claude-dev-env 1.95.0 → 2.0.0

package/hooks/blocking/test_pii_payload_scan.py

@@ -0,0 +1,168 @@
+"""Behavior tests for the Write/Edit payload PII evaluation."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+_HOOK_DIR = Path(__file__).parent
+_HOOKS_DIR = _HOOK_DIR.parent
+
+try:
+    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+except ImportError:
+    for each_bootstrap_directory in (str(_HOOK_DIR), str(_HOOKS_DIR)):
+        if each_bootstrap_directory not in sys.path:
+            sys.path.insert(0, each_bootstrap_directory)
+    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+
+_ALLOW_SLUG = "AllowOwner/allow-repo"
+_OTHER_SLUG = "OtherOwner/other-repo"
+
+
+def test_post_body_with_pii_is_blocked_by_default() -> None:
+    deny_reason = evaluate_post_body_texts([_assembled_fixture_email()])
+    assert deny_reason is not None
+    assert "post body" in deny_reason
+
+
+def test_post_body_allowlisted_values_plumb_through_to_the_scan() -> None:
+    allowed_value = _assembled_fixture_email()
+    deny_reason = evaluate_post_body_texts(
+        [allowed_value], all_allowlisted_values=frozenset({allowed_value})
+    )
+    assert deny_reason is None
+
+
+def test_post_body_unlisted_value_still_blocked_beside_allowlist() -> None:
+    deny_reason = evaluate_post_body_texts(
+        [_assembled_unlisted_email()],
+        all_allowlisted_values=frozenset({_assembled_fixture_email()}),
+    )
+    assert deny_reason is not None
+    assert "post body" in deny_reason
+
+
+def _assembled_fixture_email() -> str:
+    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _assembled_unlisted_email() -> str:
+    return "other.person" + "@" + "different-co" + ".example" + ".io"
+
+
+def _write_allowlist_identity(identity_path: Path, slug: str, value: str) -> None:
+    identity_path.write_text(
+        json.dumps({"pii_allowlisted_values": {slug: [value]}}),
+        encoding="utf-8",
+    )
+
+
+def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    origin_url = "https://github.com/" + origin_slug + ".git"
+    subprocess.run(
+        ["git", "remote", "add", "origin", origin_url],
+        cwd=repository_root,
+        check=True,
+    )
+
+
+def _write_deny_reason(target_path: Path, value: str) -> str | None:
+    content = "owner email " + value + "\n"
+    return evaluate_write_edit_payload(
+        "Write", {"file_path": str(target_path), "content": content}
+    )
+
+
+def test_write_payload_with_a_fixture_email_is_flagged(tmp_path: Path) -> None:
+    deny_reason = _write_deny_reason(tmp_path / "notes.md", _assembled_fixture_email())
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_allowlisted_value_under_the_allowlisted_repo_is_allowed(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    assert _write_deny_reason(repository_root / "notes.md", allowed_value) is None
+
+
+def test_allowlisted_value_in_a_different_repo_is_blocked(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _OTHER_SLUG)
+    deny_reason = _write_deny_reason(repository_root / "notes.md", allowed_value)
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_unlisted_value_in_the_allowlisted_repo_is_blocked(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = _write_deny_reason(
+        repository_root / "notes.md", _assembled_unlisted_email()
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_clean_write_payload_skips_repository_resolution(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+
+    def _fail_if_called(_working_directory: str | None) -> None:
+        raise AssertionError(
+            "resolve_repository_root should not run for a payload with no PII"
+        )
+
+    monkeypatch.setattr(
+        sys.modules["pii_payload_scan"], "resolve_repository_root", _fail_if_called
+    )
+    deny_reason = evaluate_write_edit_payload(
+        "Write",
+        {
+            "file_path": str(repository_root / "notes.md"),
+            "content": "nothing sensitive here\n",
+        },
+    )
+    assert deny_reason is None
+
+
+def test_allowlisted_value_under_missing_nested_parent_is_allowed(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    nested_target = repository_root / "new_dir" / "deeper" / "notes.md"
+    assert not nested_target.parent.exists()
+    assert _write_deny_reason(nested_target, allowed_value) is None

