claude-dev-env 1.94.0 → 2.0.0

package/hooks/blocking/test_sensitive_file_protector.py

@@ -0,0 +1,185 @@
+"""Decision tests for the sensitive-file filename guard.
+
+Each case drives the real hook script through its production ``__main__``
+stdin path, feeding it the PreToolUse JSON payload Claude Code sends and
+reading the permission decision back off stdout.
+
+The guard denies a filename that names a live secret or a lock file, and
+steps aside for a placeholders-only committed template (``.env.example``
+and its ``.sample`` / ``.template`` spellings). The template exemption is
+narrow: ``.env.local`` is a ``.env.*`` filename that is not a template, and
+it stays denied.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+HOOK_SCRIPT_PATH = BLOCKING_DIRECTORY / "sensitive_file_protector.py"
+
+WRITE_TOOL_NAME = "Write"
+EDIT_TOOL_NAME = "Edit"
+READ_TOOL_NAME = "Read"
+
+DENY_DECISION = "deny"
+
+PLACEHOLDER_TEMPLATE_BODY = "API_TOKEN=your-token-here\nDATABASE_HOST=localhost\n"
+ORDINARY_SOURCE_BODY = "def add(left: int, right: int) -> int:\n    return left + right\n"
+
+ALL_TEMPLATE_FILENAMES = (
+    ".env.example",
+    ".env.sample",
+    ".env.template",
+    ".ENV.Example",
+    "settings.json.template",
+)
+
+ALL_DENIED_FILENAMES = (
+    ".env",
+    ".env.local",
+    ".env.production",
+    "credentials.json",
+    "secrets.json",
+    "id_rsa",
+    "id_ed25519",
+    "server.pem",
+    "signing.key",
+    "bundle.p12",
+    "bundle.pfx",
+    "package-lock.json",
+    "yarn.lock",
+    "Pipfile.lock",
+    "poetry.lock",
+    "pnpm-lock.yaml",
+    "composer.lock",
+)
+
+ALL_UPPERCASE_DENIED_FILENAMES = (".ENV", "ID_RSA", "CREDENTIALS.JSON", "SERVER.PEM")
+
+ALL_ORDINARY_FILENAMES = ("main.py", "README.md", "settings.json")
+
+
+def _run_hook(tool_name: str, file_path: Path, content: str) -> subprocess.CompletedProcess:
+    payload = json.dumps(
+        {
+            "tool_name": tool_name,
+            "tool_input": {"file_path": str(file_path), "content": content},
+        }
+    )
+    return _run_hook_with_stdin(payload)
+
+
+def _run_hook_with_stdin(stdin_text: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [sys.executable, str(HOOK_SCRIPT_PATH)],
+        input=stdin_text,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def _permission_decision(completed: subprocess.CompletedProcess) -> str | None:
+    if not completed.stdout.strip():
+        return None
+    parsed_decision = json.loads(completed.stdout)
+    return parsed_decision["hookSpecificOutput"]["permissionDecision"]
+
+
+def _deny_reason(completed: subprocess.CompletedProcess) -> str:
+    parsed_decision = json.loads(completed.stdout)
+    return parsed_decision["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+@pytest.mark.parametrize("template_filename", ALL_TEMPLATE_FILENAMES)
+def test_template_filename_is_allowed(tmp_path: Path, template_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / template_filename, PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None, (
+        f"{template_filename} is a committed template and must not be denied by filename; "
+        f"got stdout {completed.stdout!r}"
+    )
+
+
+@pytest.mark.parametrize("sensitive_filename", ALL_DENIED_FILENAMES)
+def test_sensitive_filename_is_denied(tmp_path: Path, sensitive_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / sensitive_filename, PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION, (
+        f"{sensitive_filename} must stay denied; got stdout {completed.stdout!r}"
+    )
+
+
+@pytest.mark.parametrize("uppercase_filename", ALL_UPPERCASE_DENIED_FILENAMES)
+def test_uppercase_sensitive_filename_is_denied(tmp_path: Path, uppercase_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / uppercase_filename, PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION, (
+        f"{uppercase_filename} names a secret in an uppercase spelling and must stay denied like "
+        f"its lowercase form; got stdout {completed.stdout!r}"
+    )
+
+
+@pytest.mark.parametrize("ordinary_filename", ALL_ORDINARY_FILENAMES)
+def test_ordinary_source_file_is_allowed(tmp_path: Path, ordinary_filename: str) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / ordinary_filename, ORDINARY_SOURCE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_dot_env_local_deny_reason_names_the_file_and_the_pattern(tmp_path: Path) -> None:
+    completed = _run_hook(WRITE_TOOL_NAME, tmp_path / ".env.local", PLACEHOLDER_TEMPLATE_BODY)
+    assert _permission_decision(completed) == DENY_DECISION
+    deny_reason = _deny_reason(completed)
+    assert ".env.local" in deny_reason
+    assert ".env.*" in deny_reason
+
+
+def test_edit_to_a_template_is_allowed(tmp_path: Path) -> None:
+    completed = _run_hook(EDIT_TOOL_NAME, tmp_path / ".env.example", PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_edit_to_a_secrets_file_is_denied(tmp_path: Path) -> None:
+    completed = _run_hook(EDIT_TOOL_NAME, tmp_path / ".env", PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION
+
+
+def test_read_tool_is_not_evaluated(tmp_path: Path) -> None:
+    completed = _run_hook(READ_TOOL_NAME, tmp_path / ".env", PLACEHOLDER_TEMPLATE_BODY)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_payload_without_a_file_path_is_allowed() -> None:
+    completed = _run_hook_with_stdin(json.dumps({"tool_name": WRITE_TOOL_NAME, "tool_input": {}}))
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
+def test_malformed_payload_fails_open() -> None:
+    completed = _run_hook_with_stdin("{not valid json")
+    assert completed.returncode == 0, completed.stderr
+    assert completed.stdout.strip() == ""
+
+
+@pytest.mark.parametrize("trailing_suffix_filename", (".env.example.bak", ".env.template.old", ".env.sample.orig"))
+def test_template_suffix_must_be_last_to_earn_the_exemption(
+    tmp_path: Path, trailing_suffix_filename: str
+) -> None:
+    completed = _run_hook(
+        WRITE_TOOL_NAME, tmp_path / trailing_suffix_filename, PLACEHOLDER_TEMPLATE_BODY
+    )
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION, (
+        f"{trailing_suffix_filename} is a copy of a live secrets file, not a template; "
+        f"only a trailing template suffix earns the exemption, got {completed.stdout!r}"
+    )

