claude-dev-env 2.18.0 → 2.20.0

package/hooks/blocking/test_precommit_code_rules_gate_native_owner.py

@@ -0,0 +1,234 @@
+"""Production-path tests for native staged-gate ownership.
+
+The tests run the Agent Bash dispatcher and a native Git pre-commit hook against
+the same isolated repository. The agent path passes the commit through. The
+native path runs the staged gate and controls the commit.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from contextlib import contextmanager
+import json
+import shutil
+import stat
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+HOOKS_ROOT = Path(__file__).resolve().parent.parent
+BLOCKING_ROOT = HOOKS_ROOT / "blocking"
+GIT_HOOKS_ROOT = HOOKS_ROOT / "git-hooks"
+PRE_COMMIT_SOURCE_PATH = GIT_HOOKS_ROOT / "pre_commit.py"
+GATE_UTILS_SOURCE_PATH = GIT_HOOKS_ROOT / "gate_utils.py"
+GIT_HOOKS_CONSTANTS_SOURCE_PATH = GIT_HOOKS_ROOT / "git_hooks_constants"
+DISPATCHER_SOURCE_PATH = BLOCKING_ROOT / "bash_pre_tool_use_dispatcher.py"
+GIT_COMMAND_TIMEOUT_SECONDS = 60
+CLEAN_MODULE_SOURCE = "def add_one(number: int) -> int:\n    return number + 1\n"
+
+
+def run_git(
+    repository_root: Path,
+    *git_arguments: str,
+    check: bool = True,
+) -> subprocess.CompletedProcess[str]:
+    """Run one isolated Git command and return its captured process record."""
+    return subprocess.run(
+        ["git", *git_arguments],
+        cwd=str(repository_root),
+        check=check,
+        capture_output=True,
+        text=True,
+        timeout=GIT_COMMAND_TIMEOUT_SECONDS,
+    )
+
+
+def initialize_repository(repository_root: Path) -> None:
+    """Create a repository with one committed base file and no active hook."""
+    run_git(repository_root, "init")
+    run_git(repository_root, "config", "user.name", "Hook Test")
+    run_git(repository_root, "config", "user.email", "hook-test@example.invalid")
+    run_git(repository_root, "config", "core.hooksPath", "absent_fixture_hooks")
+    (repository_root / "README.md").write_text("base\n", encoding="utf-8")
+    run_git(repository_root, "add", "README.md")
+    run_git(repository_root, "commit", "-m", "base")
+
+
+def write_gate_script(gate_path: Path, marker_path: Path, exit_code: int) -> None:
+    """Write a staged-gate fixture that records arguments and exits."""
+    gate_path.write_text(
+        "import pathlib\n"
+        "import sys\n"
+        f"pathlib.Path({str(marker_path)!r}).write_text("
+        "'\\n'.join(sys.argv[1:]), encoding='utf-8')\n"
+        f"sys.exit({exit_code})\n",
+        encoding="utf-8",
+    )
+
+
+def install_native_pre_commit(hooks_path: Path) -> None:
+    """Install the native pre-commit module and its self-contained imports."""
+    hooks_path.mkdir()
+    shutil.copyfile(PRE_COMMIT_SOURCE_PATH, hooks_path / "pre_commit.py")
+    shutil.copyfile(GATE_UTILS_SOURCE_PATH, hooks_path / "gate_utils.py")
+    shutil.copytree(
+        GIT_HOOKS_CONSTANTS_SOURCE_PATH,
+        hooks_path / "git_hooks_constants",
+    )
+    pre_commit_path = hooks_path / "pre-commit"
+    pre_commit_path.write_text(
+        "#!/usr/bin/env python3\n"
+        "import sys\n"
+        "from pathlib import Path\n"
+        "shim_directory = Path(__file__).resolve().parent\n"
+        "sys.path.insert(0, str(shim_directory))\n"
+        "import pre_commit\n"
+        "sys.exit(pre_commit.main())\n",
+        encoding="utf-8",
+    )
+    pre_commit_path.chmod(pre_commit_path.stat().st_mode | stat.S_IXUSR)
+
+
+def configured_hooks_path(repository_root: Path) -> str | None:
+    """Return the repository-local hooks path when one is configured."""
+    completed_config = run_git(
+        repository_root,
+        "config",
+        "--local",
+        "--get",
+        "core.hooksPath",
+        check=False,
+    )
+    if completed_config.returncode != 0:
+        return None
+    return completed_config.stdout.strip()
+
+
+def restore_hooks_path(repository_root: Path, prior_hooks_path: str | None) -> None:
+    """Restore the repository-local hooks path captured before a benchmark."""
+    if prior_hooks_path is None:
+        run_git(
+            repository_root,
+            "config",
+            "--local",
+            "--unset-all",
+            "core.hooksPath",
+            check=False,
+        )
+        return
+    run_git(repository_root, "config", "--local", "core.hooksPath", prior_hooks_path)
+
+
+@contextmanager
+def temporary_hooks_path(repository_root: Path, benchmark_hooks_path: Path) -> Iterator[None]:
+    """Apply a benchmark hooks path and restore the prior local setting."""
+    prior_hooks_path = configured_hooks_path(repository_root)
+    run_git(repository_root, "config", "--local", "core.hooksPath", str(benchmark_hooks_path))
+    try:
+        yield
+    finally:
+        restore_hooks_path(repository_root, prior_hooks_path)
+
+
+def stage_module(repository_root: Path) -> None:
+    """Write and stage one Python module for the commit fixture."""
+    (repository_root / "widget.py").write_text(CLEAN_MODULE_SOURCE, encoding="utf-8")
+    run_git(repository_root, "add", "widget.py")
+
+
+def build_bash_payload(repository_root: Path) -> str:
+    """Build the Bash dispatcher payload for a commit in the fixture repository."""
+    commit_command = f'git -C "{repository_root}" commit -m add'
+    return json.dumps({"tool_name": "Bash", "tool_input": {"command": commit_command}})
+
+
+def run_agent_dispatcher(repository_root: Path) -> subprocess.CompletedProcess[str]:
+    """Run the production Bash dispatcher against the fixture commit command."""
+    return subprocess.run(
+        [sys.executable, str(DISPATCHER_SOURCE_PATH)],
+        cwd=str(repository_root),
+        input=build_bash_payload(repository_root),
+        capture_output=True,
+        text=True,
+        timeout=GIT_COMMAND_TIMEOUT_SECONDS,
+    )
+
+
+def run_native_commit(repository_root: Path) -> subprocess.CompletedProcess[str]:
+    """Run the real Git commit that invokes the configured native hook."""
+    return run_git(
+        repository_root,
+        "commit",
+        "-m",
+        "add widget",
+        check=False,
+    )
+
+
+def test_agent_dispatcher_passes_commit_through_without_running_gate(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """The Agent Bash path continues the commit without running the staged gate."""
+    initialize_repository(tmp_path)
+    stage_module(tmp_path)
+    gate_marker_path = tmp_path / "agent_gate_invocation.txt"
+    gate_path = tmp_path / "agent_gate.py"
+    write_gate_script(gate_path, gate_marker_path, exit_code=1)
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(gate_path))
+
+    completed_dispatcher = run_agent_dispatcher(tmp_path)
+
+    assert completed_dispatcher.returncode == 0, completed_dispatcher.stderr
+    assert completed_dispatcher.stdout.strip() == ""
+    assert "Git commit proceeds to configured Git hooks." in completed_dispatcher.stderr
+    assert not gate_marker_path.exists()
+
+
+@pytest.mark.parametrize("gate_exit_code, expected_commit_exit_code", [(1, 1), (0, 0)])
+def test_installed_native_pre_commit_controls_staged_gate_decision(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    gate_exit_code: int,
+    expected_commit_exit_code: int,
+) -> None:
+    """The native Git hook runs the staged gate and returns its commit decision."""
+    initialize_repository(tmp_path)
+    native_hooks_path = tmp_path / "native_hooks"
+    install_native_pre_commit(native_hooks_path)
+    stage_module(tmp_path)
+    gate_marker_path = tmp_path / "native_gate_invocation.txt"
+    gate_path = tmp_path / "native_gate.py"
+    write_gate_script(gate_path, gate_marker_path, gate_exit_code)
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(gate_path))
+
+    with temporary_hooks_path(tmp_path, native_hooks_path):
+        completed_commit = run_native_commit(tmp_path)
+
+    assert completed_commit.returncode == expected_commit_exit_code
+    assert gate_marker_path.read_text(encoding="utf-8") == "--immediate"
+
+
+def test_temporary_hooks_path_restores_shared_worktree_config_on_timeout(
+    tmp_path: Path,
+) -> None:
+    initialize_repository(tmp_path)
+    supported_hooks_path = tmp_path / "supported_hooks"
+    supported_hooks_path.mkdir()
+    run_git(tmp_path, "config", "--local", "core.hooksPath", str(supported_hooks_path))
+    unrelated_worktree = tmp_path.parent / "unrelated_worktree"
+    run_git(tmp_path, "worktree", "add", "--detach", str(unrelated_worktree))
+    benchmark_hooks_path = tmp_path / "benchmark_hooks"
+    benchmark_hooks_path.mkdir()
+
+    try:
+        with pytest.raises(subprocess.TimeoutExpired):
+            with temporary_hooks_path(tmp_path, benchmark_hooks_path):
+                raise subprocess.TimeoutExpired("benchmark", 1)
+
+        assert configured_hooks_path(tmp_path) == str(supported_hooks_path)
+        assert configured_hooks_path(unrelated_worktree) == str(supported_hooks_path)
+    finally:
+        run_git(tmp_path, "worktree", "remove", "--force", str(unrelated_worktree))

