claude-dev-env 1.93.1 → 1.95.0

package/hooks/blocking/pii_prevention_blocker.py

@@ -10,18 +10,22 @@ Surfaces guarded:
   staged file contents about to become history. Commit message bodies are out
   of scope; only staged blob text is scanned.
 
-Detection reuses the pure scanners in ``pii_scanner`` and the post-body
-extraction helpers already used by ``volatile_path_in_post_blocker``.
+Payload and post-body scanning live in ``pii_payload_scan``; git-commit command
+detection lives in ``pii_commit_command``; both re-export through this entry
+module so the hooks.json wiring and every importer resolve unchanged.
+
+A repository named in ``CLAUDE_PII_EXEMPT_REPOS`` or the ``pii_exempt_repositories``
+list in ``~/.claude/local-identity.json`` skips the staged-commit scan; a
+repository without a readable origin remote is never exempt.
 """
 
 from __future__ import annotations
 
 import json
-import re
-import shlex
 import subprocess
 import sys
 from pathlib import Path
+from urllib.parse import urlparse
 
 _blocking_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
@@ -30,60 +34,44 @@ if _blocking_directory not in sys.path:
 if _hooks_directory not in sys.path:
     sys.path.insert(0, _hooks_directory)
 
-from block_main_commit import (  # noqa: E402
-    extract_git_working_directory,
-    resolve_directory,
+from block_main_commit import resolve_directory  # noqa: E402
+from pii_commit_command import (  # noqa: E402
+    extract_git_commit_working_directory,
+    is_git_commit_shell_command,
 )
-from pii_scanner import PiiFinding, is_path_exempt_from_pii_scan, scan_text_for_pii  # noqa: E402
-from precommit_code_rules_gate import (  # noqa: E402
-    resolve_repository_root,
+from pii_payload_scan import (  # noqa: E402
+    build_deny_reason,
+    evaluate_post_body_texts,
+    evaluate_write_edit_payload,
 )
+from pii_scanner import is_path_exempt_from_pii_scan, scan_text_for_pii  # noqa: E402
+from precommit_code_rules_gate import resolve_repository_root  # noqa: E402
 from volatile_path_in_post_blocker import (  # noqa: E402
     extract_gh_post_body_texts_for_privacy_gate,
     extract_mcp_body_texts,
 )
 
