claude-dev-env 1.94.0 → 1.95.0

package/hooks/blocking/test_code_rules_shared.py

@@ -0,0 +1,181 @@
+"""Tests for the harness session scratchpad exemption in code_rules_shared."""
+
+import importlib.util
+import os
+import tempfile
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+SHARED_MODULE_PATH = Path(__file__).parent / "code_rules_shared.py"
+FIXED_USER_ID = 4242
+WORKING_DIRECTORY = "/home/user/project"
+SESSION_ID = "session-abc-123"
+
+
+def _load_shared_module() -> ModuleType:
+    module_spec = importlib.util.spec_from_file_location(
+        "code_rules_shared_under_test", SHARED_MODULE_PATH
+    )
+    assert module_spec is not None and module_spec.loader is not None
+    loaded_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(loaded_module)
+    return loaded_module
+
+
+_SHARED_MODULE = _load_shared_module()
+
+
+def _install_fixed_user_id(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(os, "getuid", lambda: FIXED_USER_ID, raising=False)
+
+
+def _point_temporary_directory_at(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> None:
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
+
+
+def _build_scratchpad_directory(temporary_root: Path) -> Path:
+    mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
+    scratchpad_directory = (
+        temporary_root
+        / f"claude-{FIXED_USER_ID}"
+        / mangled_working_directory
+        / SESSION_ID
+        / "scratchpad"
+    )
+    scratchpad_directory.mkdir(parents=True)
+    return scratchpad_directory
+
+
+def _session_payload() -> dict[str, str]:
+    return {"cwd": WORKING_DIRECTORY, "session_id": SESSION_ID}
+
+
+def test_returns_true_for_file_inside_reconstructed_scratchpad(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+    throwaway_script = scratchpad_directory / "one_off_tool.py"
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(throwaway_script), _session_payload())
+        is True
+    )
+
+
+def test_returns_false_for_file_outside_scratchpad(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    _build_scratchpad_directory(tmp_path)
+    project_module = tmp_path / "elsewhere" / "orders.py"
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(project_module), _session_payload()) is False
+    )
+
+
+def test_resolves_symlink_into_scratchpad_to_true(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+    real_script = scratchpad_directory / "real_tool.py"
+    real_script.write_text("value = 1\n")
+    link_outside = tmp_path / "link_to_scratchpad.py"
+    link_outside.symlink_to(real_script)
+
+    assert _SHARED_MODULE.is_under_session_scratchpad(str(link_outside), _session_payload()) is True
+
+
+def test_symlink_resolving_outside_scratchpad_is_false(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+    real_target_outside = tmp_path / "outside_target.py"
+    real_target_outside.write_text("value = 1\n")
+    link_inside_scratchpad = scratchpad_directory / "sneaky_link.py"
+    link_inside_scratchpad.symlink_to(real_target_outside)
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(link_inside_scratchpad), _session_payload())
+        is False
+    )
+
+
+def test_missing_session_id_signal_returns_false(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+    throwaway_script = scratchpad_directory / "one_off_tool.py"
+    payload_without_session = {"cwd": WORKING_DIRECTORY}
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(throwaway_script), payload_without_session)
+        is False
+    )
+
+
+def test_missing_working_directory_signal_returns_false(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+    throwaway_script = scratchpad_directory / "one_off_tool.py"
+    payload_without_cwd = {"session_id": SESSION_ID}
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(throwaway_script), payload_without_cwd)
+        is False
+    )
+
+
+def test_absent_getuid_returns_false(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+    throwaway_script = scratchpad_directory / "one_off_tool.py"
+    monkeypatch.delattr(os, "getuid", raising=False)
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(throwaway_script), _session_payload())
+        is False
+    )
+
+
+def test_nonexistent_scratchpad_directory_returns_false(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
+    unbuilt_target = (
+        tmp_path
+        / f"claude-{FIXED_USER_ID}"
+        / mangled_working_directory
+        / SESSION_ID
+        / "scratchpad"
+        / "one_off_tool.py"
+    )
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(unbuilt_target), _session_payload()) is False
+    )
+
+
+def test_empty_file_path_returns_false(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    _install_fixed_user_id(monkeypatch)
+    _point_temporary_directory_at(monkeypatch, tmp_path)
+    _build_scratchpad_directory(tmp_path)
+
+    assert _SHARED_MODULE.is_under_session_scratchpad("", _session_payload()) is False