package/hooks/blocking/test_tdd_enforcer_restore.py

@@ -0,0 +1,108 @@
+"""End-to-end tests for the absent-but-tracked restore exemption.
+
+Drives the real ``tdd_enforcer.py`` entry hook over a Write payload in a temp
+git repository, proving a remove-then-Write rewrite of committed code is allowed
+even when the paired test's freshness window has lapsed, while new untracked
+code and real edits to a present file stay gated.
+"""
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
+STALE_MTIME_OFFSET_SECONDS = 700
+DISABLE_EPHEMERAL_ENVIRONMENT = {"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"}
+
+
+def _run_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(SCRIPT_PATH)],
+        input=json.dumps(payload),
+        text=True,
+        capture_output=True,
+        check=False,
+        env={**os.environ, **DISABLE_EPHEMERAL_ENVIRONMENT},
+    )
+
+
+def _write_payload(file_path: Path, content: str) -> dict:
+    return {"tool_name": "Write", "tool_input": {"file_path": str(file_path), "content": content}}
+
+
+def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
+    if not completed.stdout:
+        return None
+    hook_output = json.loads(completed.stdout).get("hookSpecificOutput", {})
+    return hook_output.get("permissionDecision")
+
+
+def _run_git(repository_root: Path, *arguments: str) -> None:
+    subprocess.run(
+        ["git", *arguments],
+        cwd=str(repository_root),
+        check=True,
+        capture_output=True,
+        env={**os.environ, "GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_SYSTEM": os.devnull},
+    )
+
+
+def _init_git_repository(repository_root: Path) -> None:
+    _run_git(repository_root, "init", "-q")
+    _run_git(repository_root, "config", "user.email", "test@example.com")
+    _run_git(repository_root, "config", "user.name", "Test")
+    _run_git(repository_root, "config", "commit.gpgsign", "false")
+
+
+def _commit_tracked_service(repository_root: Path) -> tuple[Path, Path]:
+    production_file = repository_root / "service.py"
+    production_file.write_text("def serve(): return 1\n")
+    sibling_test = repository_root / "test_service.py"
+    sibling_test.write_text("def test_serve(): pass\n")
+    _run_git(repository_root, "add", "-A")
+    _run_git(repository_root, "commit", "-q", "-m", "init")
+    return production_file, sibling_test
+
+
+def test_should_allow_restore_write_of_absent_but_tracked_file_despite_stale_window(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    production_file, sibling_test = _commit_tracked_service(repository_root)
+    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+    production_file.unlink()
+
+    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_still_deny_write_of_absent_untracked_file_without_fresh_test(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    untracked_file = repository_root / "brand_new.py"
+
+    completed = _run_hook(_write_payload(untracked_file, "def fresh(): return 1\n"))
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_still_deny_write_of_present_file_with_stale_test(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    _init_git_repository(repository_root)
+    production_file, sibling_test = _commit_tracked_service(repository_root)
+    stale_timestamp = os.stat(sibling_test).st_mtime - STALE_MTIME_OFFSET_SECONDS
+    os.utime(sibling_test, (stale_timestamp, stale_timestamp))
+
+    completed = _run_hook(_write_payload(production_file, "def serve(): return 2\n"))
+
+    assert _decision_from(completed) == "deny"

package/hooks/blocking/tests/conftest.py

@@ -0,0 +1,10 @@
+"""Put the blocking and hooks directories on sys.path for the blocking tests."""
+
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parents[1])
+_hooks_directory = str(Path(__file__).resolve().parents[2])
+for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
+    if each_bootstrap_directory not in sys.path:
+        sys.path.insert(0, each_bootstrap_directory)

