claude-dev-env 2.18.0 → 2.20.0

package/hooks/blocking/test_code_rules_enforcer_banned_noun_word.py

@@ -107,6 +107,60 @@ def test_should_not_flag_exact_match_banned_identifier() -> None:
     assert issues == []
 
 
+def test_should_allow_annotated_public_definition_name_and_parameters() -> None:
+    source = (
+        "def validate_nine_patch_output_path(output_path: str) -> str:  # pragma: no-banned-noun\n"
+        "    local_output_path = output_path\n"
+        "    return local_output_path\n"
+    )
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("local_output_path" in each_issue for each_issue in issues)
+    assert not any(
+        "Identifier 'validate_nine_patch_output_path'" in each_issue
+        or "Identifier 'output_path'" in each_issue
+        for each_issue in issues
+    )
+
+
+def test_enforcer_keeps_annotation_scope_on_definition_signature() -> None:
+    source = (
+        "def validate_nine_patch_output_path(output_path: str) -> str:  # pragma: no-banned-noun\n"
+        "    local_output_path = output_path\n"
+        "    return local_output_path\n"
+    )
+    issues = validate_content(source, PRODUCTION_FILE_PATH)
+    assert any("Identifier 'local_output_path'" in each_issue for each_issue in issues)
+    assert not any(
+        "Identifier 'validate_nine_patch_output_path'" in each_issue
+        or "Identifier 'output_path'" in each_issue
+        for each_issue in issues
+    )
+
+
+def test_should_keep_annotation_scoped_to_other_definitions_and_near_matches() -> None:
+    source = (
+        "def validate_nine_patch_output_paths(output_path: str) -> str:\n"
+        "    return output_path\n"
+        "def other_handler(other_output_path: str) -> str:\n"
+        "    return other_output_path\n"
+    )
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any(
+        "validate_nine_patch_output_paths" in each_issue for each_issue in issues
+    )
+    assert any("other_output_path" in each_issue for each_issue in issues)
+
+
+def test_should_require_the_exact_compatibility_annotation() -> None:
+    source = (
+        "def validate_nine_patch_output_path(output_path: str) -> str:  # pragma: no-banned-nouns\n"
+        "    return output_path\n"
+    )
+    issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)
+    assert any("validate_nine_patch_output_path" in each_issue for each_issue in issues)
+    assert any("output_path" in each_issue for each_issue in issues)
+
+
 def test_should_not_flag_dunder_method_with_banned_word() -> None:
     source = "class Foo:\n    def __init_data__(self) -> None: pass\n"
     issues = check_banned_noun_word_boundary(source, PRODUCTION_FILE_PATH)

package/hooks/blocking/test_code_rules_enforcer_duplicate_body_hook_routing.py

@@ -14,15 +14,12 @@ target path the same way it would for the real directory.
 
 from __future__ import annotations
 
-import io
 import json
 import pathlib
 import shutil
-import subprocess
 import sys
 import tempfile
 from collections.abc import Iterator
-from types import SimpleNamespace
 
 import pytest
 
@@ -34,10 +31,10 @@ if str(_HOOKS_PARENT) not in sys.path:
     sys.path.insert(0, str(_HOOKS_PARENT))
 
 from code_rules_enforcer import main  # noqa: E402
-
-code_rules_enforcer = SimpleNamespace(main=main, sys=sys)
-
-_ENFORCER_SCRIPT_PATH = _HOOK_DIRECTORY / "code_rules_enforcer.py"
+from code_rules_enforcer_test_support import (  # noqa: E402
+    run_precheck,
+    run_write_entrypoint,
+)
 
 SHARED_HELPER_SOURCE = (
     "import re\n"
@@ -66,38 +63,18 @@ def hook_blocking_dir() -> Iterator[pathlib.Path]:
 def _run_main_with_write_payload(
     file_path: str,
     content: str,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> str:
-    """Drive ``main()`` through its stdin entry point for a Write and return stdout.
-
-    Args:
-        file_path: The on-disk path the Write targets.
-        content: The whole-file body the Write would create.
-        monkeypatch: The fixture used to redirect ``sys.stdin``.
-        capsys: The fixture used to capture the deny payload on stdout.
-
-    Returns:
-        The captured stdout, which holds the deny payload when violations fire.
-    """
-    write_payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": file_path, "content": content},
-        }
+    """Drive ``main()`` through its stdin entry point for a Write."""
+    captured_stdout, _exit_code = run_write_entrypoint(
+        main,
+        file_path,
+        content,
     )
-    monkeypatch.setattr(code_rules_enforcer.sys, "stdin", io.StringIO(write_payload))
-    try:
-        code_rules_enforcer.main([])
-    except SystemExit:
-        pass
-    return capsys.readouterr().out
+    return captured_stdout
 
