claude-dev-env 2.18.0 → 2.20.0

package/hooks/blocking/test_destructive_command_blocker.py

@@ -7,8 +7,17 @@ import sys
 import tempfile
 from pathlib import Path
 
+import pytest
 
-SCRIPT_PATH = Path(__file__).parent / "destructive_command_blocker.py"
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+if str(_BLOCKING_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_BLOCKING_DIRECTORY))
+
+import _path_setup  # noqa: E402, F401
+
+from test_hook_subprocess_support import build_bash_payload  # noqa: E402
+
+SCRIPT_PATH = _BLOCKING_DIRECTORY / "destructive_command_blocker.py"
 GH_GATE_USER_FACING_PREFIX = "[gh-gate]"
 GH_REDIRECT_ACTIVE_ENV_VAR = "CLAUDE_GH_REDIRECT_ACTIVE"
 GH_REDIRECT_ACTIVE_VALUE = "1"
@@ -23,7 +32,7 @@ def _posix_style_system_temporary_root() -> str:
 
 
 def _run_hook(
-    payload: dict,
+    payload: str,
     gh_redirect_active: bool = True,
 ) -> subprocess.CompletedProcess[str]:
     child_environment = os.environ.copy()
@@ -33,7 +42,7 @@ def _run_hook(
         child_environment.pop(GH_REDIRECT_ACTIVE_ENV_VAR, None)
     return subprocess.run(
         [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
+        input=payload,
         text=True,
         capture_output=True,
         check=False,
@@ -41,15 +50,8 @@ def _run_hook(
     )
 
 
-def _make_bash_payload(command: str) -> dict:
-    return {
-        "tool_name": "Bash",
-        "tool_input": {"command": command},
-    }
-
-
 def test_denies_gh_issue_comment_as_redirect_duplicate_guard() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'gh issue comment 83 --repo jl-cmd/claude-dev-env --body "hello"'
     )
     result = _run_hook(payload)
@@ -65,7 +67,7 @@ def test_denies_gh_issue_comment_as_redirect_duplicate_guard() -> None:
 
 
 def test_denies_gh_pr_comment_as_redirect_duplicate_guard() -> None:
-    payload = _make_bash_payload('gh pr comment 42 --body "ok"')
+    payload = build_bash_payload('gh pr comment 42 --body "ok"')
     result = _run_hook(payload)
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
@@ -73,7 +75,7 @@ def test_denies_gh_pr_comment_as_redirect_duplicate_guard() -> None:
 
 
 def test_denies_gh_pr_review_as_redirect_duplicate_guard() -> None:
-    payload = _make_bash_payload("gh pr review 42 --approve")
+    payload = build_bash_payload("gh pr review 42 --approve")
     result = _run_hook(payload)
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
@@ -81,7 +83,7 @@ def test_denies_gh_pr_review_as_redirect_duplicate_guard() -> None:
 
 
 def test_denies_gh_api_post_comment_as_redirect_duplicate_guard() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         "gh api /repos/owner/name/issues/1/comments -X POST -f body=hello"
     )
     result = _run_hook(payload)
@@ -90,7 +92,7 @@ def test_denies_gh_api_post_comment_as_redirect_duplicate_guard() -> None:
 
 
 def test_suppresses_output_on_gh_redirect_deny() -> None:
-    payload = _make_bash_payload('gh issue comment 1 --body "x"')
+    payload = build_bash_payload('gh issue comment 1 --body "x"')
     result = _run_hook(payload)
     response = json.loads(result.stdout)
     assert response["suppressOutput"] is True
@@ -98,7 +100,7 @@ def test_suppresses_output_on_gh_redirect_deny() -> None:
 
 
 def test_asks_on_rm_rf_still_works() -> None:
-    payload = _make_bash_payload("rm -rf /var/log/myapp")
+    payload = build_bash_payload("rm -rf /var/log/myapp")
     result = _run_hook(payload)
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
@@ -106,7 +108,7 @@ def test_asks_on_rm_rf_still_works() -> None:
 
 
 def test_asks_on_git_push_force_still_works() -> None:
-    payload = _make_bash_payload("git push --force origin main")
+    payload = build_bash_payload("git push --force origin main")
     result = _run_hook(payload)
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
@@ -116,21 +118,23 @@ def test_asks_on_git_push_force_still_works() -> None:
 
 
 def test_allows_plain_command_without_destructive_pattern() -> None:
-    payload = _make_bash_payload("ls -la")
+    payload = build_bash_payload("ls -la")
     result = _run_hook(payload)
     assert result.stdout.strip() == ""
     assert result.returncode == 0
 
 
 def test_ignores_non_bash_tool() -> None:
-    payload = {"tool_name": "Read", "tool_input": {"file_path": "/tmp/x"}}
+    payload = json.dumps(
+        {"tool_name": "Read", "tool_input": {"file_path": "/tmp/x"}}
+    )
     result = _run_hook(payload)
     assert result.stdout.strip() == ""
     assert result.returncode == 0
 
 
 def test_gh_issue_comment_is_allowed_when_redirect_env_var_is_unset() -> None:
-    payload = _make_bash_payload('gh issue comment 83 --body "hello"')
+    payload = build_bash_payload('gh issue comment 83 --body "hello"')
 
     result = _run_hook(payload, gh_redirect_active=False)
 
