claude-dev-env 2.2.1 → 2.4.0

package/_shared/pr-loop/scripts/pr_loop_shared_constants/stale_worktree_rule_sweep_constants.py

@@ -0,0 +1,107 @@
+"""Constants and rule-format readers for stale_worktree_rule_sweep.
+
+The worktrees root is derived from the same ~/.claude home the permission
+grant script mints its rules under, so the location is named in exactly one
+place. A worktree rule points at a directory one or more segments below that
+root (flat or nested layouts)::
+
+    Edit(<claude home>/worktrees/<worktree name>/.claude/**)
+                                 ^^^^^^^^^^^^^^^
+                                 segment 1 (flat)
+
+    Edit(<claude home>/worktrees/<repository>/<worktree name>/.claude/**)
+                                 ^^^^^^^^^^^^  ^^^^^^^^^^^^^^^
+                                 nested layout
+
+    worktree_directory_for_rule(rule, root)  ->  project directory under root
+
+A rule whose target path lies outside the worktrees root reads back as None,
+so the sweep leaves it untouched.
+"""
+
+from pathlib import Path
+
+from pr_loop_shared_constants.claude_permissions_constants import (
+    get_claude_user_settings_path,
+)
+
+WORKTREES_SUBDIRECTORY_NAME: str = "worktrees"
+
+MINIMUM_WORKTREE_PATH_SEGMENT_COUNT: int = 1
+
+RULE_PATH_OPEN_DELIMITER: str = "("
+
+RULE_PATH_CLOSE_DELIMITER: str = ")"
+
+CLAUDE_HOME_PATH_MARKER: str = "/.claude"
+
+
+def get_claude_worktrees_root() -> Path:
+    """Return the ~/.claude/worktrees directory the grant rules point under.
+
+    Reuses get_claude_user_settings_path so the ~/.claude home is resolved
+    in one place: the settings file's parent directory is the home, and the
+    worktrees live directly beneath it.
+
+    Returns:
+        The absolute path to the user's worktrees root directory.
+    """
+    claude_home_directory = get_claude_user_settings_path().parent
+    return claude_home_directory / WORKTREES_SUBDIRECTORY_NAME
+
+
+def extract_rule_target_path(rule: str) -> str | None:
+    """Return the path a permission rule targets, or None when unparsable.
+
+    A rule reads `Tool(<path>)`; the target is the text between the first
+    open delimiter and the last close delimiter::
+
+        Edit(/repo/wt/.claude/**)  ->  /repo/wt/.claude/**
+        not a rule                 ->  None
+
+    Args:
+        rule: The permission rule string to read.
+
+    Returns:
+        The target path string, or None when the delimiters are absent.
+    """
+    open_index = rule.find(RULE_PATH_OPEN_DELIMITER)
+    close_index = rule.rfind(RULE_PATH_CLOSE_DELIMITER)
+    if open_index == -1 or close_index <= open_index:
+        return None
+    return rule[open_index + 1 : close_index]
+
+
+def worktree_directory_for_rule(rule: str, worktrees_root: Path) -> Path | None:
+    """Return the worktree directory a rule targets, or None when it is not one.
+
+    Keeps every path segment below the worktrees root so flat
+    (`worktrees/<name>`) and nested (`worktrees/<repo>/<name>`) layouts
+    both resolve to the on-disk project directory::
+
+        Edit(<root>/flat-wt/.claude/**)  ->  <root>/flat-wt
+        Edit(<root>/repo/wt/.claude/**)  ->  <root>/repo/wt
+        Edit(/elsewhere/project/.claude/**)  ->  None
+
+    Args:
+        rule: The permission rule string to read.
+        worktrees_root: The ~/.claude/worktrees directory rules live under.
+
+    Returns:
+        The worktree directory, or None when the target lies outside the
+        worktrees root or has no path segments under it.
+    """
+    target_path = extract_rule_target_path(rule)
+    if target_path is None:
+        return None
+    project_portion = target_path.rsplit(CLAUDE_HOME_PATH_MARKER, 1)[0]
+    if not project_portion:
+        return None
+    try:
+        relative_path = Path(project_portion).relative_to(worktrees_root)
+    except ValueError:
+        return None
+    all_segments = relative_path.parts
+    if len(all_segments) < MINIMUM_WORKTREE_PATH_SEGMENT_COUNT:
+        return None
+    return worktrees_root.joinpath(*all_segments)