 
 def test_write_of_copied_helper_into_hook_directory_denies(
     hook_blocking_dir: pathlib.Path,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """A Write that copies a sibling helper into a second hook file is denied.
 
@@ -106,7 +83,7 @@ def test_write_of_copied_helper_into_hook_directory_denies(
     directory its module docstring names as the primary target."""
     (hook_blocking_dir / "existing_blocker.py").write_text(SHARED_HELPER_SOURCE, encoding="utf-8")
     new_file = hook_blocking_dir / "new_blocker.py"
-    stdout = _run_main_with_write_payload(str(new_file), SHARED_HELPER_SOURCE, monkeypatch, capsys)
+    stdout = _run_main_with_write_payload(str(new_file), SHARED_HELPER_SOURCE)
     assert stdout != "", (
         "A copied helper written into a second hook-infrastructure file must "
         "produce a deny payload, got empty stdout"
@@ -122,8 +99,6 @@ def test_write_of_copied_helper_into_hook_directory_denies(
 
 def test_write_of_unique_helper_into_hook_directory_allows(
     hook_blocking_dir: pathlib.Path,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """A Write of a hook file with no sibling duplicate produces no deny payload.
 
@@ -137,13 +112,13 @@ def test_write_of_unique_helper_into_hook_directory_allows(
         "    return widened\n"
     )
     new_file = hook_blocking_dir / "unique_blocker.py"
-    stdout = _run_main_with_write_payload(str(new_file), unique_helper_source, monkeypatch, capsys)
+    stdout = _run_main_with_write_payload(str(new_file), unique_helper_source)
     assert stdout == "", f"a unique hook helper must not be denied, got stdout: {stdout!r}"
 
 
 def test_precheck_of_copied_helper_at_hook_target_exits_nonzero(
     hook_blocking_dir: pathlib.Path,
-    tmp_path_factory: pytest.TempPathFactory,
+    tmp_path: pathlib.Path,
 ) -> None:
     """The pre-check CLI flags a copied helper judged at a hook-infrastructure target.
 
@@ -151,24 +126,11 @@ def test_precheck_of_copied_helper_at_hook_target_exits_nonzero(
     routes a hook ``.py`` target through the duplicate-body check rather than
     exiting clean on the blanket hook-infrastructure exemption."""
     (hook_blocking_dir / "existing_blocker.py").write_text(SHARED_HELPER_SOURCE, encoding="utf-8")
-    staging_directory = tmp_path_factory.mktemp("staging")
+    staging_directory = tmp_path
     candidate_file = staging_directory / "candidate.py"
     candidate_file.write_text(SHARED_HELPER_SOURCE, encoding="utf-8")
     target_path = str(hook_blocking_dir / "new_blocker.py")
-    completed = subprocess.run(
-        [
-            sys.executable,
-            str(_ENFORCER_SCRIPT_PATH),
-            "--check",
-            str(candidate_file),
-            "--as",
-            target_path,
-        ],
-        input="",
-        capture_output=True,
-        text=True,
-        check=False,
-    )
+    completed = run_precheck(candidate_file, target_path, None)
     assert completed.returncode == 1, (
         "a copied helper at a hook target must exit nonzero, got: "
         f"{completed.returncode}, stdout: {completed.stdout!r}, "

package/hooks/blocking/test_code_rules_enforcer_ephemeral.py

@@ -2,14 +2,11 @@
 
 from __future__ import annotations
 
-import io
 import json
-import os
 import subprocess
 import sys
 import tempfile
 from pathlib import Path
-from types import SimpleNamespace
 
 import pytest
 
@@ -22,70 +19,40 @@ if _HOOKS_DIRECTORY not in sys.path:
 
 from code_rules_enforcer import main as enforcer_main  # noqa: E402
 from code_rules_shared import is_ephemeral_script_path  # noqa: E402
+from code_rules_enforcer_test_support import (  # noqa: E402
+    build_write_payload,
+    run_enforcer_cli,
+    run_write_entrypoint,
+)
 
