claude-dev-env 2.19.0 → 2.21.0

package/hooks/blocking/codex_apply_patch.py

@@ -0,0 +1,238 @@
+"""Parse Codex apply_patch commands into safe pre-edit and post-edit views."""
+
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+_codex_patch_begin_marker = "*** Begin Patch"
+_codex_patch_end_marker = "*** End Patch"
+_codex_update_marker = "*** Update File:"
+_codex_add_marker = "*** Add File:"
+_codex_delete_marker = "*** Delete File:"
+_codex_hunk_marker = "@@"
+_codex_end_of_file_marker = "*** End of File"
+_codex_no_newline_marker = "\"
+_codex_minimum_patch_line_count = 2
+_codex_update_operation = "update"
+_codex_add_operation = "add"
+_codex_delete_operation = "delete"
+
+
+class CodexPatchError(ValueError):
+    """Describe the accepted file views required by a Codex patch."""
+
+
+@dataclass(frozen=True)
+class CodexPatchFile:
+    """Represent one Codex path with pre-edit and projected post-edit content."""
+
+    file_path: str
+    prior_content: str
+    post_content: str
+    operation: str
+
+
+def _codex_marker_text(patch_line: str) -> str:
+    """Return one patch control line minus its line ending."""
+    return patch_line.rstrip("\r\n")
+
+
+def _codex_resolve_patch_path(relative_path: str, working_directory: Path) -> str:
+    """Resolve one relative patch path under the Codex working directory."""
+    normalized_path = relative_path.replace("\\", "/")
+    all_path_parts = tuple(
+        each_part
+        for each_part in normalized_path.split("/")
+        if each_part not in ("", ".")
+    )
+    if (
+        not all_path_parts
+        or normalized_path.startswith("/")
+        or re.match(r"^[A-Za-z]:", normalized_path)
+    ):
+        raise CodexPatchError("patch path requires a relative location")
+    if any(each_part == ".." for each_part in all_path_parts):
+        raise CodexPatchError("patch path requires a traversal-free location")
+    target_path = (working_directory / Path(*all_path_parts)).resolve()
+    resolved_working_directory = working_directory.resolve()
+    if target_path != resolved_working_directory and resolved_working_directory not in target_path.parents:
+        raise CodexPatchError("patch path requires a location under the working directory")
+    return str(target_path)
+
+
+def _codex_patch_sections(command: str) -> list[tuple[str, str, list[str]]]:
+    """Parse operation sections from a Codex apply_patch command."""
+    all_lines = command.splitlines(keepends=True)
+    if len(all_lines) < _codex_minimum_patch_line_count:
+        raise CodexPatchError("patch requires begin and end markers")
+    if _codex_marker_text(all_lines[0]) != _codex_patch_begin_marker:
+        raise CodexPatchError("patch requires a begin marker")
+    if _codex_marker_text(all_lines[-1]) != _codex_patch_end_marker:
+        raise CodexPatchError("patch requires an end marker")
+    all_sections: list[tuple[str, str, list[str]]] = []
+    current_section: tuple[str, str, list[str]] | None = None
+    for each_line in all_lines[1:-1]:
+        marker_text = _codex_marker_text(each_line)
+        operation = next(
+            (
+                each_operation
+                for each_operation, each_marker in (
+                    (_codex_update_operation, _codex_update_marker),
+                    (_codex_add_operation, _codex_add_marker),
+                    (_codex_delete_operation, _codex_delete_marker),
+                )
+                if marker_text.startswith(each_marker)
+            ),
+            None,
+        )
+        if operation is not None:
+            if current_section is not None:
+                all_sections.append(current_section)
+            marker_by_operation = {
+                _codex_update_operation: _codex_update_marker,
+                _codex_add_operation: _codex_add_marker,
+                _codex_delete_operation: _codex_delete_marker,
+            }
+            path_text = marker_text[len(marker_by_operation[operation]) :].strip()
+            if not path_text:
+                raise CodexPatchError("patch operation requires a path")
+            current_section = (operation, path_text, [])
+            continue
+        if current_section is None:
+            raise CodexPatchError("patch content requires a file operation")
+        current_section[2].append(each_line)
+    if current_section is not None:
+        all_sections.append(current_section)
+    if not all_sections:
+        raise CodexPatchError("patch requires a file operation")
+    return all_sections
+
+
+def _codex_find_patch_block(
+    all_current_lines: list[str], all_old_lines: list[str], search_start: int
+) -> int:
+    """Find one hunk's old lines at or after the prior hunk position."""
