claude-dev-env 2.0.1 → 2.1.0

package/hooks/blocking/conftest.py

@@ -33,6 +33,27 @@ _DECOY_CONFIG_CONSTANTS_SOURCE = (
 )
 
 
+def _copy_mirrored_packages(mirrored_hooks_directory: Path, mirrored_blocking_directory: Path) -> None:
+    """Copy the ``config``, gate-parts, and ``hooks_constants`` packages into the mirror."""
+    shutil.copytree(_BLOCKING_SOURCE_DIRECTORY / "config", mirrored_blocking_directory / "config")
+    shutil.copytree(
+        _BLOCKING_SOURCE_DIRECTORY / "verified_commit_gate_parts",
+        mirrored_blocking_directory / "verified_commit_gate_parts",
+        ignore=shutil.ignore_patterns("tests", "__pycache__"),
+    )
+    shutil.copytree(_HOOKS_CONSTANTS_SOURCE_DIRECTORY, mirrored_hooks_directory / "hooks_constants")
+
+
+def _write_decoy_config_package(mirrored_hooks_directory: Path) -> None:
+    """Write the decoy ``config`` package that must never win resolution."""
+    decoy_config_directory = mirrored_hooks_directory / "config"
+    decoy_config_directory.mkdir()
+    (decoy_config_directory / "__init__.py").write_text(_DECOY_CONFIG_INIT_SOURCE, encoding="utf-8")
+    (decoy_config_directory / "verified_commit_constants.py").write_text(
+        _DECOY_CONFIG_CONSTANTS_SOURCE, encoding="utf-8"
+    )
+
+
 def _build_shadowed_hook_tree(tmp_path: Path) -> tuple[Path, Path]:
     """Mirror the hook tree with a decoy ``config`` package beside ``blocking``.
 
@@ -51,22 +72,20 @@ def _build_shadowed_hook_tree(tmp_path: Path) -> tuple[Path, Path]:
         if source_file.exists():
             shutil.copy2(source_file, mirrored_blocking_directory / each_file_name)
 
-    shutil.copytree(
-        _BLOCKING_SOURCE_DIRECTORY / "config",
-        mirrored_blocking_directory / "config",
-    )
-    shutil.copytree(
-        _HOOKS_CONSTANTS_SOURCE_DIRECTORY,
-        mirrored_hooks_directory / "hooks_constants",
-    )
+    _copy_mirrored_packages(mirrored_hooks_directory, mirrored_blocking_directory)
+    _write_decoy_config_package(mirrored_hooks_directory)
+    return mirrored_hooks_directory, mirrored_blocking_directory
 
-    decoy_config_directory = mirrored_hooks_directory / "config"
-    decoy_config_directory.mkdir()
-    (decoy_config_directory / "__init__.py").write_text(_DECOY_CONFIG_INIT_SOURCE, encoding="utf-8")
-    (decoy_config_directory / "verified_commit_constants.py").write_text(
-        _DECOY_CONFIG_CONSTANTS_SOURCE, encoding="utf-8"
+
+def _probe_command(mirrored_hooks_directory: Path, mirrored_blocking_directory: Path) -> str:
+    """Build the ``sys.path`` preamble that shadows ``blocking`` with the decoy config."""
+    return textwrap.dedent(
+        f"""\
+        import sys
+        sys.path.insert(0, {str(mirrored_blocking_directory)!r})
+        sys.path.insert(0, {str(mirrored_hooks_directory)!r})
+        """
     )
-    return mirrored_hooks_directory, mirrored_blocking_directory
 
 
 @pytest.fixture
@@ -75,15 +94,8 @@ def run_under_config_shadow(
 ) -> Callable[[str], subprocess.CompletedProcess[str]]:
     """Return a runner that executes a driver under a foreign-``config`` sys.path.
 
-    ::
-
-        completed = run_under_config_shadow("import verified_commit_gate")
-        ok:   completed.returncode == 0 once the bootstrap seeds the real module
-        flag: nonzero with ModuleNotFoundError while the decoy config wins
-
-    The runner prefixes the driver with a ``sys.path`` preamble that puts the
-    mirrored ``hooks`` directory (holding the decoy ``config``) ahead of
-    ``blocking``, then runs the probe with the active interpreter.
+    ``run_under_config_shadow("import verified_commit_gate")`` returns 0 once
+    the bootstrap seeds the real module, nonzero while the decoy config wins.
 
