claude-dev-env 2.19.0 → 2.21.0

package/hooks/advisory/test_refactor_guard_eligibility.py

@@ -0,0 +1,166 @@
+"""Tests for refactor candidate eligibility against a temporary Git repository."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+ADVISORY_DIRECTORY = Path(__file__).resolve().parent
+if str(ADVISORY_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(ADVISORY_DIRECTORY))
+
+import refactor_guard  # noqa: E402
+from refactor_guard_test_support import commit_file, stage_file  # noqa: E402
+
+
+def test_refactor_candidate_is_eligible_when_old_lines_are_outside_changed_surface(
+    git_repository: Path,
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    stage_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount + 1\n",
+    )
+
+    old_function = "def calculate_total(amount: int) -> int:\n    return amount"
+    renamed_function = "def compute_total(amount: int) -> int:\n    return amount"
+
+    assert refactor_guard.is_refactor_eligible(str(source_path), old_function, renamed_function)
+
+
+def test_refactor_candidate_is_ineligible_when_old_lines_are_in_changed_surface(
+    git_repository: Path,
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "pass\n")
+    old_function = "def calculate_total(amount: int) -> int:\n    return amount"
+    stage_file(git_repository, source_path, f"{old_function}\n")
+    renamed_function = "def compute_total(amount: int) -> int:\n    return amount"
+
+    assert not refactor_guard.is_refactor_eligible(str(source_path), old_function, renamed_function)
+
+
+def test_changed_surface_reads_staged_and_unstaged_lines(
+    git_repository: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "baseline = 1\n")
+
+    stage_file(git_repository, source_path, "staged_line = 1\n")
+    source_path.write_text("unstaged_line = 1\n", encoding="utf-8")
+
+    monkeypatch.setenv("GIT_DIR", str(git_repository / "missing-git-dir"))
+    monkeypatch.setenv("GIT_WORK_TREE", str(git_repository / "missing-work-tree"))
+    monkeypatch.setenv("GIT_INDEX_FILE", str(git_repository / "missing-index"))
+    monkeypatch.setenv("GIT_COMMON_DIR", str(git_repository / "missing-common-dir"))
+    monkeypatch.setenv("GIT_PREFIX", "adversarial-prefix")
+    scrubbed_environment = refactor_guard._git_environment()
+    assert not any(each_name.startswith("GIT_") for each_name in scrubbed_environment)
+    all_added_lines = refactor_guard.get_git_diff_added_lines(str(source_path))
+
+    assert all_added_lines == {"staged_line = 1", "unstaged_line = 1"}
+
+
+def test_duplicate_old_lines_require_duplicate_changed_occurrences(
+    git_repository: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "pass\n")
+    old_function = "def calculate_total(amount: int) -> int:\n    return amount\n    return amount"
+    stage_file(
+        git_repository,
+        source_path,
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+    )
+    renamed_function = old_function.replace("calculate_total", "compute_total")
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["def calculate_total(amount: int) -> int:", "    return amount"],
+    )
+
+    assert refactor_guard.is_refactor_edit(old_function, renamed_function)
+    assert not refactor_guard.is_edit_within_changed_surface(str(source_path), old_function)
+
+
+def test_ordinary_edit_is_not_a_refactor_candidate(git_repository: Path) -> None:
+    source_path = git_repository / "module.py"
+    commit_file(git_repository, source_path, "return_amount = 1\n")
+
+    assert not refactor_guard.is_refactor_eligible(
+        str(source_path), "return_amount = 1", "return_amount = 2"
+    )
+
+
+def test_new_file_is_not_a_refactor_candidate(git_repository: Path) -> None:
+    source_path = git_repository / "new_module.py"
+    source_path.write_text(
+        "def calculate_total(amount: int) -> int:\n    return amount\n",
+        encoding="utf-8",
+    )
+
+    assert refactor_guard.is_new_file(str(source_path))
+    assert not refactor_guard.is_refactor_eligible(
+        str(source_path),
+        "def calculate_total(amount: int) -> int:\n    return amount",
+        "def compute_total(amount: int) -> int:\n    return amount",
+    )
+
+
+def test_hook_infrastructure_is_not_a_refactor_candidate(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    hook_path = str(Path.home() / ".claude" / "settings.json")
+
+    assert refactor_guard.is_hook_infrastructure(hook_path)
+    assert not refactor_guard.is_refactor_eligible(
+        hook_path,
+        "def calculate_total(amount: int) -> int:\n    return amount",
+        "def compute_total(amount: int) -> int:\n    return amount",
+    )
+
+
+def test_changed_surface_below_half_is_false(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["changed line"],
+    )
+
+    assert not refactor_guard.is_edit_within_changed_surface(
+        "module.py", "changed line\noriginal line\noriginal line"
+    )
+
+
+def test_changed_surface_at_half_is_true(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["changed one", "changed two"],
+    )
+
+    assert refactor_guard.is_edit_within_changed_surface(
+        "module.py", "changed one\nchanged two\noriginal one\noriginal two"
+    )
+
+
+def test_changed_surface_above_half_is_true(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        refactor_guard,
+        "_get_added_line_occurrences",
+        lambda _file_path: ["changed one", "changed two", "changed three"],
+    )
+
+    assert refactor_guard.is_edit_within_changed_surface(
+        "module.py", "changed one\nchanged two\nchanged three\noriginal line"
+    )