@@ -139,7 +143,7 @@ def test_gh_issue_comment_is_allowed_when_redirect_env_var_is_unset() -> None:
 
 
 def test_gh_pr_comment_is_allowed_when_redirect_env_var_is_unset() -> None:
-    payload = _make_bash_payload('gh pr comment 42 --body "ok"')
+    payload = build_bash_payload('gh pr comment 42 --body "ok"')
 
     result = _run_hook(payload, gh_redirect_active=False)
 
@@ -148,7 +152,7 @@ def test_gh_pr_comment_is_allowed_when_redirect_env_var_is_unset() -> None:
 
 
 def test_gh_pr_review_is_allowed_when_redirect_env_var_is_unset() -> None:
-    payload = _make_bash_payload("gh pr review 42 --approve")
+    payload = build_bash_payload("gh pr review 42 --approve")
 
     result = _run_hook(payload, gh_redirect_active=False)
 
@@ -157,7 +161,7 @@ def test_gh_pr_review_is_allowed_when_redirect_env_var_is_unset() -> None:
 
 
 def test_gh_api_post_comment_is_allowed_when_redirect_env_var_is_unset() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         "gh api /repos/owner/name/issues/1/comments -X POST -f body=hello"
     )
 
@@ -167,13 +171,13 @@ def test_gh_api_post_comment_is_allowed_when_redirect_env_var_is_unset() -> None
     assert result.returncode == 0
 
 
-def _run_rm_hook(payload: dict) -> subprocess.CompletedProcess[str]:
+def _run_rm_hook(payload: str) -> subprocess.CompletedProcess[str]:
     child_environment = os.environ.copy()
     child_environment.pop(GH_REDIRECT_ACTIVE_ENV_VAR, None)
     child_environment.pop("CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW", None)
     return subprocess.run(
         [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
+        input=payload,
         text=True,
         capture_output=True,
         check=False,
@@ -182,7 +186,7 @@ def _run_rm_hook(payload: dict) -> subprocess.CompletedProcess[str]:
 
 
 def test_rm_rf_asks_when_target_is_non_ephemeral_path() -> None:
-    payload = _make_bash_payload("rm -rf /var/log/myapp")
+    payload = build_bash_payload("rm -rf /var/log/myapp")
 
     result = _run_rm_hook(payload)
 
@@ -191,7 +195,7 @@ def test_rm_rf_asks_when_target_is_non_ephemeral_path() -> None:
 
 
 def test_rm_rf_allowed_when_target_is_under_tmp_segment() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/some_scratch_dir")
+    payload = build_bash_payload("rm -rf /tmp/some_scratch_dir")
 
     result = _run_rm_hook(payload)
 
@@ -199,10 +203,15 @@ def test_rm_rf_allowed_when_target_is_under_tmp_segment() -> None:
     assert result.returncode == 0
 
 
-def test_rm_rf_allowed_when_target_is_under_os_temp_directory() -> None:
-    system_temp_subdirectory = Path(tempfile.mkdtemp(prefix="rm_target_"))
+def test_rm_rf_allowed_when_target_is_under_os_temp_directory(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TEMP", str(tmp_path))
+    monkeypatch.setenv("TMP", str(tmp_path))
+    system_temp_subdirectory = tmp_path / "rm_target"
+    system_temp_subdirectory.mkdir()
     forward_slash_temp_path = str(system_temp_subdirectory).replace("\\", "/")
-    payload = _make_bash_payload(f"rm -rf {forward_slash_temp_path}")
+    payload = build_bash_payload(f"rm -rf {forward_slash_temp_path}")
 
     result = _run_rm_hook(payload)
 
@@ -211,7 +220,7 @@ def test_rm_rf_allowed_when_target_is_under_os_temp_directory() -> None:
 
 
 def test_rm_rf_allowed_when_target_is_under_worktrees_segment() -> None:
-    payload = _make_bash_payload("rm -rf /Users/me/repo/worktrees/feature_branch/build")
+    payload = build_bash_payload("rm -rf /Users/me/repo/worktrees/feature_branch/build")
 
     result = _run_rm_hook(payload)
 
@@ -220,7 +229,7 @@ def test_rm_rf_allowed_when_target_is_under_worktrees_segment() -> None:
 
 
 def test_rm_rf_asks_when_target_is_bare_worktrees_directory() -> None:
-    payload = _make_bash_payload("rm -rf /Users/me/repo/worktrees")
+    payload = build_bash_payload("rm -rf /Users/me/repo/worktrees")
 
     result = _run_rm_hook(payload)
 
@@ -229,7 +238,7 @@ def test_rm_rf_asks_when_target_is_bare_worktrees_directory() -> None:
 
 
 def test_rm_rf_asks_when_rm_includes_option_with_equals_sign() -> None:
-    payload = _make_bash_payload("rm -rf --files0-from=/tmp/list /tmp/scratch")
+    payload = build_bash_payload("rm -rf --files0-from=/tmp/list /tmp/scratch")
 
     result = _run_rm_hook(payload)
 