     Args:
         tmp_path: Pytest's per-test temporary directory, fixture-injected.
@@ -93,16 +105,10 @@ def run_under_config_shadow(
         subprocess result.
     """
     mirrored_hooks_directory, mirrored_blocking_directory = _build_shadowed_hook_tree(tmp_path)
+    sys_path_preamble = _probe_command(mirrored_hooks_directory, mirrored_blocking_directory)
 
     def run_driver(driver_body: str) -> subprocess.CompletedProcess[str]:
         probe_script = tmp_path / "probe.py"
-        sys_path_preamble = textwrap.dedent(
-            f"""\
-            import sys
-            sys.path.insert(0, {str(mirrored_blocking_directory)!r})
-            sys.path.insert(0, {str(mirrored_hooks_directory)!r})
-            """
-        )
         probe_script.write_text(sys_path_preamble + textwrap.dedent(driver_body), encoding="utf-8")
         return subprocess.run(
             [sys.executable, str(probe_script)],

package/hooks/blocking/convergence_gate_blocker.py

@@ -18,9 +18,81 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
+from hooks_constants.convergence_gate_blocker_constants import (  # noqa: E402
+    COMMAND_SEPARATOR_PATTERN,
+    GH_PR_READY_ANCHOR_PATTERN,
+    PR_URL_OWNER_REPO_NUMBER_PATTERN,
+    REPO_OVERRIDE_FLAG_PATTERN,
+)
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 
 
+def _ready_command_segment(command: str) -> str:
+    """Return the ``gh pr ready`` invocation, clipped at the next command separator.
+
+    ::
+
+        gh pr ready 161 && gh pr comment 999 --repo other-owner/other-repo
+        ^^^^^^^^^^^^^^^^                            clipped -> returned segment
+
+    Scanning only this segment keeps a ``--repo`` flag or PR URL that belongs to
+    a chained command from binding the gate to the wrong PR.
+    """
+    ready_match = re.search(GH_PR_READY_ANCHOR_PATTERN, command)
+    if ready_match is None:
+        return command
+    ready_tail = command[ready_match.start() :]
+    separator_match = re.search(COMMAND_SEPARATOR_PATTERN, ready_tail)
+    if separator_match is None:
+        return ready_tail
+    return ready_tail[: separator_match.start()]
+
+
+def _parse_pr_url(command: str) -> tuple[str, str, int] | None:
+    """Return (owner, repo, pr_number) from a full PR URL in the command."""
+    url_match = re.search(PR_URL_OWNER_REPO_NUMBER_PATTERN, command)
+    if url_match is None:
+        return None
+    return url_match.group("owner"), url_match.group("repo"), int(url_match.group("number"))
+
+
+def _parse_repo_flag(command: str) -> tuple[str, str] | None:
+    """Return (owner, repo) from a --repo/-R flag in the command."""
+    flag_match = re.search(REPO_OVERRIDE_FLAG_PATTERN, command)
+    if flag_match is None:
+        return None
+    return flag_match.group("owner"), flag_match.group("repo")
+
+
+def _resolve_target_identity(command: str, cwd: str | None) -> tuple[str, str, int] | None:
+    """Resolve the (owner, repo, pr_number) the gate keys its evidence to.
+
+    A full PR URL in the command yields all three. A --repo/-R flag yields
+    the repository while the PR number resolves from the command number or
+    the cwd. With neither present, both the repository and the number
+    resolve from the cwd.
+    """
+    ready_segment = _ready_command_segment(command)
+    pr_url_identity = _parse_pr_url(ready_segment)
+    if pr_url_identity is not None:
+        return pr_url_identity
+
+    pr_number = _resolve_pr_number(ready_segment, cwd)
+    if pr_number is None:
+        return None
+
+    repo_flag_identity = _parse_repo_flag(ready_segment)
+    if repo_flag_identity is not None:
+        flag_owner, flag_repo = repo_flag_identity
+        return flag_owner, flag_repo, pr_number
+
+    cwd_identity = _resolve_owner_repo(cwd)
+    if cwd_identity is None:
+        return None
+    cwd_owner, cwd_repo = cwd_identity
+    return cwd_owner, cwd_repo, pr_number
+
+
 def _resolve_pr_number(command: str, cwd: str | None) -> int | None:
     direct_match = re.search(r"\bgh\s+pr\s+ready\s+(\d+)", command)
     if direct_match:
@@ -107,19 +179,15 @@ def main() -> None:
         sys.exit(0)
 