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.multi_edit_reconstruction import edits_for_tool  # noqa: E402
+from hooks_constants.local_identity import pii_exempt_repository_slugs  # noqa: E402
 from hooks_constants.pii_prevention_constants import (  # noqa: E402
-    ALL_BASH_FAMILY_INTERPRETER_BASENAMES,
-    ALL_COMMAND_BOUNDARY_NEWLINE_CHARACTERS,
-    ALL_GIT_BINARY_BASENAMES,
-    ALL_LEADING_SKIPPABLE_COMMAND_TOKENS,
-    ALL_ONE_OPERAND_WRAPPER_TOKENS,
-    ALL_SHELL_COMMAND_SEPARATOR_TOKENS,
-    ALL_SHELL_INTERPRETER_BASENAMES,
-    ALL_SHELL_QUOTE_CHARACTERS,
+    ALL_GIT_ORIGIN_URL_COMMAND,
+    ALL_NETWORK_GIT_URL_SCHEMES,
     ALL_SHELL_TOOL_NAMES,
     ALL_STAGED_BLOB_SHOW_COMMAND_PREFIX,
     ALL_STAGED_FILES_COMMAND,
-    ALL_VALUE_TAKING_GIT_OPTIONS,
     ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
     BODY_FILE_ENCODING,
-    CORRECTIVE_MESSAGE_FOOTER,
-    CORRECTIVE_MESSAGE_HEADER,
-    DOUBLE_DASH_OPTION_PREFIX,
-    EDIT_TOOL_NAME,
-    ENVIRONMENT_ASSIGNMENT_PATTERN,
-    FINDING_LINE_TEMPLATE,
     GIT_COMMAND_TIMEOUT_SECONDS,
-    GIT_COMMIT_SUBCOMMAND,
-    GIT_OPTION_WITH_VALUE_STEP,
-    GIT_WORKING_DIRECTORY_OPTION,
+    GIT_URL_SUFFIX,
+    GITHUB_COM_HOST,
     HOOK_SCRIPT_BASENAME,
-    INLINE_COMMAND_FLAG_CLUSTER_CHARACTER,
-    INLINE_COMMAND_TOKEN_JOINER,
-    LINE_CONTINUATION_PATTERN,
     MAXIMUM_STAGED_FILE_BYTES,
     MCP_GITHUB_TOOL_PREFIX,
-    MESSAGE_LINE_SEPARATOR,
-    MULTI_EDIT_TOOL_NAME,
+    MINIMUM_OWNER_REPO_SEGMENT_COUNT,
     NULL_BYTE_MARKER,
-    POWERSHELL_INLINE_COMMAND_FLAG,
-    POWERSHELL_LINE_CONTINUATION_PATTERN,
+    POSIX_PATH_SEPARATOR,
     REPOSITORY_ROOT_UNRESOLVED_REASON,
-    SHELL_INLINE_COMMAND_FLAG,
-    SINGLE_DASH_OPTION_PREFIX,
+    SCP_STYLE_PATH_SEPARATOR,
     STAGED_BLOB_PREFIX,
     STAGED_BLOB_REASON_DECODE_FAILED,
     STAGED_BLOB_REASON_GIT_SHOW_FAILED,
@@ -91,109 +79,15 @@ from hooks_constants.pii_prevention_constants import (  # noqa: E402
     STAGED_BLOB_REASON_OVERSIZED,
     STAGED_BLOB_UNSCANNABLE_REASON_TEMPLATE,
     STAGED_LIST_FAILURE_REASON,
-    SUBSHELL_GROUP_OPEN_TOKEN,
-    WRITE_TOOL_NAME,
+    URL_SCHEME_SEPARATOR,
+    USERINFO_HOST_SEPARATOR,
+    WINDOWS_PATH_SEPARATOR,
 )
 from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
     read_hook_input_dictionary_from_stdin,
 )
 
