claude-dev-env 2.21.0 → 2.21.2

package/docs/codex-compatibility.md

@@ -6,9 +6,11 @@
 
 Run `codex-compat materialize --source-root <claude-root> --target-root <codex-root>`. The command defaults to a dry run; add `--apply` to publish files. Use `--python <command>` or `CODEX_COMPAT_PYTHON` to select Python. If no usable interpreter is found, the command reports that condition. The launcher passes an argv array, never a shell command.
 
-The Python materializer maps Claude `_shared/`, `agents/`, `hooks/`, `rules/`, and `scripts/` into the target according to the package's compatibility materialization rules. Claude agent frontmatter is converted to Codex TOML metadata. Unsupported Claude metadata is reported, rather than silently treated as equivalent.
+The Python materializer maps Claude `_shared/`, `agents/`, `hooks/`, `rules/`, and `scripts/` into the target according to the package's compatibility materialization rules. Claude agent frontmatter is converted to Codex TOML metadata. The canonical failure blast-radius rule projects its repository-instruction excerpt into a managed `AGENTS.md` file. Claude metadata reports its supported-field shape.
 
-Rules, hooks, and scripts that have no safe Codex runtime equivalent remain inert or source-only. They are preserved for inspection and are not executed as translated target tools. The capability bridge likewise emits declarative records only; it never invokes the translated surface.
+The Codex hook projection merges a managed `apply_patch` entry for `code_rules_enforcer.py` into the target `hooks.json`. Existing Codex hook entries keep their order, repeated enforcer entries collapse to one deterministic record, and the command resolves under the target root. The enforcer reads the patch command, reconstructs every file's pre-edit and projected post-edit content, and returns a blocking diagnostic for patch shapes requiring correction or code-rule violations. The existing Claude `Write`, `Edit`, and `MultiEdit` dispatcher keeps its current order and behavior.
+
+The capability bridge emits declarative records and leaves translated surfaces for their owning runtime.
 
 Materialization uses a compatibility manifest to identify generated files. Dry runs report the plan without writing. Apply mode uses safe link/copy fallback where linking is unavailable, writes atomically, removes only stale managed files, and rolls back managed changes on failure. A failed rollback reports that reconciliation is required.
 

package/hooks/blocking/AGENTS.md

@@ -71,6 +71,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `bot_mention_comment_blocker.py` | PreToolUse (Write/Edit) | PR review comments that @-mention a bot |
 | `claude_md_orphan_file_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | Per-directory `CLAUDE.md` table cells naming a bare filename absent from the directory subtree |
 | `conventional_pr_title_gate.py` | PreToolUse (Bash) | `gh pr create`/`gh pr edit` with a `--title` that is not a Conventional Commit, in a repo whose CI runs a semantic-pull-request title check |
+| `cursor_cli_python_misfire_blocker.py` | PreToolUse (Bash/PowerShell) | `cursor` / `Cursor.exe` launched against a Python script with code-rules-gate flags, which raises Cursor's EPIPE unknown-option dialog |
 | `destructive_command_blocker.py` | PreToolUse (Bash/PowerShell) | Shell commands with destructive literals (`rm -rf`, `git reset --hard`, etc.) |
 | `docstring_rule_gate_count_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | A stale spelled-out gate-validator count in `docstring-prose-matches-implementation.md` — the "N more gate validators" / "M gated slices" count drifting from the `check_docstring_*` validators the prose names |
 | `duplicate_rmtree_helper_blocker.py` | PreToolUse (Write/Edit) | A local re-definition of the Windows-safe rmtree helper trio (`_strip_read_only_and_retry`, `_force_remove_tree` / `force_rmtree`) in place of importing a shared helper |
@@ -94,7 +95,7 @@ The check modules it calls are the `code_rules_<concern>.py` files below.
 | `precommit_code_rules_gate.py` | PreToolUse (Bash) | Staged changes that fail the CODE_RULES gate at commit time |
 | `pytest_testpaths_orphan_blocker.py` | PreToolUse (Write/Edit/MultiEdit) | New `test_*.py` files created under a directory absent from a package's explicit pytest `testpaths` allowlist |
 | `question_to_user_enforcer.py` | Stop | User-directed questions not routed through `AskUserQuestion` |
-| `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to opening the file with its native Windows app |
+| `send_user_file_open_locally_blocker.py` | PreToolUse (SendUserFile) | A desk-side file attach (`SendUserFile` with `status` not `proactive`); points to `Invoke-Item -LiteralPath` for the native Windows app |
 | `sensitive_file_protector.py` | PreToolUse (Write/Edit/MultiEdit) | Writes to sensitive credential or config files |
 | `session_edit_stage_gate.py` | PreToolUse (Bash) | A `git commit` that would drop files edited this session because they are tracked but left unstaged |
 | `session_handoff_blocker.py` | Stop | Responses suggesting a new session mid-task |