package/hooks/blocking/block_main_commit.py

@@ -28,46 +28,73 @@ PROTECTED_BRANCHES = ("main", "master")
 PROTECTED_REMOTE_PATTERNS: list[str] = []
 
 
-def extract_git_working_directory(bash_command: str) -> str | None:
-    """Extract the directory where git commit will actually execute.
-
-    Parses the bash command for directory-changing patterns that precede
-    the git commit, and for git's own -C flag.
-
-    Returns None if the commit runs in the hook's CWD.
-    """
-    git_c_match = re.search(
-        r"git\s+-C\s+[\"']?([^\"';&|]+?)[\"']?\s+commit",
+def _match_git_c_commit(bash_command: str) -> re.Match[str] | None:
+    """Return the match for a Git commit with an explicit directory."""
+    return re.search(
+        r"(?:^|(?<=[;&|]))\s*git\s+-C\s+[\"']?([^\"';&|]+?)[\"']?\s+commit(?:\s|$)",
         bash_command,
+        flags=re.IGNORECASE,
     )
+
+
+def parse_git_commit_directory(bash_command: str) -> tuple[bool, str | None]:
+    """Return the Git commit match state and selected working directory."""
+    git_c_match = _match_git_c_commit(bash_command)
     if git_c_match:
-        return git_c_match.group(1).strip()
+        return True, git_c_match.group(1).strip()
 
-    commit_pos = bash_command.lower().find("git commit")
-    if commit_pos == -1:
-        return None
+    git_commit_match = re.search(
+        r"(?:^|(?<=[;&|]))\s*git\s+commit(?:\s|$)",
+        bash_command,
+        flags=re.IGNORECASE,
+    )
+    if git_commit_match is None:
+        return False, None
 
-    prefix = bash_command[:commit_pos]
+    prefix = bash_command[:git_commit_match.start()]
 
     cd_matches = re.findall(
         r"(?:cd|pushd)\s+[\"']?([^\"';&|]+?)[\"']?\s*[;&|]",
         prefix,
+        flags=re.IGNORECASE,
     )
     if cd_matches:
-        return cd_matches[-1].strip()
+        return True, cd_matches[-1].strip()
+
+    return True, None
+
+
+def extract_git_working_directory(bash_command: str) -> str | None:
+    """Return the working directory selected by a Git commit command."""
+    _, working_directory = parse_git_commit_directory(bash_command)
+    return working_directory
 