package/hooks/blocking/test_tdd_enforcer_restore.py

@@ -0,0 +1,108 @@
+"""End-to-end tests for the absent-but-tracked restore exemption.
+
+Drives the real ``tdd_enforcer.py`` entry hook over a Write payload in a temp
+git repository, proving a remove-then-Write rewrite of committed code is allowed
+even when the paired test's freshness window has lapsed, while new untracked
+code and real edits to a present file stay gated.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
+STALE_MTIME_OFFSET_SECONDS = 700
+DISABLE_EPHEMERAL_ENVIRONMENT = {"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"}
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+        env={**os.environ, **DISABLE_EPHEMERAL_ENVIRONMENT},
+    )
+
+
+def _write_payload(file_path: Path, content: str) -> dict:
+    return {"tool_name": "Write", "tool_input": {"file_path": str(file_path), "content": content}}
+
+
+def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
+    if not completed.stdout:
+        return None
+    hook_output = json.loads(completed.stdout).get("hookSpecificOutput", {})
+    return hook_output.get("permissionDecision")
+
+
+def _run_git(repository_root: Path, *arguments: str) -> None:
+    subprocess.run(
+        ["git", *arguments],
+        cwd=str(repository_root),
+        check=True,
+        capture_output=True,
+        env={**os.environ, "GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_SYSTEM": os.devnull},
+    )
+
+
+def _init_git_repository(repository_root: Path) -> None:
+    _run_git(repository_root, "init", "-q")
+    _run_git(repository_root, "config", "user.email", "test@example.com")
+    _run_git(repository_root, "config", "user.name", "Test")
+    _run_git(repository_root, "config", "commit.gpgsign", "false")
+
+
+def _commit_tracked_service(repository_root: Path) -> tuple[Path, Path]:
+    production_file = repository_root / "service.py"
+    production_file.write_text("def serve(): return 1\n")
+    sibling_test = repository_root / "test_service.py"
+    sibling_test.write_text("def test_serve(): pass\n")
+    _run_git(repository_root, "add", "-A")
+    _run_git(repository_root, "commit", "-q", "-m", "init")
+    return production_file, sibling_test
+
+
+def test_should_allow_restore_write_of_absent_but_tracked_file_despite_stale_window(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    production_file, sibling_test = _commit_tracked_service(repository_root)
+    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+    production_file.unlink()
+
+    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_still_deny_write_of_absent_untracked_file_without_fresh_test(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    untracked_file = repository_root / "brand_new.py"
+
+    completed = _run_hook(_write_payload(untracked_file, "def fresh(): return 1\n"))
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_still_deny_write_of_present_file_with_stale_test(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    production_file, sibling_test = _commit_tracked_service(repository_root)
+    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+
+    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
+
+    assert _decision_from(completed) == "deny"