 
-def build_deny_reason(all_findings: list[PiiFinding], gate_surface: str) -> str:
-    """Return the deny message listing each finding for *gate_surface*.
-
-    Args:
-        all_findings: Findings returned by ``scan_text_for_pii``.
-        gate_surface: Human-readable surface (write, post body, staged commit).
-
-    Returns:
-        Multi-line deny reason for ``permissionDecisionReason``.
-    """
-    all_lines = [
-        CORRECTIVE_MESSAGE_HEADER,
-        f"Surface: {gate_surface}",
-    ]
-    for each_finding in all_findings:
-        all_lines.append(
-            FINDING_LINE_TEMPLATE.format(
-                category=each_finding.category,
-                preview=each_finding.preview,
-            )
-        )
-    all_lines.append(CORRECTIVE_MESSAGE_FOOTER)
-    message_line_separator = MESSAGE_LINE_SEPARATOR
-    return message_line_separator.join(all_lines)
-
-
-def _collect_write_edit_texts(
-    tool_name: str, all_tool_input: dict[str, object]
-) -> tuple[str, list[str]]:
-    raw_file_path = all_tool_input.get("file_path", "")
-    file_path = raw_file_path if isinstance(raw_file_path, str) else ""
-    if is_path_exempt_from_pii_scan(file_path):
-        return file_path, []
-    if tool_name == WRITE_TOOL_NAME:
-        write_content = all_tool_input.get("content", "")
-        if isinstance(write_content, str) and write_content:
-            return file_path, [write_content]
-        return file_path, []
-    if tool_name in (EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME):
-        all_texts: list[str] = []
-        for each_edit in edits_for_tool(tool_name, all_tool_input):
-            if not isinstance(each_edit, dict):
-                continue
-            new_string = each_edit.get("new_string", "")
-            if isinstance(new_string, str) and new_string:
-                all_texts.append(new_string)
-        return file_path, all_texts
-    return file_path, []
-
-
-def _first_findings_in_texts(all_texts: list[str]) -> list[PiiFinding]:
-    for each_text in all_texts:
-        all_findings = scan_text_for_pii(each_text)
-        if all_findings:
-            return all_findings
-    return []
-
-
-def evaluate_write_edit_payload(
-    tool_name: str, all_tool_input: dict[str, object]
-) -> str | None:
-    """Return a deny reason when Write/Edit/MultiEdit content carries PII.
-
-    Args:
-        tool_name: The intercepted tool name.
-        all_tool_input: The tool input mapping.
-
-    Returns:
-        Deny reason text, or None when the write is clean or out of scope.
-    """
-    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
-        return None
-    file_path, all_texts = _collect_write_edit_texts(tool_name, all_tool_input)
-    all_findings = _first_findings_in_texts(all_texts)
-    if not all_findings:
-        return None
-    gate_surface = f"file write ({file_path or 'unknown path'})"
-    return build_deny_reason(all_findings, gate_surface)
-
-
-def evaluate_post_body_texts(all_body_texts: list[str]) -> str | None:
-    """Return a deny reason when any durable post body carries PII.
-
-    Args:
-        all_body_texts: Body strings extracted from a gh or MCP post tool.
-
-    Returns:
-        Deny reason text, or None when every body is clean.
-    """
-    all_findings = _first_findings_in_texts(all_body_texts)
-    if not all_findings:
-        return None
-    return build_deny_reason(all_findings, "durable GitHub post body")
-
-
 def list_staged_file_paths(
     repository_root: Path,
 ) -> tuple[list[str] | None, str | None]:
@@ -314,359 +208,165 @@ def evaluate_staged_commit(
     return None
 
 
-def _strip_token_edge_quotes(token_text: str) -> str:
-    return token_text.strip("\"'")
-
-
-def _token_basename_lower(token_text: str) -> str:
-    stripped_token = _strip_token_edge_quotes(token_text)
-    return re.split(r"[\\/]", stripped_token)[-1].lower()
-
-
-def _token_is_git_binary(token_text: str) -> bool:
-    return _token_basename_lower(token_text) in ALL_GIT_BINARY_BASENAMES
-
-
-def _token_is_shell_interpreter(token_text: str) -> bool:
-    return _token_basename_lower(token_text) in ALL_SHELL_INTERPRETER_BASENAMES
-
-
-def _token_is_bash_family_interpreter(token_text: str) -> bool:
-    return _token_basename_lower(token_text) in ALL_BASH_FAMILY_INTERPRETER_BASENAMES
-
-
-def _token_is_subshell_group_open(token_text: str) -> bool:
-    return token_text == SUBSHELL_GROUP_OPEN_TOKEN
+def _strip_trailing_path_separators(origin_url: str) -> str:
+    stripped_url = origin_url
+    while stripped_url and stripped_url[-1] in (
+        POSIX_PATH_SEPARATOR,
+        WINDOWS_PATH_SEPARATOR,
+    ):
+        stripped_url = stripped_url[:-1]
+    return stripped_url
 
 
-def _token_is_skippable_prefix(token_text: str) -> bool:
-    if ENVIRONMENT_ASSIGNMENT_PATTERN.match(token_text):
-        return True
-    return _token_basename_lower(token_text) in ALL_LEADING_SKIPPABLE_COMMAND_TOKENS
+def _strip_trailing_git_suffix(origin_url: str) -> str:
+    if origin_url.lower().endswith(GIT_URL_SUFFIX):
+        return origin_url[: -len(GIT_URL_SUFFIX)]
+    return origin_url
 
