claude-dev-env 2.3.0 → 2.5.0

package/hooks/blocking/code_review_stamp_store.py

@@ -0,0 +1,233 @@
+"""Read and write the per-work-tree code-review stamp files.
+
+A stamp records that a clean ``/code-review`` pass ran against an exact branch
+surface at a given effort. Each work tree keeps one JSON file under
+``~/.claude/code-review-stamps/`` mapping an effort token to the surface hash it
+was earned against, so a later push or pull-request gate can ask whether a
+clean review at the needed effort already covers the live surface. This module
+only reads and writes those files; it runs no review.
+
+::
+
+    record_clean_stamp(root, hash_a, "low")
+    stamp_covers_surface(root, hash_a, "low")   -> True   (recorded, matching)
+    stamp_covers_surface(root, hash_a, "xhigh") -> False  (low is below xhigh)
+    stamp_covers_surface(root, hash_b, "low")   -> False  (surface hash differs)
+
+Coverage fails closed: a missing, unreadable, or malformed stamp file, a hash
+that does not match, and an effort below the threshold all read as not covered.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+import time
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parent)
+
+try:
+    from code_review_enforcement_config_bootstrap import (
+        register_code_review_enforcement_constants,
+    )
+    from verified_commit_config_bootstrap import register_verified_commit_constants
+except ModuleNotFoundError:
+    if _blocking_directory not in sys.path:
+        sys.path.insert(0, _blocking_directory)
+    from code_review_enforcement_config_bootstrap import (
+        register_code_review_enforcement_constants,
+    )
+    from verified_commit_config_bootstrap import register_verified_commit_constants
+
+register_code_review_enforcement_constants()
+register_verified_commit_constants()
+
+try:
+    from config.code_review_enforcement_constants import (
+        STAMP_DIRECTORY_NAME,
+        STAMP_KEY_EFFORT,
+        STAMP_KEY_MANIFEST_SHA256,
+        STAMP_KEY_RECORDED_AT_EPOCH,
+        effort_meets_threshold,
+    )
+    from config.verified_commit_constants import (
+        CLAUDE_HOME_DIRECTORY_NAME,
+        VERDICT_JSON_INDENT,
+    )
+    from verification_verdict_store import (
+        branch_surface_manifest,
+        empty_surface_hash,
+        manifest_sha256,
+        resolve_merge_base,
+        resolve_repo_root,
+        root_key_for_repo,
+    )
+except ModuleNotFoundError:
+    if _blocking_directory not in sys.path:
+        sys.path.insert(0, _blocking_directory)
+    from config.code_review_enforcement_constants import (
+        STAMP_DIRECTORY_NAME,
+        STAMP_KEY_EFFORT,
+        STAMP_KEY_MANIFEST_SHA256,
+        STAMP_KEY_RECORDED_AT_EPOCH,
+        effort_meets_threshold,
+    )
+    from config.verified_commit_constants import (
+        CLAUDE_HOME_DIRECTORY_NAME,
+        VERDICT_JSON_INDENT,
+    )
+    from verification_verdict_store import (
+        branch_surface_manifest,
+        empty_surface_hash,
+        manifest_sha256,
+        resolve_merge_base,
+        resolve_repo_root,
+        root_key_for_repo,
+    )
+
+
+def stamp_directory() -> Path:
+    """Return the shared directory holding every work tree's stamp file.
+
+    Stamps live outside any repository (under the user's Claude home) so no repo
+    accumulates untracked stamp files; every work tree's stamp shares this one
+    directory, distinguished by file name.
+
+    Returns:
+        The stamp directory under the user's Claude home.
+    """
+    return Path.home() / CLAUDE_HOME_DIRECTORY_NAME / STAMP_DIRECTORY_NAME
+
+
+def stamp_path_for_repo(repo_root: str) -> Path:
+    """Derive the stamp file path for a repository work tree.
+
+    Keyed by the shared ``root_key_for_repo`` derivation, so every work tree
+    gets its own stamp file and a subdirectory of a work tree resolves to the
+    same key as its root.
+
+    Args:
+        repo_root: The repository top-level directory.
+
+    Returns:
+        The stamp file path for this work tree.
+    """
+    return stamp_directory() / f"{root_key_for_repo(repo_root)}.json"
+
+
+def _read_stamps_by_effort(stamp_file: Path) -> dict[str, object]:
+    """Read the per-effort stamp records for a work tree, or an empty map.
+
+    ::
+
+        <root-key>.json holds {"low": {...}, "xhigh": {...}}  -> that map
+        file missing / unreadable / not a JSON object          -> {}