package/_shared/pr-loop/scripts/revoke_project_claude_permissions.py

@@ -41,6 +41,9 @@ from pr_loop_shared_constants.claude_settings_keys_constants import (
     CLAUDE_SETTINGS_ENVIRONMENT_KEY,
     CLAUDE_SETTINGS_PERMISSIONS_KEY,
 )
+from stale_worktree_rule_sweep import (  # noqa: E402
+    sweep_stale_worktree_rules_from_settings,
+)
 
 
 def remove_values_from_list(
@@ -219,6 +222,7 @@ def revoke_permissions_for_current_directory() -> None:
         ALL_AGENT_CONFIG_PATH_PATTERNS,
     )
     settings = load_settings(claude_user_settings_path)
+    worktree_sweep_removed_count = sweep_stale_worktree_rules_from_settings(settings)
     allow_rules_removed_count = remove_rules_from_allow_list(settings, permission_rules)
     deny_rules_removed_count = remove_rules_from_deny_list(
         settings, all_agent_config_deny_rules
@@ -234,6 +238,7 @@ def revoke_permissions_for_current_directory() -> None:
         + deny_rules_removed_count
         + directories_removed_count
         + environment_entries_removed_count
+        + worktree_sweep_removed_count
     )
     if total_changes_count == 0:
         print(f"Project path: {project_path}")

package/_shared/pr-loop/scripts/stale_worktree_rule_sweep.py

@@ -0,0 +1,107 @@
+"""Sweep permission rules that point at deleted worktrees, then deduplicate.
+
+The grant flow mints per-worktree allow/deny rules into ~/.claude/settings.json
+and the revoke flow removes them, but a revoke that never runs leaves rules
+for deleted worktrees behind, and they pile up run after run. Before the grant
+and revoke flows write, they call this sweep so the settings hold no rule for a
+worktree directory that is gone::
+
+    allow:  Edit(<root>/repo/live/.claude/**)   live on disk  -> kept
+            Edit(<root>/repo/gone/.claude/**)   deleted       -> dropped
+            Edit(<root>/repo/live/.claude/**)   duplicate     -> dropped
+
+A rule whose target lies outside the worktrees root is left untouched.
+"""
+
+from pathlib import Path
+
+from _claude_permissions_common import remove_matching_entries_from_list
+from pr_loop_shared_constants.claude_settings_keys_constants import (
+    CLAUDE_SETTINGS_ALLOW_KEY,
+    CLAUDE_SETTINGS_DENY_KEY,
+    CLAUDE_SETTINGS_PERMISSIONS_KEY,
+)
+from pr_loop_shared_constants.stale_worktree_rule_sweep_constants import (
+    get_claude_worktrees_root,
+    worktree_directory_for_rule,
+)
+
+
+def _is_stale_worktree_rule(candidate_rule: object, worktrees_root: Path) -> bool:
+    if not isinstance(candidate_rule, str):
+        return False
+    worktree_directory = worktree_directory_for_rule(candidate_rule, worktrees_root)
+    if worktree_directory is None:
+        return False
+    return not worktree_directory.exists()
+
+
+def _deduplicate_list_preserving_order(all_entries: list[object]) -> int:
+    all_unique_entries: list[object] = []
+    for each_entry in all_entries:
+        if each_entry not in all_unique_entries:
+            all_unique_entries.append(each_entry)
+    removed_count = len(all_entries) - len(all_unique_entries)
+    all_entries[:] = all_unique_entries
+    return removed_count
+
+
+def _sweep_and_deduplicate_rule_list(
+    all_rules: list[object], worktrees_root: Path
+) -> int:
+    stale_removed_count = remove_matching_entries_from_list(
+        all_rules,
+        lambda candidate_rule: _is_stale_worktree_rule(candidate_rule, worktrees_root),
+    )
+    duplicate_removed_count = _deduplicate_list_preserving_order(all_rules)
+    return stale_removed_count + duplicate_removed_count
+
+
+def _permission_rule_list(
+    all_settings: dict[str, object], list_key: str
+) -> list[object] | None:
+    permissions_section = all_settings.get(CLAUDE_SETTINGS_PERMISSIONS_KEY)
+    if not isinstance(permissions_section, dict):
+        return None
+    rule_list = permissions_section.get(list_key)
+    if not isinstance(rule_list, list):
+        return None
+    return rule_list
+
+
+def sweep_and_deduplicate_permission_lists(
+    all_settings: dict[str, object], worktrees_root: Path
+) -> int:
+    """Drop stale worktree rules and duplicates from the allow and deny lists.
+
+    Args:
+        all_settings: The parsed ~/.claude/settings.json dictionary, mutated
+            in place.
+        worktrees_root: The ~/.claude/worktrees directory rules live under.
+
+    Returns:
+        The total count of rules removed across both lists.
+    """
+    total_removed_count = 0
+    for each_list_key in (CLAUDE_SETTINGS_ALLOW_KEY, CLAUDE_SETTINGS_DENY_KEY):
+        rule_list = _permission_rule_list(all_settings, each_list_key)
+        if rule_list is None:
+            continue
+        total_removed_count += _sweep_and_deduplicate_rule_list(
+            rule_list, worktrees_root
+        )
+    return total_removed_count
+
+
+def sweep_stale_worktree_rules_from_settings(all_settings: dict[str, object]) -> int:
+    """Sweep the settings against the real ~/.claude/worktrees root on disk.
+
+    Args:
+        all_settings: The parsed ~/.claude/settings.json dictionary, mutated
+            in place.
+
+    Returns:
+        The total count of rules removed across the allow and deny lists.
+    """
+    worktrees_root = get_claude_worktrees_root()
+    return sweep_and_deduplicate_permission_lists(all_settings, worktrees_root)

