claude-dev-env 2.2.1 → 2.4.0

package/hooks/blocking/code_review_stamp_write_blocker_parts/obfuscated_stamp_path_reference.py

@@ -0,0 +1,212 @@
+"""Decide whether a command builds a stamp path with obfuscation and writes.
+
+A path-obfuscation forge hides ``.claude`` or ``code-review-stamps`` inside hex
+digits, a base64 token, a comma-separated character-code sequence, or a run of
+``+``-joined ``chr(<int>)`` calls, then pairs the assembled path with a
+non-redirect file write (``open(``, ``write_text``, ``Out-File``,
+``Set-Content``, ``Add-Content``, ``tee``). The literal path matchers miss such
+a path because it carries no plain ``code-review-stamps`` substring, so this
+module decodes each embedded token and looks for a stamp-path segment either in
+the decoded text or inside the write call's argument region. A bare ``>``
+redirect to the stamp path is caught by the literal-path matchers, so a command
+whose only write is a redirect is left alone here.
+
+The entry hook registers the constant packages before importing this module, so
+the ``from config...`` imports below resolve against the sibling ``config/``
+package without a bootstrap call here.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import re
+
+from config.code_review_enforcement_constants import (
+    ALL_STAMP_PATH_SEGMENT_BODIES,
+    ALL_STAMP_PATH_SEGMENT_NAMES,
+)
+from config.verified_commit_constants import (
+    BASE64_TOKEN_PATTERN,
+    CHARACTER_CODE_SEQUENCE_PATTERN,
+    CHR_CALL_CHAIN_PATTERN,
+    CHR_CALL_CODE_PATTERN,
+    HEX_DIGITS_PER_BYTE,
+    HEX_TOKEN_PATTERN,
+    NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN,
+    PATH_OBFUSCATION_PRIMITIVE_PATTERN,
+    WRITE_CALL_REGION_PATTERN,
+)
+
+_ASCII_ENCODING = "ascii"
+
+
+def _decode_hex_token(hex_token: str) -> str:
+    """Decode a hex-digit token to text, returning empty text on failure.
+
+    Args:
+        hex_token: A run of hex digits taken from the command.
+
+    Returns:
+        The decoded ASCII text, or empty text when the token is odd-length,
+        not valid hex, or not decodable as ASCII.
+    """
+    odd_hex_token_remainder = 1
+    if len(hex_token) % HEX_DIGITS_PER_BYTE == odd_hex_token_remainder:
+        return ""
+    try:
+        return bytes.fromhex(hex_token).decode(_ASCII_ENCODING)
+    except (ValueError, binascii.Error):
+        return ""
+
+
+def _decode_base64_token(base64_token: str) -> str:
+    """Decode a base64 token to text, returning empty text on failure.
+
+    Args:
+        base64_token: A base64-shaped token taken from the command.
+
+    Returns:
+        The decoded ASCII text, or empty text when the token is not valid
+        base64 or not decodable as ASCII.
+    """
+    try:
+        return base64.b64decode(base64_token, validate=True).decode(_ASCII_ENCODING)
+    except (ValueError, binascii.Error):
+        return ""
+
+
+def _decode_character_code_sequence(code_sequence: str) -> str:
+    """Decode a comma-separated character-code sequence to text.
+
+    Args:
+        code_sequence: A comma-separated run of decimal character codes, each
+            within the three-digit range the source pattern admits.
+
+    Returns:
+        The decoded text.
+    """
+    character_code_separator = ","
+    decoded_characters: list[str] = []
+    for each_code in code_sequence.split(character_code_separator):
+        code_point = int(each_code.strip())
+        decoded_characters.append(chr(code_point))
+    return "".join(decoded_characters)
+
+
+def _decode_chr_call_chain(chr_chain: str) -> str:
+    """Decode a run of ``+``-joined ``chr(<int>)`` calls to text.
+
+    Args:
+        chr_chain: A run of two or more ``+``-joined ``chr(<int>)`` calls taken
+            from the command, each code within the three-digit source range.
+
+    Returns:
+        The decoded text.
+    """
+    decoded_characters: list[str] = []
+    for each_code in re.findall(CHR_CALL_CODE_PATTERN, chr_chain, re.IGNORECASE):
+        decoded_characters.append(chr(int(each_code)))
+    return "".join(decoded_characters)
