claude-dev-env 1.92.0 → 1.93.0

package/hooks/blocking/test_pii_prevention_windows_git_path.py

@@ -0,0 +1,41 @@
+"""Windows path detection tests for the PII prevention commit gate.
+
+Guards the unquoted absolute Windows git path shape on the PowerShell surface::
+
+    is_git_commit_shell_command(r"C:\\tools\\git.exe commit")
+    ok:   True   -- the git.exe basename survives tokenization
+    flag: False  -- backslash escaping mangles the basename token
+
+An unquoted absolute path to the git binary must still be recognized as a
+commit so a staged blob carrying PII cannot slip past the gate.
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from pathlib import Path
+
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+if str(_BLOCKING_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_BLOCKING_DIRECTORY))
+
+_blocker_module = importlib.import_module("pii_prevention_blocker")
+
+
+def test_unquoted_windows_git_exe_path_is_detected_as_commit() -> None:
+    assert _blocker_module.is_git_commit_shell_command(r"C:\tools\git.exe commit -m x")
+
+
+def test_unquoted_windows_git_path_without_extension_is_detected() -> None:
+    assert _blocker_module.is_git_commit_shell_command(r"D:\bin\git commit -m note")
+
+
+def test_quoted_windows_git_path_stays_detected_as_commit() -> None:
+    assert _blocker_module.is_git_commit_shell_command(
+        r'& "C:\Program Files\Git\cmd\git.exe" commit -m x'
+    )
+
+
+def test_unquoted_windows_git_status_is_not_a_commit() -> None:
+    assert not _blocker_module.is_git_commit_shell_command(r"C:\tools\git.exe status")