package/hooks/blocking/test_plain_language_blocker_allowlist.py

@@ -0,0 +1,184 @@
+"""Tests for the per-project domain-vocabulary allowlist in plain_language_blocker."""
+
+import importlib.util
+import json
+from pathlib import Path
+from types import ModuleType
+
+BLOCKER_PATH = Path(__file__).parent / "plain_language_blocker.py"
+ALLOWLIST_RELATIVE_PATH = Path(".claude") / "plain-language-allow.json"
+ALWAYS_HEAVY_WORD = "utilize"
+
+
+def _load_blocker() -> ModuleType:
+    module_spec = importlib.util.spec_from_file_location(
+        "plain_language_blocker_allowlist_under_test", BLOCKER_PATH
+    )
+    assert module_spec is not None and module_spec.loader is not None
+    loaded_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(loaded_module)
+    return loaded_module
+
+
+_BLOCKER = _load_blocker()
+
+
+def _init_repo(root: Path) -> Path:
+    (root / ".git").mkdir(parents=True, exist_ok=True)
+    return root
+
+
+def _write_allowlist(project_root: Path, all_words: list[str]) -> None:
+    allowlist_path = project_root / ALLOWLIST_RELATIVE_PATH
+    allowlist_path.parent.mkdir(parents=True, exist_ok=True)
+    allowlist_path.write_text(json.dumps(all_words), encoding="utf-8")
+
+
+def _write_raw_allowlist(project_root: Path, raw_text: str) -> None:
+    allowlist_path = project_root / ALLOWLIST_RELATIVE_PATH
+    allowlist_path.parent.mkdir(parents=True, exist_ok=True)
+    allowlist_path.write_text(raw_text, encoding="utf-8")
+
+
+def _markdown_write_payload(project_root: Path, prose: str) -> dict[str, object]:
+    document_path = project_root / "docs" / "notes.md"
+    return {
+        "tool_name": "Write",
+        "cwd": str(project_root),
+        "tool_input": {"file_path": str(document_path), "content": prose},
+    }
+
+
+def _ask_user_question_payload(project_root: Path, prose: str) -> dict[str, object]:
+    return {
+        "tool_name": "AskUserQuestion",
+        "cwd": str(project_root),
+        "tool_input": {"questions": [{"question": prose, "options": []}]},
+    }
+
+
+def test_allowlisted_word_passes_in_markdown_write(tmp_path: Path) -> None:
+    prose = "Please submit the release notes."
+    project_without_allowlist = _init_repo(tmp_path / "control")
+    project_with_allowlist = _init_repo(tmp_path / "domain")
+    _write_allowlist(project_with_allowlist, ["submit"])
+
+    control_deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(project_without_allowlist, prose)
+    )
+    allowlisted_deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(project_with_allowlist, prose)
+    )
+
+    assert control_deny_reason is not None and "submit" in control_deny_reason
+    assert allowlisted_deny_reason is None
+
+
+def test_allowlisted_word_passes_in_ask_user_question(tmp_path: Path) -> None:
+    prose = "Which theme should we identify first?"
+    project_without_allowlist = _init_repo(tmp_path / "control")
+    project_with_allowlist = _init_repo(tmp_path / "domain")
+    _write_allowlist(project_with_allowlist, ["identify"])
+
+    control_deny_reason = _BLOCKER.evaluate(
+        _ask_user_question_payload(project_without_allowlist, prose)
+    )
+    allowlisted_deny_reason = _BLOCKER.evaluate(
+        _ask_user_question_payload(project_with_allowlist, prose)
+    )
+
+    assert control_deny_reason is not None and "identify" in control_deny_reason