@@ -238,7 +247,7 @@ def test_rm_rf_asks_when_rm_includes_option_with_equals_sign() -> None:
 
 
 def test_rm_rf_allowed_when_both_targets_are_ephemeral() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/first_dir /tmp/second_dir")
+    payload = build_bash_payload("rm -rf /tmp/first_dir /tmp/second_dir")
 
     result = _run_rm_hook(payload)
 
@@ -247,7 +256,7 @@ def test_rm_rf_allowed_when_both_targets_are_ephemeral() -> None:
 
 
 def test_rm_rf_asks_when_any_target_is_non_ephemeral() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/scratch /etc/passwd")
+    payload = build_bash_payload("rm -rf /tmp/scratch /etc/passwd")
 
     result = _run_rm_hook(payload)
 
@@ -260,7 +269,7 @@ def test_rm_rf_asks_when_target_has_nested_temp_segment_not_at_root() -> None:
 
 
 def test_rm_rf_asks_when_double_dash_includes_hyphen_prefixed_non_ephemeral_target() -> None:
-    payload = _make_bash_payload("rm -rf -- /tmp/scratch -non_ephemeral")
+    payload = build_bash_payload("rm -rf -- /tmp/scratch -non_ephemeral")
 
     result = _run_rm_hook(payload)
 
@@ -269,7 +278,7 @@ def test_rm_rf_asks_when_double_dash_includes_hyphen_prefixed_non_ephemeral_targ
 
 
 def test_rm_rf_allowed_when_compound_with_ampersand_and_absolute_ephemeral_target() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/reply && gh pr checks 19")
+    payload = build_bash_payload("rm -rf /tmp/reply && gh pr checks 19")
 
     result = _run_rm_hook(payload)
 
@@ -278,7 +287,7 @@ def test_rm_rf_allowed_when_compound_with_ampersand_and_absolute_ephemeral_targe
 
 
 def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_double_quoted() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf .bugteam-tmp')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf .bugteam-tmp')
 
     result = _run_rm_hook(payload)
 
@@ -287,7 +296,7 @@ def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_double_quoted
 
 
 def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_single_quoted() -> None:
-    payload = _make_bash_payload("cd '/tmp/bugteam_scratch' && rm -rf .bugteam-tmp")
+    payload = build_bash_payload("cd '/tmp/bugteam_scratch' && rm -rf .bugteam-tmp")
 
     result = _run_rm_hook(payload)
 
@@ -296,7 +305,7 @@ def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_single_quoted
 
 
 def test_rm_rf_allowed_when_leading_cd_into_ephemeral_subdirectory_unquoted() -> None:
-    payload = _make_bash_payload("cd /tmp/bugteam_scratch && rm -rf .bugteam-tmp")
+    payload = build_bash_payload("cd /tmp/bugteam_scratch && rm -rf .bugteam-tmp")
 
     result = _run_rm_hook(payload)
 
@@ -309,7 +318,7 @@ def test_rm_rf_allowed_when_leading_cd_into_windows_temp_worktree_subdirectory()
         _windows_style_system_temporary_root()
         + r"\bugteam-pr-58-20260424071040\pr-58\worktree"
     )
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         f'cd "{windows_style_temp_worktree}" && rm -rf .bugteam-tmp'
     )
 
@@ -320,7 +329,7 @@ def test_rm_rf_allowed_when_leading_cd_into_windows_temp_worktree_subdirectory()
 
 
 def test_rm_rf_allowed_when_leading_cd_into_ephemeral_with_extra_compound_after_rm() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf .bugteam-tmp && gh pr checks 19'
     )
 
@@ -331,7 +340,7 @@ def test_rm_rf_allowed_when_leading_cd_into_ephemeral_with_extra_compound_after_
 
 
 def test_rm_rf_asks_when_leading_cd_into_ephemeral_with_wildcard_target() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf *')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf *')
 
     result = _run_rm_hook(payload)
 
@@ -340,7 +349,7 @@ def test_rm_rf_asks_when_leading_cd_into_ephemeral_with_wildcard_target() -> Non
 
 
 def test_rm_rf_asks_when_cwd_ephemeral_and_relative_target_escapes_via_dotdot() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf ../../etc')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf ../../etc')
 
     result = _run_rm_hook(payload)
 
@@ -349,7 +358,7 @@ def test_rm_rf_asks_when_cwd_ephemeral_and_relative_target_escapes_via_dotdot()
 
 
 def test_rm_rf_asks_when_rm_uses_files0_from_long_option_with_equals() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf --files0-from=/etc/passwd'
     )
 
@@ -360,7 +369,7 @@ def test_rm_rf_asks_when_rm_uses_files0_from_long_option_with_equals() -> None:
 
 
 def test_rm_rf_asks_when_rm_uses_unknown_long_option() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf --nuke /tmp/bugteam_scratch/stuff'
     )
 
@@ -371,7 +380,7 @@ def test_rm_rf_asks_when_rm_uses_unknown_long_option() -> None:
 
 
 def test_rm_rf_asks_when_rm_target_uses_windows_backslash_absolute_path_unquoted() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         r'cd "/tmp/bugteam_scratch" && rm -rf C:\sensitive\path'
     )
 