package/_shared/pr-loop/scripts/tests/CLAUDE.md

@@ -27,6 +27,8 @@ pytest suite for the scripts and constants in `_shared/pr-loop/scripts/`. Each t
 | `test_reviewer_availability.py` | `reviewer_availability.py` end-to-end: Copilot and Bugbot availability, opt-out via `CLAUDE_REVIEWS_DISABLED`, and every Copilot quota outcome |
 | `test_reviewer_availability_constants.py` | `pr_loop_shared_constants/reviewer_availability_constants.py` |
 | `test_revoke_project_claude_permissions.py` | `revoke_project_claude_permissions.py` end-to-end |
+| `test_stale_worktree_rule_sweep.py` | `stale_worktree_rule_sweep.py` sweep and deduplication end-to-end |
+| `test_stale_worktree_rule_sweep_constants.py` | `pr_loop_shared_constants/stale_worktree_rule_sweep_constants.py` worktrees-root resolution and rule-format readers |
 | `test_agent_config_carveout.py` | Agent-config deny-rule carve-out logic |
 | `conftest.py` | Shared pytest fixtures |
 

package/_shared/pr-loop/scripts/tests/test_agent_config_carveout.py

@@ -15,7 +15,6 @@ import json
 import sys
 from pathlib import Path
 from types import ModuleType
-from typing import Any
 
 import pytest
 
@@ -79,7 +78,7 @@ def _seed_grant_then_run(
     fake_settings_path: Path,
     fake_project_root: Path,
     monkeypatch: pytest.MonkeyPatch,
-    pre_existing_settings: dict[str, Any],
+    pre_existing_settings: dict[str, object],
 ) -> None:
     fake_settings_path.write_text(json.dumps(pre_existing_settings), encoding="utf-8")
     grant_module = _load_grant_module()
@@ -96,7 +95,7 @@ def _seed_revoke_then_run(
     fake_settings_path: Path,
     fake_project_root: Path,
     monkeypatch: pytest.MonkeyPatch,
-    pre_existing_settings: dict[str, Any],
+    pre_existing_settings: dict[str, object],
 ) -> None:
     fake_settings_path.write_text(json.dumps(pre_existing_settings), encoding="utf-8")
     revoke_module = _load_revoke_module()
@@ -119,6 +118,24 @@ def _project_path_as_posix(fake_project_root: Path) -> str:
     return str(fake_project_root).replace("\\", "/")
 