+    assert allowlisted_deny_reason is None
+
+
+def test_non_allowlisted_heavy_word_still_blocked(tmp_path: Path) -> None:
+    _init_repo(tmp_path)
+    _write_allowlist(tmp_path, ["submit"])
+
+    deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(tmp_path, f"Please {ALWAYS_HEAVY_WORD} the cache now.")
+    )
+
+    assert deny_reason is not None and ALWAYS_HEAVY_WORD in deny_reason
+
+
+def test_allowlist_match_is_case_insensitive(tmp_path: Path) -> None:
+    prose = "Please SUBMIT the release notes."
+    project_without_allowlist = _init_repo(tmp_path / "control")
+    project_with_allowlist = _init_repo(tmp_path / "domain")
+    _write_allowlist(project_with_allowlist, ["Submit"])
+
+    control_deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(project_without_allowlist, prose)
+    )
+    allowlisted_deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(project_with_allowlist, prose)
+    )
+
+    assert control_deny_reason is not None and "submit" in control_deny_reason
+    assert allowlisted_deny_reason is None
+
+
+def test_malformed_allowlist_json_is_ignored(tmp_path: Path) -> None:
+    _init_repo(tmp_path)
+    _write_raw_allowlist(tmp_path, "{ this is not valid json ")
+
+    deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(tmp_path, "Please submit the release notes.")
+    )
+
+    assert deny_reason is not None and "submit" in deny_reason
+
+
+def test_allowlist_in_a_different_project_root_is_not_applied(tmp_path: Path) -> None:
+    project_with_allowlist = _init_repo(tmp_path / "project_a")
+    project_without_allowlist = _init_repo(tmp_path / "project_b")
+    _write_allowlist(project_with_allowlist, ["submit"])
+
+    deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(project_without_allowlist, "Please submit the notes.")
+    )
+
+    assert deny_reason is not None and "submit" in deny_reason
+
+
+def test_allowlist_above_the_repo_root_is_not_applied(tmp_path: Path) -> None:
+    _write_allowlist(tmp_path, ["submit"])
+    repository_root = _init_repo(tmp_path / "repo")
+
+    deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(repository_root, "Please submit the notes.")
+    )
+
+    assert deny_reason is not None and "submit" in deny_reason
+
+
+def test_allowlist_at_the_repo_root_is_applied(tmp_path: Path) -> None:
+    repository_root = _init_repo(tmp_path / "repo")
+    _write_allowlist(repository_root, ["submit"])
+
+    deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(repository_root, "Please submit the notes.")
+    )
+
+    assert deny_reason is None
+
+
+def test_allowlist_without_a_repo_root_is_not_applied(tmp_path: Path) -> None:
+    _write_allowlist(tmp_path, ["submit"])
+
+    deny_reason = _BLOCKER.evaluate(
+        _markdown_write_payload(tmp_path, "Please submit the notes.")
+    )
+
+    assert deny_reason is not None and "submit" in deny_reason
+
+
+def test_find_banned_terms_skips_allowlisted_terms() -> None:
+    matched_without_allowlist = _BLOCKER.find_banned_terms("Please submit the notes.")
+    matched_with_allowlist = _BLOCKER.find_banned_terms(
+        "Please submit the notes.", frozenset({"submit"})
+    )
+
+    assert any(each_term == "submit" for each_term, _ in matched_without_allowlist)
+    assert all(each_term != "submit" for each_term, _ in matched_with_allowlist)