package/hooks/blocking/cursor_cli_python_misfire_blocker.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""PreToolUse hook: deny Cursor launches that mistreat a Python gate script.
+
+Agents sometimes run ``cursor code_rules_gate.py --base origin/main`` (or the
+same shape through ``Cursor.exe`` / ``cursor.cmd``) when the intent is either
+to execute the gate or to open a file. Cursor's main process then hits
+``onUnknownOption`` for the gate flags, ``console.warn`` writes to a closed
+pipe, and Windows shows an EPIPE error dialog — while still opening the
+``.py`` path in the editor.
+
+::
+
+    cursor code_rules_gate.py --base origin/main     flag
+    Cursor.exe gate.py --staged                      flag
+    cursor.cmd path/to/x.py --repo-root .            flag
+    cursor code_rules_gate.py                        ok: editor open, no gate flags
+    cursor -g file.py:10                             ok: editor goto, no gate flags
+    cursor README.md                                 ok: open without gate flags
+    python code_rules_gate.py --base origin/main     ok: real gate run
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.cursor_cli_python_misfire_blocker_constants import (  # noqa: E402
+    ALL_SUPPORTED_TOOL_NAMES,
+    CALLING_HOOK_NAME,
+    COMMAND_KEY,
+    CORRECTIVE_MESSAGE,
+    CURSOR_LAUNCH_PATTERN,
+    DENY_DECISION,
+    GATE_FLAG_PATTERN,
+    GATE_SCRIPT_PATTERN,
+    HOOK_EVENT_NAME,
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+    PERMISSION_DECISION_REASON_KEY,
+    PYTHON_PATH_PATTERN,
+    TOOL_INPUT_KEY,
+    TOOL_NAME_KEY,
+)
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
+    read_hook_input_dictionary_from_stdin,
+)
+
+
+def is_cursor_python_gate_misfire(command: str) -> bool:
+    """Return True when *command* launches Cursor against a gate-shaped Python run.
+
+    Args:
+        command: Raw Bash or PowerShell command string from the tool input.
+
+    Returns:
+        True when Cursor is the launch target, a gate CLI flag is present, and
+        the operands name the gate script or another ``.py`` path.
+    """
+    if not command or not CURSOR_LAUNCH_PATTERN.search(command):
+        return False
+    if not GATE_FLAG_PATTERN.search(command):
+        return False
+    return bool(GATE_SCRIPT_PATTERN.search(command) or PYTHON_PATH_PATTERN.search(command))
+
+
+def main() -> None:
+    hook_input = read_hook_input_dictionary_from_stdin()
+    if hook_input is None:
+        sys.exit(0)
+
+    tool_name = hook_input.get(TOOL_NAME_KEY, "")
+    if tool_name not in ALL_SUPPORTED_TOOL_NAMES:
+        sys.exit(0)
+
+    tool_input = hook_input.get(TOOL_INPUT_KEY) or {}
+    if not isinstance(tool_input, dict):
+        sys.exit(0)
+    command = tool_input.get(COMMAND_KEY, "")
+    if not isinstance(command, str) or not is_cursor_python_gate_misfire(command):
+        sys.exit(0)
+
+    deny_payload = {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: CORRECTIVE_MESSAGE,
+        }
+    }
+    log_hook_block(
+        calling_hook_name=CALLING_HOOK_NAME,
+        hook_event=HOOK_EVENT_NAME,
+        block_reason=CORRECTIVE_MESSAGE,
+        tool_name=str(tool_name),
+    )
+    print(json.dumps(deny_payload))
+    sys.stdout.flush()
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/plain_language_blocker.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""PreToolUse hook that checks AskUserQuestion prose when enabled."""
+
+from __future__ import annotations
+
+import json
+import sys
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from blocking.config.prose_style_enforcement_constants import (  # noqa: E402
+    prose_style_enforcement_enabled_in_environment,
+)
+from hooks_constants.ask_user_question_shape_constants import (  # noqa: E402
+    ASK_USER_QUESTION_TOOL_NAME,
+)
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.plain_language_blocker_constants import (  # noqa: E402
+    ALL_PLAIN_LANGUAGE_TERM_PATTERNS,
+    FENCED_CODE_PATTERN,
+    FILE_PATH_PATTERN,
+    INLINE_CODE_PATTERN,
+    PLAIN_LANGUAGE_BLOCK_PREFIX,
+    PLAIN_LANGUAGE_NOTICE,
+    PLAIN_LANGUAGE_TERM_SEPARATOR,
+    URL_PATTERN,
+)
+from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
+    read_hook_input_dictionary_from_stdin,
