claude-dev-env 2.11.0 → 2.13.0

package/docs/references/code-review-enforcement.md

@@ -1,132 +0,0 @@
-# Code-review enforcement
-
-This feature ties two git actions to a clean run of the built-in
-`/code-review --fix`:
-
-- **`git push`** needs a clean review at effort **low** or higher.
-- **Pull-request creation** (`gh pr create` and the MCP `create_pull_request`
-  tool) needs a clean review at effort **xhigh** or higher.
-
-The gates follow the same shape as the `verified_commit` gate family.
-
-## Opt-in (default off)
-
-Enforcement is **off by default**. Turn it on by setting the environment
-variable `CLAUDE_CODE_REVIEW_ENFORCEMENT` to `1`, `true`, `yes`, or `on`
-(case and surrounding spaces are ignored). Any other value, and an unset
-variable, leave enforcement off.
-
-Set the variable in the machine's own user environment so every gate reads it,
-including the native git pre-push backstop, which git runs in the shell's
-environment. An `env` block in `settings.json` reaches the three Claude Code
-hook gates alone. Each gate process reads the variable as it starts, so a
-Claude Code session already running keeps its current setting until it
-restarts, while the git pre-push backstop picks up the current shell
-environment on each push.
-
-A user-environment setting arms the gates machine-wide. The backstop installs
-through the shared `core.hooksPath`, so it runs for every repository on the
-machine, and the gates carry no per-repository allowlist. Each repository then
-needs its own clean stamp before a push lands there.
-
-The variable feeds the master flag `CODE_REVIEW_ENFORCEMENT_ENABLED` in
-`hooks/blocking/config/code_review_enforcement_constants.py`, which every gate
-reads at start-up. When it is on, the push gate, the PR-create gate, the native
-pre-push backstop (via the shared deny decision), and the stamp-directory write
-blocker all enforce. When it is off, every gate allows the action and the
-write-blocker allows stamp-directory access.
-
-`npx claude-dev-env` copies the shipped `hooks/` tree over `~/.claude/` on each
-install, so the environment setting survives an install and an edit to the
-constant does not.
-
-## How a stamp works
-
-A stamp is a small JSON file that records one fact: a clean `/code-review` pass
-ran against an exact branch surface at a given effort. Each work tree keeps one
-file under `~/.claude/code-review-stamps/`, named by a hash of the resolved
-work-tree path.
-
-The stamp binds to a **branch-surface hash** — the hash of every changed path
-and untracked file, each bound by its content digest, measured against the
-merge base. When any byte of the change surface moves, the live hash stops
-matching the stored hash, so the stamp stops covering the surface and the gate
-asks for a fresh review.
-
-A gate allows the action only when a stored stamp matches the live hash exactly
-and its effort ranks at or above the effort the action needs. A missing,
-unreadable, or malformed stamp reads as no coverage, so the gate fails closed.
-
-## The single sanctioned minter
-
-Only `invoke_code_review.py --record-stamp` writes a stamp. It forces a headless
-`/code-review <effort> --fix` run, then mints a stamp only when the review
-returns a clean exit code and leaves the branch surface unchanged in the same
-pass. A pass that applies fixes mints nothing; the run loops on the new surface
-up to a capped number of passes and mints only on a stable clean pass.
-
-## Two layers guard the stamp directory
-
-The gates trust one rule: only the sanctioned minter writes stamp files. Two
-layers hold that rule.
-
-1. **File-tool deny in `settings.json`.** `Write`, `Edit`, and `MultiEdit`
-   under `~/.claude/code-review-stamps/` are denied. This layer covers work
-   inside the repository. The installer merges hook groups into a user's
-   `settings.json` and does not ship this package's `permissions.deny`, so on a
-   user's machine this layer protects contributor work, at parity with the
-   `verified_commit` gate's own file-tool deny.
-2. **`code_review_stamp_directory_write_blocker` hook.** This hook ships through
-   `hooks.json`, so it reaches every install. It has two arms:
-   - a shell arm that denies any Bash or PowerShell command naming the stamp
-     directory, or importing the stamp store module, or calling its mint
-     function — while it lets the sanctioned minter command through;
-   - a file-tool arm that denies any `Write`, `Edit`, or `MultiEdit` whose path
-     resolves under the stamp directory. This arm closes the plain file-tool
-     forge on every shipped install, which the package `settings.json` deny
-     cannot reach on its own.