package/hooks/blocking/tests/test_pii_prevention_blocker.py

@@ -0,0 +1,260 @@
+"""Repository-resolution behavior of the PII commit gate (issue #65).
+
+The gate scans the repository the command names, not the session working
+directory, so::
+
+    git -C <healthy repo> commit  ->  scans <healthy repo> from any cwd
+    cd <repo> && git commit        ->  scans <repo>
+    git -C <repo> commit (cwd gone) ->  still scans <repo>, never refuses for cwd
+    git -C <not-a-repo> commit      ->  refusal names <not-a-repo>
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from pii_prevention_blocker import evaluate, evaluate_bash_command
+
+_HOOK_PATH = Path(__file__).resolve().parents[1] / "pii_prevention_blocker.py"
+_ALLOW_SLUG = "AllowOwner/allow-repo"
+_OTHER_SLUG = "OtherOwner/other-repo"
+
+
+def _run_hook(payload: dict[str, object]) -> tuple[int, str]:
+    completed_process = subprocess.run(
+        [sys.executable, str(_HOOK_PATH)],
+        input=json.dumps(payload),
+        capture_output=True,
+        text=True,
+        timeout=30,
+        check=False,
+    )
+    return completed_process.returncode, completed_process.stdout
+
+
+def _assembled_fixture_email() -> str:
+    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _assembled_unlisted_email() -> str:
+    return "other.person" + "@" + "different-co" + ".example" + ".io"
+
+
+def _write_allowlist_identity(identity_path: Path, slug: str, value: str) -> None:
+    identity_path.write_text(
+        json.dumps({"pii_allowlisted_values": {slug: [value]}}),
+        encoding="utf-8",
+    )
+
+
+def _init_repo_with_origin_and_staged_value(
+    repository_root: Path, origin_slug: str, staged_value: str
+) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "dev@example.com"],
+        cwd=repository_root,
+        check=True,
+    )
+    subprocess.run(
+        ["git", "config", "user.name", "Fixture Dev"], cwd=repository_root, check=True
+    )
+    subprocess.run(
+        ["git", "remote", "add", "origin", "https://github.com/" + origin_slug + ".git"],
+        cwd=repository_root,
+        check=True,
+    )
+    (repository_root / "notes.md").write_text(
+        "owner email " + staged_value + "\n", encoding="utf-8"
+    )
+    subprocess.run(["git", "add", "notes.md"], cwd=repository_root, check=True)
+
+
+def _commit_payload(repository_root: Path) -> dict[str, object]:
+    return {
+        "tool_name": "Bash",
+        "tool_input": {"command": f"git -C {repository_root} commit -m x"},
+    }
+
+
+def test_commit_subprocess_allows_allowlisted_value_in_the_allowlisted_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(repository_root, _ALLOW_SLUG, allowed_value)
+    return_code, hook_stdout = _run_hook(_commit_payload(repository_root))
+    assert return_code == 0
+    assert hook_stdout.strip() == ""
+
+
+def test_commit_subprocess_blocks_allowlisted_value_in_a_different_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    allowed_value = _assembled_fixture_email()
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(repository_root, _OTHER_SLUG, allowed_value)
+    _return_code, hook_stdout = _run_hook(_commit_payload(repository_root))
+    assert "email" in hook_stdout
+
+
+def test_commit_blocks_an_unlisted_value_in_the_allowlisted_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(
+        repository_root, _ALLOW_SLUG, _assembled_unlisted_email()
+    )
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory=str(repository_root),
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_commit_with_missing_local_identity_still_blocks_the_value(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(tmp_path / "absent.json"))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_origin_and_staged_value(
+        repository_root, _ALLOW_SLUG, _assembled_fixture_email()
+    )
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory=str(repository_root),
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def _init_repo_with_staged_pii(repository_root: Path) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    subprocess.run(
+        ["git", "config", "user.email", "dev@example.com"],
+        cwd=repository_root,
+        check=True,
+    )
+    subprocess.run(
+        ["git", "config", "user.name", "Fixture Dev"],
+        cwd=repository_root,
+        check=True,
+    )
+    (repository_root / "notes.md").write_text(
+        "owner email " + _assembled_fixture_email() + "\n",
+        encoding="utf-8",
+    )
+    subprocess.run(["git", "add", "notes.md"], cwd=repository_root, check=True)
+
+
+def test_dash_c_scans_named_repo_from_unrelated_cwd(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_cd_prefix_scans_named_repo_from_unrelated_cwd(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"cd {repository_root} && git commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_cd_prefix_with_git_exe_scans_named_repo_from_unrelated_cwd(
+    tmp_path: Path,
+) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"cd {repository_root} && git.exe commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_removed_working_directory_does_not_block_named_repo(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    removed_directory = tmp_path / "gone"
+    removed_directory.mkdir()
+    removed_directory.rmdir()
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory=str(removed_directory),
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_multiple_dash_c_compose_to_the_named_repo(tmp_path: Path) -> None:
+    repository_root = tmp_path / "parent" / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate_bash_command(
+        f"git -C {tmp_path / 'parent'} -C healthy_repo commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_full_dispatch_blocks_pii_commit_from_unrelated_cwd(tmp_path: Path) -> None:
+    repository_root = tmp_path / "healthy_repo"
+    _init_repo_with_staged_pii(repository_root)
+    deny_reason = evaluate(
+        {
+            "tool_name": "Bash",
+            "tool_input": {"command": f"git -C {repository_root} commit -m x"},
+            "cwd": "/tmp",
+        }
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_unresolvable_named_repo_refusal_names_the_path() -> None:
+    deny_reason = evaluate_bash_command(
+        "git -C /nonexistent/repo/xyz commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is not None
+    assert "repository root" in deny_reason
+    assert "/nonexistent/repo/xyz" in deny_reason
+
+
+def test_clean_named_repo_passes(tmp_path: Path) -> None:
+    repository_root = tmp_path / "clean_repo"
+    repository_root.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    (repository_root / "readme.md").write_text("all clear\n", encoding="utf-8")
+    subprocess.run(["git", "add", "readme.md"], cwd=repository_root, check=True)
+    deny_reason = evaluate_bash_command(
+        f"git -C {repository_root} commit -m x",
+        working_directory="/tmp",
+    )
+    assert deny_reason is None