@@ -382,10 +391,7 @@ def test_rm_rf_asks_when_rm_target_uses_windows_backslash_absolute_path_unquoted
 
 
 def test_rm_rf_asks_when_relative_target_without_declared_cwd_fails_closed() -> None:
-    payload_with_no_cwd = {
-        "tool_name": "Bash",
-        "tool_input": {"command": "rm -rf relative/path"},
-    }
+    payload_with_no_cwd = build_bash_payload("rm -rf relative/path")
 
     result = _run_rm_hook(payload_with_no_cwd)
 
@@ -394,7 +400,7 @@ def test_rm_rf_asks_when_relative_target_without_declared_cwd_fails_closed() ->
 
 
 def test_rm_rf_allowed_when_cwd_ephemeral_and_relative_target_stays_within() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf ./build')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf ./build')
 
     result = _run_rm_hook(payload)
 
@@ -403,13 +409,9 @@ def test_rm_rf_allowed_when_cwd_ephemeral_and_relative_target_stays_within() ->
 
 
 def test_rm_rf_asks_when_tool_input_cwd_is_ephemeral_but_rm_target_is_absolute_non_ephemeral() -> None:
-    payload_with_tool_input_cwd = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": "rm -rf /var/log/myapp",
-            "cwd": "/tmp/bugteam_scratch",
-        },
-    }
+    payload_with_tool_input_cwd = build_bash_payload(
+        "rm -rf /var/log/myapp", tool_input_cwd="/tmp/bugteam_scratch"
+    )
 
     result = _run_rm_hook(payload_with_tool_input_cwd)
 
@@ -438,7 +440,7 @@ def test_rm_rf_asks_when_cd_ephemeral_but_target_has_nested_tmp_segment_not_at_r
 
 
 def test_git_push_force_asks_when_leading_cd_into_ephemeral_subdirectory() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && git push --force')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && git push --force')
 
     result = _run_rm_hook(payload)
 
@@ -448,7 +450,7 @@ def test_git_push_force_asks_when_leading_cd_into_ephemeral_subdirectory() -> No
 
 
 def test_git_clean_force_recursive_asks_when_leading_cd_into_ephemeral_subdirectory() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && git clean -fd')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && git clean -fd')
 
     result = _run_rm_hook(payload)
 
@@ -458,7 +460,7 @@ def test_git_clean_force_recursive_asks_when_leading_cd_into_ephemeral_subdirect
 
 
 def test_rm_rf_plus_git_push_force_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf cache && git push --force'
     )
 
@@ -469,7 +471,7 @@ def test_rm_rf_plus_git_push_force_piggyback_asks_when_leading_cd_into_ephemeral
 
 
 def test_rm_rf_plus_git_clean_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf cache && git clean -fd'
     )
 
@@ -480,7 +482,7 @@ def test_rm_rf_plus_git_clean_piggyback_asks_when_leading_cd_into_ephemeral() ->
 
 
 def test_rm_rf_plus_mkfs_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf cache && mkfs.ext4 /dev/sda1'
     )
 
@@ -491,7 +493,7 @@ def test_rm_rf_plus_mkfs_piggyback_asks_when_leading_cd_into_ephemeral() -> None
 
 
 def test_rm_rf_plus_drop_table_piggyback_asks_when_leading_cd_into_ephemeral() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/bugteam_scratch" && rm -rf cache && psql -c "DROP TABLE users"'
     )
 
@@ -502,7 +504,7 @@ def test_rm_rf_plus_drop_table_piggyback_asks_when_leading_cd_into_ephemeral() -
 
 
 def test_rm_rf_asks_when_leading_cd_into_ephemeral_but_rm_target_is_bare_tmp_root() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf /tmp')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf /tmp')
 
     result = _run_rm_hook(payload)
 
@@ -511,7 +513,7 @@ def test_rm_rf_asks_when_leading_cd_into_ephemeral_but_rm_target_is_bare_tmp_roo
 
 
 def test_rm_rf_asks_when_leading_cd_into_ephemeral_but_rm_target_is_bare_worktrees_root() -> None:
-    payload = _make_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf /worktrees')
+    payload = build_bash_payload('cd "/tmp/bugteam_scratch" && rm -rf /worktrees')
 
     result = _run_rm_hook(payload)
 
@@ -520,13 +522,9 @@ def test_rm_rf_asks_when_leading_cd_into_ephemeral_but_rm_target_is_bare_worktre
 
 
 def test_rm_rf_asks_when_command_fails_shlex_parse_with_unbalanced_quotes() -> None:
-    payload_with_tool_input_cwd = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": 'rm -rf "unclosed_quote',
-            "cwd": "/tmp/bugteam_scratch",
-        },
-    }
+    payload_with_tool_input_cwd = build_bash_payload(
+        'rm -rf "unclosed_quote', tool_input_cwd="/tmp/bugteam_scratch"
+    )
 
     result = _run_rm_hook(payload_with_tool_input_cwd)
 