package/hooks/blocking/test_pytest_testpaths_orphan_blocker.py

@@ -6,7 +6,8 @@ import subprocess
 import sys
 from pathlib import Path
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+HOOK_DIRECTORY = Path(__file__).resolve().parent
+sys.path.insert(0, str(HOOK_DIRECTORY))
 
 from pytest_testpaths_orphan_blocker import (
     _explicit_testpaths,
@@ -15,7 +16,7 @@ from pytest_testpaths_orphan_blocker import (
     is_test_file,
 )
 
-HOOK_SCRIPT_PATH = os.path.join(os.path.dirname(__file__), "pytest_testpaths_orphan_blocker.py")
+HOOK_SCRIPT_PATH = HOOK_DIRECTORY / "pytest_testpaths_orphan_blocker.py"
 
 PYPROJECT_WITH_EXPLICIT_TESTPATHS = (
     "[tool.pytest.ini_options]\n"
@@ -51,21 +52,22 @@ def _write_package(package_root: Path, pyproject_text: str) -> None:
     (package_root / "pyproject.toml").write_text(pyproject_text, encoding="utf-8")
 
 
-class _RunHook:
-    """Helper to test the hook via subprocess, mirroring the sibling test style."""
-
-    def __call__(self, tool_name: str, tool_input: dict) -> subprocess.CompletedProcess:
-        payload = json.dumps({"tool_name": tool_name, "tool_input": tool_input})
-        return subprocess.run(
-            [sys.executable, HOOK_SCRIPT_PATH],
-            input=payload,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-
-
-_run_hook = _RunHook()
+def _run_hook(
+    tool_name: str, tool_input: dict, home_directory: Path
+) -> subprocess.CompletedProcess:
+    """Run the hook in a subprocess with the supplied tool payload."""
+    payload = json.dumps({"tool_name": tool_name, "tool_input": tool_input})
+    child_environment = os.environ.copy()
+    child_environment["HOME"] = str(home_directory)
+    child_environment["USERPROFILE"] = str(home_directory)
+    return subprocess.run(
+        [sys.executable, HOOK_SCRIPT_PATH],
+        input=payload,
+        capture_output=True,
+        text=True,
+        check=True,
+        env=child_environment,
+    )
 