-    return None
+
+def is_commit_command(bash_command: str) -> bool:
+    """Return the Git commit match state for the shell command."""
+    is_commit, _ = parse_git_commit_directory(bash_command)
+    return is_commit
+
+
+def is_git_c_commit_command(bash_command: str) -> bool:
+    """Return whether the command names a Git commit target with ``-C``."""
+    return _match_git_c_commit(bash_command) is not None
 
 
-def resolve_directory(directory: str | None) -> str | None:
+def resolve_directory(
+    directory: str | None,
+    from_directory: str | None = None,
+) -> str | None:
     """Resolve a directory path, expanding ~ and validating existence."""
-    if directory is None:
+    selected_directory = directory if directory is not None else from_directory
+    if selected_directory is None:
         return None
 
-    expanded = os.path.expanduser(directory)
+    expanded = os.path.expanduser(selected_directory)
 
     if not os.path.isabs(expanded):
-        expanded = os.path.abspath(expanded)
+        base_directory = from_directory or os.getcwd()
+        expanded = os.path.abspath(os.path.join(base_directory, expanded))
 
     if os.path.isdir(expanded):
         return expanded
@@ -112,22 +139,25 @@ def is_protected_repo(working_dir: str | None = None) -> bool:
     return False
 
 
-def is_commit_command(bash_command: str) -> bool:
-    return "git commit" in bash_command.lower().strip()
-
-
 def is_main_commit_confirmed(bash_command: str) -> bool:
     """Return True if the command includes the explicit confirmation sentinel."""
     return "--allow-main-commit" in bash_command
 
 
-def parse_bash_command_from_stdin() -> str:
+def parse_hook_context_from_stdin() -> tuple[str, str | None]:
     try:
         hook_event = json.load(sys.stdin)
     except json.JSONDecodeError:
-        return ""
+        return "", None
+
+    bash_command = hook_event.get("tool_input", {}).get("command", "")
+    return bash_command, hook_event.get("cwd")
+
 
-    return hook_event.get("tool_input", {}).get("command", "")
+def parse_bash_command_from_stdin() -> str:
+    """Return the Bash command from the hook payload on standard input."""
+    bash_command, _ = parse_hook_context_from_stdin()
+    return bash_command
 
 
 DRAFT_PR_INSTRUCTION = (
@@ -156,18 +186,21 @@ def build_denial_response(branch_name: str, repo_dir: str | None) -> dict:
 
 
 def main() -> None:
-    bash_command = parse_bash_command_from_stdin()
+    bash_command, event_cwd = parse_hook_context_from_stdin()
+    has_commit_command, target_dir_raw = parse_git_commit_directory(bash_command)
 
-    if not is_commit_command(bash_command):
+    if not has_commit_command:
         sys.exit(0)
 
     if is_main_commit_confirmed(bash_command):
         sys.exit(0)
 
-    target_dir_raw = extract_git_working_directory(bash_command)
-    target_dir = resolve_directory(target_dir_raw)
+    if event_cwd is None and is_git_c_commit_command(bash_command):
+        sys.exit(0)
+
+    target_dir = resolve_directory(target_dir_raw, from_directory=event_cwd)
 
-    if target_dir_raw and not target_dir:
+    if (target_dir_raw or event_cwd) and not target_dir:
         sys.exit(0)
 
     current_branch = get_branch_at_directory(working_dir=target_dir)