@@ -535,7 +533,7 @@ def test_rm_rf_asks_when_command_fails_shlex_parse_with_unbalanced_quotes() -> N
 
 
 def test_rm_rf_asks_when_leading_cd_target_is_non_ephemeral_directory() -> None:
-    payload = _make_bash_payload('cd "/etc" && rm -rf scratch')
+    payload = build_bash_payload('cd "/etc" && rm -rf scratch')
 
     result = _run_rm_hook(payload)
 
@@ -544,7 +542,7 @@ def test_rm_rf_asks_when_leading_cd_target_is_non_ephemeral_directory() -> None:
 
 
 def test_rm_rf_asks_when_leading_cd_target_is_bare_ephemeral_root() -> None:
-    payload = _make_bash_payload('cd "/tmp" && rm -rf scratch')
+    payload = build_bash_payload('cd "/tmp" && rm -rf scratch')
 
     result = _run_rm_hook(payload)
 
@@ -553,7 +551,7 @@ def test_rm_rf_asks_when_leading_cd_target_is_bare_ephemeral_root() -> None:
 
 
 def test_rm_rf_allowed_when_leading_cd_target_is_git_worktrees_directory() -> None:
-    payload = _make_bash_payload('cd "/Users/me/repo/worktrees" && rm -rf feature')
+    payload = build_bash_payload('cd "/Users/me/repo/worktrees" && rm -rf feature')
 
     result = _run_rm_hook(payload)
 
@@ -562,7 +560,7 @@ def test_rm_rf_allowed_when_leading_cd_target_is_git_worktrees_directory() -> No
 
 
 def test_rm_rf_asks_when_leading_cd_target_is_relative_path() -> None:
-    payload = _make_bash_payload('cd "./scratch" && rm -rf inner')
+    payload = build_bash_payload('cd "./scratch" && rm -rf inner')
 
     result = _run_rm_hook(payload)
 
@@ -571,7 +569,7 @@ def test_rm_rf_asks_when_leading_cd_target_is_relative_path() -> None:
 
 
 def test_rm_rf_allowed_for_chat_observed_bugteam_backslash_worktree_scratch_cleanup() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "'
         + _windows_style_system_temporary_root()
         + r'\bugteam-pr-58-20260424071040\pr-58\worktree" && rm -rf .bugteam-tmp'
@@ -584,7 +582,7 @@ def test_rm_rf_allowed_for_chat_observed_bugteam_backslash_worktree_scratch_clea
 
 
 def test_rm_rf_allowed_for_chat_observed_bugteam_forward_slash_worktree_scratch_cleanup() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "'
         + _posix_style_system_temporary_root()
         + '/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf .bugteam-tmp'
@@ -597,7 +595,7 @@ def test_rm_rf_allowed_for_chat_observed_bugteam_forward_slash_worktree_scratch_
 
 
 def test_rm_rf_allowed_for_chat_observed_bugfix_reply_scratch_file_cleanup() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "'
         + _posix_style_system_temporary_root()
         + '/bugteam-pr-58-20260424071040/pr-58/worktree" && rm -rf tmp_reply_loop1-1.md'
@@ -610,7 +608,7 @@ def test_rm_rf_allowed_for_chat_observed_bugfix_reply_scratch_file_cleanup() ->
 
 
 def test_rm_rf_allowed_for_chat_observed_bugfind_multiple_scratch_files_cleanup() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "'
         + _posix_style_system_temporary_root()
         + '/bugteam-pr-58-20260424071040/pr-256/worktree" && rm -rf tmp_review_body.md tmp_finding_1.md'
@@ -623,14 +621,13 @@ def test_rm_rf_allowed_for_chat_observed_bugfind_multiple_scratch_files_cleanup(
 
 
 def test_rm_rf_allowed_via_tool_input_cwd_pointing_at_chat_observed_bugteam_worktree() -> None:
-    payload_with_tool_input_cwd = {
-        "tool_name": "Bash",
-        "tool_input": {
-            "command": "rm -rf .bugteam-tmp",
-            "cwd": _posix_style_system_temporary_root()
-            + "/bugteam-pr-58-20260424071040/pr-58/worktree",
-        },
-    }
+    payload_with_tool_input_cwd = build_bash_payload(
+        "rm -rf .bugteam-tmp",
+        tool_input_cwd=(
+            _posix_style_system_temporary_root()
+            + "/bugteam-pr-58-20260424071040/pr-58/worktree"
+        ),
+    )
 
     result = _run_rm_hook(payload_with_tool_input_cwd)
 
@@ -639,7 +636,7 @@ def test_rm_rf_allowed_via_tool_input_cwd_pointing_at_chat_observed_bugteam_work
 
 
 def test_rm_rf_allowed_for_chat_observed_absolute_path_in_bugteam_windows_worktree_scratch() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'rm -rf "'
         + _posix_style_system_temporary_root()
         + '/bugteam-pr-58-20260424071040/pr-58/worktree/.bugteam-tmp"'
@@ -652,7 +649,7 @@ def test_rm_rf_allowed_for_chat_observed_absolute_path_in_bugteam_windows_worktr
 
 
 def test_rm_rf_asks_when_leading_cd_target_contains_command_substitution_dollar_parenthesis() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/$(rm -rf ~/.ssh)" && ls'
     )
 