 
-def _following_tokens_invoke_commit(all_following_tokens: list[str]) -> bool:
-    token_index = 0
-    option_with_value_step = GIT_OPTION_WITH_VALUE_STEP
-    while token_index < len(all_following_tokens):
-        each_token = _strip_token_edge_quotes(all_following_tokens[token_index])
-        option_name = each_token
-        has_attached_value = False
-        if each_token.startswith(DOUBLE_DASH_OPTION_PREFIX) and "=" in each_token:
-            option_name, _, _attached_value = each_token.partition("=")
-            has_attached_value = True
-        if option_name in ALL_VALUE_TAKING_GIT_OPTIONS:
-            if has_attached_value:
-                token_index += 1
-            else:
-                token_index += option_with_value_step
-            continue
-        if each_token.startswith(SINGLE_DASH_OPTION_PREFIX):
-            token_index += 1
-            continue
-        return each_token.lower() == GIT_COMMIT_SUBCOMMAND
-    return False
+def _normalized_origin_url(origin_url: str) -> str:
+    return _strip_trailing_git_suffix(_strip_trailing_path_separators(origin_url))
 
 
-def _split_shell_command_segments(all_tokens: list[str]) -> list[list[str]]:
-    all_segments: list[list[str]] = [[]]
-    shell_separators = ALL_SHELL_COMMAND_SEPARATOR_TOKENS
-    for each_token in all_tokens:
-        if each_token in shell_separators:
-            all_segments.append([])
-            continue
-        all_segments[-1].append(each_token)
-    return all_segments
-
-
-def _tokenize_shell_command(shell_command_piece: str) -> list[str] | None:
-    lexer = shlex.shlex(shell_command_piece, posix=True, punctuation_chars=True)
-    lexer.whitespace_split = True
-    lexer.escape = ""
-    lexer.commenters = ""
+def _host_and_path_from_scheme_url(origin_url: str) -> tuple[str, str] | None:
+    parsed_url = urlparse(origin_url)
+    if parsed_url.scheme not in ALL_NETWORK_GIT_URL_SCHEMES:
+        return None
+    maybe_host = parsed_url.hostname
+    if maybe_host is None:
+        return None
     try:
-        return list(lexer)
+        parsed_url.port
     except ValueError:
         return None
+    repository_path = parsed_url.path.replace(
+        WINDOWS_PATH_SEPARATOR, POSIX_PATH_SEPARATOR
+    ).lstrip(POSIX_PATH_SEPARATOR)
+    return maybe_host.lower(), repository_path
 