package/hooks/blocking/code_rules_blast_radius.py

@@ -0,0 +1,194 @@
+"""Blast-radius check: a raise inside per-item work must name what it stops."""
+
+import ast
+import sys
+from collections.abc import Iterator
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+_hooks_directory = str(Path(__file__).resolve().parent.parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from code_rules_shared import (  # noqa: E402
+    is_hook_infrastructure,
+    is_test_file,
+)
+
+from hooks_constants.blast_radius_constants import (  # noqa: E402
+    ALL_BLAST_RADIUS_SUFFIXES,
+    BLAST_RADIUS_MESSAGE_SUFFIX,
+    MAX_BLAST_RADIUS_ISSUES,
+)
+
+
+def _raised_type_name(raise_node: ast.Raise) -> str | None:
+    """Return the name of the exception type a raise statement constructs.
+
+    Args:
+        raise_node: The raise statement to read.
+
+    Returns:
+        The exception type name. A ``None`` return classifies bare re-raises and
+        alternate AST forms.
+    """
+    raised = raise_node.exc
+    if raised is None:
+        return None
+    if isinstance(raised, ast.Call):
+        raised = raised.func
+    if isinstance(raised, ast.Name):
+        return raised.id
+    if isinstance(raised, ast.Attribute):
+        return raised.attr
+    return None
+
+
+def _declares_blast_radius(type_name: str) -> bool:
+    """Report whether an exception type name states what its failure stops.
+
+    Args:
+        type_name: The exception type name to inspect.
+
+    Returns:
+        ``True`` when the name ends in a recognized blast-radius suffix.
+    """
+    return any(type_name.endswith(each_suffix) for each_suffix in ALL_BLAST_RADIUS_SUFFIXES)
+
+
+def _handler_type_names(handler: ast.ExceptHandler) -> list[str]:
+    """Return named exception types caught by one except clause."""
+    caught = handler.type
+    if caught is None:
+        return []
+    all_caught = caught.elts if isinstance(caught, ast.Tuple) else [caught]
+    return [
+        each_caught.id
+        for each_caught in all_caught
+        if isinstance(each_caught, ast.Name)
+    ] + [
+        each_caught.attr
+        for each_caught in all_caught
+        if isinstance(each_caught, ast.Attribute)
+    ]
+
+
+def _handler_names_blast_radius_type(handler: ast.ExceptHandler) -> bool:
+    """Report whether an except clause catches a blast-radius-declaring type.
+
+    Args:
+        handler: The except clause to inspect.
+
+    Returns:
+        ``True`` when any caught type name carries a blast-radius suffix.
+    """
+    return any(_declares_blast_radius(each_name) for each_name in _handler_type_names(handler))
+
+
+def _handler_matches_raise(handler: ast.ExceptHandler, type_name: str | None) -> bool:
+    """Report whether a handler corresponds to the raise it encloses."""
+    all_handler_names = _handler_type_names(handler)
+    if type_name is None:
+        return _handler_names_blast_radius_type(handler)
+    return type_name in all_handler_names
+
+
+def _walk_loop_body(node: ast.AST) -> Iterator[ast.AST]:
+    """Walk loop statements without entering nested definition scopes."""
+    for each_child in ast.iter_child_nodes(node):
+        if isinstance(
+            each_child,
+            (ast.AsyncFunctionDef, ast.ClassDef, ast.FunctionDef, ast.Lambda),
+        ):
+            continue
+        yield each_child
+        yield from _walk_loop_body(each_child)
+
+
+def _boundary_guarded_raise_lines(tree: ast.Module) -> set[int]:
+    """Collect raise lines already sitting inside a blast-radius boundary.
+
+    Args:
+        tree: The parsed module to walk.
+
+    Returns:
+        The line numbers of raise statements enclosed by a try whose handlers
+        name a blast-radius-declaring type.
+    """
+    all_guarded: set[int] = set()
+    for each_node in ast.walk(tree):
+        if not isinstance(each_node, ast.Try):
+            continue
+        for each_body_node in each_node.body:
+            for each_inner in ast.walk(each_body_node):
+                if isinstance(each_inner, ast.Raise) and any(
+                    _handler_matches_raise(each_handler, _raised_type_name(each_inner))
+                    for each_handler in each_node.handlers
+                ):
+                    all_guarded.add(each_inner.lineno)
+    return all_guarded
+
+
+def _per_item_raise_nodes(tree: ast.Module) -> list[ast.Raise]:
+    """Collect raise statements that sit inside a loop body.
+
+    A raise reached through per-item iteration ends every remaining item by
+    default. A declared radius identifies the intended scope, so each raise
+    in this path benefits from an explicit name.
+
+    Args:
+        tree: The parsed module to walk.
+
+    Returns:
+        Every raise statement found under a for or while loop body.
+    """
+    all_raises: list[ast.Raise] = []
+    for each_node in ast.walk(tree):
+        if not isinstance(each_node, (ast.For, ast.AsyncFor, ast.While)):
+            continue
+        for each_inner in _walk_loop_body(each_node):
+            if isinstance(each_inner, ast.Raise):
+                all_raises.append(each_inner)
+    return all_raises
+
+
+def check_blast_radius_declared(content: str, file_path: str) -> list[str]:
+    """Check that raises inside per-item work name their stopping scope.
+
+    A raise reached through a loop body ends the whole batch by default, so a
+    one-item defect discards every item that already succeeded. Naming the type
+    ``*RunFatal`` or ``*ItemBlocked`` states the intent, and a boundary catching
+    a declared type already handles it.
+
+    Args:
+        content: The file body to inspect.
+        file_path: The path the body will be written to.
+
+    Returns:
+        One advisory line per raise that needs a declared blast radius, capped
+        at the configured maximum.
+    """
+    if is_test_file(file_path) or is_hook_infrastructure(file_path):
+        return []
+
+    try:
+        parsed_tree = ast.parse(content)
+    except SyntaxError:
+        return []
+
+    all_guarded_lines = _boundary_guarded_raise_lines(parsed_tree)
+    all_issues: list[str] = []
+    all_reported_lines: set[int] = set()
+    for each_raise in _per_item_raise_nodes(parsed_tree):
+        if each_raise.lineno in all_guarded_lines or each_raise.lineno in all_reported_lines:
+            continue
+        type_name = _raised_type_name(each_raise)
+        if type_name is None or _declares_blast_radius(type_name):
+            continue
+        all_reported_lines.add(each_raise.lineno)
+        all_issues.append(f"Line {each_raise.lineno}: {type_name} {BLAST_RADIUS_MESSAGE_SUFFIX}")
+        if len(all_issues) >= MAX_BLAST_RADIUS_ISSUES:
+            break
+    return all_issues