@@ -663,7 +660,7 @@ def test_rm_rf_asks_when_leading_cd_target_contains_command_substitution_dollar_
 
 
 def test_rm_rf_asks_when_leading_cd_target_contains_backtick_command_substitution() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/`rm -rf ~/.ssh`" && rm -rf .bugteam-tmp'
     )
 
@@ -674,7 +671,7 @@ def test_rm_rf_asks_when_leading_cd_target_contains_backtick_command_substitutio
 
 
 def test_rm_rf_asks_when_leading_cd_target_contains_variable_expansion() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/$SNEAKY_VAR" && rm -rf .bugteam-tmp'
     )
 
@@ -685,7 +682,7 @@ def test_rm_rf_asks_when_leading_cd_target_contains_variable_expansion() -> None
 
 
 def test_rm_rf_asks_when_leading_cd_adjacent_quoted_strings_resolve_outside_ephemeral() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         'cd "/tmp/a""/../../etc" && rm -rf .'
     )
 
@@ -696,7 +693,7 @@ def test_rm_rf_asks_when_leading_cd_adjacent_quoted_strings_resolve_outside_ephe
 
 
 def test_rm_rf_asks_when_leading_cd_adjacent_quoted_strings_use_mixed_quotes() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         """cd "/tmp/a"'/../../etc' && rm -rf ."""
     )
 
@@ -707,7 +704,7 @@ def test_rm_rf_asks_when_leading_cd_adjacent_quoted_strings_use_mixed_quotes() -
 
 
 def test_rm_rf_asks_when_target_is_bare_tmp_root() -> None:
-    payload = _make_bash_payload("rm -rf /tmp")
+    payload = build_bash_payload("rm -rf /tmp")
 
     result = _run_rm_hook(payload)
 
@@ -716,7 +713,7 @@ def test_rm_rf_asks_when_target_is_bare_tmp_root() -> None:
 
 
 def test_rm_rf_asks_when_target_is_double_slash_tmp_root() -> None:
-    payload = _make_bash_payload("rm -rf //tmp")
+    payload = build_bash_payload("rm -rf //tmp")
 
     result = _run_rm_hook(payload)
 
@@ -724,8 +721,13 @@ def test_rm_rf_asks_when_target_is_double_slash_tmp_root() -> None:
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
 
 
-def test_rm_rf_asks_when_target_is_bare_os_temp_root() -> None:
-    payload = _make_bash_payload(f"rm -rf {tempfile.gettempdir()}")
+def test_rm_rf_asks_when_target_is_bare_os_temp_root(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    system_temporary_root = tempfile.gettempdir()
+    monkeypatch.setenv("TEMP", system_temporary_root)
+    monkeypatch.setenv("TMP", system_temporary_root)
+    payload = build_bash_payload(f"rm -rf {system_temporary_root}")
 
     result = _run_rm_hook(payload)
 
@@ -734,14 +736,14 @@ def test_rm_rf_asks_when_target_is_bare_os_temp_root() -> None:
 
 
 def test_rm_rf_asks_when_ephemeral_auto_allow_disabled_via_env_var() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/scratch")
+    payload = build_bash_payload("rm -rf /tmp/scratch")
 
     child_environment = os.environ.copy()
     child_environment.pop(GH_REDIRECT_ACTIVE_ENV_VAR, None)
     child_environment["CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW"] = "1"
     result = subprocess.run(
         [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
+        input=payload,
         text=True,
         capture_output=True,
         check=False,
@@ -753,7 +755,7 @@ def test_rm_rf_asks_when_ephemeral_auto_allow_disabled_via_env_var() -> None:
 
 
 def test_rm_recursive_force_long_flags_allowed_under_tmp() -> None:
-    payload = _make_bash_payload("rm --recursive --force /tmp/long_flag_scratch")
+    payload = build_bash_payload("rm --recursive --force /tmp/long_flag_scratch")
 
     result = _run_rm_hook(payload)
 
@@ -762,7 +764,7 @@ def test_rm_recursive_force_long_flags_allowed_under_tmp() -> None:
 
 
 def test_rm_rf_asks_when_quoted_dotdot_traverses_out_of_ephemeral_root() -> None:
-    payload = _make_bash_payload('rm -rf /tmp/".."/etc')
+    payload = build_bash_payload('rm -rf /tmp/".."/etc')
 
     result = _run_rm_hook(payload)
 
@@ -771,7 +773,7 @@ def test_rm_rf_asks_when_quoted_dotdot_traverses_out_of_ephemeral_root() -> None
 
 
 def test_rm_rf_allowed_when_quoted_path_is_legitimate_ephemeral() -> None:
-    payload = _make_bash_payload('rm -rf "/tmp/some scratch dir"')
+    payload = build_bash_payload('rm -rf "/tmp/some scratch dir"')
 
     result = _run_rm_hook(payload)
 
@@ -780,7 +782,7 @@ def test_rm_rf_allowed_when_quoted_path_is_legitimate_ephemeral() -> None:
 
 
 def test_rm_rf_asks_when_single_quoted_dotdot_traverses_out_of_ephemeral() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/'..'/etc")
+    payload = build_bash_payload("rm -rf /tmp/'..'/etc")
 
     result = _run_rm_hook(payload)
 