 
 def test_is_test_file_accepts_test_prefixed_python_file() -> None:
@@ -129,11 +131,13 @@ def test_hook_blocks_create_of_unregistered_test_file(tmp_path: Path) -> None:
             "file_path": str(unregistered_test_file),
             "content": "def test_x() -> None:\n    assert True\n",
         },
+        tmp_path,
     )
     decision = json.loads(completed.stdout)
     hook_output = decision["hookSpecificOutput"]
     assert hook_output["permissionDecision"] == "deny"
     assert "theme_assets/tests" in hook_output["permissionDecisionReason"]
+    assert (tmp_path / ".claude" / "logs" / "hook-blocks.log").is_file()
 
 
 def test_hook_allows_create_of_registered_test_file(tmp_path: Path) -> None:
@@ -146,6 +150,7 @@ def test_hook_allows_create_of_registered_test_file(tmp_path: Path) -> None:
             "file_path": str(registered_test_file),
             "content": "def test_x() -> None:\n    assert True\n",
         },
+        tmp_path,
     )
     assert completed.stdout.strip() == ""
 
@@ -163,6 +168,7 @@ def test_hook_ignores_edit_of_existing_test_file(tmp_path: Path) -> None:
             "old_string": "assert True",
             "new_string": "assert 1 == 1",
         },
+        tmp_path,
     )
     assert completed.stdout.strip() == ""
 
@@ -174,6 +180,7 @@ def test_hook_ignores_non_test_python_file(tmp_path: Path) -> None:
     completed = _run_hook(
         "Write",
         {"file_path": str(production_module), "content": "VALUE = 1\n"},
+        tmp_path,
     )
     assert completed.stdout.strip() == ""
 
@@ -242,6 +249,6 @@ def test_hook_does_not_crash_on_scalar_tool_ancestor(tmp_path: Path) -> None:
             "file_path": str(any_test_file),
             "content": "def test_x() -> None:\n    assert True\n",
         },
+        tmp_path,
     )
-    assert completed.returncode == 0
     assert completed.stdout.strip() == ""

package/hooks/blocking/test_sensitive_file_protector.py

@@ -14,20 +14,33 @@ it stays denied.
 from __future__ import annotations
 
 import json
+import shlex
 import subprocess
 import sys
+from functools import cache
 from pathlib import Path
 
 import pytest
 
 BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+HOOKS_DIRECTORY = BLOCKING_DIRECTORY.parent
+CLAUDE_DEV_ENV_DIRECTORY = BLOCKING_DIRECTORY.parent.parent
 HOOK_SCRIPT_PATH = BLOCKING_DIRECTORY / "sensitive_file_protector.py"
+DISPATCHER_SCRIPT_PATH = BLOCKING_DIRECTORY / "pre_tool_use_dispatcher.py"
+HOOKS_JSON_PATH = HOOKS_DIRECTORY / "hooks.json"
+DIRECT_HOOK_TIMEOUT_SECONDS = 10
 
-WRITE_TOOL_NAME = "Write"
-EDIT_TOOL_NAME = "Edit"
 READ_TOOL_NAME = "Read"
 
-DENY_DECISION = "deny"
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))
+
+from hooks_constants.pre_tool_use_dispatcher_constants import (  # noqa: E402, I001
+    DENY_DECISION,
+    EDIT_TOOL_NAME,
+    MULTI_EDIT_TOOL_NAME,
+    WRITE_TOOL_NAME,
+)
 
 PLACEHOLDER_TEMPLATE_BODY = "API_TOKEN=your-token-here\nDATABASE_HOST=localhost\n"
 ORDINARY_SOURCE_BODY = "def add(left: int, right: int) -> int:\n    return left + right\n"
@@ -65,11 +78,77 @@ ALL_UPPERCASE_DENIED_FILENAMES = (".ENV", "ID_RSA", "CREDENTIALS.JSON", "SERVER.
 ALL_ORDINARY_FILENAMES = ("main.py", "README.md", "settings.json")
 