+
+    A missing, unreadable, or malformed stamp file yields an empty map, so a
+    caller reading it sees no coverage and fails closed.
+
+    Args:
+        stamp_file: The per-work-tree stamp file path.
+
+    Returns:
+        The mapping of effort token to its stored record, or an empty map when
+        the file is absent, unreadable, or not a JSON object.
+    """
+    try:
+        parsed_stamps = json.loads(stamp_file.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    if not isinstance(parsed_stamps, dict):
+        return {}
+    return parsed_stamps
+
+
+def record_clean_stamp(repo_root: str, bound_manifest_sha256: str, effort: str) -> Path:
+    """Write one effort's clean-review stamp for a work tree.
+
+    Reads any existing per-effort records, sets this effort's entry to the given
+    surface hash and the current epoch, and writes the map back. Recording a
+    second effort keeps the first; recording the same effort again overwrites
+    its bound hash.
+
+    Args:
+        repo_root: The repository top-level directory.
+        bound_manifest_sha256: Hash of the branch surface the clean review covered.
+        effort: The effort token the clean review ran at.
+
+    Returns:
+        The stamp file path the record was written to.
+    """
+    stamp_file = stamp_path_for_repo(repo_root)
+    stamp_file.parent.mkdir(parents=True, exist_ok=True)
+    all_stamps_by_effort = _read_stamps_by_effort(stamp_file)
+    all_stamps_by_effort[effort] = {
+        STAMP_KEY_EFFORT: effort,
+        STAMP_KEY_MANIFEST_SHA256: bound_manifest_sha256,
+        STAMP_KEY_RECORDED_AT_EPOCH: int(time.time()),
+    }
+    stamp_file.write_text(
+        json.dumps(all_stamps_by_effort, indent=VERDICT_JSON_INDENT), encoding="utf-8"
+    )
+    return stamp_file
+
+
+def stamp_covers_surface(repo_root: str, live_manifest_sha256: str, required_effort: str) -> bool:
+    """Decide whether a clean stamp covers the live surface at the needed effort.
+
+    A stored entry covers the surface when its bound hash equals the live hash
+    exactly and its effort ranks at or above the required effort. Any missing,
+    unreadable, or malformed stamp reads as not covered.
+
+    Args:
+        repo_root: The repository top-level directory.
+        live_manifest_sha256: Hash of the live branch surface the gate checks.
+        required_effort: The effort the gate demands for the action.
+
+    Returns:
+        True as soon as one stored entry matches the live hash and meets the
+        required effort; False when none match.
+    """
+    all_stamps_by_effort = _read_stamps_by_effort(stamp_path_for_repo(repo_root))
+    for each_stamp_record in all_stamps_by_effort.values():
+        if not isinstance(each_stamp_record, dict):
+            continue
+        if each_stamp_record.get(STAMP_KEY_MANIFEST_SHA256) != live_manifest_sha256:
+            continue
+        stored_effort = each_stamp_record.get(STAMP_KEY_EFFORT)
+        if not isinstance(stored_effort, str):
+            continue
+        if effort_meets_threshold(stored_effort, required_effort):
+            return True
+    return False
+
+
+def live_surface_hash(work_tree_directory: str) -> str | None:
+    """Compute the live branch-surface manifest hash for a work tree.
+
+    Resolves the work tree's repo root and merge base, then hashes the current
+    change surface — every changed path and untracked file bound by its content
+    digest — so the hash tracks the exact bytes under review.
+
+    Args:
+        work_tree_directory: A directory inside the work tree to hash.
+
+    Returns:
+        The surface manifest hash, or None when the directory is outside a work
+        tree, the merge base or manifest cannot be resolved, or the change
+        surface is empty (HEAD equals the merge base, so nothing is under review).
+    """
+    repo_root = resolve_repo_root(work_tree_directory)
+    if repo_root is None:
+        return None
+    merge_base_sha = resolve_merge_base(repo_root)
+    if merge_base_sha is None:
+        return None
+    surface_manifest_text = branch_surface_manifest(repo_root, merge_base_sha)
+    if surface_manifest_text is None:
+        return None
+    surface_hash = manifest_sha256(surface_manifest_text)
+    if surface_hash == empty_surface_hash():
+        return None
+    return surface_hash