 
-def _fallback_segments_by_physical_line(shell_command_piece: str) -> list[list[str]]:
-    all_segments: list[list[str]] = []
-    for each_physical_line in shell_command_piece.splitlines():
-        line_tokens = each_physical_line.split()
-        all_segments.extend(_split_shell_command_segments(line_tokens))
-    return all_segments
-
-
-def _segments_for_piece(shell_command_piece: str) -> list[list[str]]:
-    piece_tokens = _tokenize_shell_command(shell_command_piece)
-    if piece_tokens is None:
-        return _fallback_segments_by_physical_line(shell_command_piece)
-    return _split_shell_command_segments(piece_tokens)
-
-
-def _split_on_unquoted_newlines(shell_command: str) -> list[str]:
-    all_pieces: list[str] = []
-    current_characters: list[str] = []
-    active_quote_character = ""
-    for each_character in shell_command:
-        if active_quote_character:
-            if each_character == active_quote_character:
-                active_quote_character = ""
-            current_characters.append(each_character)
-            continue
-        if each_character in ALL_SHELL_QUOTE_CHARACTERS:
-            active_quote_character = each_character
-            current_characters.append(each_character)
-            continue
-        if each_character in ALL_COMMAND_BOUNDARY_NEWLINE_CHARACTERS:
-            all_pieces.append("".join(current_characters))
-            current_characters = []
-            continue
-        current_characters.append(each_character)
-    all_pieces.append("".join(current_characters))
-    return all_pieces
-
-
-def _all_command_segments(shell_command: str) -> list[list[str]]:
-    collapsed_command = LINE_CONTINUATION_PATTERN.sub("", shell_command)
-    collapsed_command = POWERSHELL_LINE_CONTINUATION_PATTERN.sub("", collapsed_command)
-    all_segments: list[list[str]] = []
-    for each_piece in _split_on_unquoted_newlines(collapsed_command):
-        all_segments.extend(_segments_for_piece(each_piece))
-    return all_segments
-
+def _host_and_path_from_scp_url(origin_url: str) -> tuple[str, str] | None:
+    if USERINFO_HOST_SEPARATOR not in origin_url:
+        return None
+    userinfo_and_host, separator, repository_path = origin_url.partition(
+        SCP_STYLE_PATH_SEPARATOR
+    )
+    if not separator or USERINFO_HOST_SEPARATOR not in userinfo_and_host:
+        return None
+    if not repository_path:
+        return None
+    host = userinfo_and_host.rsplit(USERINFO_HOST_SEPARATOR, maxsplit=1)[-1]
+    if not host:
+        return None
+    normalized_path = repository_path.replace(
+        WINDOWS_PATH_SEPARATOR, POSIX_PATH_SEPARATOR
+    )
+    return host.lower(), normalized_path
 
-def _token_is_leading_skip_target(token_text: str) -> bool:
-    return _token_is_git_binary(token_text) or _token_is_shell_interpreter(token_text)
 
+def _host_and_repository_path_from_origin_url(
+    origin_url: str,
+) -> tuple[str, str] | None:
+    normalized_url = _normalized_origin_url(origin_url)
+    if URL_SCHEME_SEPARATOR in normalized_url:
+        return _host_and_path_from_scheme_url(normalized_url)
+    return _host_and_path_from_scp_url(normalized_url)
 
-def _token_is_wrapper_option_flag(token_text: str) -> bool:
-    return token_text.startswith(SINGLE_DASH_OPTION_PREFIX)
 
+def _owner_repo_slug_from_path(repository_path: str) -> str | None:
+    all_segments = [
+        each_segment
+        for each_segment in repository_path.split(POSIX_PATH_SEPARATOR)
+        if each_segment
+    ]
+    if len(all_segments) < MINIMUM_OWNER_REPO_SEGMENT_COUNT:
+        return None
+    owner_name = all_segments[0]
+    repository_name = all_segments[1]
+    return POSIX_PATH_SEPARATOR.join((owner_name, repository_name)).lower()
 
-def _wrapper_leading_operand_count(token_text: str) -> int:
-    if _token_basename_lower(token_text) in ALL_ONE_OPERAND_WRAPPER_TOKENS:
-        return 1
-    return 0
 
+def _owner_repo_slug_from_origin_url(origin_url: str) -> str | None:
+    """Return the lowercased owner/repo slug from a github.com origin URL.
 
-def _flag_value_token_follows(all_segment_tokens: list[str], value_index: int) -> bool:
-    if value_index >= len(all_segment_tokens):
-        return False
-    if not _token_is_leading_skip_target(all_segment_tokens[value_index]):
-        return True
-    return _later_token_is_leading_skip_target(all_segment_tokens, value_index + 1)
-
-
-def _later_token_is_leading_skip_target(
-    all_segment_tokens: list[str], search_start_index: int
-) -> bool:
-    for each_token in all_segment_tokens[search_start_index:]:
-        if _token_is_leading_skip_target(each_token):
-            return True
-    return False
-
-
-def _skip_leading_noop_tokens(all_segment_tokens: list[str]) -> int:
-    token_index = 0
-    has_skipped_wrapper_prefix = False
-    pending_operand_budget = 0
-    while token_index < len(all_segment_tokens):
-        each_token = all_segment_tokens[token_index]
-        if _token_is_subshell_group_open(each_token):
-            token_index += 1
-            continue
-        if _token_is_skippable_prefix(each_token):
-            has_skipped_wrapper_prefix = True
-            pending_operand_budget += _wrapper_leading_operand_count(each_token)
-            token_index += 1
-            continue
-        if not has_skipped_wrapper_prefix:
-            break
-        if _token_is_leading_skip_target(each_token):
-            break
-        if _token_is_wrapper_option_flag(each_token):
-            token_index += 1
-            if _flag_value_token_follows(all_segment_tokens, token_index):
-                token_index += 1
-            continue
-        if pending_operand_budget > 0:
-            pending_operand_budget -= 1
-            token_index += 1
-            continue
-        break
-    return token_index
+    ::
 