+    if not all_old_lines:
+        return search_start
+    last_start = len(all_current_lines) - len(all_old_lines)
+    for each_start in range(search_start, last_start + 1):
+        if all_current_lines[each_start : each_start + len(all_old_lines)] == all_old_lines:
+            return each_start
+    return -1
+
+
+def _codex_apply_hunk(
+    all_current_lines: list[str], all_hunk_lines: list[str], search_start: int
+) -> tuple[list[str], int]:
+    """Apply one context, deletion, and addition hunk to file lines."""
+    all_old_lines: list[str] = []
+    all_new_lines: list[str] = []
+    for each_line in all_hunk_lines:
+        marker_text = _codex_marker_text(each_line)
+        if marker_text in (_codex_end_of_file_marker, _codex_no_newline_marker):
+            continue
+        if not each_line or each_line[0] not in " +-":
+            raise CodexPatchError("patch hunk requires context, deletion, or addition lines")
+        line_content = each_line[1:]
+        if each_line[0] in " -":
+            all_old_lines.append(line_content)
+        if each_line[0] in " +":
+            all_new_lines.append(line_content)
+    block_start = _codex_find_patch_block(all_current_lines, all_old_lines, search_start)
+    if block_start < 0:
+        raise CodexPatchError("patch hunk requires matching file content")
+    all_current_lines[block_start : block_start + len(all_old_lines)] = all_new_lines
+    return all_current_lines, block_start + len(all_new_lines)
+
+
+def _codex_apply_update(prior_content: str, all_section_lines: list[str]) -> str:
+    """Apply every hunk in one Codex update section."""
+    all_current_lines = prior_content.splitlines(keepends=True)
+    all_hunk_lines: list[str] = []
+    search_start = 0
+    has_hunk = False
+    for each_line in all_section_lines:
+        marker_text = _codex_marker_text(each_line)
+        if marker_text.startswith(_codex_hunk_marker):
+            if all_hunk_lines:
+                all_current_lines, search_start = _codex_apply_hunk(
+                    all_current_lines, all_hunk_lines, search_start
+                )
+                all_hunk_lines = []
+            has_hunk = True
+            continue
+        all_hunk_lines.append(each_line)
+    if all_hunk_lines:
+        all_current_lines, _ = _codex_apply_hunk(all_current_lines, all_hunk_lines, search_start)
+    if not has_hunk:
+        raise CodexPatchError("update section requires a hunk marker")
+    return "".join(all_current_lines)
+
+
+def _codex_add_content(all_section_lines: list[str]) -> str:
+    """Build new content from an Add File section."""
+    all_content_lines: list[str] = []
+    for each_line in all_section_lines:
+        marker_text = _codex_marker_text(each_line)
+        if marker_text == _codex_end_of_file_marker:
+            continue
+        if not each_line or each_line[0] != "+":
+            raise CodexPatchError("add section requires added lines")
+        all_content_lines.append(each_line[1:])
+    return "".join(all_content_lines)
+
+
+def _codex_read_patch_file(
+    operation: str, target_path: Path, all_section_lines: list[str]
+) -> CodexPatchFile:
+    """Read one pre-edit file and project its post-edit content."""
+    try:
+        prior_content = target_path.read_text(encoding="utf-8")
+    except (FileNotFoundError, IsADirectoryError, OSError, UnicodeDecodeError, ValueError) as error:
+        if operation == _codex_add_operation and isinstance(error, FileNotFoundError):
+            prior_content = ""
+        else:
+            raise CodexPatchError("patch target requires readable UTF-8 content") from error
+    if operation == _codex_add_operation:
+        if target_path.exists():
+            raise CodexPatchError("add target requires a new path")
+        post_content = _codex_add_content(all_section_lines)
+    elif operation == _codex_update_operation:
+        post_content = _codex_apply_update(prior_content, all_section_lines)
+    else:
+        if any(
+            _codex_marker_text(each_line) != _codex_end_of_file_marker
+            for each_line in all_section_lines
+        ):
+            raise CodexPatchError("delete section requires end-of-file content")
+        post_content = ""
+    return CodexPatchFile(str(target_path), prior_content, post_content, operation)
+
+
+def parse_codex_apply_patch(
+    command: str, working_directory: str | None = None
+) -> tuple[CodexPatchFile, ...]:
+    """Return pre-edit and post-edit views for every Codex patch path."""