+
+
+def _append_when_present(all_decoded_texts: list[str], decoded_text: str) -> None:
+    """Append the lowercase decoded text when it is non-empty.
+
+    Args:
+        all_decoded_texts: The running list of decoded texts to extend.
+        decoded_text: One token's decoded text, empty when the token failed.
+
+    Returns:
+        None. The list is extended in place when the text is non-empty.
+    """
+    if decoded_text:
+        all_decoded_texts.append(decoded_text.lower())
+
+
+def _decoded_texts_from_command(command_text: str) -> list[str]:
+    """Decode every hex, base64, character-code, and chr-chain token a command embeds.
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        The lowercase decoded text for every token that decodes cleanly;
+        tokens that fail to decode or carry an out-of-range code are skipped.
+    """
+    all_decoded_texts: list[str] = []
+    for each_hex_token in re.findall(HEX_TOKEN_PATTERN, command_text, re.IGNORECASE):
+        _append_when_present(all_decoded_texts, _decode_hex_token(each_hex_token))
+    for each_base64_token in re.findall(BASE64_TOKEN_PATTERN, command_text):
+        _append_when_present(all_decoded_texts, _decode_base64_token(each_base64_token))
+    for each_code_sequence in re.findall(CHARACTER_CODE_SEQUENCE_PATTERN, command_text):
+        _append_when_present(all_decoded_texts, _decode_character_code_sequence(each_code_sequence))
+    for each_chr_chain in re.findall(CHR_CALL_CHAIN_PATTERN, command_text, re.IGNORECASE):
+        _append_when_present(all_decoded_texts, _decode_chr_call_chain(each_chr_chain))
+    return all_decoded_texts
+
+
+def _decoded_token_references_stamp_segment(command_text: str) -> bool:
+    """Decide whether a decodable token in a command hides a stamp-path segment.
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when a decodable token decodes to a stamp-path segment body
+        (``claude`` or ``code-review-stamps``).
+    """
+    all_decoded_texts = _decoded_texts_from_command(command_text)
+    return any(
+        each_segment_body in each_decoded_text
+        for each_decoded_text in all_decoded_texts
+        for each_segment_body in ALL_STAMP_PATH_SEGMENT_BODIES
+    )
+
+
+def _write_call_region_names_stamp_segment(command_text: str) -> bool:
+    """Decide whether a write call's argument region names a stamp-path segment.
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when a stamp-path segment name appears inside a non-redirect write
+        call's argument region.
+    """
+    write_call_region_pattern = re.compile(WRITE_CALL_REGION_PATTERN, re.IGNORECASE)
+    for each_region_match in write_call_region_pattern.finditer(command_text):
+        lowercased_region = each_region_match.group(0).lower()
+        if any(each_name in lowercased_region for each_name in ALL_STAMP_PATH_SEGMENT_NAMES):
+            return True
+    return False
+
+
+def references_obfuscated_stamp_path(command_text: str) -> bool:
+    """Decide whether a command pairs path obfuscation with a stamp-path write.
+
+    ::
+
+        python -c "open(bytes.fromhex('...code-review-stamps...'),'w')"  -> True
+        open(bytes.fromhex('2f746d702f78'),'w')                          -> False
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when the command holds a path-obfuscation primitive, a
+        non-redirect file write, and a stamp-path segment reachable by that
+        write — either a decoded token anywhere in the command or a plain-text
+        segment inside the write call's argument region.
+    """
+    has_obfuscation_primitive = (
+        re.search(PATH_OBFUSCATION_PRIMITIVE_PATTERN, command_text) is not None
+    )
+    has_non_redirect_write = (
+        re.search(NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN, command_text) is not None
+    )
+    if not (has_obfuscation_primitive and has_non_redirect_write):
+        return False
+    if _decoded_token_references_stamp_segment(command_text):
+        return True
+    return _write_call_region_names_stamp_segment(command_text)