package/hooks/blocking/test_sensitive_file_protector.py

@@ -0,0 +1,185 @@
+"""Decision tests for the sensitive-file filename guard.
+
+Each case drives the real hook script through its production ``__main__``
+stdin path, feeding it the PreToolUse JSON payload Claude Code sends and
+reading the permission decision back off stdout.
+
+The guard denies a filename that names a live secret or a lock file, and
+steps aside for a placeholders-only committed template (``.env.example``
+and its ``.sample`` / ``.template`` spellings). The template exemption is
+narrow: ``.env.local`` is a ``.env.*`` filename that is not a template, and
+it stays denied.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+HOOK_SCRIPT_PATH = BLOCKING_DIRECTORY / "sensitive_file_protector.py"
+
+WRITE_TOOL_NAME = "Write"
+EDIT_TOOL_NAME = "Edit"
+READ_TOOL_NAME = "Read"
+
+DENY_DECISION = "deny"
+
+PLACEHOLDER_TEMPLATE_BODY = "API_TOKEN=your-token-here\nDATABASE_HOST=localhost\n"
+ORDINARY_SOURCE_BODY = "def add(left: int, right: int) -> int:\n    return left + right\n"
+
+ALL_TEMPLATE_FILENAMES = (
+    ".env.example",
+    ".env.sample",
+    ".env.template",
+    ".ENV.Example",
+    "settings.json.template",
+)
+
+ALL_DENIED_FILENAMES = (
+    ".env",
+    ".env.local",
+    ".env.production",
+    "credentials.json",
+    "secrets.json",
+    "id_rsa",
+    "id_ed25519",
+    "server.pem",
+    "signing.key",
+    "bundle.p12",
+    "bundle.pfx",
+    "package-lock.json",
+    "yarn.lock",
+    "Pipfile.lock",
+    "poetry.lock",
+    "pnpm-lock.yaml",
+    "composer.lock",
+)
+
+ALL_UPPERCASE_DENIED_FILENAMES = (".ENV", "ID_RSA", "CREDENTIALS.JSON", "SERVER.PEM")
+
+ALL_ORDINARY_FILENAMES = ("main.py", "README.md", "settings.json")
+
+
+def _run_hook(tool_name: str, file_path: Path, content: str) -> subprocess.CompletedProcess:
+    payload = json.dumps(
+        {
+            "tool_name": tool_name,
+            "tool_input": {"file_path": str(file_path), "content": content},
+        }
+    )
+    return _run_hook_with_stdin(payload)
+
+
+def _run_hook_with_stdin(stdin_text: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [sys.executable, str(HOOK_SCRIPT_PATH)],
+        input=stdin_text,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def _permission_decision(completed: subprocess.CompletedProcess) -> str | None:
+    if not completed.stdout.strip():
+        return None
+    parsed_decision = json.loads(completed.stdout)
+    return parsed_decision["hookSpecificOutput"]["permissionDecision"]
+
+
+def _deny_reason(completed: subprocess.CompletedProcess) -> str:
+    parsed_decision = json.loads(completed.stdout)
+    return parsed_decision["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+@pytest.mark.parametrize("template_filename", ALL_TEMPLATE_FILENAMES)
+def test_template_filename_is_allowed(tmp_path: Path, template_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / template_filename, PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None, (
+        f"{template_filename} is a committed template and must not be denied by filename; "
+        f"got stdout {completed.stdout!r}"
+    )
+
+
+@pytest.mark.parametrize("sensitive_filename", ALL_DENIED_FILENAMES)
+def test_sensitive_filename_is_denied(tmp_path: Path, sensitive_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / sensitive_filename, PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION, (
+        f"{sensitive_filename} must stay denied; got stdout {completed.stdout!r}"
+    )
+
+
+@pytest.mark.parametrize("uppercase_filename", ALL_UPPERCASE_DENIED_FILENAMES)
+def test_uppercase_sensitive_filename_is_denied(tmp_path: Path, uppercase_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / uppercase_filename, PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION, (
+        f"{uppercase_filename} names a secret in an uppercase spelling and must stay denied like "
+        f"its lowercase form; got stdout {completed.stdout!r}"
+    )
+
+
+@pytest.mark.parametrize("ordinary_filename", ALL_ORDINARY_FILENAMES)
+def test_ordinary_source_file_is_allowed(tmp_path: Path, ordinary_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / ordinary_filename, ORDINARY_SOURCE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_dot_env_local_deny_reason_names_the_file_and_the_pattern(tmp_path: Path) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / ".env.local", PLACEHOLDER_TEMPLATE_BODY)
+    assert _permission_decision(completed) == DENY_DECISION
+    deny_reason = _deny_reason(completed)
+    assert ".env.local" in deny_reason
+    assert ".env.*" in deny_reason
+
+
+def test_edit_to_a_template_is_allowed(tmp_path: Path) -> None:
+    completed = _run_hook(EDIT_TOOL_NAME, tmp_path / ".env.example", PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_edit_to_a_secrets_file_is_denied(tmp_path: Path) -> None:
+    completed = _run_hook(EDIT_TOOL_NAME, tmp_path / ".env", PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION
+
+
+def test_read_tool_is_not_evaluated(tmp_path: Path) -> None:
+    completed = _run_hook(READ_TOOL_NAME, tmp_path / ".env", PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_payload_without_a_file_path_is_allowed() -> None:
+    completed = _run_hook_with_stdin(json.dumps({"tool_name": WRITE_TOOL_NAME, "tool_input": {}}))
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_malformed_payload_fails_open() -> None:
+    completed = _run_hook_with_stdin("{not valid json")
+    assert completed.returncode == 0, completed.stderr
+    assert completed.stdout.strip() == ""
+
+
+@pytest.mark.parametrize("trailing_suffix_filename", (".env.example.bak", ".env.template.old", ".env.sample.orig"))
+def test_template_suffix_must_be_last_to_earn_the_exemption(
+    tmp_path: Path, trailing_suffix_filename: str
+) -> None:
+    completed = _run_hook(
+        WRITE_TOOL_NAME, tmp_path / trailing_suffix_filename, PLACEHOLDER_TEMPLATE_BODY
+    )
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION, (
+        f"{trailing_suffix_filename} is a copy of a live secrets file, not a template; "
+        f"only a trailing template suffix earns the exemption, got {completed.stdout!r}"
+    )