package/hooks/blocking/test_tdd_enforcer_scratchpad.py

@@ -0,0 +1,105 @@
+"""Tests for the session-scratchpad exemption wired into tdd_enforcer.main."""
+
+import importlib.util
+import io
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+TDD_ENFORCER_PATH = Path(__file__).parent / "tdd_enforcer.py"
+FIXED_USER_ID = 5150
+WORKING_DIRECTORY = "/home/user/project"
+SESSION_ID = "tdd-session-987"
+PRODUCTION_CONTENT = "def fulfill_order():\n    return True\n"
+
+
+def _load_tdd_enforcer() -> ModuleType:
+    module_spec = importlib.util.spec_from_file_location(
+        "tdd_enforcer_scratchpad_under_test", TDD_ENFORCER_PATH
+    )
+    assert module_spec is not None and module_spec.loader is not None
+    loaded_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(loaded_module)
+    return loaded_module
+
+
+_TDD_ENFORCER = _load_tdd_enforcer()
+
+
+def _install_scratchpad_signals(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> Path:
+    monkeypatch.setattr(os, "getuid", lambda: FIXED_USER_ID, raising=False)
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
+    mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
+    scratchpad_directory = (
+        temporary_root
+        / f"claude-{FIXED_USER_ID}"
+        / mangled_working_directory
+        / SESSION_ID
+        / "scratchpad"
+    )
+    scratchpad_directory.mkdir(parents=True)
+    return scratchpad_directory
+
+
+def _write_payload(target: Path) -> dict[str, object]:
+    return {
+        "tool_name": "Write",
+        "cwd": WORKING_DIRECTORY,
+        "session_id": SESSION_ID,
+        "tool_input": {"file_path": str(target), "content": PRODUCTION_CONTENT},
+    }
+
+
+def _run_main(
+    monkeypatch: pytest.MonkeyPatch, payload: dict[str, object]
+) -> tuple[int | None, str]:
+    monkeypatch.setattr(sys, "stdin", io.StringIO(json.dumps(payload)))
+    captured_stdout = io.StringIO()
+    monkeypatch.setattr(sys, "stdout", captured_stdout)
+    exit_code: int | None = None
+    try:
+        _TDD_ENFORCER.main()
+    except SystemExit as raised_exit:
+        raw_code = raised_exit.code
+        exit_code = raw_code if isinstance(raw_code, int) else None
+    return exit_code, captured_stdout.getvalue()
+
+
+def _decision_from(stdout_text: str) -> str | None:
+    if not stdout_text.strip():
+        return None
+    parsed = json.loads(stdout_text)
+    return parsed.get("hookSpecificOutput", {}).get("permissionDecision")
+
+
+def test_scratchpad_production_write_is_exempt_from_tdd_gate(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    scratchpad_directory = _install_scratchpad_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    throwaway_script = scratchpad_directory / "one_off_probe.py"
+
+    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(throwaway_script))
+
+    assert exit_code == 0
+    assert _decision_from(stdout_text) != "deny"
+
+
+def test_identical_non_scratchpad_write_is_still_blocked(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _install_scratchpad_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    outside_directory = tmp_path / "project" / "orders"
+    outside_directory.mkdir(parents=True)
+    production_module = outside_directory / "one_off_probe.py"
+
+    exit_code, stdout_text = _run_main(monkeypatch, _write_payload(production_module))
+
+    assert exit_code == 0
+    assert _decision_from(stdout_text) == "deny"

package/hooks/blocking/tests/conftest.py

@@ -0,0 +1,10 @@
+"""Put the blocking and hooks directories on sys.path for the blocking tests."""
+
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parents[1])
+_hooks_directory = str(Path(__file__).resolve().parents[2])
+for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
+    if each_bootstrap_directory not in sys.path:
+        sys.path.insert(0, each_bootstrap_directory)