package/hooks/blocking/code_review_stamp_write_blocker_parts/__init__.py

@@ -0,0 +1,7 @@
+"""Concern modules of the code-review stamp write blocker, wired by the entry hook.
+
+The entry hook ``code_review_stamp_directory_write_blocker.py`` imports two
+public matchers from this package to keep its own file short: a split
+directory-change matcher and an obfuscated-path-write matcher. Each mirrors the
+sibling verdict-directory guard's logic against the code-review stamp segments.
+"""

package/hooks/blocking/code_review_stamp_write_blocker_parts/conftest.py

@@ -0,0 +1,15 @@
+"""Put the blocking and hooks directories on sys.path for the parts tests.
+
+The concern modules import their shared constants as ``from config...`` against
+the sibling ``blocking/config/`` package, so the tests need the blocking
+directory (which holds that package) and the hooks directory on the path.
+"""
+
+import sys
+from pathlib import Path
+
+_blocking_directory = str(Path(__file__).resolve().parents[1])
+_hooks_directory = str(Path(__file__).resolve().parents[2])
+for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
+    if each_bootstrap_directory not in sys.path:
+        sys.path.insert(0, each_bootstrap_directory)

package/hooks/blocking/code_review_stamp_write_blocker_parts/obfuscated_stamp_path_reference.py