@@ -789,7 +791,7 @@ def test_rm_rf_asks_when_single_quoted_dotdot_traverses_out_of_ephemeral() -> No
 
 
 def test_rm_rf_asks_when_target_is_glob_wildcard_under_tmp() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/*")
+    payload = build_bash_payload("rm -rf /tmp/*")
 
     result = _run_rm_hook(payload)
 
@@ -798,7 +800,7 @@ def test_rm_rf_asks_when_target_is_glob_wildcard_under_tmp() -> None:
 
 
 def test_rm_rf_asks_when_target_is_question_mark_glob_under_tmp() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/?")
+    payload = build_bash_payload("rm -rf /tmp/?")
 
     result = _run_rm_hook(payload)
 
@@ -807,7 +809,7 @@ def test_rm_rf_asks_when_target_is_question_mark_glob_under_tmp() -> None:
 
 
 def test_rm_rf_asks_when_target_is_bracket_glob_under_tmp() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/[abc]")
+    payload = build_bash_payload("rm -rf /tmp/[abc]")
 
     result = _run_rm_hook(payload)
 
@@ -816,7 +818,7 @@ def test_rm_rf_asks_when_target_is_bracket_glob_under_tmp() -> None:
 
 
 def test_rm_rf_asks_when_target_is_worktrees_glob() -> None:
-    payload = _make_bash_payload("rm -rf /worktrees/*")
+    payload = build_bash_payload("rm -rf /worktrees/*")
 
     result = _run_rm_hook(payload)
 
@@ -824,10 +826,14 @@ def test_rm_rf_asks_when_target_is_worktrees_glob() -> None:
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
 
 
-def test_rm_rf_asks_when_target_is_os_temp_root_glob() -> None:
-    system_temporary_root = tempfile.gettempdir()
+def test_rm_rf_asks_when_target_is_os_temp_root_glob(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TEMP", str(tmp_path))
+    monkeypatch.setenv("TMP", str(tmp_path))
+    system_temporary_root = str(tmp_path)
     forward_slash_temp_root = system_temporary_root.replace("\\", "/")
-    payload = _make_bash_payload(f"rm -rf {forward_slash_temp_root}/*")
+    payload = build_bash_payload(f"rm -rf {forward_slash_temp_root}/*")
 
     result = _run_rm_hook(payload)
 
@@ -835,10 +841,14 @@ def test_rm_rf_asks_when_target_is_os_temp_root_glob() -> None:
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask"
 
 
-def test_rm_rf_allowed_when_unquoted_windows_backslash_target_is_ephemeral() -> None:
-    system_temporary_root = tempfile.gettempdir()
+def test_rm_rf_allowed_when_unquoted_windows_backslash_target_is_ephemeral(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TEMP", str(tmp_path))
+    monkeypatch.setenv("TMP", str(tmp_path))
+    system_temporary_root = str(tmp_path)
     windows_style_target = system_temporary_root.replace("/", "\\") + "\\scratch"
-    payload = _make_bash_payload(f"rm -rf {windows_style_target}")
+    payload = build_bash_payload(f"rm -rf {windows_style_target}")
 
     result = _run_rm_hook(payload)
 
@@ -847,7 +857,7 @@ def test_rm_rf_allowed_when_unquoted_windows_backslash_target_is_ephemeral() ->
 
 
 def test_rm_rf_allowed_when_unquoted_windows_backslash_target_contains_worktrees_segment() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         r"rm -rf C:\Users\developer\project\worktrees\feature_branch\build"
     )
 
@@ -858,7 +868,7 @@ def test_rm_rf_allowed_when_unquoted_windows_backslash_target_contains_worktrees
 
 
 def test_rm_rf_allowed_when_finding_example_windows_backslash_ephemeral_target() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         "rm -rf " + _windows_style_system_temporary_root() + r"\scratch"
     )
 
@@ -869,7 +879,7 @@ def test_rm_rf_allowed_when_finding_example_windows_backslash_ephemeral_target()
 
 
 def test_rm_rf_asks_when_target_is_literal_tmp_star_finding_example() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/*")
+    payload = build_bash_payload("rm -rf /tmp/*")
 
     result = _run_rm_hook(payload)
 
@@ -878,7 +888,7 @@ def test_rm_rf_asks_when_target_is_literal_tmp_star_finding_example() -> None:
 
 
 def test_rm_rf_asks_when_target_basename_is_wildcard_with_prefix_under_tmp() -> None:
-    payload = _make_bash_payload("rm -rf /tmp/foo*")
+    payload = build_bash_payload("rm -rf /tmp/foo*")
 
     result = _run_rm_hook(payload)
 
@@ -887,7 +897,7 @@ def test_rm_rf_asks_when_target_basename_is_wildcard_with_prefix_under_tmp() ->
 
 
 def _run_hook_with_fake_home(
-    payload: dict,
+    payload: str,
     fake_home: Path,
     working_directory: Path,
     disable_ephemeral_auto_allow: bool = True,
@@ -902,7 +912,7 @@ def _run_hook_with_fake_home(
         child_environment.pop("CLAUDE_DESTRUCTIVE_DISABLE_EPHEMERAL_AUTO_ALLOW", None)
     return subprocess.run(
         [sys.executable, str(SCRIPT_PATH)],
-        input=json.dumps(payload),
+        input=payload,
         text=True,
         capture_output=True,
         check=False,
@@ -927,7 +937,7 @@ def test_git_reset_hard_allowed_when_cwd_matches_settings_allow_list(tmp_path: P
     project_directory.mkdir()
     project_path_forward = str(project_directory).replace("\\", "/")
     _write_settings_with_allow_list(fake_home, [project_path_forward])
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, project_directory)
 