     command = hook_input.get("tool_input", {}).get("command", "")
-    gh_pr_ready_pattern = re.compile(r"\bgh\s+pr\s+ready\b(?![^&|;\n]*--undo)")
+    gh_pr_ready_pattern = re.compile(GH_PR_READY_ANCHOR_PATTERN)
     if not gh_pr_ready_pattern.search(command):
         sys.exit(0)
 
     cwd = hook_input.get("cwd")
-    pr_number = _resolve_pr_number(command, cwd)
-    if pr_number is None:
-        sys.exit(0)
-
-    owner_repo = _resolve_owner_repo(cwd)
-    if owner_repo is None:
+    target_identity = _resolve_target_identity(command, cwd)
+    if target_identity is None:
         sys.exit(0)
-    owner, repo = owner_repo
+    owner, repo, pr_number = target_identity
 
     completed_process = _run_convergence_check(
         check_convergence_script, owner, repo, pr_number, cwd

package/hooks/blocking/plain_language_blocker.py

@@ -19,6 +19,7 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
+from blocking.code_rules_shared import is_ephemeral_path  # noqa: E402
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 from hooks_constants.plain_language_blocker_constants import (  # noqa: E402
     ALL_SOFTWARE_TERMS,
@@ -324,6 +325,13 @@ def evaluate(payload_by_key: dict[str, object]) -> str | None:
     if not isinstance(raw_tool_name, str) or not isinstance(raw_tool_input, dict):
         return None
 
+    if raw_tool_name in ALL_WRITE_EDIT_TOOL_NAMES:
+        target_file_path = raw_tool_input.get("file_path", "")
+        if isinstance(target_file_path, str) and is_ephemeral_path(
+            target_file_path, payload_by_key
+        ):
+            return None
+
     prose_text = _collect_prose_for_tool(raw_tool_name, raw_tool_input)
     if not prose_text:
         return None

package/hooks/blocking/state_description_blocker.py

@@ -19,8 +19,9 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
-from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
+from blocking.code_rules_shared import is_ephemeral_path  # noqa: E402
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
 from hooks_constants.state_description_blocker_constants import (  # noqa: E402
     ALL_BLOCK_COMMENT_EXTENSIONS,
     ALL_BLOCK_COMMENT_ONLY_EXTENSIONS,
@@ -297,6 +298,8 @@ def evaluate(payload_by_key: dict[str, object]) -> str | None:
     file_path = tool_input.get("file_path", "")
     if not isinstance(file_path, str) or not file_path:
         return None
+    if is_ephemeral_path(file_path, payload_by_key):
+        return None
     if not (is_markdown_file(file_path) or is_comment_bearing_file(file_path)):
         return None
 