+        https://github.com/Owner/Repo.git                 ->  owner/repo
+        https://github.com/Owner/Repo                     ->  owner/repo
+        https://github.com:443/Owner/Repo.git             ->  owner/repo
+        ssh://git@github.com:22/Owner/Repo.git            ->  owner/repo
+        git@github.com:Owner/Repo.git                     ->  owner/repo
+        ssh://git@github.com/Owner/Repo.git               ->  owner/repo
+        https://github.com/Owner/Repo.git/                ->  owner/repo
+        https://evil.test/Owner/Repo.git                  ->  None
+        https://github.com:443.evil.test/Owner/Repo.git   ->  None
+        ssh://git@github.com:22.evil.test/Owner/Repo.git  ->  None
+        C:/repos/Owner/Repo                               ->  None
 
-def _token_is_powershell_command_flag_prefix(lowered_token: str) -> bool:
-    if lowered_token == SINGLE_DASH_OPTION_PREFIX:
-        return False
-    return POWERSHELL_INLINE_COMMAND_FLAG.startswith(lowered_token)
+    Accepts only the exact host ``github.com`` (case-insensitive). Spoof hosts,
+    unparseable port authorities, and path-shaped origins return None so the
+    repository is never exempt.
 
+    Args:
+        origin_url: The ``remote.origin.url`` value, https or ssh form.
 
-def _token_is_interpreter_inline_command_flag(
-    token_text: str, interpreter_allows_short_flag_cluster: bool
-) -> bool:
-    if not token_text.startswith(SINGLE_DASH_OPTION_PREFIX):
-        return False
-    if token_text.startswith(DOUBLE_DASH_OPTION_PREFIX):
-        return False
-    lowered_token = token_text.lower()
-    if lowered_token == SHELL_INLINE_COMMAND_FLAG:
-        return True
-    if _token_is_powershell_command_flag_prefix(lowered_token):
-        return True
-    if not interpreter_allows_short_flag_cluster:
-        return False
-    clustered_flag_characters = lowered_token[len(SINGLE_DASH_OPTION_PREFIX) :]
-    return INLINE_COMMAND_FLAG_CLUSTER_CHARACTER in clustered_flag_characters
-
-
-def _interpreter_inline_command_invokes_commit(
-    interpreter_token: str, all_following_tokens: list[str]
-) -> bool:
-    allows_short_flag_cluster = _token_is_bash_family_interpreter(interpreter_token)
-    token_index = 0
-    while token_index < len(all_following_tokens):
-        each_token = all_following_tokens[token_index]
-        if _token_is_interpreter_inline_command_flag(
-            each_token, allows_short_flag_cluster
-        ):
-            argument_index = token_index + 1
-            if argument_index >= len(all_following_tokens):
-                return False
-            inline_command = INLINE_COMMAND_TOKEN_JOINER.join(
-                all_following_tokens[argument_index:]
-            )
-            return is_git_commit_shell_command(inline_command)
-        token_index += 1
-    return False
+    Returns:
+        The ``owner/repo`` slug in lowercase, or None when the host is not
+        exactly ``github.com``, the port authority is unparseable, or the URL
+        carries no owner/repo tail.
+    """
+    maybe_host_and_path = _host_and_repository_path_from_origin_url(origin_url)
+    if maybe_host_and_path is None:
+        return None
+    host, repository_path = maybe_host_and_path
+    if host != GITHUB_COM_HOST:
+        return None
+    return _owner_repo_slug_from_path(repository_path)
 