+)
+
+
+def strip_non_prose_regions(text: str) -> str:
+    """Remove exact code, URL, and path regions before scanning prose."""
+    without_fenced_code = FENCED_CODE_PATTERN.sub(" ", text)
+    without_inline_code = INLINE_CODE_PATTERN.sub(" ", without_fenced_code)
+    without_urls = URL_PATTERN.sub(" ", without_inline_code)
+    return FILE_PATH_PATTERN.sub(" ", without_urls)
+
+def find_banned_terms(text: str) -> list[tuple[str, str]]:
+    """Return each detected formal term and its familiar replacement."""
+    prose_text = strip_non_prose_regions(text)
+    all_matches: list[tuple[str, str]] = []
+    seen_terms: set[str] = set()
+    for each_pattern, each_replacement in ALL_PLAIN_LANGUAGE_TERM_PATTERNS:
+        match = each_pattern.search(prose_text)
+        if match is None:
+            continue
+        matched_term = match.group(0).lower()
+        if matched_term in seen_terms:
+            continue
+        seen_terms.add(matched_term)
+        all_matches.append((matched_term, each_replacement))
+    return all_matches
+
+
+def _question_prose(payload_by_key: Mapping[str, object]) -> list[str]:
+    """Return question and option-description prose from a tool payload."""
+    raw_tool_input = payload_by_key.get("tool_input", {})
+    if not isinstance(raw_tool_input, Mapping):
+        return []
+    raw_questions = raw_tool_input.get("questions", [])
+    if not isinstance(raw_questions, Sequence) or isinstance(
+        raw_questions, (str, bytes)
+    ):
+        return []
+    all_prose: list[str] = []
+    for each_raw_question in raw_questions:
+        if not isinstance(each_raw_question, Mapping):
+            continue
+        question = each_raw_question.get("question")
+        if isinstance(question, str):
+            all_prose.append(question)
+        raw_options = each_raw_question.get("options", [])
+        if not isinstance(raw_options, Sequence) or isinstance(
+            raw_options, (str, bytes)
+        ):
+            continue
+        for each_raw_option in raw_options:
+            if not isinstance(each_raw_option, Mapping):
+                continue
+            description = each_raw_option.get("description")
+            if isinstance(description, str):
+                all_prose.append(description)
+    return all_prose
+
+
+def evaluate(payload_by_key: Mapping[str, object]) -> str | None:
+    """Return a deny reason for formal AskUserQuestion prose."""
+    if not prose_style_enforcement_enabled_in_environment():
+        return None
+    if payload_by_key.get("tool_name") != ASK_USER_QUESTION_TOOL_NAME:
+        return None
+    all_matches: list[tuple[str, str]] = []
+    for each_prose in _question_prose(payload_by_key):
+        for each_match in find_banned_terms(each_prose):
+            if each_match not in all_matches:
+                all_matches.append(each_match)
+    if not all_matches:
+        return None
+    return build_block_reason(all_matches)
+
+
+def build_block_reason(all_matches: Sequence[tuple[str, str]]) -> str:
+    """Build a concise denial reason with one replacement per detected term."""
+    swaps = PLAIN_LANGUAGE_TERM_SEPARATOR.join(
+        f"{term} -> {replacement}" for term, replacement in all_matches
+    )
+    return f"{PLAIN_LANGUAGE_BLOCK_PREFIX}{swaps}."
+
+
+def build_deny_payload(deny_reason: str) -> dict[str, object]:
+    """Build the standard PreToolUse deny response."""
+    log_hook_block(
+        calling_hook_name="plain_language_blocker.py",
+        hook_event="PreToolUse",
+        block_reason=deny_reason,
+        tool_name=ASK_USER_QUESTION_TOOL_NAME,
+    )
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": deny_reason,
+        },
+        "systemMessage": PLAIN_LANGUAGE_NOTICE,
+        "suppressOutput": True,
+    }
+
+
+def main() -> None:
+    """Read one hook payload and emit a deny response when needed."""
+    payload_by_key = read_hook_input_dictionary_from_stdin()
+    if payload_by_key is None:
+        return
+    deny_reason = evaluate(payload_by_key)
+    if deny_reason is None:
+        return
+    sys.stdout.write(json.dumps(build_deny_payload(deny_reason)) + "\n")
+    sys.stdout.flush()
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pre_tool_use_dispatcher.py