package/hooks/blocking/code_rules_enforcer.py

@@ -16,6 +16,7 @@ concern focused. The separate ``tdd_enforcer.py`` hook accepts any
 ``code_rules_*`` module family, so the suffix files satisfy its gate.
 """
 import json
+import os
 import sys
 from collections import Counter
 from collections.abc import Callable
@@ -29,6 +30,8 @@ if _BLOCKING_DIRECTORY not in sys.path:
 if _HOOKS_DIRECTORY not in sys.path:
     sys.path.insert(0, _HOOKS_DIRECTORY)
 
+_codex_apply_patch_tool_name = "apply_patch"
+
 from code_rules_annotations_length import (  # noqa: E402
     check_function_length,
     check_known_pytest_fixture_annotations,
@@ -41,6 +44,9 @@ from code_rules_banned_identifiers import (  # noqa: E402
     check_banned_noun_word_boundary,
     check_banned_prefixes,
 )
+from code_rules_blast_radius import (  # noqa: E402
+    check_blast_radius_declared,
+)
 from code_rules_boolean_mustcheck import (  # noqa: E402
     check_boolean_naming,
     check_ignored_must_check_return,
@@ -200,6 +206,11 @@ from code_rules_typeddict_stub import (  # noqa: E402
 from code_rules_unused_imports import (  # noqa: E402
     check_unused_module_level_imports,
 )
+from codex_apply_patch import (  # noqa: E402
+    CodexPatchError,
+    CodexPatchFile,
+    parse_codex_apply_patch,
+)
 
 from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     ALL_CODE_EXTENSIONS,
@@ -208,6 +219,7 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     DENY_REASON_ISSUE_PREVIEW_COUNT,
     PRECHECK_USAGE_EXIT_CODE,
     PRECHECK_USAGE_MESSAGE,
+    VIOLATION_SEPARATOR,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 from hooks_constants.setup_project_paths_constants import (  # noqa: E402
@@ -215,6 +227,76 @@ from hooks_constants.setup_project_paths_constants import (  # noqa: E402
 )
 