package/hooks/blocking/test_pii_scanner.py

@@ -0,0 +1,165 @@
+"""Behavior tests for the pure PII scanner."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_HOOK_DIR = Path(__file__).parent
+_HOOKS_DIR = _HOOK_DIR.parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+if str(_HOOKS_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_DIR))
+
+from pii_scanner import (  # noqa: E402
+    is_path_exempt_from_pii_scan,
+    scan_text_for_pii,
+)
+
+SYNTHETIC_GITHUB_TOKEN = "ghp_" + ("A" * 36)
+SYNTHETIC_AWS_KEY = "AKIA" + ("B" * 16)
+SYNTHETIC_PEM_HEADER = "-----BEGIN RSA PRIVATE KEY-----"
+SYNTHETIC_REAL_EMAIL = "person.fixture@company-example.io"
+SYNTHETIC_SAFE_EMAIL = "user@example.com"
+SYNTHETIC_HOME_PATH = r"C:\Users\fixture_real_user\notes.txt"
+SYNTHETIC_PLACEHOLDER_HOME = r"C:\Users\<you>\notes.txt"
+SYNTHETIC_PRIVATE_IP = "192.168.42.17"
+SYNTHETIC_PUBLIC_IP = "8.8.8.8"
+
+
+def test_flags_real_email_and_allows_example_domain() -> None:
+    all_email_hits = scan_text_for_pii(f"contact {SYNTHETIC_REAL_EMAIL}")
+    all_safe_hits = scan_text_for_pii(f"contact {SYNTHETIC_SAFE_EMAIL}")
+    assert any(each.category == "email" for each in all_email_hits)
+    assert all_email_hits[0].matched_text == SYNTHETIC_REAL_EMAIL
+    assert all_safe_hits == []
+
+
+def test_flags_home_path_and_allows_placeholder_user() -> None:
+    all_home_hits = scan_text_for_pii(f"path is {SYNTHETIC_HOME_PATH}")
+    all_placeholder_hits = scan_text_for_pii(f"path is {SYNTHETIC_PLACEHOLDER_HOME}")
+    assert any(each.category == "home-path" for each in all_home_hits)
+    assert all_placeholder_hits == []
+
+
+def test_allows_hygiene_placeholder_username_example() -> None:
+    assert scan_text_for_pii(r"path is C:\Users\example\notes.txt") == []
+    assert scan_text_for_pii("path is C:/Users/example/.claude/hooks") == []
+
+
+def test_flags_unix_home_path() -> None:
+    all_unix_hits = scan_text_for_pii(
+        "config lives in /Users/fixture_real_user/.config"
+    )
+    assert any(each.category == "home-path" for each in all_unix_hits)
+
+
+def test_flags_private_ip_and_allows_public_ip() -> None:
+    all_lan_hits = scan_text_for_pii(f"host {SYNTHETIC_PRIVATE_IP}")
+    all_dns_hits = scan_text_for_pii(f"dns {SYNTHETIC_PUBLIC_IP}")
+    assert any(each.category == "private-ip" for each in all_lan_hits)
+    assert all_lan_hits[0].matched_text == SYNTHETIC_PRIVATE_IP
+    assert all_dns_hits == []
+
+
+def test_allows_loopback_unspecified_and_link_local_addresses() -> None:
+    assert scan_text_for_pii("http://127.0.0.1:8080/health") == []
+    assert scan_text_for_pii("Listen on 0.0.0.0:8000") == []
+    assert scan_text_for_pii("peer 169.254.10.20") == []
+
+
+def test_allows_product_nas_private_ip() -> None:
+    assert scan_text_for_pii("ssh -p 9222 jon@192.168.1.100 uptime") == []
+
+
+def test_flags_github_token_aws_key_and_pem_header() -> None:
+    all_github_hits = scan_text_for_pii(f"export TOKEN={SYNTHETIC_GITHUB_TOKEN}")
+    all_aws_hits = scan_text_for_pii(f"key={SYNTHETIC_AWS_KEY}")
+    all_pem_hits = scan_text_for_pii(SYNTHETIC_PEM_HEADER + "\nabc\n")
+    assert any(each.category == "secret" for each in all_github_hits)
+    assert any(each.category == "secret" for each in all_aws_hits)
+    assert any(each.category == "secret" for each in all_pem_hits)
+
+
+def test_secret_and_email_previews_are_redacted() -> None:
+    all_secret_hits = scan_text_for_pii(f"export TOKEN={SYNTHETIC_GITHUB_TOKEN}")
+    all_email_hits = scan_text_for_pii(f"contact {SYNTHETIC_REAL_EMAIL}")
+    secret_finding = next(
+        each for each in all_secret_hits if each.category == "secret"
+    )
+    email_finding = next(each for each in all_email_hits if each.category == "email")
+    assert secret_finding.matched_text == SYNTHETIC_GITHUB_TOKEN
+    assert SYNTHETIC_GITHUB_TOKEN not in secret_finding.preview
+    assert "…" in secret_finding.preview
+    assert email_finding.matched_text == SYNTHETIC_REAL_EMAIL
+    assert SYNTHETIC_REAL_EMAIL not in email_finding.preview
+    assert "…" in email_finding.preview
+
+
+def test_allows_common_cloud_and_system_home_usernames() -> None:
+    assert scan_text_for_pii(r"C:\Users\ubuntu\notes.txt") == []
+    assert scan_text_for_pii(r"C:\Users\admin\notes.txt") == []
+    assert scan_text_for_pii("/home/runner/work/repo") == []
+    assert scan_text_for_pii("/home/container/app") == []
+
+
+def test_flags_genuine_human_home_username() -> None:
+    all_human_hits = scan_text_for_pii(r"C:\Users\johnsmith\notes.txt")
+    assert any(each.category == "home-path" for each in all_human_hits)
+
+
+def test_short_nonsafe_email_preview_is_fully_redacted() -> None:
+    all_email_hits = scan_text_for_pii("reach owner@acme.io")
+    email_finding = next(
+        each for each in all_email_hits if each.category == "email"
+    )
+    assert email_finding.matched_text == "owner@acme.io"
+    assert email_finding.preview == "[redacted]"
+    assert "owner" not in email_finding.preview
+
+
+def test_home_path_preview_redacts_only_the_username() -> None:
+    all_home_hits = scan_text_for_pii(r"path is C:\Users\johnsmith\secret.txt")
+    home_finding = next(
+        each for each in all_home_hits if each.category == "home-path"
+    )
+    assert "johnsmith" not in home_finding.preview
+    assert "[redacted]" in home_finding.preview
+    assert "Users" in home_finding.preview
+
+
+def test_home_path_preview_redacts_home_segment_when_name_repeats_earlier() -> None:
+    all_home_hits = scan_text_for_pii(r"path is C:\Users\Users\secret.txt")
+    home_finding = next(
+        each for each in all_home_hits if each.category == "home-path"
+    )
+    assert home_finding.preview == r"C:\Users\[redacted]"
+
+
+def test_clean_prose_returns_no_findings() -> None:
+    prose = "Ship the fix. Use user@example.com in docs. Path is C:/Users/<you>/."
+    assert scan_text_for_pii(prose) == []
+
+
+def test_path_exemptions_for_tests_license_and_self_modules() -> None:
+    assert is_path_exempt_from_pii_scan("packages/hooks/blocking/test_pii_scanner.py")
+    assert is_path_exempt_from_pii_scan("LICENSE")
+    assert is_path_exempt_from_pii_scan("LICENSE.md")
+    assert is_path_exempt_from_pii_scan("hooks/blocking/pii_scanner.py")
+    assert is_path_exempt_from_pii_scan(
+        "packages/claude-dev-env/hooks/hooks_constants/pii_prevention_constants.py"
+    )
+    assert not is_path_exempt_from_pii_scan("vendor/pii_scanner.py")
+    assert not is_path_exempt_from_pii_scan("not_hooks/blocking/pii_scanner.py")
+    assert not is_path_exempt_from_pii_scan("xhooks/blocking/pii_scanner.py")
+    assert not is_path_exempt_from_pii_scan("LICENSE_leak.env")
+    assert not is_path_exempt_from_pii_scan("src/app/settings.md")
+    assert not is_path_exempt_from_pii_scan("test_notes.md")
+    assert not is_path_exempt_from_pii_scan("test_secrets.env")
+    assert not is_path_exempt_from_pii_scan("")
+
+
+def test_empty_path_still_scans_payload_text() -> None:
+    all_hits = scan_text_for_pii(f"contact {SYNTHETIC_REAL_EMAIL}")
+    assert any(each.category == "email" for each in all_hits)