-
-## What the gates block
-
-- **Casual and accidental forges.** A plain file-tool write to the stamp
-  directory, and a casual shell write to it, are both denied.
-- **Hidden-path and split-step shell forges.** A shell command that assembles
-  the stamp path from hex, base64, or character math is decoded and denied. A
-  command that splits the directory change across steps to walk into the stamp
-  directory is traced and denied.
-- **Lazy skips.** A push or a pull-request creation cannot go ahead without a
-  stamp that matches the live surface at the needed effort.
-
-## What the gates do not block
-
-The chain-mode `/code-review` runs as a subprocess spawn of the `claude`
-binary, not a harness-recorded subagent, so there is no signed sidecar to
-anchor a forgery-proof mint. The stamp reaches the same posture the
-`verified_commit` gate holds, and no further. These bypass surfaces stay open:
-
-- **Pull requests that skip the tool paths.** A PR opened through
-  `gh api -X POST .../pulls` or the GitHub web page never triggers the
-  create-PR gate.
-- **`git push --no-verify`.** This flag tells git to skip the native pre-push
-  hook, so the native backstop does not run.
-- **A push that clears the enable variable.** The backstop reads
-  `CLAUDE_CODE_REVIEW_ENFORCEMENT` from the shell that runs the push, so
-  `CLAUDE_CODE_REVIEW_ENFORCEMENT=0 git push` reads as enforcement off and the
-  backstop allows the push with no flag and no bypass marker.
-- **A rebuilt store.** A script that re-implements the stamp store in memory
-  and writes a matching file can mint a stamp the gates accept.
-
-In short: these gates stop casual forges and lazy skips. They do not stop a
-determined attacker who sets out to defeat them.
-
-## Where the pieces live
-
-- Gates: `hooks/blocking/code_review_push_gate.py`,
-  `hooks/blocking/code_review_pr_create_gate.py`.
-- Stamp store: `hooks/blocking/code_review_stamp_store.py`.
-- Directory guard: `hooks/blocking/code_review_stamp_directory_write_blocker.py`.
-- Shared constants: `hooks/blocking/config/code_review_enforcement_constants.py`.
-- Native backstop: `hooks/git-hooks/pre_push.py` reuses the push gate's
-  `deny_reason_for_directory` so the native hook and the Claude gate share one
-  decision source.
-- Minter: `scripts/invoke_code_review.py --record-stamp`.

package/hooks/blocking/code_review_enforcement_config_bootstrap.py

@@ -1,53 +0,0 @@
-"""Deterministic loader for the code-review enforcement constants module.
-
-The stamp store and every code-review gate import their shared constants as
-``from config.code_review_enforcement_constants import ...``. In the installed
-hook tree a second, unrelated ``config`` package can sit ahead of this package
-on ``sys.path`` and win that dotted name by path order, so the import binds to
-the wrong file and raises ImportError on any constant the stale copy lacks.
-This module binds the dotted name to its sibling ``config/`` file by explicit
-location, so resolution never depends on ``sys.path`` order.
-"""
-
-from __future__ import annotations
-
-import importlib.util
-import sys
-from pathlib import Path
-
-
-def register_code_review_enforcement_constants() -> None:
-    """Bind the code-review enforcement constants dotted name to its config file.
-
-    ::
-
-        sys.path = ["<installed hooks>", "<blocking>"]  # foreign config first
-        register_code_review_enforcement_constants()
-        from config.code_review_enforcement_constants import STAMP_DIRECTORY_NAME
-        ok: bound to <blocking>/config/code_review_enforcement_constants.py
-
-    A ``from config.code_review_enforcement_constants import`` that follows this
-    call reads the entry straight from ``sys.modules``, so it resolves to this
-    file whatever else owns the ``config`` name. An entry already cached is left
-    in place, so the call is idempotent and never displaces a module a caller
-    loaded on purpose.
-
-    Returns:
-        None. The effect is the ``sys.modules`` registration.