 _ENFORCER_SCRIPT = Path(__file__).resolve().parent / "code_rules_enforcer.py"
 _TDD_SCRIPT = Path(__file__).resolve().parent / "tdd_enforcer.py"
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
 
-code_rules_enforcer_module = SimpleNamespace(main=enforcer_main, sys=sys)
-
 
 def _run_enforcer_cli(
     all_cli_arguments: list[str],
-    extra_env: dict[str, str],
+    extra_environment_by_name: dict[str, str] | None = None,
 ) -> subprocess.CompletedProcess[str]:
     """Drive the enforcer script through its real argv entry point.
 
     Args:
         all_cli_arguments: The argument vector appended after the script path.
-        extra_env: Additional environment variables merged into the subprocess env.
+        extra_environment_by_name: Additional environment variables merged into the subprocess environment.
 
     Returns:
         The completed process carrying stdout, stderr, and the exit code.
     """
-    subprocess_env = {**os.environ, **extra_env}
-    return subprocess.run(
-        [sys.executable, str(_ENFORCER_SCRIPT), *all_cli_arguments],
-        input="",
-        capture_output=True,
-        text=True,
-        check=False,
-        env=subprocess_env,
-    )
+    return run_enforcer_cli(_ENFORCER_SCRIPT, all_cli_arguments, extra_environment_by_name)
 
 
 def _run_main_with_write_payload(
     file_path: str,
     content: str,
-    monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> tuple[str, int]:
-    """Drive enforcer_main through its stdin entry point for a Write payload.
-
-    Args:
-        file_path: The destination path the Write targets.
-        content: The content of the Write.
-        monkeypatch: The pytest fixture used to redirect sys.stdin.
-        capsys: The pytest fixture used to capture the deny payload on stdout.
-
-    Returns:
-        A tuple of (captured_stdout, exit_code).
-    """
-    write_payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": file_path, "content": content},
-        }
-    )
-    monkeypatch.setattr(code_rules_enforcer_module.sys, "stdin", io.StringIO(write_payload))
-    exit_code = 0
-    try:
-        code_rules_enforcer_module.main([])
-    except SystemExit as each_exit:
-        exit_code = int(each_exit.code or 0)
-    captured = capsys.readouterr()
-    return captured.out, exit_code
+    """Drive enforcer_main through its stdin entry point for a Write payload."""
+    return run_write_entrypoint(enforcer_main, file_path, content)
 
 
 def _run_tdd_with_write_payload(
@@ -101,18 +68,12 @@ def _run_tdd_with_write_payload(
     Returns:
         The completed process carrying stdout, stderr, and the exit code.
     """
-    write_payload = json.dumps(
-        {
-            "tool_name": "Write",
-            "tool_input": {"file_path": file_path, "content": content},
-        }
-    )
+    write_payload = build_write_payload(file_path, content)
     return subprocess.run(
         [sys.executable, str(_TDD_SCRIPT)],
         input=write_payload,
         capture_output=True,
         text=True,
-        check=False,
     )
 
 
@@ -279,7 +240,6 @@ def test_should_return_false_for_empty_path() -> None:
 def test_should_exit_zero_for_ephemeral_pretooluse_target(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """B11: enforcer main exits 0 with no deny payload for an ephemeral file_path."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
@@ -287,8 +247,6 @@ def test_should_exit_zero_for_ephemeral_pretooluse_target(
     captured_stdout, exit_code = _run_main_with_write_payload(
         ephemeral_path,
         _VIOLATING_PRODUCTION_SOURCE,
-        monkeypatch,
-        capsys,
     )
     assert exit_code == 0
     assert "deny" not in captured_stdout.lower()
@@ -297,7 +255,6 @@ def test_should_exit_zero_for_ephemeral_pretooluse_target(
 def test_should_exit_zero_for_ephemeral_path_with_hooks_substring(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """B12: an ephemeral path carrying /hooks/ exits 0 (hook-infra route short-circuited)."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
@@ -305,8 +262,6 @@ def test_should_exit_zero_for_ephemeral_path_with_hooks_substring(
     captured_stdout, exit_code = _run_main_with_write_payload(
         ephemeral_hooks_path,
         _VIOLATING_PRODUCTION_SOURCE,
-        monkeypatch,
-        capsys,
     )
     assert exit_code == 0
     assert "deny" not in captured_stdout.lower()
@@ -319,7 +274,7 @@ def test_should_return_zero_from_precheck_for_ephemeral_target(
     candidate_file = tmp_path / "candidate.py"
     candidate_file.write_text(_VIOLATING_PRODUCTION_SOURCE, encoding="utf-8")
     ephemeral_target = "/tmp/target.py"
-    completed = _run_enforcer_cli(["--check", str(candidate_file), "--as", ephemeral_target], extra_env={})
+    completed = _run_enforcer_cli(["--check", str(candidate_file), "--as", ephemeral_target])
     assert completed.returncode == 0
 