+    if not isinstance(command, str) or not command.strip():
+        raise CodexPatchError("patch command requires text")
+    resolved_working_directory = Path(working_directory or os.getcwd()).expanduser().resolve()
+    if not resolved_working_directory.is_dir():
+        raise CodexPatchError("patch working directory requires an existing directory")
+    all_patch_files: list[CodexPatchFile] = []
+    seen_paths: set[str] = set()
+    for each_operation, each_relative_path, each_section_lines in _codex_patch_sections(command):
+        try:
+            resolved_path = _codex_resolve_patch_path(
+                each_relative_path, resolved_working_directory
+            )
+        except (OSError, ValueError) as error:
+            raise CodexPatchError("patch path requires a resolvable location") from error
+        path_key = resolved_path.casefold()
+        if path_key in seen_paths:
+            raise CodexPatchError("patch paths require unique entries")
+        seen_paths.add(path_key)
+        all_patch_files.append(
+            _codex_read_patch_file(each_operation, Path(resolved_path), each_section_lines)
+        )
+    return tuple(all_patch_files)

package/hooks/blocking/test_block_main_commit.py

@@ -0,0 +1,145 @@
+"""Production-path tests for direct commit branch protection."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+
+def _run_git(from_directory: Path, *arguments: str) -> None:
+    subprocess.run(
+        ["git", *arguments],
+        cwd=from_directory,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+
+def _create_repository(from_directory: Path, branch_name: str) -> Path:
+    repository = from_directory / branch_name
+    repository.mkdir()
+    _run_git(repository, "init", "--initial-branch", "main")
+    hook_directory = repository / ".git" / "test-hooks"
+    hook_directory.mkdir()
+    _run_git(repository, "config", "core.hooksPath", str(hook_directory))
+    _run_git(repository, "config", "user.email", "test@example.com")
+    _run_git(repository, "config", "user.name", "Test User")
+    (repository / "tracked.txt").write_text("tracked\n", encoding="utf-8")
+    _run_git(repository, "add", "tracked.txt")
+    _run_git(repository, "-c", "commit.gpgsign=false", "commit", "-m", "initial")
+    if branch_name != "main":
+        _run_git(repository, "switch", "-c", branch_name)
+    return repository
+
+
+def _run_commit_gate(
+    from_directory: Path,
+    process_directory: Path,
+    command: str = "git commit -m test",
+    include_event_cwd: bool = True,
+) -> subprocess.CompletedProcess[str]:
+    hook_script = Path(__file__).with_name("block_main_commit.py")
+    home_directory = from_directory.parent / "test-home"
+    home_directory.mkdir(exist_ok=True)
+    environment = os.environ.copy()
+    environment.update({"HOME": str(home_directory), "USERPROFILE": str(home_directory)})
+    hook_payload: dict[str, object] = {
+        "tool_name": "Bash",
+        "tool_input": {"command": command},
+    }
+    if include_event_cwd:
+        hook_payload["cwd"] = str(from_directory)
+    return subprocess.run(
+        [sys.executable, str(hook_script)],
+        cwd=process_directory,
+        input=json.dumps(hook_payload),
+        check=False,
+        capture_output=True,
+        text=True,
+        env=environment,
+    )
+
+
+def test_blocks_commit_on_protected_branch_from_hook_event_cwd(tmp_path: Path) -> None:
+    repository = _create_repository(tmp_path, "main")
+    process_repository = _create_repository(tmp_path, "agent-owned-change")
+
+    completed_process = _run_commit_gate(repository, process_repository)
+
+    assert completed_process.returncode == 0
+    hook_response = json.loads(completed_process.stdout)
+    assert hook_response["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert str(repository) in hook_response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_allows_commit_on_owned_branch_from_hook_event_cwd(tmp_path: Path) -> None:
+    repository = _create_repository(tmp_path, "agent-owned-change")
+    process_repository = _create_repository(tmp_path, "main")
+
+    completed_process = _run_commit_gate(repository, process_repository)
+
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""
+
+
+def test_resolves_relative_git_c_from_hook_event_cwd(tmp_path: Path) -> None:
+    repository = _create_repository(tmp_path, "main")
+    process_repository = _create_repository(tmp_path, "agent-owned-change")
+
+    completed_process = _run_commit_gate(
+        tmp_path,
+        process_repository,
+        command="git -C main commit -m test",
+    )
+
+    assert completed_process.returncode == 0
+    hook_response = json.loads(completed_process.stdout)
+    assert hook_response["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert str(repository) in hook_response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_preserves_dispatcher_ownership_without_event_cwd(tmp_path: Path) -> None:
+    repository = _create_repository(tmp_path, "main")
+    process_repository = _create_repository(tmp_path, "agent-owned-change")
+
+    completed_process = _run_commit_gate(
+        tmp_path,
+        process_repository,
+        command=f'git -C "{repository}" commit -m test',
+        include_event_cwd=False,
+    )
+