@@ -496,13 +496,15 @@ def _emit_allow_decision(decision: DispatcherDecision) -> None:
     allow_payload: dict[str, object] = {
         "hookSpecificOutput": allow_hook_specific,
     }
-    if decision.all_additional_context:
+    all_unique_additional_context = unique_first_seen_strings(decision.all_additional_context)
+    all_unique_system_messages = unique_first_seen_strings(decision.all_system_messages)
+    if all_unique_additional_context:
         allow_hook_specific["additionalContext"] = CONTEXT_JOIN_SEPARATOR.join(
-            decision.all_additional_context
+            all_unique_additional_context
         )
-    if decision.all_system_messages:
+    if all_unique_system_messages:
         allow_payload["systemMessage"] = SYSTEM_MESSAGE_JOIN_SEPARATOR.join(
-            decision.all_system_messages
+            all_unique_system_messages
         )
     sys.stdout.write(json.dumps(allow_payload) + "\n")
     sys.stdout.flush()

package/hooks/blocking/send_user_file_open_locally_blocker.py

@@ -3,8 +3,9 @@
 
 SendUserFile attaches a file to the session. While the user is at the terminal
 (status "normal" or unset) an attach does not let them see the file — it must
-open on screen in its native Windows app. The one attach allowed
-through is an away-from-desk phone push (status "proactive").
+open on screen in its native Windows app. The corrective message names the
+``Invoke-Item -LiteralPath`` form. The one attach allowed through is an
+away-from-desk phone push (status "proactive").
 """
 
 import json

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -219,6 +219,7 @@ def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
         for each_entry in select_applicable_entries(POWERSHELL_TOOL_NAME)
     ]
     assert powershell_paths == [
+        "blocking/cursor_cli_python_misfire_blocker.py",
         "blocking/unscoped_search_blocker.py",
         "blocking/pii_prevention_blocker.py",
     ]

package/hooks/blocking/test_code_rules_enforcer_codex_apply_patch.py

@@ -143,6 +143,31 @@ def test_codex_payload_blocks_malformed_patch(
 
     stdout = _run_codex_payload(payload, monkeypatch, capsys)
 
+    deny_payload = json.loads(stdout)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+def test_codex_payload_blocks_a_nul_containing_patch_path(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    """A path containing NUL is converted into the standard JSON deny response."""
+    production_directory = _production_directory(tmp_path)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(production_directory),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: unsafe\x00.py\n"
+                "+raise RuntimeError()\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_codex_payload(payload, monkeypatch, capsys)
+
     deny_payload = json.loads(stdout)
     assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]