 
@@ -332,7 +287,6 @@ def test_should_run_full_suite_for_non_ephemeral_target(
     non_ephemeral_target = "/repo/src/orders.py"
     completed = _run_enforcer_cli(
         ["--check", str(candidate_file), "--as", non_ephemeral_target],
-        extra_env={},
     )
     assert completed.returncode == 1
 
@@ -346,7 +300,7 @@ def test_should_run_full_suite_when_override_truthy(
     ephemeral_target = "/tmp/scratch.py"
     completed = _run_enforcer_cli(
         ["--check", str(candidate_file), "--as", ephemeral_target],
-        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+        extra_environment_by_name={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
     )
     assert completed.returncode == 1
 
@@ -354,7 +308,6 @@ def test_should_run_full_suite_when_override_truthy(
 def test_should_exempt_same_path_set_on_both_gates(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
-    capsys: pytest.CaptureFixture[str],
 ) -> None:
     """B21: every ephemeral path exits 0 on both enforcer main and TDD enforcer main."""
     monkeypatch.setenv("CLAUDE_JOB_DIR", str(tmp_path))
@@ -367,8 +320,6 @@ def test_should_exempt_same_path_set_on_both_gates(
         captured_stdout, exit_code = _run_main_with_write_payload(
             each_ephemeral_path,
             _VIOLATING_PRODUCTION_SOURCE,
-            monkeypatch,
-            capsys,
         )
         assert exit_code == 0, (
             f"enforcer must exit 0 for ephemeral path {each_ephemeral_path!r}, "