 
+def _two_stale_trust_entries(project_path_posix: str) -> tuple[str, str]:
+    base_entry = f"Trusted local workspace: {project_path_posix}/.claude/**"
+    return f"{base_entry} wording form one", f"{base_entry} wording form two"
+
+
+def _project_trust_entry_count(
+    environment_list: list[object], project_path_posix: str
+) -> int:
+    project_marker = f"{project_path_posix}/.claude/**"
+    return sum(
+        1
+        for each_entry in environment_list
+        if isinstance(each_entry, str)
+        and each_entry.startswith("Trusted local workspace:")
+        and project_marker in each_entry
+    )
+
+
 def test_grant_writes_deny_rules_for_every_tool_and_pattern(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
@@ -140,14 +157,13 @@ def test_grant_writes_deny_rules_for_every_tool_and_pattern(
             )
 
 
-def test_grant_writes_glob_deny_rules_for_every_agent_config_pattern(
+def test_grant_mints_only_edit_and_read_rules(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
-    """Glob must be in the deny tuple so agent-config paths require approval.
-
-    The AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE promises Edit/Write/Read/Glob
-    trust EXCEPT for agent-config files. Glob deny rules are how the EXCEPT
-    clause is honored for the Glob tool.
+    """Claude Code matches file operations against Edit(path) and Read(path)
+    rules only, so a grant run mints those two tools alone. A Write(path) or
+    Glob(path) rule is ignored by the permission checker and prints a startup
+    warning, so no minted rule may name either tool.
     """
     fake_project_root = _make_fake_project(tmp_path)
     fake_settings_path = tmp_path / "settings.json"
@@ -157,15 +173,15 @@ def test_grant_writes_glob_deny_rules_for_every_agent_config_pattern(
     )
     capsys.readouterr()
     written_settings = json.loads(fake_settings_path.read_text(encoding="utf-8"))
-    deny_list = written_settings["permissions"]["deny"]
-    project_path_posix = _project_path_as_posix(fake_project_root)
-    assert "Glob" in constants_module.ALL_AGENT_CONFIG_DENY_TOOLS
-    assert "Glob" not in constants_module.ALL_PERMISSION_ALLOW_TOOLS
-    for each_pattern in constants_module.ALL_AGENT_CONFIG_PATH_PATTERNS:
-        expected_glob_rule = f"Glob({project_path_posix}/.claude/{each_pattern})"
-        assert expected_glob_rule in deny_list, (
-            f"deny list missing expected Glob rule {expected_glob_rule!r}"
-        )
+    permissions_section = written_settings["permissions"]
+    minted_rules = permissions_section["allow"] + permissions_section["deny"]
+    assert "Write" not in constants_module.ALL_PERMISSION_ALLOW_TOOLS
+    assert "Write" not in constants_module.ALL_AGENT_CONFIG_DENY_TOOLS
+    assert "Glob" not in constants_module.ALL_AGENT_CONFIG_DENY_TOOLS
+    assert minted_rules, "grant run wrote no permission rules"
+    for each_rule in minted_rules:
+        assert "Write(" not in each_rule, f"unmatched Write rule: {each_rule!r}"
+        assert "Glob(" not in each_rule, f"unmatched Glob rule: {each_rule!r}"
 