-    """
-    _bind_config_module_by_location(
-        "config.code_review_enforcement_constants",
-        Path(__file__).resolve().parent / "config" / "code_review_enforcement_constants.py",
-    )
-
-
-def _bind_config_module_by_location(dotted_name: str, constants_file_path: Path) -> None:
-    """Register a dotted config name against an explicit file path in sys.modules."""
-    if dotted_name in sys.modules:
-        return
-    module_spec = importlib.util.spec_from_file_location(dotted_name, constants_file_path)
-    if module_spec is None or module_spec.loader is None:
-        return
-    constants_module = importlib.util.module_from_spec(module_spec)
-    sys.modules[dotted_name] = constants_module
-    module_spec.loader.exec_module(constants_module)

package/hooks/blocking/code_review_gate_deny.py

@@ -1,74 +0,0 @@
-"""Shared deny scaffold for the code-review PreToolUse gates.
-
-The push gate and the PR-create gate deny a blocked tool call the same way: a
-``hookSpecificOutput`` payload carrying the deny decision and a corrective
-reason, logged through ``log_hook_block`` before it reaches stdout. This module
-holds that one payload builder and the log-and-emit helper, so the two gates
-share a single deny shape and stay in step.
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-
-try:
-    _blocking_directory = str(Path(__file__).resolve().parent)
-    _hooks_directory = str(Path(__file__).resolve().parent.parent)
-    for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-
-    from code_review_enforcement_config_bootstrap import (
-        register_code_review_enforcement_constants,
-    )
-
-    register_code_review_enforcement_constants()
-
-    from config.code_review_enforcement_constants import (
-        DENY_PERMISSION_DECISION,
-        PRE_TOOL_USE_HOOK_EVENT_NAME,
-    )
-
-    from hooks_constants.hook_block_logger import log_hook_block
-except ImportError as import_error:
-    raise ImportError(
-        "the code_review_gate_deny dependencies did not import; "
-        "ensure the hooks directory is importable."
-    ) from import_error
-
-
-def build_code_review_deny_payload(deny_reason: str) -> dict[str, dict[str, str]]:
-    """Build the PreToolUse deny payload for a blocked code-review gate action.
-
-    Args:
-        deny_reason: The corrective message naming why the action is denied.
-
-    Returns:
-        The ``hookSpecificOutput`` deny payload.
-    """
-    return {
-        "hookSpecificOutput": {
-            "hookEventName": PRE_TOOL_USE_HOOK_EVENT_NAME,
-            "permissionDecision": DENY_PERMISSION_DECISION,
-            "permissionDecisionReason": deny_reason,
-        }
-    }
-
-
-def log_and_emit_code_review_deny(deny_reason: str, tool_name: str, hook_module_name: str) -> None:
-    """Log a code-review gate block and write its deny payload to stdout.
-
-    Args:
-        deny_reason: The corrective message naming why the action is denied.
-        tool_name: The name of the gated tool, recorded in the block log.
-        hook_module_name: The calling gate's module name, recorded in the log.
-    """
-    log_hook_block(
-        calling_hook_name=hook_module_name,
-        hook_event=PRE_TOOL_USE_HOOK_EVENT_NAME,
-        block_reason=deny_reason,
-        tool_name=tool_name if isinstance(tool_name, str) else None,
-    )
-    sys.stdout.write(json.dumps(build_code_review_deny_payload(deny_reason)) + "\n")

package/hooks/blocking/code_review_pr_create_gate.py

@@ -1,198 +0,0 @@
-"""PreToolUse gate: PR create lands only behind a clean xhigh code-review stamp.
-
-Fires when ``CODE_REVIEW_ENFORCEMENT_ENABLED`` is on (default off). Runs on
-Bash/PowerShell ``gh pr create`` and on the MCP ``create_pull_request``
-tool. Resolves the repository from the session
-working directory (or the payload cwd), computes the live change-surface
-hash, and allows the create only when a clean stamp at effort ``xhigh`` or
-higher covers that exact hash under ``~/.claude/code-review-stamps/``.
-
-Empty surfaces and repos with no resolvable upstream base are out of scope
-and allowed. Push lands behind ``code_review_push_gate`` and commit behind
-``verified_commit_gate``; this gate covers pull-request creation only.