package/hooks/blocking/code_review_stamp_write_blocker_parts/split_directory_change_into_stamp.py

@@ -0,0 +1,138 @@
+"""Decide whether a split directory change reaches the stamp directory then runs a command.
+
+A change into the Claude home (``cd ~/.claude``) followed by a change into a
+relative ``code-review-stamps`` directory (``cd code-review-stamps``) lands in
+the stamp directory without ever naming the two segments adjacently, so the
+absolute-path matcher and the single-step ``cd ~/.claude/code-review-stamps``
+matcher both miss it. The trust contract denies every shell command that
+reaches the stamp directory, so any command after the second change — a
+redirect, ``cp``, ``mv``, ``tee``, ``install``, or a ``python -c`` write — is a
+forge vector. An unrelated second change (``cd hooks``) lands elsewhere and
+passes.
+
+The entry hook registers the constant packages before importing this module, so
+the ``from config...`` imports below resolve against the sibling ``config/``
+package without a bootstrap call here.
+"""
+
+from __future__ import annotations
+
+import re
+
+from config.code_review_enforcement_constants import STAMP_DIRECTORY_CHANGE_TARGET_PATTERN
+from config.verified_commit_constants import (
+    CLAUDE_HOME_DIRECTORY_NAME,
+    CLAUDE_HOME_TARGET_BOUNDARY_PATTERN,
+    COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN,
+    DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN,
+    DIRECTORY_CHANGE_OPTION_TERMINATOR,
+    DIRECTORY_CHANGE_PATH_OPTIONS,
+    DIRECTORY_CHANGE_PATTERN_PREFIX,
+    DIRECTORY_CHANGE_PATTERN_SUFFIX,
+    DIRECTORY_CHANGE_TARGET_PATTERN,
+    DIRECTORY_CHANGE_VERBS,
+)
+from config.verified_commit_gate_output_constants import REGEX_ALTERNATION_SEPARATOR
+
+
+def _directory_change_verbs_pattern() -> str:
+    """Build the alternation of directory-change verbs for a change matcher.
+
+    Returns:
+        The regex alternation of escaped directory-change verbs in sorted order.
+    """
+    return REGEX_ALTERNATION_SEPARATOR.join(
+        re.escape(each_verb) for each_verb in sorted(DIRECTORY_CHANGE_VERBS)
+    )
+
+
+def _directory_change_option_prefix_pattern() -> str:
+    """Build the optional path-option prefix that may precede a change target.
+
+    Returns:
+        The regex matching zero or more leading path-option or terminator
+        tokens, ready to sit between the change suffix and target patterns.
+    """
+    option_alternation = REGEX_ALTERNATION_SEPARATOR.join(
+        re.escape(each_option)
+        for each_option in sorted(
+            DIRECTORY_CHANGE_PATH_OPTIONS | {DIRECTORY_CHANGE_OPTION_TERMINATOR}
+        )
+    )
+    return DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN % option_alternation
+
+
+def directory_change_prefix() -> str:
+    """Build the change-verb prefix shared by the directory-change matchers.
+
+    The stamp-directory write-blocker reuses this same prefix, so a single
+    builder feeds both this module's split-change matchers and the blocker's
+    single-step change matchers, and the two never drift.
+
+    Returns:
+        The regex prefix matching a directory-change verb and any leading
+        path-option tokens, ready for a target pattern to follow.
+    """
+    return (
+        DIRECTORY_CHANGE_PATTERN_PREFIX
+        + _directory_change_verbs_pattern()
+        + DIRECTORY_CHANGE_PATTERN_SUFFIX
+        + _directory_change_option_prefix_pattern()
+    )
+
+
+def _change_into_claude_pattern() -> re.Pattern[str]:
+    """Build the compiled matcher for a directory change into the Claude home.
+
+    Returns:
+        The compiled, case-insensitive pattern matching a change verb into any
+        path ending in ``.claude``.
+    """
+    return re.compile(
+        directory_change_prefix()
+        + DIRECTORY_CHANGE_TARGET_PATTERN
+        + re.escape(CLAUDE_HOME_DIRECTORY_NAME)
+        + CLAUDE_HOME_TARGET_BOUNDARY_PATTERN,
+        re.IGNORECASE,
+    )
+
+
+def _change_into_stamp_pattern() -> re.Pattern[str]:
+    """Build the compiled matcher for a directory change into the stamp directory.
+
+    Returns:
+        The compiled, case-insensitive pattern matching a change verb into a
+        relative ``code-review-stamps`` directory.
+    """
+    return re.compile(
+        directory_change_prefix() + STAMP_DIRECTORY_CHANGE_TARGET_PATTERN, re.IGNORECASE
+    )
+
+
+def changes_through_split_directory_into_stamp(command_text: str) -> bool:
+    """Decide whether a split change reaches the stamp directory then runs a command.
+
+    ::
+
+        cd ~/.claude && cd code-review-stamps && echo x > f.json  -> True
+        cd ~/.claude && cd hooks && echo x > f.json               -> False
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when a change into the Claude home precedes a change into a
+        relative stamp directory that is itself followed by any further command.
+    """
+    change_into_claude_match = _change_into_claude_pattern().search(command_text)
+    if change_into_claude_match is None:
+        return False
+    change_into_stamp_match = _change_into_stamp_pattern().search(
+        command_text, change_into_claude_match.end()
+    )
+    if change_into_stamp_match is None:
+        return False
+    command_after_change_pattern = re.compile(COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN)
+    return (
+        command_after_change_pattern.search(command_text, change_into_stamp_match.end()) is not None
+    )