package/hooks/blocking/test_code_rules_enforcer_dead_module_constant.py

@@ -448,3 +448,61 @@ def test_widened_scan_reads_each_file_at_most_once(
     assert not over_read_paths, (
         f"Widening must read each .py file at most once, got over-reads: {over_read_paths}"
     )
+
+
+def _build_settings_package(workflow_directory: Path, constants_body: str) -> Path:
+    constants_package = workflow_directory / "app_settings"
+    constants_package.mkdir(parents=True)
+    (constants_package / "__init__.py").write_text("", encoding="utf-8")
+    constants_path = constants_package / "app_settings_constants.py"
+    constants_path.write_text(constants_body, encoding="utf-8")
+    return constants_path
+
+
+def test_deny_once_records_intent_then_retry_passes_after_consumer(
+    neutral_root: Path,
+) -> None:
+    constants_body = 'PATH_ENV_NAME = "THEME_PATH"\n'
+    workflow_directory = neutral_root / "workflow"
+    constants_path = _build_settings_package(workflow_directory, constants_body)
+    first_issues = _check(constants_body, str(constants_path))
+    assert any("PATH_ENV_NAME" in each_issue for each_issue in first_issues), first_issues
+    assert any(
+        "app_settings_constants.py" in each_issue for each_issue in first_issues
+    ), f"Deny message must record the target constants module, got: {first_issues}"
+    assert any(
+        "re-issue this write" in each_issue for each_issue in first_issues
+    ), f"Deny message must instruct the retry escape, got: {first_issues}"
+    consumer_body = (
+        "from app_settings.app_settings_constants import PATH_ENV_NAME\n"
+        "\n"
+        "def resolve() -> str:\n"
+        "    return PATH_ENV_NAME\n"
+    )
+    (workflow_directory / "consumer_service.py").write_text(
+        consumer_body, encoding="utf-8"
+    )
+    retry_issues = _check(constants_body, str(constants_path))
+    assert retry_issues == [], (
+        f"Once the consumer is on disk the retry passes, got: {retry_issues}"
+    )
+
+
+def test_dead_constant_stays_denied_on_every_attempt(neutral_root: Path) -> None:
+    constants_body = 'PATH_ENV_NAME = "THEME_PATH"\n'
+    workflow_directory = neutral_root / "workflow"
+    constants_path = _build_settings_package(workflow_directory, constants_body)
+    (workflow_directory / "unrelated.py").write_text(
+        "def noop() -> int:\n    return 1\n", encoding="utf-8"
+    )
+    first_issues = _check(constants_body, str(constants_path))
+    second_issues = _check(constants_body, str(constants_path))
+    for each_attempt in (first_issues, second_issues):
+        assert any("PATH_ENV_NAME" in each_issue for each_issue in each_attempt), each_attempt
+        assert any(
+            "app_settings_constants.py" in each_issue for each_issue in each_attempt
+        ), f"Every deny attempt records the target module, got: {each_attempt}"
+        assert any(
+            "re-issue this write" in each_issue for each_issue in each_attempt
+        ), f"A dead constant stays denied with the retry escape, got: {each_attempt}"
+