 
 def test_grant_purges_stale_trust_entries_then_writes_current_template(
@@ -174,18 +190,10 @@ def test_grant_purges_stale_trust_entries_then_writes_current_template(
     fake_project_root = _make_fake_project(tmp_path)
     fake_settings_path = tmp_path / "settings.json"
     project_path_posix = _project_path_as_posix(fake_project_root)
-    stale_entry_a = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** old wording form A"
-    )
-    stale_entry_b = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** "
-        f"different earlier wording"
-    )
+    stale_entry_a, stale_entry_b = _two_stale_trust_entries(project_path_posix)
     unrelated_entry = "Some unrelated environment hint"
-    pre_existing_settings: dict[str, Any] = {
-        "autoMode": {
-            "environment": [stale_entry_a, stale_entry_b, unrelated_entry],
-        },
+    pre_existing_settings: dict[str, object] = {
+        "autoMode": {"environment": [stale_entry_a, stale_entry_b, unrelated_entry]},
     }
     _seed_grant_then_run(
         fake_settings_path,
@@ -199,14 +207,7 @@ def test_grant_purges_stale_trust_entries_then_writes_current_template(
     assert stale_entry_a not in environment_list
     assert stale_entry_b not in environment_list
     assert unrelated_entry in environment_list
-    matching_trust_entries = [
-        each_entry
-        for each_entry in environment_list
-        if isinstance(each_entry, str)
-        and each_entry.startswith("Trusted local workspace:")
-        and f"{project_path_posix}/.claude/**" in each_entry
-    ]
-    assert len(matching_trust_entries) == 1
+    assert _project_trust_entry_count(environment_list, project_path_posix) == 1
     assert "Stale auto-mode environment entries purged" in captured.out
 
 
@@ -223,10 +224,8 @@ def test_revoke_removes_deny_rules(
         constants_module.ALL_AGENT_CONFIG_DENY_TOOLS,
         constants_module.ALL_AGENT_CONFIG_PATH_PATTERNS,
     )
-    pre_existing_settings: dict[str, Any] = {
-        "permissions": {
-            "deny": list(all_deny_rules),
-        },
+    pre_existing_settings: dict[str, object] = {
+        "permissions": {"deny": list(all_deny_rules)},
     }
     _seed_revoke_then_run(
         fake_settings_path,
@@ -248,16 +247,11 @@ def test_revoke_removes_every_legacy_trust_entry_for_project(
     fake_project_root = _make_fake_project(tmp_path)
     fake_settings_path = tmp_path / "settings.json"
     project_path_posix = _project_path_as_posix(fake_project_root)
-    legacy_entry_a = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** template revision A"
-    )
-    legacy_entry_b = (
-        f"Trusted local workspace: {project_path_posix}/.claude/** template revision B"
-    )
+    legacy_entry_a, legacy_entry_b = _two_stale_trust_entries(project_path_posix)
     unrelated_other_project_entry = (
         "Trusted local workspace: /some/other/project/.claude/** still valid"
     )
-    pre_existing_settings: dict[str, Any] = {
+    pre_existing_settings: dict[str, object] = {
         "autoMode": {
             "environment": [
                 legacy_entry_a,
@@ -293,43 +287,31 @@ def test_is_trust_entry_for_project_predicate_filters_by_prefix_and_project_path
     common_module = _load_common_module()
     project_path_posix = "/fake/proj"
     trust_prefix = "Trusted local workspace:"
-    non_string_value: object = 42
-    assert (
-        common_module.is_trust_entry_for_project(
-            non_string_value, project_path_posix, trust_prefix
-        )
-        is False
-    )
     wrong_prefix_entry = (
         f"Something else: {project_path_posix}/.claude/** with marker token"
     )
-    assert (
-        common_module.is_trust_entry_for_project(
-            wrong_prefix_entry, project_path_posix, trust_prefix
-        )
-        is False
-    )
     different_project_entry = (
         "Trusted local workspace: /other/project/.claude/** unrelated"
     )
-    assert (
-        common_module.is_trust_entry_for_project(
-            different_project_entry, project_path_posix, trust_prefix
-        )
-        is False
-    )
     matching_entry = (
         f"Trusted local workspace: {project_path_posix}/.claude/** any wording form"
     )
-    assert (
-        common_module.is_trust_entry_for_project(
-            matching_entry, project_path_posix, trust_prefix
+    predicate_cases: list[tuple[object, bool]] = [
+        (42, False),
+        (wrong_prefix_entry, False),
+        (different_project_entry, False),
+        (matching_entry, True),
+    ]
+    for candidate_entry, expected_result in predicate_cases:
+        assert (
+            common_module.is_trust_entry_for_project(
+                candidate_entry, project_path_posix, trust_prefix
+            )
+            is expected_result
         )
-        is True
-    )
 