package/hooks/blocking/code_review_stamp_write_blocker_parts/test_obfuscated_stamp_path_reference.py

@@ -0,0 +1,49 @@
+"""Behavioral tests for the obfuscated-stamp-path matcher.
+
+The matcher blocks a command that assembles a stamp path from hex, base64, or
+``chr(<int>)`` codes and pairs it with a non-redirect file write, while a
+decode-to-other-path one-liner passes.
+"""
+
+from __future__ import annotations
+
+from code_review_stamp_write_blocker_parts.obfuscated_stamp_path_reference import (
+    references_obfuscated_stamp_path,
+)
+
+STAMP_PATH_TEXT = "/.claude/code-review-stamps/a.json"
+BENIGN_PATH_TEXT = "/tmp/x"
+
+
+def _hex_forge_command(path_text: str) -> str:
+    return f"python -c \"open(bytes.fromhex('{path_text.encode().hex()}'),'w').write('x')\""
+
+
+def _chr_chain_forge_command(path_text: str) -> str:
+    chr_chain = "+".join(f"chr({ord(each_character)})" for each_character in path_text)
+    return f"python -c \"open({chr_chain},'w').write('x')\""
+
+
+def _character_code_forge_command(path_text: str) -> str:
+    comma_separated_codes = ",".join(str(ord(each_character)) for each_character in path_text)
+    return f"python -c \"open(bytes([{comma_separated_codes}]),'w').write('x')\""
+
+
+def test_hex_assembled_stamp_path_write_is_blocked() -> None:
+    assert references_obfuscated_stamp_path(_hex_forge_command(STAMP_PATH_TEXT))
+
+
+def test_character_code_assembled_stamp_path_write_is_blocked() -> None:
+    assert references_obfuscated_stamp_path(_character_code_forge_command(STAMP_PATH_TEXT))
+
+
+def test_chr_chain_assembled_stamp_path_write_is_blocked() -> None:
+    assert references_obfuscated_stamp_path(_chr_chain_forge_command(STAMP_PATH_TEXT))
+
+
+def test_decode_to_other_path_write_is_not_blocked() -> None:
+    assert not references_obfuscated_stamp_path(_hex_forge_command(BENIGN_PATH_TEXT))
+
+
+def test_redirect_only_stamp_reference_is_left_to_literal_matchers() -> None:
+    assert not references_obfuscated_stamp_path("echo x > ~/.claude/code-review-stamps/a.json")

package/hooks/blocking/code_review_stamp_write_blocker_parts/test_split_directory_change_into_stamp.py