 
-def _segment_invokes_git_commit(all_segment_tokens: list[str]) -> bool:
-    command_index = _skip_leading_noop_tokens(all_segment_tokens)
-    if command_index >= len(all_segment_tokens):
-        return False
-    all_following_tokens = all_segment_tokens[command_index + 1 :]
-    command_token = all_segment_tokens[command_index]
-    if _token_is_shell_interpreter(command_token):
-        return _interpreter_inline_command_invokes_commit(
-            command_token, all_following_tokens
-        )
-    if not _token_is_git_binary(command_token):
-        return False
-    return _following_tokens_invoke_commit(all_following_tokens)
-
-
-def is_git_commit_shell_command(shell_command: str) -> bool:
-    """Report whether *shell_command* invokes git commit (token-aware).
-
-    Each segment is read past its leading noise to the real command word::
-
-        sudo git commit -m x        ->  skip the wrapper, then match commit
-        nice -n 10 git commit       ->  skip the wrapper and its flag value
-        then git commit -m x        ->  skip the keyword, then match commit
-        build & git commit -m x     ->  split on the background operator
-        bash -cx "git commit"                     ->  unwrap the bash cluster
-        pwsh -ExecutionPolicy Bypass -Command ... ->  skip past the pwsh flag
-        (git commit -m x)                         ->  step over the group open
-
-    Skipped leading tokens: a subshell-group open ``(``, env-assignments, shell
-    keywords (then, do, else, elif), and wrapper commands (sudo, env, time,
-    nice, xargs, command, stdbuf) together with each wrapper's own option flags,
-    flag values, and the single leading operand that timeout and flock take
-    before their command. A non-wrapper command word between a wrapper and a
-    later git commit stops the scan, so the wrapper's own payload command is
-    read rather than the trailing git token. Segments split on unquoted control
-    separators (including
-    a lone ``&`` background operator) and newlines, and the git binary may be
-    path-prefixed and carry global flags (no-verify, config, and
-    working-directory) before its subcommand. A shell interpreter is unwrapped
-    at its inline-command flag by interpreter family: bash and sh take an
-    isolated ``-c`` or any short-flag cluster carrying ``c`` (``-lc``, ``-cx``),
-    and PowerShell (pwsh, powershell) takes only ``-Command`` or ``-c``, so a
-    leading pwsh flag whose name merely contains ``c`` (``-ExecutionPolicy``,
-    ``-NonInteractive``) is stepped over until the real ``-Command`` is reached.
-    The inline command's remaining tokens rejoin into one string, so an
-    unquoted multi-token command is read whole.
+def _repository_origin_slug(repository_root: Path) -> str | None:
+    """Return the lowercased owner/repo slug of the origin remote, or None.
 
     Args:
-        shell_command: Bash or PowerShell tool command string.
+        repository_root: Repository whose origin remote identifies it.
 