 
-def _run_hook(tool_name: str, file_path: Path, content: str) -> subprocess.CompletedProcess:
+@cache
+def _registered_dispatcher_details(
+    hooks_json_path: Path = HOOKS_JSON_PATH,
+) -> tuple[list[str], int]:
+    hooks_configuration = json.loads(hooks_json_path.read_text(encoding="utf-8"))
+    pre_tool_use_registrations = hooks_configuration["hooks"]["PreToolUse"]
+    dispatcher_registrations = []
+    for each_registration in pre_tool_use_registrations:
+        for each_hook in each_registration["hooks"]:
+            command_parts = shlex.split(each_hook["command"])
+            if Path(command_parts[-1]).name != "pre_tool_use_dispatcher.py":
+                continue
+            dispatcher_registrations.append(
+                (each_registration, each_hook, command_parts)
+            )
+    assert len(dispatcher_registrations) == 1, (
+        "hooks.json must contain exactly one pre_tool_use_dispatcher.py registration; "
+        f"found {len(dispatcher_registrations)}"
+    )
+    each_registration, each_hook, command_parts = dispatcher_registrations[0]
+    assert each_registration["matcher"] == "Write|Edit|MultiEdit", (
+        "dispatcher registration must cover exactly Write, Edit, and MultiEdit; "
+        f"got matcher {each_registration['matcher']!r}"
+    )
+    assert command_parts[0] == "python3"
+    dispatcher_script_path = Path(
+        command_parts[-1].replace(
+            "${CLAUDE_PLUGIN_ROOT}", str(CLAUDE_DEV_ENV_DIRECTORY)
+        )
+    )
+    assert dispatcher_script_path.resolve() == DISPATCHER_SCRIPT_PATH.resolve()
+    registered_timeout_seconds = each_hook["timeout"]
+    assert isinstance(registered_timeout_seconds, int)
+    return (
+        [sys.executable, str(dispatcher_script_path)],
+        registered_timeout_seconds,
+    )
+
+
+def _build_file_tool_input(
+    tool_name: str, file_path: Path, replacement_content: str
+) -> dict[str, str | list[dict[str, str]]]:
+    file_path_text = str(file_path)
+    if tool_name == EDIT_TOOL_NAME:
+        return {
+            "file_path": file_path_text,
+            "old_string": "API_TOKEN=old-token\n",
+            "new_string": replacement_content,
+        }
+    if tool_name == MULTI_EDIT_TOOL_NAME:
+        return {
+            "file_path": file_path_text,
+            "edits": [
+                {
+                    "old_string": "API_TOKEN=old-token\n",
+                    "new_string": replacement_content,
+                }
+            ],
+        }
+    return {"file_path": file_path_text, "content": replacement_content}
+
+
+def _run_hook(
+    tool_name: str, file_path: Path, replacement_content: str
+) -> subprocess.CompletedProcess:
     payload = json.dumps(
         {
             "tool_name": tool_name,
-            "tool_input": {"file_path": str(file_path), "content": content},
+            "tool_input": _build_file_tool_input(
+                tool_name, file_path, replacement_content
+            ),
         }
     )
     return _run_hook_with_stdin(payload)
@@ -82,6 +161,22 @@ def _run_hook_with_stdin(stdin_text: str) -> subprocess.CompletedProcess:
         capture_output=True,
         text=True,
         check=False,
+        timeout=DIRECT_HOOK_TIMEOUT_SECONDS,
+    )
+
+
+def _run_dispatcher(
+    tool_name: str, tool_input: dict[str, str | list[dict[str, str]]]
+) -> subprocess.CompletedProcess[str]:
+    payload = json.dumps({"tool_name": tool_name, "tool_input": tool_input})
+    dispatcher_command, dispatcher_timeout_seconds = _registered_dispatcher_details()
+    return subprocess.run(
+        dispatcher_command,
+        input=payload,
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=dispatcher_timeout_seconds,
     )
 
 
@@ -153,6 +248,51 @@ def test_edit_to_a_secrets_file_is_denied(tmp_path: Path) -> None:
     assert _permission_decision(completed) == DENY_DECISION
 