package/hooks/blocking/test_cursor_cli_python_misfire_blocker.py

@@ -0,0 +1,208 @@
+"""Behavior tests for the Cursor-vs-Python gate misfire PreToolUse hook."""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import pathlib
+import sys
+from unittest import mock
+
+_HOOK_DIR = pathlib.Path(__file__).parent
+if str(_HOOK_DIR) not in sys.path:
+    sys.path.insert(0, str(_HOOK_DIR))
+
+_HOOKS_DIR = str(_HOOK_DIR.parent)
+if _HOOKS_DIR not in sys.path:
+    sys.path.insert(0, _HOOKS_DIR)
+
+hook_spec = importlib.util.spec_from_file_location(
+    "cursor_cli_python_misfire_blocker",
+    _HOOK_DIR / "cursor_cli_python_misfire_blocker.py",
+)
+assert hook_spec is not None
+assert hook_spec.loader is not None
+hook_module = importlib.util.module_from_spec(hook_spec)
+hook_spec.loader.exec_module(hook_module)
+
+is_cursor_python_gate_misfire = hook_module.is_cursor_python_gate_misfire
+
+from hooks_constants.cursor_cli_python_misfire_blocker_constants import (  # noqa: E402
+    CORRECTIVE_MESSAGE,
+    DENY_DECISION,
+)
+
+
+def test_blocks_cursor_with_code_rules_gate_and_base_flag() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            "cursor code_rules_gate.py --base origin/main"
+        )
+        is True
+    )
+
+
+def test_blocks_cursor_exe_with_staged_flag_on_python_path() -> None:
+    assert (
+        is_cursor_python_gate_misfire(r"Cursor.exe C:\temp\helper.py --staged")
+        is True
+    )
+
+
+def test_blocks_cursor_cmd_with_repo_root_flag() -> None:
+    assert (
+        is_cursor_python_gate_misfire("cursor.cmd path/to/module.py --repo-root .")
+        is True
+    )
+
+
+def test_allows_code_rules_gate_path_without_extra_flags() -> None:
+    assert is_cursor_python_gate_misfire("cursor code_rules_gate.py") is False
+
+
+def test_allows_cursor_goto_on_python_file() -> None:
+    assert is_cursor_python_gate_misfire("cursor -g file.py:10") is False
+
+
+def test_allows_cursor_goto_on_code_rules_gate_without_gate_flags() -> None:
+    assert (
+        is_cursor_python_gate_misfire("cursor -g code_rules_gate.py:40") is False
+    )
+
+
+def test_blocks_start_process_cursor_with_quoted_gate_flag() -> None:
+    command = (
+        r'Start-Process Cursor.exe -ArgumentList '
+        r'"C:\temp\helper.py","--staged"'
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_blocks_quoted_full_path_cursor_exe_with_gate_flags() -> None:
+    command = (
+        r"& 'C:\Program Files\Cursor\Cursor.exe' "
+        r"code_rules_gate.py --base origin/main"
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_blocks_unquoted_absolute_cursor_exe_with_gate_flags() -> None:
+    command = (
+        r"C:\Apps\Cursor\Cursor.exe code_rules_gate.py --base origin/main"
+    )
+    assert is_cursor_python_gate_misfire(command) is True
+
+
+def test_allows_relative_path_under_cursor_directory() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            r"cursor\fix\x\code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+    assert (
+        is_cursor_python_gate_misfire(
+            "cursor/fix/x/code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+
+
+def test_allows_cursor_open_of_non_python_file() -> None:
+    assert is_cursor_python_gate_misfire("cursor README.md") is False
+
+
+def test_allows_python_running_the_gate() -> None:
+    assert (
+        is_cursor_python_gate_misfire(
+            "python code_rules_gate.py --base origin/main"
+        )
+        is False
+    )
+
+
+def test_allows_invoke_item() -> None:
+    assert (
+        is_cursor_python_gate_misfire("Invoke-Item -LiteralPath 'C:\\tmp\\a.py'")
+        is False
+    )
+
+
+def test_allows_empty_command() -> None:
+    assert is_cursor_python_gate_misfire("") is False
+
+
+def test_corrective_message_names_python_and_invoke_item() -> None:
+    assert "python" in CORRECTIVE_MESSAGE
+    assert "Invoke-Item -LiteralPath" in CORRECTIVE_MESSAGE
+    assert "EPIPE" in CORRECTIVE_MESSAGE
+
+
+def _run_main_with_io(input_text: str) -> str:
+    with mock.patch("sys.stdin", io.StringIO(input_text)):
+        with mock.patch("sys.stdout", new_callable=io.StringIO) as mock_stdout:
+            try:
+                hook_module.main()
+            except SystemExit:
+                pass
+            return mock_stdout.getvalue()
+
+
+def test_main_denies_bash_misfire() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cursor code_rules_gate.py --base origin/main",
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    output = json.loads(output_text)
+    assert output["hookSpecificOutput"]["permissionDecision"] == DENY_DECISION
+    assert "cursor-python-misfire" in output["hookSpecificOutput"][
+        "permissionDecisionReason"
+    ]
+
+
+def test_main_denies_powershell_misfire() -> None:
+    hook_input = {
+        "tool_name": "PowerShell",
+        "tool_input": {
+            "command": "cursor.cmd code_rules_gate.py --staged",
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    output = json.loads(output_text)
+    assert output["hookSpecificOutput"]["permissionDecision"] == DENY_DECISION
+
+
+def test_main_passes_python_gate_run() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "python code_rules_gate.py --base origin/main",
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
+def test_main_passes_wrong_tool_name() -> None:
+    hook_input = {
+        "tool_name": "Write",
+        "tool_input": {
+            "command": "cursor code_rules_gate.py --base origin/main",
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
+def test_main_passes_malformed_json() -> None:
+    assert _run_main_with_io("not valid json {{{") == ""
+
+
+def test_main_passes_when_tool_input_is_null() -> None:
+    hook_input = {
+        "tool_name": "Bash",
+        "tool_input": None,
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""