package/hooks/blocking/test_tdd_enforcer_scratchpad.py

@@ -0,0 +1,105 @@
+"""Tests for the session-scratchpad exemption wired into tdd_enforcer.main."""
+
+import importlib.util
+import io
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+TDD_ENFORCER_PATH = Path(__file__).parent / "tdd_enforcer.py"
+FIXED_USER_ID = 5150
+WORKING_DIRECTORY = "/home/user/project"
+SESSION_ID = "tdd-session-987"
+PRODUCTION_CONTENT = "def fulfill_order():\n    return True\n"
+
+
+def _load_tdd_enforcer() -> ModuleType:
+    module_spec = importlib.util.spec_from_file_location(
+        "tdd_enforcer_scratchpad_under_test", TDD_ENFORCER_PATH
+    )
+    assert module_spec is not None and module_spec.loader is not None
+    loaded_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(loaded_module)
+    return loaded_module
+
+
+_TDD_ENFORCER = _load_tdd_enforcer()
+
+
+def _install_scratchpad_signals(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> Path:
+    monkeypatch.setattr(os, "getuid", lambda: FIXED_USER_ID, raising=False)
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
+    mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
+    scratchpad_directory = (
+        temporary_root
+        / f"claude-{FIXED_USER_ID}"
+        / mangled_working_directory
+        / SESSION_ID
+        / "scratchpad"
+    )
+    scratchpad_directory.mkdir(parents=True)
+    return scratchpad_directory
+
+
+def _write_payload(target: Path) -> dict[str, object]:
+    return {
+        "tool_name": "Write",
+        "cwd": WORKING_DIRECTORY,
+        "session_id": SESSION_ID,
+        "tool_input": {"file_path": str(target), "content": PRODUCTION_CONTENT},
+    }
+
+
+def _run_main(
+    monkeypatch: pytest.MonkeyPatch, payload: dict[str, object]
+) -> tuple[int | None, str]:
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+    captured_stdout = io.StringIO()
+    monkeypatch.setattr(sys, "stdout", captured_stdout)
+    exit_code: int | None = None
+    try:
+        _TDD_ENFORCER.main()
+    except SystemExit as raised_exit:
+        raw_code = raised_exit.code
+        exit_code = raw_code if isinstance(raw_code, int) else None
+    return exit_code, captured_stdout.getvalue()
+
+
+def _decision_from(stdout_text: str) -> str | None:
+    if not stdout_text.strip():
+        return None
+    parsed = json.loads(stdout_text)
+    return parsed.get("hookSpecificOutput", {}).get("permissionDecision")
+
+
+def test_scratchpad_production_write_is_exempt_from_tdd_gate(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    scratchpad_directory = _install_scratchpad_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    throwaway_script = scratchpad_directory / "one_off_probe.py"
+
+    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(throwaway_script))
+
+    assert exit_code == 0
+    assert _decision_from(stdout_text) != "deny"
+
+
+def test_identical_non_scratchpad_write_is_still_blocked(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_scratchpad_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    outside_directory = tmp_path / "project" / "orders"
+    outside_directory.mkdir(parents=True)
+    production_module = outside_directory / "one_off_probe.py"
+
+    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(production_module))
+
+    assert exit_code == 0
+    assert _decision_from(stdout_text) == "deny"