package/hooks/blocking/tests/test_pii_prevention_blocker.py

@@ -0,0 +1,260 @@
+"""Repository-resolution behavior of the PII commit gate (issue #65).
+
+The gate scans the repository the command names, not the session working
+directory, so::
+
+    git -C <healthy repo> commit  ->  scans <healthy repo> from any cwd
+    cd <repo> && git commit        ->  scans <repo>
+    git -C <repo> commit (cwd gone) ->  still scans <repo>, never refuses for cwd
+    git -C <not-a-repo> commit      ->  refusal names <not-a-repo>
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from pii_prevention_blocker import evaluate, evaluate_bash_command
+
+_HOOK_PATH = Path(__file__).resolve().parents[1] / "pii_prevention_blocker.py"
+_ALLOW_SLUG = "AllowOwner/allow-repo"
+_OTHER_SLUG = "OtherOwner/other-repo"
+
+
+def _run_hook(payload: dict[str, object]) -> tuple[int, str]:
+    completed_process = subprocess.run(
+        [sys.executable, str(_HOOK_PATH)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        timeout=30,
+        check=False,
+    )
+    return completed_process.returncode, completed_process.stdout
+
+
+def _assembled_fixture_email() -> str:
+    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _assembled_unlisted_email() -> str:
+    return "other.person" + "@" + "different-co" + ".example" + ".io"
+
+
+def _write_allowlist_identity(identity_path: Path, slug: str, value: str) -> None:
+    identity_path.write_text(
+        json.dumps({"pii_allowlisted_values": {slug: [value]}}),
+        encoding="utf-8",
+    )
+
+
+def _init_repo_with_origin_and_staged_value(
+    repository_root: Path, origin_slug: str, staged_value: str
+) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "dev@example.com"],
+        cwd=repository_root,
+        check=True,
+    )
+    subprocess.run(
+        ["git", "config", "user.name", "Fixture Dev"], cwd=repository_root, check=True
+    )
+    subprocess.run(
+        ["git", "remote", "add", "origin", "https://github.com/" + origin_slug + ".git"],
+        cwd=repository_root,
+        check=True,
+    )
+    (repository_root / "notes.md").write_text(
+        "owner email " + staged_value + "\n", encoding="utf-8"
+    )
+    subprocess.run(["git", "add", "notes.md"], cwd=repository_root, check=True)
+
+
+def _commit_payload(repository_root: Path) -> dict[str, object]:
+    return {
+        "tool_name": "Bash",
+        "tool_input": {"command": f"git -C {repository_root} commit -m x"},
+    }
+
+
+def test_commit_subprocess_allows_allowlisted_value_in_the_allowlisted_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(repository_root, _ALLOW_SLUG, allowed_value)
+    return_code, hook_stdout = _run_hook(_commit_payload(repository_root))
+    assert return_code == 0
+    assert hook_stdout.strip() == ""
+
+
+def test_commit_subprocess_blocks_allowlisted_value_in_a_different_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(repository_root, _OTHER_SLUG, allowed_value)
+    _return_code, hook_stdout = _run_hook(_commit_payload(repository_root))
+    assert "email" in hook_stdout
+
+
+def test_commit_blocks_an_unlisted_value_in_the_allowlisted_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(
+        repository_root, _ALLOW_SLUG, _assembled_unlisted_email()
+    )
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory=str(repository_root),
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_commit_with_missing_local_identity_still_blocks_the_value(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(tmp_path / "absent.json"))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(
+        repository_root, _ALLOW_SLUG, _assembled_fixture_email()
+    )
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory=str(repository_root),
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def _init_repo_with_staged_pii(repository_root: Path) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "dev@example.com"],
+        cwd=repository_root,
+        check=True,
+    )
+    subprocess.run(
+        ["git", "config", "user.name", "Fixture Dev"],
+        cwd=repository_root,
+        check=True,
+    )
+    (repository_root / "notes.md").write_text(
+        "owner email " + _assembled_fixture_email() + "\n",
+        encoding="utf-8",
+    )
+    subprocess.run(["git", "add", "notes.md"], cwd=repository_root, check=True)
+
+
+def test_dash_c_scans_named_repo_from_unrelated_cwd(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_cd_prefix_scans_named_repo_from_unrelated_cwd(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"cd {repository_root} && git commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_cd_prefix_with_git_exe_scans_named_repo_from_unrelated_cwd(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"cd {repository_root} && git.exe commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_removed_working_directory_does_not_block_named_repo(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    removed_directory = tmp_path / "gone"
+    removed_directory.mkdir()
+    removed_directory.rmdir()
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory=str(removed_directory),
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_multiple_dash_c_compose_to_the_named_repo(tmp_path: Path) -> None:
+    repository_root = tmp_path / "parent" / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"git -C {tmp_path / 'parent'} -C healthy_repo commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_full_dispatch_blocks_pii_commit_from_unrelated_cwd(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate(
+        {
+            "tool_name": "Bash",
+            "tool_input": {"command": f"git -C {repository_root} commit -m x"},
+            "cwd": "/tmp",
+        }
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_unresolvable_named_repo_refusal_names_the_path() -> None:
+    deny_reason = evaluate_bash_command(
+        "git -C /nonexistent/repo/xyz commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "repository root" in deny_reason
+    assert "/nonexistent/repo/xyz" in deny_reason
+
+
+def test_clean_named_repo_passes(tmp_path: Path) -> None:
+    repository_root = tmp_path / "clean_repo"
+    repository_root.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    (repository_root / "readme.md").write_text("all clear\n", encoding="utf-8")
+    subprocess.run(["git", "add", "readme.md"], cwd=repository_root, check=True)
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is None