package/hooks/blocking/test_pr_description_enforcer_pr_number.py

@@ -33,7 +33,7 @@ def test_extract_pr_number_from_gh_pr_comment() -> None:
 
 
 def test_extract_pr_number_from_gh_pr_create_returns_none() -> None:
-    command = 'gh pr create --repo jl-cmd/claude-code-config --body "some body"'
+    command = 'gh pr create --repo jl-cmd/claude-dev-env --body "some body"'
     assert hook_module._extract_pr_number_from_command(command) is None
 
 

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -20,9 +20,12 @@ from pathlib import Path
 
 import pytest
 
-_HOOKS_DIR = str(Path(__file__).resolve().parent.parent)
-if _HOOKS_DIR not in sys.path:
-    sys.path.insert(0, _HOOKS_DIR)
+_BLOCKING_DIR = Path(__file__).resolve().parent
+_HOOKS_ROOT = _BLOCKING_DIR.parent
+if str(_BLOCKING_DIR) not in sys.path:
+    sys.path.insert(0, str(_BLOCKING_DIR))
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
 
 from hooks_constants.pre_tool_use_dispatcher_constants import (  # noqa: E402, I001
     ALL_HOSTED_HOOK_ENTRIES,
@@ -41,8 +44,6 @@ from pre_tool_use_dispatcher import (  # noqa: E402, I001
     run_hosted_hook,
 )
 