     Returns:
-        True when a command segment invokes git with a commit subcommand.
+        The ``owner/repo`` slug in lowercase, or None when the repository has no
+        readable origin remote or the URL carries no owner/repo tail.
     """
-    if not shell_command or not shell_command.strip():
-        return False
-    for each_segment in _all_command_segments(shell_command):
-        if _segment_invokes_git_commit(each_segment):
-            return True
-    return False
-
-
-def _following_tokens_working_directory(all_following_tokens: list[str]) -> str | None:
-    token_index = 0
-    option_with_value_step = GIT_OPTION_WITH_VALUE_STEP
-    while token_index < len(all_following_tokens):
-        each_token = _strip_token_edge_quotes(all_following_tokens[token_index])
-        if each_token == GIT_WORKING_DIRECTORY_OPTION:
-            value_index = token_index + 1
-            if value_index >= len(all_following_tokens):
-                return None
-            return _strip_token_edge_quotes(all_following_tokens[value_index])
-        option_name = each_token
-        has_attached_value = False
-        if each_token.startswith(DOUBLE_DASH_OPTION_PREFIX) and "=" in each_token:
-            option_name, _, _attached_value = each_token.partition("=")
-            has_attached_value = True
-        if option_name in ALL_VALUE_TAKING_GIT_OPTIONS:
-            token_index += 1 if has_attached_value else option_with_value_step
-            continue
-        if each_token.startswith(SINGLE_DASH_OPTION_PREFIX):
-            token_index += 1
-            continue
-        return None
-    return None
-
-
-def _segment_git_commit_working_directory(
-    all_segment_tokens: list[str],
-) -> str | None:
-    command_index = _skip_leading_noop_tokens(all_segment_tokens)
-    if command_index >= len(all_segment_tokens):
+    try:
+        completed_process = subprocess.run(
+            list(ALL_GIT_ORIGIN_URL_COMMAND),
+            capture_output=True,
+            text=True,
+            timeout=GIT_COMMAND_TIMEOUT_SECONDS,
+            cwd=str(repository_root),
+        )
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return None
-    command_token = all_segment_tokens[command_index]
-    if not _token_is_git_binary(command_token):
+    if completed_process.returncode != 0:
         return None
-    all_following_tokens = all_segment_tokens[command_index + 1 :]
-    return _following_tokens_working_directory(all_following_tokens)
-
+    return _owner_repo_slug_from_origin_url(completed_process.stdout.strip())
 
-def extract_git_commit_working_directory(shell_command: str) -> str | None:
-    """Return the directory a git-commit command runs in, or None for the CWD.
 
-    Reads the ``-C`` value off the same commit-invoking segment the detector
-    matches, so every git-binary shape the detector recognizes resolves too::
+def _is_repository_exempt_from_pii_scan(repository_root: Path) -> bool:
+    """Report whether commits in *repository_root* skip the staged PII scan.
 
-        git.exe -C /repoA commit -m x   ->  /repoA
-        git -C "C:/repo" commit -m x    ->  C:/repo
-        cd /repoB && git commit -m x    ->  /repoB (cd/pushd fallback)
-        git commit -m x                 ->  None   (runs in the CWD)
+    Exempt repositories are named by owner/repo slug through
+    ``CLAUDE_PII_EXEMPT_REPOS`` or the ``pii_exempt_repositories`` list in the
+    git-ignored ``~/.claude/local-identity.json``. A repository without a readable
+    origin remote is never exempt (fail-closed to scanning).
 
     Args:
-        shell_command: Bash or PowerShell tool command string.
+        repository_root: Repository whose index is about to be committed.
 
     Returns:
-        The working directory the commit targets, or None when it uses the CWD.
+        True when the repository's origin slug is in the exempt set.
     """
-    for each_segment in _all_command_segments(shell_command):
-        if not _segment_invokes_git_commit(each_segment):
-            continue
-        segment_directory = _segment_git_commit_working_directory(each_segment)
-        if segment_directory is not None:
-            return segment_directory
-    return extract_git_working_directory(shell_command)
+    origin_slug = _repository_origin_slug(repository_root)
+    if origin_slug is None:
+        return False
+    return origin_slug in pii_exempt_repository_slugs()
 
 
 def evaluate_bash_command(
@@ -698,6 +398,8 @@ def evaluate_bash_command(
     repository_root = resolve_repository_root(resolved_directory)
     if repository_root is None:
         return REPOSITORY_ROOT_UNRESOLVED_REASON
+    if _is_repository_exempt_from_pii_scan(repository_root):
+        return None
     return evaluate_staged_commit(repository_root)