-"""
-
-from __future__ import annotations
-
-import json
-import re
-import sys
-from pathlib import Path
-
-try:
-    _blocking_directory = str(Path(__file__).resolve().parent)
-    _hooks_directory = str(Path(__file__).resolve().parent.parent)
-    for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-
-    from code_review_enforcement_config_bootstrap import (
-        register_code_review_enforcement_constants,
-    )
-    from verified_commit_config_bootstrap import register_verified_commit_constants
-
-    register_code_review_enforcement_constants()
-    register_verified_commit_constants()
-
-    from code_review_gate_deny import (
-        build_code_review_deny_payload,
-        log_and_emit_code_review_deny,
-    )
-    from code_review_stamp_store import live_surface_hash, stamp_covers_surface
-    from config.code_review_enforcement_constants import (
-        ALL_GATED_SHELL_TOOL_NAMES,
-        CODE_REVIEW_ENFORCEMENT_ENABLED,
-        GH_PR_CREATE_INVOCATION_PATTERN,
-        HASH_PREVIEW_LENGTH,
-        MCP_CREATE_PULL_REQUEST_TOOL_NAME,
-        PR_CREATE_GATE_CORRECTIVE_MESSAGE,
-        PR_CREATE_GATE_HOOK_MODULE_NAME,
-        PR_CREATE_REQUIRED_EFFORT,
-    )
-    from verification_verdict_store import resolve_repo_root
-except ImportError as import_error:
-    raise ImportError(
-        "the code_review_pr_create_gate dependencies did not import; "
-        "ensure the hooks directory is importable."
-    ) from import_error
-
-
-def _strip_quoted_regions(command_text: str) -> str:
-    """Blank out single- and double-quoted spans so prose is not gated."""
-    quote_pattern = re.compile(r"\"[^\"]*\"|'[^']*'")
-    return quote_pattern.sub(lambda each_match: " " * len(each_match.group(0)), command_text)
-
-
-def command_invokes_gh_pr_create(command_text: str) -> bool:
-    """Decide whether a shell command invokes ``gh pr create``.
-
-    ::
-
-        gh pr create --title T --body-file b.md  -> True
-        echo "gh pr create"                      -> False (quoted prose)
-        gh pr edit 1 --title T                   -> False
-
-    Args:
-        command_text: The raw command string from the tool payload.
-
-    Returns:
-        True when the command contains a real ``gh pr create`` invocation.
-    """
-    quote_stripped_command = _strip_quoted_regions(command_text)
-    invocation_pattern = re.compile(GH_PR_CREATE_INVOCATION_PATTERN, re.IGNORECASE)
-    return invocation_pattern.search(quote_stripped_command) is not None
-
-
-def is_mcp_create_pull_request_tool(tool_name: str) -> bool:
-    """Decide whether a tool name is the MCP create-pull-request tool.
-
-    Args:
-        tool_name: The PreToolUse ``tool_name`` field.
-
-    Returns:
-        True when the name is the configured MCP create-PR tool.
-    """
-    return tool_name == MCP_CREATE_PULL_REQUEST_TOOL_NAME
-
-
-def deny_reason_for_directory(target_directory: str) -> str | None:
-    """Decide whether a PR create from a directory must be blocked.
-
-    ::
-
-        enforcement off / no repo / empty surface / covering xhigh stamp -> None
-        production surface without xhigh-or-higher stamp -> corrective (deny)
-
-    Args:
-        target_directory: The session or repo directory the create targets.
-
-    Returns:
-        The deny reason when the surface needs a clean xhigh stamp and none
-        covers it; None when the create may proceed.
-    """
-    if not CODE_REVIEW_ENFORCEMENT_ENABLED:
-        return None
-    repo_root = resolve_repo_root(target_directory)
-    if repo_root is None:
-        return None
-    surface_hash = live_surface_hash(repo_root)
-    if surface_hash is None:
-        return None
-    if stamp_covers_surface(repo_root, surface_hash, PR_CREATE_REQUIRED_EFFORT):
-        return None
-    hash_preview = surface_hash[:HASH_PREVIEW_LENGTH]
-    return (
-        f"{PR_CREATE_GATE_CORRECTIVE_MESSAGE} (repo: {repo_root}, surface sha256 {hash_preview}...)"