@@ -0,0 +1,212 @@
+"""Decide whether a command builds a stamp path with obfuscation and writes.
+
+A path-obfuscation forge hides ``.claude`` or ``code-review-stamps`` inside hex
+digits, a base64 token, a comma-separated character-code sequence, or a run of
+``+``-joined ``chr(<int>)`` calls, then pairs the assembled path with a
+non-redirect file write (``open(``, ``write_text``, ``Out-File``,
+``Set-Content``, ``Add-Content``, ``tee``). The literal path matchers miss such
+a path because it carries no plain ``code-review-stamps`` substring, so this
+module decodes each embedded token and looks for a stamp-path segment either in
+the decoded text or inside the write call's argument region. A bare ``>``
+redirect to the stamp path is caught by the literal-path matchers, so a command
+whose only write is a redirect is left alone here.
+
+The entry hook registers the constant packages before importing this module, so
+the ``from config...`` imports below resolve against the sibling ``config/``
+package without a bootstrap call here.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import re
+
+from config.code_review_enforcement_constants import (
+    ALL_STAMP_PATH_SEGMENT_BODIES,
+    ALL_STAMP_PATH_SEGMENT_NAMES,
+)
+from config.verified_commit_constants import (
+    BASE64_TOKEN_PATTERN,
+    CHARACTER_CODE_SEQUENCE_PATTERN,
+    CHR_CALL_CHAIN_PATTERN,
+    CHR_CALL_CODE_PATTERN,
+    HEX_DIGITS_PER_BYTE,
+    HEX_TOKEN_PATTERN,
+    NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN,
+    PATH_OBFUSCATION_PRIMITIVE_PATTERN,
+    WRITE_CALL_REGION_PATTERN,
+)
+
+_ASCII_ENCODING = "ascii"
+
+
+def _decode_hex_token(hex_token: str) -> str:
+    """Decode a hex-digit token to text, returning empty text on failure.
+
+    Args:
+        hex_token: A run of hex digits taken from the command.
+
+    Returns:
+        The decoded ASCII text, or empty text when the token is odd-length,
+        not valid hex, or not decodable as ASCII.
+    """
+    odd_hex_token_remainder = 1
+    if len(hex_token) % HEX_DIGITS_PER_BYTE == odd_hex_token_remainder:
+        return ""
+    try:
+        return bytes.fromhex(hex_token).decode(_ASCII_ENCODING)
+    except (ValueError, binascii.Error):
+        return ""
+
+
+def _decode_base64_token(base64_token: str) -> str:
+    """Decode a base64 token to text, returning empty text on failure.
+
+    Args:
+        base64_token: A base64-shaped token taken from the command.
+
+    Returns:
+        The decoded ASCII text, or empty text when the token is not valid
+        base64 or not decodable as ASCII.
+    """
+    try:
+        return base64.b64decode(base64_token, validate=True).decode(_ASCII_ENCODING)
+    except (ValueError, binascii.Error):
+        return ""
+
+
+def _decode_character_code_sequence(code_sequence: str) -> str:
+    """Decode a comma-separated character-code sequence to text.
+
+    Args:
+        code_sequence: A comma-separated run of decimal character codes, each
+            within the three-digit range the source pattern admits.
+
+    Returns:
+        The decoded text.
+    """
+    character_code_separator = ","
+    decoded_characters: list[str] = []
+    for each_code in code_sequence.split(character_code_separator):
+        code_point = int(each_code.strip())
+        decoded_characters.append(chr(code_point))
+    return "".join(decoded_characters)
+
+
+def _decode_chr_call_chain(chr_chain: str) -> str:
+    """Decode a run of ``+``-joined ``chr(<int>)`` calls to text.
+
+    Args:
+        chr_chain: A run of two or more ``+``-joined ``chr(<int>)`` calls taken
+            from the command, each code within the three-digit source range.
+
+    Returns:
+        The decoded text.
+    """
+    decoded_characters: list[str] = []
+    for each_code in re.findall(CHR_CALL_CODE_PATTERN, chr_chain, re.IGNORECASE):
+        decoded_characters.append(chr(int(each_code)))
+    return "".join(decoded_characters)
+
+
+def _append_when_present(all_decoded_texts: list[str], decoded_text: str) -> None:
+    """Append the lowercase decoded text when it is non-empty.
+
+    Args:
+        all_decoded_texts: The running list of decoded texts to extend.
+        decoded_text: One token's decoded text, empty when the token failed.
+
+    Returns:
+        None. The list is extended in place when the text is non-empty.
+    """
+    if decoded_text:
+        all_decoded_texts.append(decoded_text.lower())
+
+
+def _decoded_texts_from_command(command_text: str) -> list[str]:
+    """Decode every hex, base64, character-code, and chr-chain token a command embeds.
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        The lowercase decoded text for every token that decodes cleanly;
+        tokens that fail to decode or carry an out-of-range code are skipped.
+    """
+    all_decoded_texts: list[str] = []
+    for each_hex_token in re.findall(HEX_TOKEN_PATTERN, command_text, re.IGNORECASE):
+        _append_when_present(all_decoded_texts, _decode_hex_token(each_hex_token))
+    for each_base64_token in re.findall(BASE64_TOKEN_PATTERN, command_text):
+        _append_when_present(all_decoded_texts, _decode_base64_token(each_base64_token))
+    for each_code_sequence in re.findall(CHARACTER_CODE_SEQUENCE_PATTERN, command_text):
+        _append_when_present(all_decoded_texts, _decode_character_code_sequence(each_code_sequence))
+    for each_chr_chain in re.findall(CHR_CALL_CHAIN_PATTERN, command_text, re.IGNORECASE):
+        _append_when_present(all_decoded_texts, _decode_chr_call_chain(each_chr_chain))
+    return all_decoded_texts
+
+
+def _decoded_token_references_stamp_segment(command_text: str) -> bool:
+    """Decide whether a decodable token in a command hides a stamp-path segment.
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when a decodable token decodes to a stamp-path segment body
+        (``claude`` or ``code-review-stamps``).
+    """
+    all_decoded_texts = _decoded_texts_from_command(command_text)
+    return any(
+        each_segment_body in each_decoded_text
+        for each_decoded_text in all_decoded_texts
+        for each_segment_body in ALL_STAMP_PATH_SEGMENT_BODIES
+    )
+
+
+def _write_call_region_names_stamp_segment(command_text: str) -> bool:
+    """Decide whether a write call's argument region names a stamp-path segment.
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when a stamp-path segment name appears inside a non-redirect write
+        call's argument region.
+    """
+    write_call_region_pattern = re.compile(WRITE_CALL_REGION_PATTERN, re.IGNORECASE)
+    for each_region_match in write_call_region_pattern.finditer(command_text):
+        lowercased_region = each_region_match.group(0).lower()
+        if any(each_name in lowercased_region for each_name in ALL_STAMP_PATH_SEGMENT_NAMES):
+            return True
+    return False
+
+
+def references_obfuscated_stamp_path(command_text: str) -> bool:
+    """Decide whether a command pairs path obfuscation with a stamp-path write.
+
+    ::
+
+        python -c "open(bytes.fromhex('...code-review-stamps...'),'w')"  -> True
+        open(bytes.fromhex('2f746d702f78'),'w')                          -> False
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when the command holds a path-obfuscation primitive, a
+        non-redirect file write, and a stamp-path segment reachable by that
+        write — either a decoded token anywhere in the command or a plain-text
+        segment inside the write call's argument region.
+    """
+    has_obfuscation_primitive = (
+        re.search(PATH_OBFUSCATION_PRIMITIVE_PATTERN, command_text) is not None
+    )
+    has_non_redirect_write = (
+        re.search(NON_REDIRECT_FILE_WRITE_PRIMITIVE_PATTERN, command_text) is not None
+    )
+    if not (has_obfuscation_primitive and has_non_redirect_write):
+        return False
+    if _decoded_token_references_stamp_segment(command_text):
+        return True
+    return _write_call_region_names_stamp_segment(command_text)