-_BLOCKING_DIR = Path(__file__).resolve().parent
-_HOOKS_ROOT = _BLOCKING_DIR.parent
 _DISPATCHER_SCRIPT = str(_BLOCKING_DIR / "pre_tool_use_dispatcher.py")
 
 _TEMP_FILE_PATH = str(_HOOKS_ROOT.parent.parent.parent / "tmp" / "dispatcher_test_dummy.txt")
@@ -632,8 +633,8 @@ def test_dispatcher_write_applies_both_groups() -> None:
     assert "blocking/plain_language_blocker.py" in all_write_script_paths, (
         "plain_language_blocker (Group B) must be in Write applicable set"
     )
-    assert len(all_write_entries) == 19, (
-        f"Write tool must apply to all 19 hosted hooks, got {len(all_write_entries)}"
+    assert len(all_write_entries) == 20, (
+        f"Write tool must apply to all 20 hosted hooks, got {len(all_write_entries)}"
     )
 
 
@@ -646,16 +647,16 @@ def test_dispatcher_edit_applies_both_groups() -> None:
     assert "blocking/stale_comment_reference_blocker.py" in all_edit_script_paths, (
         "stale_comment_reference_blocker belongs in the Edit applicable set"
     )
-    assert len(all_edit_entries) == 20, (
-        f"expected 20 Edit entries, got {len(all_edit_entries)}"
+    assert len(all_edit_entries) == 21, (
+        f"expected 21 Edit entries, got {len(all_edit_entries)}"
     )
 
 
 def test_dispatcher_multi_edit_applies_only_group_b() -> None:
-    """MultiEdit tool triggers only Group B (8 hooks), not Group A."""
+    """MultiEdit tool triggers only Group B (9 hooks), not Group A."""
     all_multi_edit_entries = _applicable_entries_for_tool(MULTI_EDIT_TOOL_NAME)
-    assert len(all_multi_edit_entries) == 8, (
-        f"MultiEdit tool must apply to exactly 8 Group-B hooks, got {len(all_multi_edit_entries)}"
+    assert len(all_multi_edit_entries) == 9, (
+        f"MultiEdit tool must apply to exactly 9 Group-B hooks, got {len(all_multi_edit_entries)}"
     )
 
 
@@ -666,7 +667,7 @@ def test_proceed_after_run_all_validators_removal_allows() -> None:
     it was never a PreToolUse hook and never hosted by the PreToolUse dispatcher.
     A Python Write payload that run_all_validators would have flagged (mypy errors, for
     instance) still produces ALLOW from the PreToolUse dispatcher because the PreToolUse
-    dispatcher covers only its 18 hosted blocking hooks — none of which includes the
+    dispatcher covers only its 21 hosted blocking hooks — none of which includes the
     validators runner.
     """
     python_content_with_type_error = (