@@ -0,0 +1,38 @@
+"""Behavioral tests for the split directory-change-into-stamp matcher.
+
+The matcher blocks a command that changes into the Claude home, then into a
+relative ``code-review-stamps`` directory, then runs any further command, while
+an unrelated second change or a benign command passes.
+"""
+
+from __future__ import annotations
+
+from code_review_stamp_write_blocker_parts.split_directory_change_into_stamp import (
+    changes_through_split_directory_into_stamp,
+)
+
+SPLIT_CHANGE_FORGE = "cd ~/.claude && cd code-review-stamps && echo x > f.json"
+UNRELATED_SECOND_CHANGE = "cd ~/.claude && cd hooks && echo x > f.json"
+PYTEST_RUN = "python -m pytest test_code_review_stamp_store.py"
+
+
+def test_split_change_into_stamp_then_command_is_blocked() -> None:
+    assert changes_through_split_directory_into_stamp(SPLIT_CHANGE_FORGE)
+
+
+def test_unrelated_second_change_is_not_blocked() -> None:
+    assert not changes_through_split_directory_into_stamp(UNRELATED_SECOND_CHANGE)
+
+
+def test_pytest_run_is_not_blocked() -> None:
+    assert not changes_through_split_directory_into_stamp(PYTEST_RUN)
+
+
+def test_change_into_stamp_without_following_command_is_not_blocked() -> None:
+    assert not changes_through_split_directory_into_stamp("cd ~/.claude && cd code-review-stamps")
+
+
+def test_pushd_split_change_into_stamp_then_command_is_blocked() -> None:
+    assert changes_through_split_directory_into_stamp(
+        "pushd ~/.claude && pushd code-review-stamps && cp a b"
+    )

package/hooks/blocking/code_verifier_spawn_preflight_gate.py

@@ -1,18 +1,19 @@
 #!/usr/bin/env python3
 """PreToolUse hook: pre-flight gate for the code-verifier subagent spawn.
 
-The hook fires only on an ``Agent`` tool call whose ``subagent_type`` is
+The hook fires on an ``Agent`` or ``Task`` tool call whose ``subagent_type`` is
 ``code-verifier``. Before that verification spawn runs, the hook checks the
 branch for two committability problems against the resolved base ref: a real
 merge conflict (a non-mutating trial-merge of HEAD against the base ref) and a
 CODE_RULES violation on a line added in the working tree since the merge base
-(committed on the branch or uncommitted). When
-either fires, the hook denies the spawn with a reason addressed to the spawning
-agent that names the conflicting files and the violating file:line, so that
-agent fixes them and re-spawns. Both checks fail OPEN on any infrastructure
-problem — a non-repo cwd, an absent base ref, a git or engine failure, or a
-timeout — because the authoritative fail-closed CODE_RULES enforcement already
-runs at Write time and at commit time. The hook never network-fetches and never
+(committed on the branch or uncommitted). When either fires, the hook denies
+the spawn with a reason addressed to the spawning agent that names the
+conflicting files and the violating file:line, so that agent fixes them and
+re-spawns. A CODE_RULES engine import/load failure is fail-closed (deny with a
+named load-failure section). Environmental problems — a non-repo cwd, an
+absent base ref, a git failure, an unreadable file alone, or a timeout — fail
+OPEN because the authoritative fail-closed CODE_RULES enforcement already runs
+at Write time and at commit time. The hook never network-fetches and never
 mutates the index or working tree.
 """
 
@@ -21,6 +22,7 @@ from __future__ import annotations
 import contextlib
 import io
 import json
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -43,6 +45,7 @@ from verification_verdict_store import (  # noqa: E402
 )
 
 from hooks_constants.code_verifier_spawn_preflight_gate_constants import (  # noqa: E402
+    ALL_CODE_VERIFIER_SPAWN_TOOL_NAMES,
     ALL_MERGE_HEAD_PROBE_FLAGS,
     ALL_MERGE_TREE_COMMAND_FLAGS,
     ALL_NAME_ONLY_WORKTREE_DIFF_FLAGS,
@@ -51,6 +54,7 @@ from hooks_constants.code_verifier_spawn_preflight_gate_constants import (  # no
     CODE_RULES_SECTION_HEADER,
     CODE_VERIFIER_SUBAGENT_TYPE,
     DENY_REASON_LEAD,
+    ENGINE_LOAD_FAILURE_SECTION,
     GATE_SCRIPTS_RELATIVE_PATH,
     MERGE_CONFLICT_SECTION_HEADER,
     MERGE_TREE_CLEAN_EXIT_CODE,
@@ -58,9 +62,6 @@ from hooks_constants.code_verifier_spawn_preflight_gate_constants import (  # no
     MERGE_TREE_TIMEOUT_SECONDS,
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.pr_converge_bugteam_enforcer_constants import (  # noqa: E402
-    AGENT_TOOL_NAME,
-)
 
 _scripts_dir = str(Path(__file__).resolve().parents[2] / GATE_SCRIPTS_RELATIVE_PATH)
 if _scripts_dir not in sys.path:
@@ -78,17 +79,17 @@ from code_rules_gate import (  # noqa: E402
 
 
 def _should_run(payload_by_field: dict[str, object]) -> bool:
-    """Return True only for a code-verifier Agent spawn.
+    """Return True only for a code-verifier Agent or Task spawn.
 