package/hooks/blocking/test_code_rules_enforcer_dead_module_constant_alias.py

@@ -0,0 +1,133 @@
+from __future__ import annotations
+
+import importlib.util
+import os
+import shutil
+import stat
+import tempfile
+from collections.abc import Callable, Iterator
+from pathlib import Path
+
+import pytest
+
+ENFORCER_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
+specification = importlib.util.spec_from_file_location("code_rules_enforcer", ENFORCER_PATH)
+assert specification is not None and specification.loader is not None
+code_rules_enforcer = importlib.util.module_from_spec(specification)
+specification.loader.exec_module(code_rules_enforcer)
+
+CONSTANTS_BODY = 'MEDIUM_TERMINAL = "terminal"\nMEDIUM_CODE = "code"\nMEDIUM_TEXT = "text"\n'
+
+
+def _strip_read_only_and_retry(
+    removal_function: Callable[[str], object],
+    target_path: str,
+    _exc_info: BaseException,
+) -> None:
+    try:
+        os.chmod(target_path, stat.S_IWRITE)
+        removal_function(target_path)
+    except OSError:
+        pass
+
+
+@pytest.fixture
+def neutral_root() -> Iterator[Path]:
+    """Yield a temp directory whose path carries no ``test_`` segment.
+
+    ::
+
+        tmp_path (pytest default)    -> embeds "test_..." in its name
+                                          -> is_test_file() misreads the path
+        mkdtemp(prefix="deadconst-") -> no "test_" segment  ->  reads as
+                                          a production path  ok
+
+    A ``.git`` marker is planted at the root so the cross-tree widening
+    resolves the repository root to this synthetic tree.
+    """
+    neutral_directory = Path(tempfile.mkdtemp(prefix="deadconst-")).resolve()
+    (neutral_directory / ".git").mkdir()
+    try:
+        yield neutral_directory
+    finally:
+        shutil.rmtree(neutral_directory, onexc=_strip_read_only_and_retry)
+
+
+def _check(source: str, file_path: str) -> list[str]:
+    return code_rules_enforcer.check_dead_module_constants(source, file_path)
+
+
+def _build_constants_package(
+    workflow_directory: Path,
+    constants_body: str,
+    consumer_body: str,
+) -> Path:
+    constants_package = workflow_directory / "report_constants"
+    constants_package.mkdir(parents=True)
+    (constants_package / "__init__.py").write_text("", encoding="utf-8")
+    constants_path = constants_package / "render_report_constants.py"
+    constants_path.write_text(constants_body, encoding="utf-8")
+    (workflow_directory / "render_report.py").write_text(consumer_body, encoding="utf-8")
+    return constants_path
+
+
+def _assert_alias_read_constants_live(issues: list[str]) -> None:
+    assert not any(
+        "MEDIUM_TERMINAL" in each_issue or "MEDIUM_CODE" in each_issue for each_issue in issues
+    ), f"A constant read as attribute of an imported module stays live, got: {issues}"
+    assert any("MEDIUM_TEXT" in each_issue for each_issue in issues), (
+        f"A constant read by no module must still be flagged, got: {issues}"
+    )
+
+
+def test_does_not_flag_constant_read_via_from_import_module_alias_attribute(
+    neutral_root: Path,
+) -> None:
+    consumer_body = (
+        "from report_constants import render_report_constants as constants\n"
+        "\n"
+        "def panel_class(medium: str) -> str:\n"
+        "    if medium == constants.MEDIUM_TERMINAL:\n"
+        "        return 'terminal'\n"
+        "    return 'code' if medium == constants.MEDIUM_CODE else 'other'\n"
+    )
+    constants_path = _build_constants_package(
+        neutral_root / "workflow", CONSTANTS_BODY, consumer_body
+    )
+    _assert_alias_read_constants_live(_check(CONSTANTS_BODY, str(constants_path)))
+
+
+def test_does_not_flag_constant_read_via_import_as_alias_attribute(
+    neutral_root: Path,
+) -> None:
+    consumer_body = (
+        "import report_constants.render_report_constants as constants\n"
+        "\n"
+        "def label(medium: str) -> str:\n"
+        "    if medium == constants.MEDIUM_TERMINAL:\n"
+        "        return 'terminal'\n"
+        "    return 'code' if medium == constants.MEDIUM_CODE else 'other'\n"
+    )
+    constants_path = _build_constants_package(
+        neutral_root / "workflow", CONSTANTS_BODY, consumer_body
+    )
+    _assert_alias_read_constants_live(_check(CONSTANTS_BODY, str(constants_path)))
+
+
+def test_does_not_flag_constant_read_via_plain_module_name_attribute(
+    neutral_root: Path,
+) -> None:
+    consumer_body = (
+        "from report_constants import render_report_constants\n"
+        "\n"
+        "def label(medium: str) -> str:\n"
+        "    if medium == render_report_constants.MEDIUM_TERMINAL:\n"
+        "        return 'terminal'\n"
+        "    if medium == render_report_constants.MEDIUM_CODE:\n"
+        "        return 'code'\n"
+        "    return 'other'\n"
+    )
+    constants_path = _build_constants_package(
+        neutral_root / "workflow", CONSTANTS_BODY, consumer_body
+    )
+    _assert_alias_read_constants_live(_check(CONSTANTS_BODY, str(constants_path)))

package/hooks/blocking/test_code_rules_shared.py

@@ -12,6 +12,9 @@ SHARED_MODULE_PATH = Path(__file__).parent / "code_rules_shared.py"
 FIXED_USER_ID = 4242
 WORKING_DIRECTORY = "/home/user/project"
 SESSION_ID = "session-abc-123"
+HARNESS_USER_DIRECTORY_WINDOWS = "claude"
+WINDOWS_MANGLED_WORKING_DIRECTORY = "c--Users-dev--claude-project"
+SESSION_ID_ENVIRONMENT_VARIABLE = "CLAUDE_CODE_SESSION_ID"
 
 
 def _load_shared_module() -> ModuleType:
@@ -27,10 +30,6 @@ def _load_shared_module() -> ModuleType:
 _SHARED_MODULE = _load_shared_module()
 