package/hooks/blocking/test_stop_dispatcher.py

@@ -0,0 +1,187 @@
+"""Behavior tests for the Stop-hook dispatcher."""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+_HOOKS_DIR = str(Path(__file__).resolve().parent.parent)
+_BLOCKING_DIR = Path(__file__).resolve().parent
+if _HOOKS_DIR not in sys.path:
+    sys.path.insert(0, _HOOKS_DIR)
+_blocking_dir_text = str(_BLOCKING_DIR)
+if _blocking_dir_text not in sys.path:
+    sys.path.insert(0, _blocking_dir_text)
+
+from hooks_constants.hosted_hook_runner import HostedHookRun  # noqa: E402
+from stop_dispatcher import dispatch, select_first_block_stdout  # noqa: E402
+
+_DISPATCHER_SCRIPT = str(_BLOCKING_DIR / "stop_dispatcher.py")
+
+
+def _block_json(
+    reason: str, *, system_message: str = "", suppress_output: bool = False
+) -> str:
+    """Build a Stop block stdout string with optional supplementary fields."""
+    payload: dict[str, object] = {"decision": "block", "reason": reason}
+    if system_message:
+        payload["systemMessage"] = system_message
+    if suppress_output:
+        payload["suppressOutput"] = True
+    return json.dumps(payload)
+
+
+def test_first_block_wins_among_non_crashed_runs() -> None:
+    """The first non-crashed block decision is the one the dispatcher emits."""
+    all_runs = [
+        HostedHookRun(captured_stdout="", did_crash=False),
+        HostedHookRun(captured_stdout=_block_json("first"), did_crash=False),
+        HostedHookRun(captured_stdout=_block_json("second"), did_crash=False),
+    ]
+    selected = select_first_block_stdout(all_runs)
+    assert json.loads(selected)["reason"] == "first"
+
+
+def test_crashed_hook_before_block_is_skipped() -> None:
+    """A crash before a block fails open so a later block still surfaces."""
+    all_runs = [
+        HostedHookRun(captured_stdout="", did_crash=True),
+        HostedHookRun(captured_stdout=_block_json("later"), did_crash=False),
+    ]
+    selected = select_first_block_stdout(all_runs)
+    assert json.loads(selected)["reason"] == "later"
+
+
+def test_no_block_when_every_hook_is_silent() -> None:
+    """A silent chain produces no block stdout."""
+    assert select_first_block_stdout([HostedHookRun("", False), HostedHookRun("", False)]) == ""
+
+
+def test_select_preserves_system_message_and_suppress_output() -> None:
+    """select_first_block_stdout keeps supplementary fields on the winning block."""
+    all_runs = [
+        HostedHookRun(captured_stdout="", did_crash=True),
+        HostedHookRun(
+            captured_stdout=_block_json(
+                "keep fields",
+                system_message="rewrite the ending",
+                suppress_output=True,
+            ),
+            did_crash=False,
+        ),
+    ]
+    selected = json.loads(select_first_block_stdout(all_runs))
+    assert selected["reason"] == "keep fields"
+    assert selected["systemMessage"] == "rewrite the ending"
+    assert selected["suppressOutput"] is True
+
+
+def test_dispatch_re_emits_first_block_with_system_message_and_suppress(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """dispatch re-emits the first block's full JSON including supplementary fields."""
+    all_responses = [
+        HostedHookRun(captured_stdout="", did_crash=False),
+        HostedHookRun(
+            captured_stdout=_block_json(
+                "hedging blocked",
+                system_message="rewrite the ending",
+                suppress_output=True,
+            ),
+            did_crash=False,
+        ),
+        HostedHookRun(captured_stdout=_block_json("later block"), did_crash=False),
+    ]
+    response_iterator = iter(all_responses)
+
+    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
+        del script_path, payload_text
+        return next(response_iterator)
+
+    monkeypatch.setattr("stop_dispatcher.run_hook_capturing_output", _fake_run_hook)
+    monkeypatch.setattr(
+        "stop_dispatcher.ALL_STOP_HOSTED_HOOK_PATHS",
+        (
+            "blocking/hedging_language_blocker.py",
+            "blocking/question_to_user_enforcer.py",
+            "diagnostic/hook_log_stop_wrapper.py",
+        ),
+    )
+    dispatch('{"session_id": "test"}')
+    emitted_payload = json.loads(capsys.readouterr().out.strip())
+    assert emitted_payload["decision"] == "block"
+    assert emitted_payload["reason"] == "hedging blocked"
+    assert emitted_payload["systemMessage"] == "rewrite the ending"
+    assert emitted_payload["suppressOutput"] is True
+
+
+def test_dispatch_writes_nothing_when_no_hook_blocks(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """dispatch leaves stdout empty when every hosted hook is silent or allows."""
+    monkeypatch.setattr(
+        "stop_dispatcher.run_hook_capturing_output",
+        lambda script_path, payload_text: HostedHookRun(captured_stdout="", did_crash=False),
+    )
+    monkeypatch.setattr(
+        "stop_dispatcher.ALL_STOP_HOSTED_HOOK_PATHS",
+        ("blocking/hedging_language_blocker.py",),
+    )
+    dispatch('{"session_id": "test"}')
+    assert capsys.readouterr().out == ""
+
+
+def test_dispatcher_exits_zero_on_empty_payload() -> None:
+    """The dispatcher exits zero when stdin is empty."""
+    completed = subprocess.run(
+        [sys.executable, _DISPATCHER_SCRIPT],
+        check=False,
+        input="",
+        capture_output=True,
+        text=True,
+    )
+    assert completed.returncode == 0
+    assert completed.stdout.strip() == ""
+
+
+def test_dispatcher_blocks_hedging_message_matching_standalone() -> None:
+    """A hedging last_assistant_message blocks through the dispatcher."""
+    payload_text = json.dumps(
+        {
+            "stop_hook_active": False,
+            "last_assistant_message": "This is probably correct without a source.",
+        }
+    )
+    completed = subprocess.run(
+        [sys.executable, _DISPATCHER_SCRIPT],
+        check=False,
+        input=payload_text,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+    )
+    assert completed.returncode == 0
+    parsed = json.loads(completed.stdout)
+    assert parsed["decision"] == "block"
+    assert "probably" in parsed["reason"].lower() or "hedging" in parsed["reason"].lower()
+
+
+def test_dispatcher_imports_standalone_with_only_blocking_on_the_path() -> None:
+    """The dispatcher's bootstrap resolves hooks_constants without hooks/ on PYTHONPATH."""
+    subprocess_environment = {**os.environ, "PYTHONPATH": str(_BLOCKING_DIR)}
+    completed = subprocess.run(
+        [sys.executable, "-c", "import stop_dispatcher; print('ok')"],
+        check=False,
+        capture_output=True,
+        text=True,
+        env=subprocess_environment,
+    )
+    assert completed.returncode == 0, completed.stderr
+    assert completed.stdout.strip() == "ok"

