+
+from __future__ import annotations
+
+import hashlib
+import sys
+from pathlib import Path
+
+import pytest
+from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+from repository_checks import tracked_private_terms
+from repository_checks.config.constants import (
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
+    FINDINGS_EXIT_CODE,
+    SUCCESS_EXIT_CODE,
+)
+
+_TESTS_DIRECTORY = Path(__file__).resolve().parent
+if str(_TESTS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TESTS_DIRECTORY))
+
+from repository_policy_test_support import (
+    commit_tracked_files,
+    initialize_repository,
+    run_policy,
+    write_text,
+)
+
+_FIXTURE_TERM = "acmewidget"
+
+
+@pytest.fixture(autouse=True)
+def private_fixture_terms(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        tracked_private_terms,
+        "ALL_PRIVATE_TERM_DIGESTS",
+        frozenset(
+            {
+                PrivateTermDigest(
+                    length=len(_FIXTURE_TERM),
+                    sha256=hashlib.sha256(_FIXTURE_TERM.encode("utf-8")).hexdigest(),
+                )
+            }
+        ),
+    )
+
+
+def test_should_flag_a_tracked_file_naming_a_private_organization(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "docs" / "notes.md", "intro\nBuilt by Acme Widgets.\n")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == FINDINGS_EXIT_CODE
+    assert f"{CHECK_ID_TRACKED_PRIVATE_TERMS}: docs/notes.md:" in stdout_text
+    assert "Line 2" in stdout_text
+    assert "Acme" not in stdout_text
+
+
+def test_should_pass_a_tree_that_names_no_private_organization(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    initialize_repository(repository_root)
+    write_text(repository_root / "docs" / "notes.md", "An acme of widget design.\n")
+    commit_tracked_files(repository_root)
+    exit_code, stdout_text, _stderr_text = run_policy(repository_root)
+    assert exit_code == SUCCESS_EXIT_CODE
+    assert stdout_text == ""

package/scripts/tests/test_tracked_secrets.py

@@ -46,7 +46,7 @@ _PII_PREVENTION_CONSTANTS = load_hooks_module(
 _PII_CATEGORY_EMAIL = _PII_PREVENTION_CONSTANTS.CATEGORY_EMAIL
 _PII_CATEGORY_HOME_PATH = _PII_PREVENTION_CONSTANTS.CATEGORY_HOME_PATH
 _PII_CATEGORY_PRIVATE_IP = _PII_PREVENTION_CONSTANTS.CATEGORY_PRIVATE_IP
-_OWNED_ADDRESS = "10.83.21.14"
+_OWNED_ADDRESS = "10.0.0.14"
 _OWNED_ADDRESS_RELATIVE_PATH = "src/runner.py"