package/hooks/blocking/tests/test_repository_exemption.py

@@ -0,0 +1,105 @@
+"""Behavioral tests for the moved repository-exemption helpers.
+
+Covers the origin-URL slug parser and the per-repository exemption decision::
+
+    https://github.com/Owner/Repo.git   ->  owner/repo
+    https://evil.test/Owner/Repo.git    ->  None
+    ok:   origin slug in CLAUDE_PII_EXEMPT_REPOS  ->  exempt (True)
+    flag: origin slug absent from the exempt set  ->  scanned (False)
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+from pii_prevention_blocker_parts.repository_exemption import (
+    _is_repository_exempt_from_pii_scan,
+    _owner_repo_slug_from_origin_url,
+    repository_allowlisted_values,
+)
+
+_ALLOWED_VALUE = "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
+
+
+def _write_allowlist_identity(identity_path: Path, slug: str) -> None:
+    identity_path.write_text(
+        json.dumps({"pii_allowlisted_values": {slug: [_ALLOWED_VALUE]}}),
+        encoding="utf-8",
+    )
+
+
+def test_repository_allowlisted_values_returns_the_mapped_values(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, "AllowOwner/allow-repo")
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "AllowOwner/allow-repo")
+    assert repository_allowlisted_values(repository_root) == frozenset({_ALLOWED_VALUE})
+
+
+def test_repository_allowlisted_values_empty_for_an_unmapped_repo(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    identity_path = tmp_path / "local-identity.json"
+    _write_allowlist_identity(identity_path, "AllowOwner/allow-repo")
+    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "OtherOwner/other-repo")
+    assert repository_allowlisted_values(repository_root) == frozenset()
+
+
+def test_github_https_origin_yields_lowercased_owner_repo_slug() -> None:
+    assert _owner_repo_slug_from_origin_url("https://github.com/Owner/Repo.git") == "owner/repo"
+
+
+def test_github_ssh_origin_yields_lowercased_owner_repo_slug() -> None:
+    assert _owner_repo_slug_from_origin_url("git@github.com:Owner/Repo.git") == "owner/repo"
+
+
+def test_spoofed_host_origin_yields_no_slug() -> None:
+    assert _owner_repo_slug_from_origin_url("https://evil.test/Owner/Repo.git") is None
+
+
+def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
+    repository_root.mkdir(parents=True, exist_ok=True)
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    origin_url = "https://github.com/" + origin_slug + ".git"
+    subprocess.run(
+        ["git", "remote", "add", "origin", origin_url],
+        cwd=repository_root,
+        check=True,
+    )
+
+
+def test_repository_with_exempt_origin_is_exempt(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "ExemptOwner/exempt-repo")
+    assert _is_repository_exempt_from_pii_scan(repository_root) is True
+
+
+def test_repository_with_unlisted_origin_is_scanned(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("CLAUDE_PII_EXEMPT_REPOS", "ExemptOwner/exempt-repo")
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, "OtherOwner/other-repo")
+    assert _is_repository_exempt_from_pii_scan(repository_root) is False
+
+
+def test_repository_without_origin_is_never_exempt(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    repository_root.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
+    assert _is_repository_exempt_from_pii_scan(repository_root) is False
+
+
+def test_owner_repo_slug_strips_a_trailing_slash_origin() -> None:
+    assert _owner_repo_slug_from_origin_url("https://github.com/Owner/Repo/") == "owner/repo"