package/hooks/hooks_constants/CLAUDE.md

@@ -32,6 +32,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `dynamic_stderr_handler.py` | `DynamicStderrHandler` — a logging handler that resolves `sys.stderr` at emit time (for testability) |
 | `gh_pr_author_swap_constants.py` | Constants for the PR-author swap enforcement hooks |
 | `hardcoded_user_path_constants.py` | Patterns for detecting hardcoded home-directory paths |
+| `harness_scratchpad_constants.py` | Fixed path components (`claude-` user-directory prefix, separator replacement, `scratchpad` leaf name) and payload keys that rebuild the harness session scratchpad directory for the code-rules and TDD gate exemptions |
 | `hook_block_logger.py` | `log_hook_block()` — shared fail-safe logger every blocking hook calls to append a JSON record of each block decision to `~/.claude/logs/hook-blocks.log` |
 | `hook_log_extractor_constants.py` | Neon table name, offset state file path, timeouts, and outcome-type mapping for the hook-log extractor |
 | `hook_prose_detector_consistency_constants.py` | Trigger patterns and corrective messages for the hook-prose consistency checker |
@@ -60,6 +61,7 @@ Shared constant modules imported by hooks throughout the `hooks/` tree. Each fil
 | `python_style_checks_constants.py` | Command-line argument count and blank-line count between top-level functions for the style validator |
 | `reviewer_spawn_gate_constants.py` | Bash tool name, the sentinel marker, the Copilot and Bugbot trigger markers, the availability-script relative path and override env-var name, and the deny-message template for the reviewer-spawn gate |
 | `send_user_file_open_locally_blocker_constants.py` | Tool name, proactive status, and the block message for the open-locally attach blocker |
+| `sensitive_file_protector_constants.py` | Sensitive filename patterns, the committed-template suffixes that earn an exemption, the write/edit tool names, and the deny decision and message template for `sensitive_file_protector` |
 | `session_edit_stage_gate_constants.py` | Tracker filename prefix/suffix, JSON payload key, edit tool name set, session-id sanitize pattern, lock filename suffix and lock-acquire timing, git diff command, commit flag escapes, and deny-message template shared by the session edit stage gate trio |
 | `session_env_cleanup_constants.py` | Stale-age threshold and directory names for the session-env cleanup hook |
 | `session_handoff_blocker_constants.py` | Trigger phrases for the session-handoff blocker |

package/hooks/hooks_constants/harness_scratchpad_constants.py

@@ -0,0 +1,17 @@
+"""Constants for resolving the Claude Code harness session scratchpad directory.
+
+The harness gives each session a throwaway scratch directory it announces in
+the session's system prompt, laid out as
+``<tempdir>/claude-<uid>/<mangled-cwd>/<session-id>/scratchpad``. These constants
+name the fixed path components the code-rules and TDD gates read to rebuild that
+directory from the signals a hook process can see.
+
+The exemption is POSIX-only: without ``os.getuid`` (Windows) it never fires,
+so full enforcement stays in place there.
+"""
+
+HARNESS_SCRATCHPAD_USER_DIRECTORY_PREFIX: str = "claude-"
+HARNESS_SCRATCHPAD_PATH_SEPARATOR_REPLACEMENT: str = "-"
+HARNESS_SCRATCHPAD_LEAF_DIRECTORY_NAME: str = "scratchpad"
+HOOK_PAYLOAD_SESSION_ID_KEY: str = "session_id"
+HOOK_PAYLOAD_WORKING_DIRECTORY_KEY: str = "cwd"