@@ -944,7 +954,7 @@ def test_git_reset_hard_asks_when_cwd_not_in_settings_allow_list(tmp_path: Path)
     unapproved_directory.mkdir()
     approved_path_forward = str(approved_directory).replace("\\", "/")
     _write_settings_with_allow_list(fake_home, [approved_path_forward])
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, unapproved_directory)
 
@@ -958,7 +968,7 @@ def test_git_reset_hard_asks_when_settings_missing(tmp_path: Path) -> None:
     fake_home.mkdir()
     project_directory = tmp_path / "unapproved_project"
     project_directory.mkdir()
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, project_directory)
 
@@ -972,7 +982,7 @@ def test_git_reset_hard_asks_when_allow_list_is_empty(tmp_path: Path) -> None:
     project_directory = tmp_path / "some_project"
     project_directory.mkdir()
     _write_settings_with_allow_list(fake_home, [])
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, project_directory)
 
@@ -993,7 +1003,7 @@ def test_git_reset_hard_allowed_in_linked_git_worktree(tmp_path: Path) -> None:
         cwd=main_repository,
         check=True,
     )
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, worktree_directory, disable_ephemeral_auto_allow=False)
 
@@ -1006,7 +1016,7 @@ def test_git_reset_hard_allowed_when_path_contains_worktrees_segment(tmp_path: P
     fake_home.mkdir()
     worktree_directory = tmp_path / "worktrees" / "some_feature"
     worktree_directory.mkdir(parents=True)
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, worktree_directory, disable_ephemeral_auto_allow=False)
 
@@ -1014,10 +1024,16 @@ def test_git_reset_hard_allowed_when_path_contains_worktrees_segment(tmp_path: P
     assert result.returncode == 0
 
 
-def test_git_reset_hard_allowed_under_os_temp_directory() -> None:
-    fake_home = Path(tempfile.mkdtemp(prefix="home_"))
-    working_directory = Path(tempfile.mkdtemp(prefix="ephemeral_work_"))
-    payload = _make_bash_payload("git reset --hard origin/main")
+def test_git_reset_hard_allowed_under_os_temp_directory(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("TEMP", str(tmp_path))
+    monkeypatch.setenv("TMP", str(tmp_path))
+    fake_home = tmp_path / "home"
+    fake_home.mkdir()
+    working_directory = tmp_path / "ephemeral_work"
+    working_directory.mkdir()
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, working_directory, disable_ephemeral_auto_allow=False)
 
@@ -1030,7 +1046,7 @@ def test_git_reset_hard_asks_in_plain_directory_with_no_settings(tmp_path: Path)
     fake_home.mkdir()
     plain_directory = tmp_path / "regular_project"
     plain_directory.mkdir()
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, plain_directory)
 
@@ -1046,7 +1062,7 @@ def test_git_reset_hard_asks_when_settings_file_is_invalid_json(tmp_path: Path)
     )
     project_directory = tmp_path / "unapproved_project"
     project_directory.mkdir()
-    payload = _make_bash_payload("git reset --hard origin/main")
+    payload = build_bash_payload("git reset --hard origin/main")
 
     result = _run_hook_with_fake_home(payload, fake_home, project_directory)
 
@@ -1058,7 +1074,7 @@ def test_git_reset_hard_asks_when_settings_file_is_invalid_json(tmp_path: Path)
 
 
 def _assert_hook_allows(command: str) -> None:
-    result = _run_rm_hook(_make_bash_payload(command))
+    result = _run_rm_hook(build_bash_payload(command))
     assert result.stdout.strip() == "", (
         f"Expected allow (no output) for {command!r}, got: {result.stdout!r}"
     )
@@ -1066,7 +1082,7 @@ def _assert_hook_allows(command: str) -> None:
 
 
 def _assert_hook_asks(command: str, expected_reason_fragment: str | None = None) -> None:
-    result = _run_rm_hook(_make_bash_payload(command))
+    result = _run_rm_hook(build_bash_payload(command))
     response = json.loads(result.stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "ask", (
         f"Expected ask for {command!r}, got: {response!r}"
@@ -1721,7 +1737,7 @@ def test_all_refspecs_convergence_branch_with_flags() -> None:
 
 
 def test_force_push_convergence_with_no_verify_blocked() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         "git push --force origin --no-verify claude/fix-123"
     )
 
@@ -1733,7 +1749,7 @@ def test_force_push_convergence_with_no_verify_blocked() -> None:
 
 
 def test_force_push_convergence_with_no_gpg_sign_blocked() -> None:
-    payload = _make_bash_payload(
+    payload = build_bash_payload(
         "git push --force origin --no-gpg-sign claude/fix-123"
     )