package/hooks/blocking/test_verdict_directory_write_blocker.py

@@ -78,7 +78,7 @@ def test_powershell_out_file_into_verdict_directory_is_flagged() -> None:
 def test_backslash_verdict_path_is_flagged() -> None:
     assert (
         references_verdict_directory(
-            "echo forged > C:\\Users\\jon\\.claude\\verification\\abc.json"
+            "echo forged > C:\\Users\\example\\.claude\\verification\\abc.json"
         )
         is True
     )

package/hooks/blocking/test_volatile_path_in_post_blocker.py

@@ -31,7 +31,7 @@ def _body_names_volatile_path(tool_name: str, tool_input: dict[str, object]) ->
 
 
 def test_scan_detects_job_scratch_path_backslash() -> None:
-    text = r"See C:\Users\jon\.claude-editor\jobs\95762cea\tmp\staging\contact_sheet.png"
+    text = r"See C:\Users\example\.claude-editor\jobs\95762cea\tmp\staging\contact_sheet.png"
     assert scan_text_for_volatile_marker(text) == ".claude-editor/jobs/"
 
 
@@ -46,7 +46,7 @@ def test_scan_detects_worktree_path() -> None:
 
 
 def test_scan_detects_appdata_temp_case_insensitive() -> None:
-    text = r"C:\Users\jon\AppData\Local\Temp\bugteam\worktree"
+    text = r"C:\Users\example\AppData\Local\Temp\bugteam\worktree"
     assert scan_text_for_volatile_marker(text) == "appdata/local/temp"
 
 
@@ -74,7 +74,7 @@ def test_scan_clean_body_returns_none() -> None:
 def test_gh_comment_with_job_scratch_path_is_blocked() -> None:
     command = (
         'gh pr comment 669 --body "Contact sheet at '
-        r'C:\Users\jon\.claude-editor\jobs\95762cea\tmp\staging\contact_sheet.png"'
+        r'C:\Users\example\.claude-editor\jobs\95762cea\tmp\staging\contact_sheet.png"'
     )
     assert _body_names_volatile_path("Bash", {"command": command})
 

package/hooks/blocking/volatile_path_in_post_blocker.py

@@ -220,11 +220,14 @@ def _collect_body_flag_values(
     return all_inline_bodies, all_body_file_paths
 
 
-def _read_body_file(body_file_path: str) -> str | None:
+def _read_body_file(
+    body_file_path: str, working_directory: str | None = None
+) -> str | None:
     """Return the contents of a body-file path, or None when it cannot be read.
 