 
-def _install_fixed_user_id(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(os, "getuid", lambda: FIXED_USER_ID, raising=False)
-
-
 def _point_temporary_directory_at(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> None:
     monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
 
@@ -48,6 +47,24 @@ def _build_scratchpad_directory(temporary_root: Path) -> Path:
     return scratchpad_directory
 
 
+def _build_windows_scratchpad_directory(temporary_root: Path) -> Path:
+    """Build the Windows-shaped scratchpad directory that carries no user id segment."""
+    scratchpad_directory = (
+        temporary_root
+        / HARNESS_USER_DIRECTORY_WINDOWS
+        / WINDOWS_MANGLED_WORKING_DIRECTORY
+        / SESSION_ID
+        / "scratchpad"
+    )
+    scratchpad_directory.mkdir(parents=True)
+    return scratchpad_directory
+
+
+def _simulate_windows_platform(monkeypatch: pytest.MonkeyPatch, temporary_root: Path) -> None:
+    monkeypatch.delattr(os, "getuid", raising=False)
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(temporary_root))
+
+
 def _session_payload() -> dict[str, str]:
     return {"cwd": WORKING_DIRECTORY, "session_id": SESSION_ID}
 
@@ -55,7 +72,6 @@ def _session_payload() -> dict[str, str]:
 def test_returns_true_for_file_inside_reconstructed_scratchpad(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
     scratchpad_directory = _build_scratchpad_directory(tmp_path)
     throwaway_script = scratchpad_directory / "one_off_tool.py"
@@ -69,7 +85,6 @@ def test_returns_true_for_file_inside_reconstructed_scratchpad(
 def test_returns_false_for_file_outside_scratchpad(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
     _build_scratchpad_directory(tmp_path)
     project_module = tmp_path / "elsewhere" / "orders.py"
@@ -82,7 +97,6 @@ def test_returns_false_for_file_outside_scratchpad(
 def test_resolves_symlink_into_scratchpad_to_true(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
     scratchpad_directory = _build_scratchpad_directory(tmp_path)
     real_script = scratchpad_directory / "real_tool.py"
@@ -96,7 +110,6 @@ def test_resolves_symlink_into_scratchpad_to_true(
 def test_symlink_resolving_outside_scratchpad_is_false(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
     scratchpad_directory = _build_scratchpad_directory(tmp_path)
     real_target_outside = tmp_path / "outside_target.py"
@@ -113,8 +126,8 @@ def test_symlink_resolving_outside_scratchpad_is_false(
 def test_missing_session_id_signal_returns_false(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
+    monkeypatch.delenv(SESSION_ID_ENVIRONMENT_VARIABLE, raising=False)
     scratchpad_directory = _build_scratchpad_directory(tmp_path)
     throwaway_script = scratchpad_directory / "one_off_tool.py"
     payload_without_session = {"cwd": WORKING_DIRECTORY}
@@ -125,10 +138,12 @@ def test_missing_session_id_signal_returns_false(
     )
 
 
-def test_missing_working_directory_signal_returns_false(
+def test_exempt_without_working_directory_signal(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
+    """The platform-safe predicate keys on the session id and the temp-directory path
+    shape, so a payload carrying the session id alone still exempts a real scratchpad
+    target even when it omits the working directory."""
     _point_temporary_directory_at(monkeypatch, tmp_path)
     scratchpad_directory = _build_scratchpad_directory(tmp_path)
     throwaway_script = scratchpad_directory / "one_off_tool.py"
@@ -136,27 +151,28 @@ def test_missing_working_directory_signal_returns_false(
 
     assert (
         _SHARED_MODULE.is_under_session_scratchpad(str(throwaway_script), payload_without_cwd)
-        is False
+        is True
     )
 