     Args:
         payload_by_field: The full PreToolUse hook payload (already
             JSON-parsed), keyed by top-level field name.
 
     Returns:
-        True when the tool is Agent and ``tool_input.subagent_type`` is
-        ``code-verifier``; False for every other shape.
+        True when the tool is Agent or Task and ``tool_input.subagent_type``
+        is ``code-verifier``; False for every other shape.
     """
-    if payload_by_field.get("tool_name", "") != AGENT_TOOL_NAME:
+    if payload_by_field.get("tool_name", "") not in ALL_CODE_VERIFIER_SPAWN_TOOL_NAMES:
         return False
     tool_input = payload_by_field.get("tool_input", {})
     if not isinstance(tool_input, dict):
@@ -297,7 +298,7 @@ def _tracked_file_added_lines(repo_root: str, merge_base_sha: str, relative_path
 def _code_rules_report(
     repo_root: str, all_file_paths: list[Path], all_added_lines_by_path: dict[Path, set[int]]
 ) -> str | None:
-    """Run the CODE_RULES engine and return its blocking report, or None.
+    """Run the CODE_RULES engine and return a full deny section, or None.
 
     Args:
         repo_root: The repository top-level directory.
@@ -306,19 +307,30 @@ def _code_rules_report(
             by resolved absolute path.
 
     Returns:
-        The engine's grouped file:line report when a blocking violation lands
-        on an added line, or None when the surface is clean, only an unreadable
-        changed file caused a non-zero gate exit, the engine fails to load, or
-        any engine error arises — every non-block outcome fails OPEN. The
-        harness hook timeout in hooks.json is the wall-clock bound on a runaway
-        engine.
+        A full deny section when a blocking violation lands on an added line or
+        the CODE_RULES engine fails to import/load (fail-closed). None when the
+        surface is clean, only an unreadable changed file caused a non-zero gate
+        exit, or an environmental engine error arises — those non-block outcomes
+        fail OPEN. The harness hook timeout in hooks.json is the wall-clock
+        bound on a runaway engine.
     """
     if not all_file_paths:
         return None
     try:
         validate_content = load_validate_content()
     except SystemExit:
-        return None
+        return ENGINE_LOAD_FAILURE_SECTION
+    except (
+        ImportError,
+        SyntaxError,
+        AttributeError,
+        RuntimeError,
+        TypeError,
+        NameError,
+        OSError,
+        re.error,
+    ):
+        return ENGINE_LOAD_FAILURE_SECTION
     try:
         blocking_present, captured_report = _run_gate_capturing_stderr(
             validate_content, all_file_paths, Path(repo_root), all_added_lines_by_path
@@ -327,7 +339,7 @@ def _code_rules_report(
         return None
     if not blocking_present:
         return None
-    return captured_report
+    return f"{CODE_RULES_SECTION_HEADER}\n{captured_report.strip()}"
 
 
 def _run_gate_capturing_stderr(
@@ -382,8 +394,8 @@ def _build_deny_reason(
         all_conflicting_files: The conflicting file paths from the conflict
             check, an empty list when clean, or None when that check failed open.
         base_ref: The base ref named in the conflict section header.
-        code_rules_report: The grouped report from the CODE_RULES check, or None
-            when that check found nothing or failed open.
+        code_rules_report: A full CODE_RULES deny section (violations or engine
+            load failure), or None when that check found nothing or failed open.
 
     Returns:
         The full deny reason when either check fired, or None when neither
@@ -395,7 +407,7 @@ def _build_deny_reason(
         conflict_header = MERGE_CONFLICT_SECTION_HEADER.format(base_ref=base_ref)
         reason_sections.append(f"{conflict_header}\n{conflict_lines}")
     if code_rules_report:
-        reason_sections.append(f"{CODE_RULES_SECTION_HEADER}\n{code_rules_report.strip()}")
+        reason_sections.append(code_rules_report.strip())
     if not reason_sections:
         return None
     return DENY_REASON_LEAD + "\n\n" + "\n\n".join(reason_sections)