 
-def test_is_trust_entry_rejects_cross_project_path_suffix_collision() -> None:
+def test_is_trust_entry_for_project_rejects_cross_project_suffix_collision() -> None:
     """When the project_path is a path suffix of an unrelated entry's path,
     the predicate must reject the unrelated entry (the boundary anchor case)."""
     common_module = _load_common_module()

package/_shared/pr-loop/scripts/tests/test_claude_permissions_constants.py

@@ -25,16 +25,14 @@ constants_module = _load_constants_module()
 
 
 def test_exposes_all_permission_allow_tools_tuple() -> None:
-    assert constants_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Write", "Read")
+    assert constants_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Read")
+    assert "Write" not in constants_module.ALL_PERMISSION_ALLOW_TOOLS
 
 
-def test_exposes_all_agent_config_deny_tools_tuple_with_glob() -> None:
-    assert constants_module.ALL_AGENT_CONFIG_DENY_TOOLS == (
-        "Edit",
-        "Write",
-        "Read",
-        "Glob",
-    )
+def test_exposes_all_agent_config_deny_tools_tuple() -> None:
+    assert constants_module.ALL_AGENT_CONFIG_DENY_TOOLS == ("Edit", "Read")
+    assert "Write" not in constants_module.ALL_AGENT_CONFIG_DENY_TOOLS
+    assert "Glob" not in constants_module.ALL_AGENT_CONFIG_DENY_TOOLS
     assert "Glob" not in constants_module.ALL_PERMISSION_ALLOW_TOOLS
 
 
@@ -56,13 +54,9 @@ def test_template_derives_human_readable_pattern_list_from_pattern_tuple() -> No
     template_text: str = constants_module.AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE
     assert "{project_path}" in template_text
     for each_pattern in constants_module.ALL_AGENT_CONFIG_PATH_PATTERNS:
-        if each_pattern.endswith("/**"):
-            directory_name = each_pattern[: -len("/**")]
-            expected_phrase = f"anything under {directory_name}/"
-        elif each_pattern == "mcp.json":
-            expected_phrase = "the mcp.json file"
-        else:
-            expected_phrase = each_pattern
+        expected_phrase = constants_module._describe_agent_config_pattern_for_humans(
+            each_pattern
+        )
         assert expected_phrase in template_text, (
             f"template missing derived phrase for pattern {each_pattern!r}: "
             f"expected {expected_phrase!r}"

package/_shared/pr-loop/scripts/tests/test_grant_project_claude_permissions.py

@@ -29,9 +29,20 @@ def _load_grant_module() -> ModuleType:
     return module
 
 
+def _nested_list_at(settings: dict[str, object], section_key: str, list_key: str) -> (
+    list[object]
+):
+    section = settings[section_key]
+    assert isinstance(section, dict)
+    nested_list = section[list_key]
+    assert isinstance(nested_list, list)
+    return nested_list
+
+
 def test_module_imports_constants_from_config_modules() -> None:
     grant_module = _load_grant_module()
-    assert grant_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Write", "Read")
+    assert grant_module.ALL_PERMISSION_ALLOW_TOOLS == ("Edit", "Read")
+    assert grant_module.ALL_AGENT_CONFIG_DENY_TOOLS == ("Edit", "Read")
     assert "{project_path}" in grant_module.AUTO_MODE_ENVIRONMENT_ENTRY_TEMPLATE
     assert grant_module.CLAUDE_SETTINGS_PERMISSIONS_KEY == "permissions"
 