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""
+
+
+def test_matches_case_insensitive_shell_git_command(tmp_path: Path) -> None:
+    repository = _create_repository(tmp_path, "main")
+    process_repository = _create_repository(tmp_path, "agent-owned-change")
+
+    completed_process = _run_commit_gate(
+        tmp_path,
+        process_repository,
+        command="CD main && GIT COMMIT -m test",
+    )
+
+    assert completed_process.returncode == 0
+    hook_response = json.loads(completed_process.stdout)
+    assert hook_response["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert str(repository) in hook_response["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_ignores_unrelated_command_containing_git_commit(tmp_path: Path) -> None:
+    repository = _create_repository(tmp_path, "main")
+    process_repository = _create_repository(tmp_path, "agent-owned-change")
+
+    completed_process = _run_commit_gate(
+        repository,
+        process_repository,
+        command="echo git commit",
+    )
+
+    assert completed_process.returncode == 0
+    assert completed_process.stdout == ""

package/hooks/blocking/test_code_rules_blast_radius.py

@@ -0,0 +1,161 @@
+"""Tests for the blast-radius declaration check."""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+if _blocking_directory not in sys.path:
+    sys.path.insert(0, _blocking_directory)
+
+from code_rules_blast_radius import check_blast_radius_declared  # noqa: E402
+
+PRODUCTION_PATH = "pipeline/asset_run.py"
+
+
+def test_should_report_a_loop_raise_with_pending_blast_radius_declaration() -> None:
+    """A loop-body raise gets an advisory requesting its blast-radius declaration."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        if each_member.requires_preparation:\n"
+        "            raise AssetError('member requires preparation')\n"
+    )
+
+    all_issues = check_blast_radius_declared(content, PRODUCTION_PATH)
+
+    assert len(all_issues) == 1
+    assert "Line 4" in all_issues[0]
+
+
+def test_should_accept_a_run_fatal_raise_inside_a_loop() -> None:
+    """A RunFatal type declares that the whole run ends."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        if each_member.digest_differs:\n"
+        "            raise AssetRunFatal('source bytes changed')\n"
+    )
+
+    assert check_blast_radius_declared(content, PRODUCTION_PATH) == []
+
+
+def test_should_accept_an_item_blocked_raise_inside_a_loop() -> None:
+    """An ItemBlocked type declares a member-scoped stop."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        if each_member.requires_resize:\n"
+        "            raise AssetItemBlocked('member requires resizing')\n"
+    )
+
+    assert check_blast_radius_declared(content, PRODUCTION_PATH) == []
+
+
+def test_should_accept_a_raise_wrapped_by_a_blast_radius_boundary() -> None:
+    """A per-member boundary catches a declared type and parks the failure."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        try:\n"
+        "            if each_member.requires_resize:\n"
+                "                raise AssetItemBlocked('member requires resizing')\n"
+        "        except AssetItemBlocked as failure:\n"
+        "            park(each_member, failure)\n"
+    )
+
+    assert check_blast_radius_declared(content, PRODUCTION_PATH) == []
+
+
+def test_should_report_runtime_error_with_a_different_declared_handler() -> None:
+    """A different declared handler leaves a runtime crash requiring a name."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        try:\n"
+        "            raise RuntimeError('code defect')\n"
+        "        except AssetItemBlocked:\n"
+        "            park(each_member)\n"
+    )
+
+    assert len(check_blast_radius_declared(content, PRODUCTION_PATH)) == 1
+
+
+@pytest.mark.parametrize("raised_type", ["RuntimeError", "TypeError", "AttributeError", "ValueError"])
+def test_should_require_corresponding_handler_for_each_explicit_raise(
+    raised_type: str,
+) -> None:
+    """Each explicit raise needs a handler naming that same type."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        try:\n"
+        f"            raise {raised_type}('code defect')\n"
+        "        except AssetItemBlocked:\n"
+        "            park(each_member)\n"
+    )
+
+    assert len(check_blast_radius_declared(content, PRODUCTION_PATH)) == 1
+
+
+def test_should_accept_a_run_level_raise_during_manifest_preparation() -> None:
+    """A run-level raise belongs to manifest preparation."""
+    content = (
+        "def prepare(manifest):\n"
+        "    if manifest.requires_preparation:\n"
+        "        raise AssetError('manifest requires preparation')\n"
+    )
+
+    assert check_blast_radius_declared(content, PRODUCTION_PATH) == []
+
+
+def test_should_accept_a_bare_reraise_inside_a_loop() -> None:
+    """A bare re-raise propagates an error carrying a declared radius."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        try:\n"
+        "            process(each_member)\n"
+        "        except AssetItemBlocked:\n"
+        "            raise\n"
+    )
+
+    assert check_blast_radius_declared(content, PRODUCTION_PATH) == []
+
+
+def test_should_accept_test_files() -> None:
+    """Test modules raise freely during scenario coverage."""