 
+def _codex_patch_issues(each_patch_file: CodexPatchFile) -> list[str]:
+    """Run the existing code-rules verdict over one Codex patch view."""
+    if not each_patch_file.post_content and each_patch_file.operation == "delete":
+        return []
+    if _is_hook_infrastructure_python_target(each_patch_file.file_path):
+        all_issues = _hook_infrastructure_blocking_issues(
+            each_patch_file.post_content,
+            each_patch_file.file_path,
+            each_patch_file.post_content,
+            each_patch_file.prior_content,
+        )
+    elif _is_validated_target(each_patch_file.file_path):
+        all_issues = validate_content(
+            each_patch_file.post_content,
+            each_patch_file.file_path,
+            each_patch_file.prior_content,
+            each_patch_file.post_content,
+            each_patch_file.prior_content,
+        )
+    else:
+        return []
+    return [
+        f"{each_patch_file.file_path}: {each_issue}"
+        for each_issue in all_issues
+    ]
+
+
+def _report_codex_patch_payload(
+    all_pretooluse_payload: dict[str, object], deny_stream: TextIO
+) -> None:
+    """Validate every file view carried by a Codex apply_patch payload."""
+    tool_input = all_pretooluse_payload.get("tool_input")
+    if not isinstance(tool_input, dict):
+        _write_deny_payload(
+            "BLOCKED: [CODE_RULES] apply_patch payload requires tool input",
+            deny_stream,
+        )
+        return
+    patch_command = tool_input.get("command")
+    if not isinstance(patch_command, str):
+        _write_deny_payload(
+            "BLOCKED: [CODE_RULES] apply_patch payload requires a string command",
+            deny_stream,
+        )
+        return
+    working_directory = all_pretooluse_payload.get("cwd")
+    if not isinstance(working_directory, str):
+        working_directory = os.getcwd()
+    try:
+        all_patch_files = parse_codex_apply_patch(patch_command, working_directory)
+    except CodexPatchError as error:
+        _write_deny_payload(
+            f"BLOCKED: [CODE_RULES] apply_patch payload requires accepted patch markers: {error}",
+            deny_stream,
+        )
+        return
+    all_issues = [
+        each_issue
+        for each_patch_file in all_patch_files
+        for each_issue in _codex_patch_issues(each_patch_file)
+    ]
+    if all_issues:
+        _write_deny_payload(
+            f"BLOCKED: [CODE_RULES] {len(all_issues)} violation(s): "
+            + VIOLATION_SEPARATOR.join(all_issues[:DENY_REASON_ISSUE_PREVIEW_COUNT])
+            + _precheck_hint(),
+            deny_stream,
+        )
+
+
 def validate_content(
     content: str,
     file_path: str,
@@ -295,6 +377,15 @@ def validate_content(
                 defer_scope_to_caller,
             )
         )
+        all_issues.extend(
+            _fragment_or_deferred_check(
+                check_blast_radius_declared,
+                old_content,
+                content,
+                file_path,
+                defer_scope_to_caller,
+            )
+        )
         all_issues.extend(check_fstring_structural_literals(content, file_path))
         all_issues.extend(check_constants_outside_config(content, file_path))
         all_issues.extend(check_config_duplicate_path_anchor(content, file_path))
@@ -1247,6 +1338,10 @@ def main(all_arguments: list[str]) -> None:
         sys.exit(0)
 
     tool_name = pretooluse_payload.get("tool_name", "")
+    if tool_name == _codex_apply_patch_tool_name:
+        _report_codex_patch_payload(pretooluse_payload, sys.stdout)
+        sys.exit(0)
+
     tool_input = pretooluse_payload.get("tool_input", {})
     file_path = tool_input.get("file_path", "")