 
-def test_absent_getuid_returns_false(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    _install_fixed_user_id(monkeypatch)
-    _point_temporary_directory_at(monkeypatch, tmp_path)
-    scratchpad_directory = _build_scratchpad_directory(tmp_path)
+def test_exempt_on_windows_without_getuid(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """On Windows the os.getuid attribute is absent, and a real scratchpad target still
+    resolves as exempt through its temp-directory path shape and session id."""
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    scratchpad_directory = _build_windows_scratchpad_directory(tmp_path)
     throwaway_script = scratchpad_directory / "one_off_tool.py"
-    monkeypatch.delattr(os, "getuid", raising=False)
 
     assert (
         _SHARED_MODULE.is_under_session_scratchpad(str(throwaway_script), _session_payload())
-        is False
+        is True
     )
 
 
 def test_nonexistent_scratchpad_directory_returns_false(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
     mangled_working_directory = WORKING_DIRECTORY.replace("/", "-")
     unbuilt_target = (
@@ -174,8 +190,92 @@ def test_nonexistent_scratchpad_directory_returns_false(
 
 
 def test_empty_file_path_returns_false(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    _install_fixed_user_id(monkeypatch)
     _point_temporary_directory_at(monkeypatch, tmp_path)
     _build_scratchpad_directory(tmp_path)
 
     assert _SHARED_MODULE.is_under_session_scratchpad("", _session_payload()) is False
+
+
+def test_windows_shape_repository_file_is_not_exempt(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    _build_windows_scratchpad_directory(tmp_path)
+    repository_module = tmp_path / "repository" / "src" / "orders.py"
+    repository_module.parent.mkdir(parents=True)
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(repository_module), _session_payload())
+        is False
+    )
+
+
+def test_temp_path_outside_scratchpad_shape_is_not_exempt(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A path under the harness user directory but off the session/scratchpad shape
+    keeps full enforcement."""
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    _build_windows_scratchpad_directory(tmp_path)
+    off_shape_target = tmp_path / HARNESS_USER_DIRECTORY_WINDOWS / "unrelated" / "notes.py"
+    off_shape_target.parent.mkdir(parents=True)
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(off_shape_target), _session_payload())
+        is False
+    )
+
+
+def test_repository_path_containing_scratchpad_word_is_not_exempt(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A repository path outside the temp directory that merely carries a scratchpad
+    segment keeps full enforcement."""
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    _build_windows_scratchpad_directory(tmp_path)
+    repository_lookalike = tmp_path.parent / "project_repo" / "scratchpad" / "tool.py"
+
+    assert (
+        _SHARED_MODULE.is_under_session_scratchpad(str(repository_lookalike), _session_payload())
+        is False
+    )
+
+
+def test_is_ephemeral_path_true_for_windows_scratchpad(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    scratchpad_directory = _build_windows_scratchpad_directory(tmp_path)
+    throwaway_script = scratchpad_directory / "probe.py"
+
+    assert _SHARED_MODULE.is_ephemeral_path(str(throwaway_script), _session_payload()) is True
+
+
+def test_is_ephemeral_path_true_for_root_anchored_tmp(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+
+    assert _SHARED_MODULE.is_ephemeral_path("/tmp/scratch.py") is True
+
+
+def test_is_ephemeral_path_false_for_repository_file(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_file = tmp_path / "repository" / "orders.py"
+    repository_file.parent.mkdir(parents=True)
+
+    assert _SHARED_MODULE.is_ephemeral_path(str(repository_file), _session_payload()) is False
+
+
+def test_is_ephemeral_path_reads_session_id_from_environment(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """With no payload, the session scratchpad match reads the session id from the
+    harness environment variable, so a caller that holds no payload still matches."""
+    _simulate_windows_platform(monkeypatch, tmp_path)
+    monkeypatch.setenv(SESSION_ID_ENVIRONMENT_VARIABLE, SESSION_ID)
+    scratchpad_directory = _build_windows_scratchpad_directory(tmp_path)
+    throwaway_script = scratchpad_directory / "probe.py"
+
+    assert _SHARED_MODULE.is_ephemeral_path(str(throwaway_script)) is True