+    content = (
+        "def test_records_member_failure(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        raise AssetError('member failure')\n"
+    )
+
+    assert check_blast_radius_declared(content, "pipeline/test_asset_run.py") == []
+
+
+def test_should_report_each_loop_raise_with_pending_blast_radius_declaration() -> None:
+    """Each loop-body raise gets an advisory requesting its blast-radius declaration."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        if each_member.requires_source:\n"
+        "            raise AssetError('member requires a source')\n"
+        "        if each_member.requires_resize:\n"
+        "            raise AssetError('member requires resizing')\n"
+    )
+
+    assert len(check_blast_radius_declared(content, PRODUCTION_PATH)) == 2
+
+
+def test_should_ignore_raise_in_nested_helper_body() -> None:
+    """A nested helper body is checked at its own call boundary."""
+    content = (
+        "def run(all_members):\n"
+        "    for each_member in all_members:\n"
+        "        def validate_member():\n"
+        "            raise AssetError('member validation failed')\n"
+    )
+
+    assert check_blast_radius_declared(content, PRODUCTION_PATH) == []

package/hooks/blocking/test_code_rules_enforcer_codex_apply_patch.py

@@ -0,0 +1,148 @@
+"""Tests for the Codex apply_patch adapter."""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+_HOOK_DIRECTORY = Path(__file__).resolve().parent
+_HOOKS_PARENT = _HOOK_DIRECTORY.parent
+if str(_HOOK_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIRECTORY))
+if str(_HOOKS_PARENT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_PARENT))
+
+import code_rules_enforcer
+import codex_apply_patch
+
+
+def _run_codex_payload(
+    payload: dict[str, object],
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> str:
+    """Run the real enforcer entry point and return its stdout."""
+    monkeypatch.setattr(code_rules_enforcer.sys, "stdin", io.StringIO(json.dumps(payload)))
+    with contextlib.suppress(SystemExit):
+        code_rules_enforcer.main([])
+    return capsys.readouterr().out
+
+
+def _production_directory(tmp_path: Path) -> Path:
+    """Return a temporary directory whose path carries production semantics."""
+    production_directory = tmp_path.parent / "codex-prod"
+    production_directory.mkdir(exist_ok=True)
+    return production_directory
+
+
+def test_parse_codex_apply_patch_projects_every_multi_file_operation(
+    tmp_path: Path,
+) -> None:
+    """The parser returns pre-edit and post-edit content for update, add, and delete."""
+    updated_path = tmp_path / "updated.py"
+    deleted_path = tmp_path / "deleted.py"
+    updated_path.write_text("before\nkeep\n", encoding="utf-8")
+    deleted_path.write_text("remove\n", encoding="utf-8")
+    patch = (
+        "*** Begin Patch\n"
+        "*** Update File: updated.py\n"
+        "@@\n"
+        "-before\n"
+        "+after\n"
+        " keep\n"
+        "*** Add File: added.py\n"
+        "+new\n"
+        "*** Delete File: deleted.py\n"
+        "*** End Patch"
+    )
+
+    all_patch_files = codex_apply_patch.parse_codex_apply_patch(patch, str(tmp_path))
+
+    views_by_name = {
+        Path(each_patch.file_path).name: each_patch for each_patch in all_patch_files
+    }
+    assert views_by_name["updated.py"].prior_content == "before\nkeep\n"
+    assert views_by_name["updated.py"].post_content == "after\nkeep\n"
+    assert views_by_name["added.py"].prior_content == ""
+    assert views_by_name["added.py"].post_content == "new\n"
+    assert views_by_name["deleted.py"].prior_content == "remove\n"
+    assert views_by_name["deleted.py"].post_content == ""
+
+
+def test_codex_payload_allows_declared_blast_radius(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A loop raise with a declared stopping scope passes the Codex hook."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: module.py\n"
+                "+for each_member in all_members:\n"
+                "+    raise AssetItemBlocked()\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    assert stdout == ""
+
+
+def test_codex_payload_blocks_undeclared_blast_radius(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A loop raise requires a stopping-scope declaration for acceptance."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: module.py\n"
+                "+for each_member in all_members:\n"
+                "+    raise RuntimeError()\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    deny_payload = json.loads(stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "blast radius" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_codex_payload_blocks_malformed_patch(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A malformed Codex patch returns a blocking diagnostic."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {"command": "*** Begin Patch\n*** End Patch"},
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
+    deny_payload = json.loads(stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]