-    )
-
-
-def _deny_for_directory_or_none(
-    session_directory: str,
-) -> dict[str, dict[str, str]] | None:
-    """Return the deny payload for a directory that lacks a covering stamp."""
-    deny_reason = deny_reason_for_directory(session_directory)
-    if deny_reason is None:
-        return None
-    return build_code_review_deny_payload(deny_reason)
-
-
-def _shell_command_targets_pr_create(all_pretooluse_payload: dict[str, object]) -> bool:
-    """Decide whether a shell payload carries a real ``gh pr create``."""
-    tool_input = all_pretooluse_payload.get("tool_input", {})
-    if not isinstance(tool_input, dict):
-        return False
-    command_text = tool_input.get("command", "")
-    if not isinstance(command_text, str) or not command_text:
-        return False
-    return command_invokes_gh_pr_create(command_text)
-
-
-def decision_for_payload(
-    all_pretooluse_payload: dict[str, object],
-) -> dict[str, dict[str, str]] | None:
-    """Build the deny decision for a gated PR-create attempt.
-
-    Args:
-        all_pretooluse_payload: The PreToolUse hook payload.
-
-    Returns:
-        The deny decision mapping when the create lacks a covering xhigh
-        stamp; None when the create may proceed.
-    """
-    tool_name = all_pretooluse_payload.get("tool_name", "")
-    if not isinstance(tool_name, str):
-        return None
-    session_directory = all_pretooluse_payload.get("cwd", ".")
-    if not isinstance(session_directory, str):
-        session_directory = "."
-    if is_mcp_create_pull_request_tool(tool_name):
-        return _deny_for_directory_or_none(session_directory)
-    if tool_name not in ALL_GATED_SHELL_TOOL_NAMES:
-        return None
-    if not _shell_command_targets_pr_create(all_pretooluse_payload):
-        return None
-    return _deny_for_directory_or_none(session_directory)
-
-
-def main() -> None:
-    """Read the PreToolUse payload and decide whether to allow the PR create."""
-    try:
-        pretooluse_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        return
-    deny_decision = decision_for_payload(pretooluse_payload)
-    if deny_decision is None:
-        return
-    tool_name = pretooluse_payload.get("tool_name", "")
-    deny_reason = deny_decision["hookSpecificOutput"]["permissionDecisionReason"]
-    if not isinstance(deny_reason, str):
-        return
-    log_and_emit_code_review_deny(
-        deny_reason,
-        tool_name if isinstance(tool_name, str) else "",
-        PR_CREATE_GATE_HOOK_MODULE_NAME,
-    )
-
-
-if __name__ == "__main__":
-    main()

package/hooks/blocking/code_review_push_gate.py

@@ -1,145 +0,0 @@
-"""PreToolUse gate: git push lands only behind a clean low code-review stamp.
-
-Fires on Bash/PowerShell tool calls when ``CODE_REVIEW_ENFORCEMENT_ENABLED``
-is on (default off). When the command carries a ``git push``, the gate
-resolves each repository the push targets, computes the live
-change-surface hash against the merge base, and allows the push only when a
-clean stamp at effort ``low`` or higher covers that exact hash under
-``~/.claude/code-review-stamps/``.
-
-Allowed without a stamp:
-
-- a command carrying the bypass marker (``# code-review-skip``) as a trailing
-  shell comment,
-- a repository with no resolvable upstream base,
-- a mechanically exempt surface (docs and image files, pytest test files, and
-  Python files whose docstring-stripped AST is unchanged), and
-- a surface a clean ``low``-or-higher stamp already covers.
-
-Commit lands behind ``verified_commit_gate``; only push is gated here.