@@ -47,3 +58,82 @@ def test_grant_module_guards_sys_path_insert_against_duplicates() -> None:
         "grant_project_claude_permissions.py must guard sys.path.insert against "
         "duplicate entries on reload (consistent with sibling modules)"
     )
+
+
+def test_add_rules_to_allow_list_appends_new_rules_then_skips_duplicates() -> None:
+    grant_module = _load_grant_module()
+    settings: dict[str, object] = {}
+    new_rules = ["Edit(/proj/.claude/**)", "Read(/proj/.claude/**)"]
+    first_added_count = grant_module.add_rules_to_allow_list(settings, new_rules)
+    assert first_added_count == 2
+    allow_list = _nested_list_at(settings, "permissions", "allow")
+    assert new_rules[0] in allow_list
+    assert new_rules[1] in allow_list
+    second_added_count = grant_module.add_rules_to_allow_list(settings, new_rules)
+    assert second_added_count == 0
+
+
+def test_add_rules_to_deny_list_appends_new_rules_then_skips_duplicates() -> None:
+    grant_module = _load_grant_module()
+    settings: dict[str, object] = {}
+    new_rules = ["Edit(/proj/.claude/hooks/**)", "Read(/proj/.claude/hooks/**)"]
+    first_added_count = grant_module.add_rules_to_deny_list(settings, new_rules)
+    assert first_added_count == 2
+    deny_list = _nested_list_at(settings, "permissions", "deny")
+    assert new_rules[0] in deny_list
+    assert new_rules[1] in deny_list
+    second_added_count = grant_module.add_rules_to_deny_list(settings, new_rules)
+    assert second_added_count == 0
+
+
+def test_add_directory_to_additional_directories_is_idempotent() -> None:
+    grant_module = _load_grant_module()
+    settings: dict[str, object] = {}
+    project_directory = "/proj"
+    first_added_count = grant_module.add_directory_to_additional_directories(
+        settings, project_directory
+    )
+    assert first_added_count == 1
+    directories = _nested_list_at(settings, "permissions", "additionalDirectories")
+    assert project_directory in directories
+    second_added_count = grant_module.add_directory_to_additional_directories(
+        settings, project_directory
+    )
+    assert second_added_count == 0
+
+
+def test_add_auto_mode_environment_entry_is_idempotent() -> None:
+    grant_module = _load_grant_module()
+    settings: dict[str, object] = {}
+    entry_text = "Trusted local workspace: /proj/.claude/** current wording"
+    first_added_count = grant_module.add_auto_mode_environment_entry(
+        settings, entry_text
+    )
+    assert first_added_count == 1
+    environment = _nested_list_at(settings, "autoMode", "environment")
+    assert entry_text in environment
+    second_added_count = grant_module.add_auto_mode_environment_entry(
+        settings, entry_text
+    )
+    assert second_added_count == 0
+
+
+def test_purge_stale_trust_entries_removes_matches_and_keeps_protected() -> None:
+    grant_module = _load_grant_module()
+    trust_prefix = grant_module.AUTO_MODE_ENVIRONMENT_ENTRY_PREFIX
+    stale_entry = "Trusted local workspace: /proj/.claude/** stale wording"
+    protected_entry = "Trusted local workspace: /proj/.claude/** current wording"
+    unrelated_entry = "Some unrelated environment hint"
+    settings: dict[str, object] = {
+        "autoMode": {
+            "environment": [stale_entry, protected_entry, unrelated_entry],
+        },
+    }
+    purged_count = grant_module.purge_stale_trust_entries(
+        settings, "/proj", trust_prefix, protected_entry=protected_entry
+    )
+    assert purged_count == 1
+    remaining_environment = _nested_list_at(settings, "autoMode", "environment")
+    assert stale_entry not in remaining_environment
+    assert protected_entry in remaining_environment
+    assert unrelated_entry in remaining_environment