 
+def test_multi_edit_to_a_secrets_file_is_denied(tmp_path: Path) -> None:
+    completed = _run_hook(
+        MULTI_EDIT_TOOL_NAME, tmp_path / ".env", PLACEHOLDER_TEMPLATE_BODY
+    )
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION
+
+
+def test_hooks_json_registers_exact_dispatcher_matcher_and_timeout() -> None:
+    dispatcher_command, dispatcher_timeout_seconds = _registered_dispatcher_details()
+    assert dispatcher_command[1] == str(DISPATCHER_SCRIPT_PATH)
+    assert dispatcher_timeout_seconds == 60
+
+
+@pytest.mark.parametrize(
+    ("tool_name", "target_filename", "expected_permission_decision"),
+    [
+        pytest.param(WRITE_TOOL_NAME, ".env", DENY_DECISION, id="write-secret-denied"),
+        pytest.param(EDIT_TOOL_NAME, ".env", DENY_DECISION, id="edit-secret-denied"),
+        pytest.param(
+            MULTI_EDIT_TOOL_NAME, ".env", DENY_DECISION, id="multi-edit-secret-denied"
+        ),
+        pytest.param(WRITE_TOOL_NAME, ".env.example", None, id="write-template-allowed"),
+        pytest.param(EDIT_TOOL_NAME, ".env.example", None, id="edit-template-allowed"),
+    ],
+)
+def test_dispatcher_applies_sensitive_filename_contract(
+    tmp_path: Path,
+    tool_name: str,
+    target_filename: str,
+    expected_permission_decision: str | None,
+) -> None:
+    completed = _run_dispatcher(
+        tool_name,
+        _build_file_tool_input(
+            tool_name, tmp_path / target_filename, PLACEHOLDER_TEMPLATE_BODY
+        ),
+    )
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == expected_permission_decision, (
+        f"{tool_name} to {target_filename} expected "
+        f"{expected_permission_decision!r}, got stdout {completed.stdout!r}"
+    )
+
+
 def test_read_tool_is_not_evaluated(tmp_path: Path) -> None:
     completed = _run_hook(READ_TOOL_NAME, tmp_path / ".env", PLACEHOLDER_TEMPLATE_BODY)
     assert completed.returncode == 0, completed.stderr

package/hooks/blocking/test_session_edit_stage_gate_staging.py

@@ -0,0 +1,64 @@
+"""Production-path staging tests for the session-edit stage gate."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_TEST_DIRECTORY = Path(__file__).resolve().parent
+if str(_TEST_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_TEST_DIRECTORY))
+
+from test_session_edit_stage_gate_support import (  # noqa: E402
+    make_test_directories,
+    parse_dispatcher_decision,
+    prepare_repository_with_unstaged_edit,
+    run_bash_dispatcher,
+    run_tracker_event,
+    read_tracker_paths,
+)
+
+SESSION_ID = "staging-production-session"
+
+
+def test_dispatcher_denies_tracker_recorded_unstaged_edit(tmp_path: Path) -> None:
+    """The Bash dispatcher denies a commit for a tracker-recorded edit."""
+    repository_root, temp_directory, home_directory = make_test_directories(tmp_path)
+    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
+    tracker_run = run_tracker_event(
+        tracked_file, SESSION_ID, repository_root, temp_directory, home_directory
+    )
+    assert tracker_run.returncode == 0
+    assert read_tracker_paths(temp_directory, SESSION_ID) == [str(tracked_file.resolve())]
+
+    dispatcher_run = run_bash_dispatcher(
+        "git commit -m update",
+        SESSION_ID,
+        repository_root,
+        temp_directory,
+        home_directory,
+    )
+    assert dispatcher_run.returncode == 0
+    decision, reason = parse_dispatcher_decision(dispatcher_run.stdout)
+    assert decision == "deny"
+    assert "widget.py" in reason
+
+
+def test_dispatcher_allows_specific_staging_segment(tmp_path: Path) -> None:
+    """The Bash dispatcher accepts a commit preceded by a specific git add."""
+    repository_root, temp_directory, home_directory = make_test_directories(tmp_path)
+    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
+    tracker_run = run_tracker_event(
+        tracked_file, SESSION_ID, repository_root, temp_directory, home_directory
+    )
+    assert tracker_run.returncode == 0
+
+    dispatcher_run = run_bash_dispatcher(
+        "git add widget.py && git commit -m update",
+        SESSION_ID,
+        repository_root,
+        temp_directory,
+        home_directory,
+    )
+    assert dispatcher_run.returncode == 0
+    assert parse_dispatcher_decision(dispatcher_run.stdout) == ("", "")