     Args:
         body_file_path: The path given to ``--body-file``/``-F``.
+        working_directory: Optional base directory for relative body-file paths.
 
     Returns:
         The file text, or None for an unresolvable shell value (such as ``-`` for
@@ -232,21 +235,28 @@ def _read_body_file(body_file_path: str) -> str | None:
     """
     if is_unresolvable_shell_value(body_file_path):
         return None
+    resolved_path = Path(body_file_path)
+    if not resolved_path.is_absolute() and working_directory:
+        resolved_path = Path(working_directory) / body_file_path
     try:
-        return Path(body_file_path).read_text(encoding=BODY_FILE_ENCODING)
+        return resolved_path.read_text(encoding=BODY_FILE_ENCODING)
     except OSError:
         return None
 
 
-def extract_gh_post_body_texts(command: str) -> list[str]:
+def extract_gh_post_body_texts(
+    command: str, working_directory: str | None = None
+) -> list[str]:
     """Return every post body text an affected ``gh`` command would send.
 
     Non-post ``gh`` commands and unparseable command lines yield an empty list.
     Body-file contents are read from disk so the embedded text is scanned rather
-    than the file path.
+    than the file path. Relative body-file paths resolve against
+    *working_directory* when provided.
 
     Args:
         command: The raw Bash tool command string.
+        working_directory: Optional base directory for relative body-file paths.
 
     Returns:
         Inline ``--body`` strings plus the contents of each readable body-file.
@@ -265,12 +275,51 @@ def extract_gh_post_body_texts(command: str) -> list[str]:
     )
     all_body_texts = list(all_inline_bodies)
     for each_path in all_body_file_paths:
-        file_text = _read_body_file(each_path)
+        file_text = _read_body_file(each_path, working_directory=working_directory)
         if file_text is not None:
             all_body_texts.append(file_text)
     return all_body_texts
 
 
+def extract_gh_post_body_texts_for_privacy_gate(
+    command: str, working_directory: str | None = None
+) -> tuple[list[str], str | None]:
+    """Like ``extract_gh_post_body_texts``, but fail-closed on unreadable body-files.
+
+    Args:
+        command: The raw Bash tool command string.
+        working_directory: Optional base directory for relative body-file paths.
+
+    Returns:
+        ``(all_body_texts, None)`` when every declared body-file was read (or
+        none were declared), else ``([], deny_reason)`` when a body-file flag is
+        present but its contents could not be loaded for scanning.
+    """
+    logical_line = get_logical_first_line(command)
+    if not logical_line:
+        return [], None
+    try:
+        all_command_tokens = shlex.split(logical_line, posix=False)
+    except ValueError:
+        return [], None
+    if not _tokens_name_gh_post_command(all_command_tokens):
+        return [], None
+    all_inline_bodies, all_body_file_paths = _collect_body_flag_values(
+        all_command_tokens
+    )
+    all_body_texts = list(all_inline_bodies)
+    for each_path in all_body_file_paths:
+        file_text = _read_body_file(each_path, working_directory=working_directory)
+        if file_text is None:
+            return [], (
+                "BLOCKED [pii_prevention_blocker]: durable post uses --body-file "
+                f"but '{each_path}' could not be read for PII scanning. Use an "
+                "absolute path, ensure the file exists, or pass --body text."
+            )
+        all_body_texts.append(file_text)
+    return all_body_texts, None
+
+
 def extract_mcp_body_texts(all_tool_input: dict[str, object]) -> list[str]:
     """Return the body and comment strings from a GitHub MCP post tool input.