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-
-try:
-    _blocking_directory = str(Path(__file__).resolve().parent)
-    _hooks_directory = str(Path(__file__).resolve().parent.parent)
-    for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-
-    from code_review_enforcement_config_bootstrap import (
-        register_code_review_enforcement_constants,
-    )
-    from verified_commit_config_bootstrap import register_verified_commit_constants
-
-    register_code_review_enforcement_constants()
-    register_verified_commit_constants()
-
-    from code_review_gate_deny import log_and_emit_code_review_deny
-    from code_review_stamp_store import live_surface_hash, stamp_covers_surface
-    from config.code_review_enforcement_constants import (
-        ALL_GATED_SHELL_TOOL_NAMES,
-        CODE_REVIEW_BYPASS_MARKER,
-        CODE_REVIEW_ENFORCEMENT_ENABLED,
-        GATED_PUSH_SUBCOMMANDS,
-        HASH_PREVIEW_LENGTH,
-        PUSH_GATE_CORRECTIVE_MESSAGE,
-        PUSH_GATE_HOOK_MODULE_NAME,
-        PUSH_REQUIRED_EFFORT,
-    )
-    from verification_verdict_store import (
-        is_verification_exempt_diff,
-        resolve_merge_base,
-        resolve_repo_root,
-    )
-    from verified_commit_gate_parts.command_tokenization import (
-        command_carries_trailing_marker,
-    )
-    from verified_commit_gate_parts.gated_invocations import gated_repo_directories
-except ImportError as import_error:
-    raise ImportError(
-        "the code_review_push_gate dependencies did not import; "
-        "ensure the hooks directory is importable."
-    ) from import_error
-
-
-def deny_reason_for_directory(target_directory: str) -> str | None:
-    """Decide whether a push from a directory must be blocked.
-
-    Allowed when enforcement is off, the directory is no repo, has no upstream
-    base, is a mechanically exempt surface, or a clean low-or-higher stamp
-    covers it.
-
-    Args:
-        target_directory: The directory the push targets.
-
-    Returns:
-        The deny reason when the surface lacks a covering low stamp, else None.
-    """
-    if not CODE_REVIEW_ENFORCEMENT_ENABLED:
-        return None
-    repo_root = resolve_repo_root(target_directory)
-    if repo_root is None:
-        return None
-    merge_base_sha = resolve_merge_base(repo_root)
-    if merge_base_sha is None:
-        return None
-    if is_verification_exempt_diff(repo_root, merge_base_sha):
-        return None
-    surface_hash = live_surface_hash(repo_root)
-    if surface_hash is None:
-        return None
-    if stamp_covers_surface(repo_root, surface_hash, PUSH_REQUIRED_EFFORT):
-        return None
-    hash_preview = surface_hash[:HASH_PREVIEW_LENGTH]
-    return f"{PUSH_GATE_CORRECTIVE_MESSAGE} (repo: {repo_root}, surface sha256 {hash_preview}...)"
-
-
-def _emit_first_denied_directory(command_text: str, session_directory: str, tool_name: str) -> None:
-    """Deny the push against the first target directory that lacks a stamp."""
-    all_target_directories = gated_repo_directories(
-        command_text, session_directory, all_gated_subcommands=GATED_PUSH_SUBCOMMANDS
-    )
-    for each_target_directory in all_target_directories:
-        deny_reason = deny_reason_for_directory(each_target_directory)
-        if deny_reason is None:
-            continue
-        log_and_emit_code_review_deny(deny_reason, tool_name, PUSH_GATE_HOOK_MODULE_NAME)
-        return
-
-
-def main() -> None:
-    """Read the PreToolUse payload and decide whether to allow the push.
-
-    Allows the command without a stamp when it carries the bypass marker
-    (``CODE_REVIEW_BYPASS_MARKER``) as a genuine trailing shell comment;
-    otherwise denies a push whose surface lacks a covering low stamp.
-    """
-    try:
-        pretooluse_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        return
-    tool_name = pretooluse_payload.get("tool_name", "")
-    if tool_name not in ALL_GATED_SHELL_TOOL_NAMES:
-        return
-    tool_input = pretooluse_payload.get("tool_input", {})
-    if not isinstance(tool_input, dict):
-        return
-    command_text = tool_input.get("command", "")
-    if not isinstance(command_text, str) or not command_text:
-        return
-    if command_carries_trailing_marker(command_text, CODE_REVIEW_BYPASS_MARKER):
-        return
-    session_directory = pretooluse_payload.get("cwd", ".")
-    if not isinstance(session_directory, str):
-        session_directory = "."
-    _emit_first_denied_directory(command_text, session_directory, tool_name)
-
-
-if __name__ == "__main__":
-    main()