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -0,0 +1,309 @@
+"""Test narrow Edit classification and required rule selection."""
+
+from __future__ import annotations
+
+import ast
+import io
+import inspect
+import json
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+import pytest
+_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
+_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
+if _BLOCKING_DIRECTORY not in sys.path:
+    sys.path.insert(0, _BLOCKING_DIRECTORY)
+if _HOOKS_DIRECTORY not in sys.path:
+    sys.path.insert(0, _HOOKS_DIRECTORY)
+
+from code_rules_enforcer import (  # noqa: E402
+    main,
+    validate_content,
+)
+
+
+PRODUCTION_FILE_PATH = "packages/app/services.py"
+
+
+@dataclass(frozen=True)
+class NarrowEditFixture:
+    """One accepted Edit family with a clean prior fragment and a violation."""
+
+    old_fragment: str
+    new_fragment: str
+    expected_marker: str
+    rule_name: str
+
+ALL_SCOPE_AWARE_RULE_NAMES = frozenset(
+    {
+        "check_blast_radius_declared",
+        "check_import_block_sorted",
+        "check_magic_values",
+        "check_duplicate_function_body_across_files",
+        "check_same_file_inline_duplicate_body",
+        "check_banned_identifiers",
+        "check_banned_noun_word_boundary",
+        "check_docstring_runon_sentence",
+        "check_docstring_prose_wall_without_illustration",
+        "check_boolean_naming",
+        "check_ignored_must_check_return",
+        "check_tests_use_isolated_filesystem_paths",
+        "check_return_annotations",
+        "check_function_length",
+        "check_public_function_missing_paired_test",
+        "check_join_separator_string_magic",
+        "check_string_literal_magic",
+        "check_js_boolean_naming",
+        "check_js_banned_identifiers",
+        "check_js_bare_flag_return_directive",
+    }
+)
+
+
+SCOPE_AWARE_RULE_NAMES = ALL_SCOPE_AWARE_RULE_NAMES
+NARROW_EDIT_ACCEPTED_RULE_NAMES = frozenset(
+    {
+        "check_string_literal_magic",
+        "check_join_separator_string_magic",
+        "check_banned_noun_word_boundary",
+        "check_boolean_naming",
+        "check_ignored_must_check_return",
+    }
+)
+
+
+EXPECTED_RULE_TEXT_BY_NAME = {
+    "check_string_literal_magic": "string magic value",
+    "check_join_separator_string_magic": "string separator",
+    "check_banned_noun_word_boundary": "Identifier",
+    "check_boolean_naming": "Boolean",
+    "check_ignored_must_check_return": "return value",
+}
+
+
+ALL_REQUIRED_RULE_FIXTURES = (
+    NarrowEditFixture(
+        old_fragment=(
+            "import os\n\n"
+            "def fetch_secret() -> str:\n"
+            "    return os.environ.get('missing', '')\n"
+        ),
+        new_fragment=(
+            "import os\n\n"
+            "def fetch_secret() -> str:\n"
+            "    return os.environ['STRIPE_SECRET']\n"
+        ),
+        expected_marker="STRIPE_SECRET",
+        rule_name="check_string_literal_magic",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def render_paths(all_paths: list[str]) -> str:\n"
+            "    return JOIN_DELIMITER.join(all_paths)\n"
+        ),
+        new_fragment=(
+            "def render_paths(all_paths: list[str]) -> str:\n"
+            "    return ', '.join(all_paths)\n"
+        ),
+        expected_marker="join",
+        rule_name="check_join_separator_string_magic",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def read_count() -> int:\n"
+            "    clean_count = 0\n"
+            "    return clean_count\n"
+        ),
+        new_fragment=(
+            "def read_count() -> int:\n"
+            "    result_count = 0\n"
+            "    return result_count\n"
+        ),
+        expected_marker="result_count",
+        rule_name="check_banned_noun_word_boundary",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def check_ready() -> bool:\n"
+            "    is_ready = True\n"
+            "    return is_ready\n"
+        ),
+        new_fragment=(
+            "def check_ready() -> bool:\n"
+            "    ready = True\n"
+            "    return ready\n"
+        ),
+        expected_marker="ready",
+        rule_name="check_boolean_naming",
+    ),
+    NarrowEditFixture(
+        old_fragment=(
+            "def submit_form() -> None:\n"
+            "    if find_and_click('#submit'):\n"
+            "        return\n"
+        ),
+        new_fragment=(
+            "def submit_form() -> None:\n"
+            "    find_and_click('#submit')\n"
+        ),
+        expected_marker="find_and_click",
+        rule_name="check_ignored_must_check_return",
+    ),
+)
+
+
+def _validate_narrow_edit(narrow_edit_fixture: NarrowEditFixture) -> list[str]:
+    prior_full_file = narrow_edit_fixture.old_fragment
+    post_edit_full_file = narrow_edit_fixture.new_fragment
+    return validate_content(
+        narrow_edit_fixture.new_fragment,
+        PRODUCTION_FILE_PATH,
+        old_content=narrow_edit_fixture.old_fragment,
+        full_file_content=post_edit_full_file,
+        prior_full_file_content=prior_full_file,
+    )
+
+
+def _scope_aware_rule_names_from_source() -> frozenset[str]:
+    source_tree = ast.parse(inspect.getsource(validate_content))
+    all_rule_names: set[str] = set()
+    for each_call in ast.walk(source_tree):
+        if not isinstance(each_call, ast.Call):
+            continue
+        if not isinstance(each_call.func, ast.Name):
+            continue
+        if each_call.func.id == "_fragment_or_deferred_check":
+            all_argument_names = {
+                each_name.id
+                for each_argument in each_call.args[1:]
+                for each_name in ast.walk(each_argument)
+                if isinstance(each_name, ast.Name)
+            }
+            if (
+                "defer_scope_to_caller" in all_argument_names
+                and each_call.args
+                and isinstance(each_call.args[0], ast.Name)
+            ):
+                all_rule_names.add(each_call.args[0].id)
+            continue
+        if not each_call.func.id.startswith("check_"):
+            continue
+        all_argument_names = {
+            each_name.id
+            for each_argument in each_call.args
+            for each_name in ast.walk(each_argument)
+            if isinstance(each_name, ast.Name)
+        }
+        all_argument_names.update(
+            each_name.id
+            for each_keyword in each_call.keywords
+            for each_name in ast.walk(each_keyword.value)
+            if isinstance(each_name, ast.Name)
+        )
+        if (
+            "all_changed_lines" in all_argument_names
+            or "defer_scope_to_caller" in all_argument_names
+        ):
+            all_rule_names.add(each_call.func.id)
+    return frozenset(all_rule_names)
+
+
+@pytest.mark.parametrize("narrow_edit_fixture", ALL_REQUIRED_RULE_FIXTURES)
+def test_narrow_edit_selects_each_accepted_rule(
+    narrow_edit_fixture: NarrowEditFixture,
+) -> None:
+    all_issues = _validate_narrow_edit(narrow_edit_fixture)
+    expected_rule_text = EXPECTED_RULE_TEXT_BY_NAME[narrow_edit_fixture.rule_name]
+
+    assert any(
+        narrow_edit_fixture.expected_marker in each_issue
+        and expected_rule_text in each_issue
+        for each_issue in all_issues
+    ), (
+        "the changed fragment must select its checker and report its diagnostic marker "
+        f"{narrow_edit_fixture.expected_marker!r}, got {all_issues!r}"
+    )
+
+
+def test_scope_aware_inventory_matches_enforcer_dispatch() -> None:
+    assert _scope_aware_rule_names_from_source() == ALL_SCOPE_AWARE_RULE_NAMES
+def test_narrow_edit_acceptance_set_is_source_backed_and_complete() -> None:
+    all_fixture_rule_names = {
+        each_fixture.rule_name for each_fixture in ALL_REQUIRED_RULE_FIXTURES
+    }
+
+    assert all_fixture_rule_names == NARROW_EDIT_ACCEPTED_RULE_NAMES
+    assert NARROW_EDIT_ACCEPTED_RULE_NAMES <= ALL_SCOPE_AWARE_RULE_NAMES
+
+def test_narrow_edit_drops_an_untouched_banned_noun() -> None:
+    untouched_source = "OLD_RESULT_PATH = 0\n"
+    old_fragment = "PLACEHOLDER_NAME = 0\n"
+    new_fragment = "NEW_RESULT_PATH = 0\n"
+    issues = validate_content(
+        new_fragment,
+        PRODUCTION_FILE_PATH,
+        old_content=old_fragment,
+        full_file_content=untouched_source + new_fragment,
+        prior_full_file_content=untouched_source + old_fragment,
+    )
+
+    assert any("NEW_RESULT_PATH" in each_issue for each_issue in issues)
+    assert not any("OLD_RESULT_PATH" in each_issue for each_issue in issues)
+
+
+def test_narrow_edit_skips_python_rules_for_a_non_python_target() -> None:
+    source = "def process_data() -> None:\n    print('payload')\n"
+
+    issues = validate_content(source, "packages/app/services.txt", old_content="")
+
+    assert issues == []
+def _run_edit_stage(
+    file_path: Path,
+    old_fragment: str,
+    new_fragment: str,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> str:
+    payload = json.dumps(
+        {
+            "tool_name": "Edit",
+            "tool_input": {
+                "file_path": str(file_path),
+                "old_string": old_fragment,
+                "new_string": new_fragment,
+            },
+        }
+    )
+    monkeypatch.setattr(sys, "stdin", io.StringIO(payload))
+    try:
+        main([])
+    except SystemExit:
+        pass
+    return capsys.readouterr().out
+
+
+def test_edit_entrypoint_reports_an_accepted_rule_for_the_changed_fragment(
+    tmp_path_factory: pytest.TempPathFactory,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    staging_directory = tmp_path_factory.mktemp("narrow_edit")
+    source_file = staging_directory / "service.py"
+    old_fragment = "def read_count() -> int:\n    clean_count = 0\n    return clean_count\n"
+    new_fragment = "def read_count() -> int:\n    result_count = 0\n    return result_count\n"
+    source_file.write_text(old_fragment, encoding="utf-8")
+
+    captured_stdout = _run_edit_stage(
+        source_file,
+        old_fragment,
+        new_fragment,
+        monkeypatch,
+        capsys,
+    )
+
+    deny_payload = json.loads(captured_stdout)
+    deny_reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "result_count" in deny_reason