package/hooks/blocking/code_review_stamp_write_blocker_parts/split_directory_change_into_stamp.py

@@ -0,0 +1,138 @@
+"""Decide whether a split directory change reaches the stamp directory then runs a command.
+
+A change into the Claude home (``cd ~/.claude``) followed by a change into a
+relative ``code-review-stamps`` directory (``cd code-review-stamps``) lands in
+the stamp directory without ever naming the two segments adjacently, so the
+absolute-path matcher and the single-step ``cd ~/.claude/code-review-stamps``
+matcher both miss it. The trust contract denies every shell command that
+reaches the stamp directory, so any command after the second change — a
+redirect, ``cp``, ``mv``, ``tee``, ``install``, or a ``python -c`` write — is a
+forge vector. An unrelated second change (``cd hooks``) lands elsewhere and
+passes.
+
+The entry hook registers the constant packages before importing this module, so
+the ``from config...`` imports below resolve against the sibling ``config/``
+package without a bootstrap call here.
+"""
+
+from __future__ import annotations
+
+import re
+
+from config.code_review_enforcement_constants import STAMP_DIRECTORY_CHANGE_TARGET_PATTERN
+from config.verified_commit_constants import (
+    CLAUDE_HOME_DIRECTORY_NAME,
+    CLAUDE_HOME_TARGET_BOUNDARY_PATTERN,
+    COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN,
+    DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN,
+    DIRECTORY_CHANGE_OPTION_TERMINATOR,
+    DIRECTORY_CHANGE_PATH_OPTIONS,
+    DIRECTORY_CHANGE_PATTERN_PREFIX,
+    DIRECTORY_CHANGE_PATTERN_SUFFIX,
+    DIRECTORY_CHANGE_TARGET_PATTERN,
+    DIRECTORY_CHANGE_VERBS,
+)
+from config.verified_commit_gate_output_constants import REGEX_ALTERNATION_SEPARATOR
+
+
+def _directory_change_verbs_pattern() -> str:
+    """Build the alternation of directory-change verbs for a change matcher.
+
+    Returns:
+        The regex alternation of escaped directory-change verbs in sorted order.
+    """
+    return REGEX_ALTERNATION_SEPARATOR.join(
+        re.escape(each_verb) for each_verb in sorted(DIRECTORY_CHANGE_VERBS)
+    )
+
+
+def _directory_change_option_prefix_pattern() -> str:
+    """Build the optional path-option prefix that may precede a change target.
+
+    Returns:
+        The regex matching zero or more leading path-option or terminator
+        tokens, ready to sit between the change suffix and target patterns.
+    """
+    option_alternation = REGEX_ALTERNATION_SEPARATOR.join(
+        re.escape(each_option)
+        for each_option in sorted(
+            DIRECTORY_CHANGE_PATH_OPTIONS | {DIRECTORY_CHANGE_OPTION_TERMINATOR}
+        )
+    )
+    return DIRECTORY_CHANGE_OPTION_PREFIX_PATTERN % option_alternation
+
+
+def directory_change_prefix() -> str:
+    """Build the change-verb prefix shared by the directory-change matchers.
+
+    The stamp-directory write-blocker reuses this same prefix, so a single
+    builder feeds both this module's split-change matchers and the blocker's
+    single-step change matchers, and the two never drift.
+
+    Returns:
+        The regex prefix matching a directory-change verb and any leading
+        path-option tokens, ready for a target pattern to follow.
+    """
+    return (
+        DIRECTORY_CHANGE_PATTERN_PREFIX
+        + _directory_change_verbs_pattern()
+        + DIRECTORY_CHANGE_PATTERN_SUFFIX
+        + _directory_change_option_prefix_pattern()
+    )
+
+
+def _change_into_claude_pattern() -> re.Pattern[str]:
+    """Build the compiled matcher for a directory change into the Claude home.
+
+    Returns:
+        The compiled, case-insensitive pattern matching a change verb into any
+        path ending in ``.claude``.
+    """
+    return re.compile(
+        directory_change_prefix()
+        + DIRECTORY_CHANGE_TARGET_PATTERN
+        + re.escape(CLAUDE_HOME_DIRECTORY_NAME)
+        + CLAUDE_HOME_TARGET_BOUNDARY_PATTERN,
+        re.IGNORECASE,
+    )
+
+
+def _change_into_stamp_pattern() -> re.Pattern[str]:
+    """Build the compiled matcher for a directory change into the stamp directory.
+
+    Returns:
+        The compiled, case-insensitive pattern matching a change verb into a
+        relative ``code-review-stamps`` directory.
+    """
+    return re.compile(
+        directory_change_prefix() + STAMP_DIRECTORY_CHANGE_TARGET_PATTERN, re.IGNORECASE
+    )
+
+
+def changes_through_split_directory_into_stamp(command_text: str) -> bool:
+    """Decide whether a split change reaches the stamp directory then runs a command.
+
+    ::
+
+        cd ~/.claude && cd code-review-stamps && echo x > f.json  -> True
+        cd ~/.claude && cd hooks && echo x > f.json               -> False
+
+    Args:
+        command_text: The raw command string from the tool payload.
+
+    Returns:
+        True when a change into the Claude home precedes a change into a
+        relative stamp directory that is itself followed by any further command.
+    """
+    change_into_claude_match = _change_into_claude_pattern().search(command_text)
+    if change_into_claude_match is None:
+        return False
+    change_into_stamp_match = _change_into_stamp_pattern().search(
+        command_text, change_into_claude_match.end()
+    )
+    if change_into_stamp_match is None:
+        return False
+    command_after_change_pattern = re.compile(COMMAND_AFTER_DIRECTORY_CHANGE_PATTERN)
+    return (
+        command_after_change_pattern.search(command_text, change_into_stamp_match.end()) is not None
+    )

package/hooks/blocking/code_review_stamp_write_blocker_parts/test_obfuscated_stamp_path_reference.py

@@ -0,0 +1,49 @@
+"""Behavioral tests for the obfuscated-stamp-path matcher.
+
+The matcher blocks a command that assembles a stamp path from hex, base64, or
+``chr(<int>)`` codes and pairs it with a non-redirect file write, while a
+decode-to-other-path one-liner passes.
+"""
+
+from __future__ import annotations
+
+from code_review_stamp_write_blocker_parts.obfuscated_stamp_path_reference import (
+    references_obfuscated_stamp_path,
+)
+
+STAMP_PATH_TEXT = "/.claude/code-review-stamps/a.json"
+BENIGN_PATH_TEXT = "/tmp/x"
+
+
+def _hex_forge_command(path_text: str) -> str:
+    return f"python -c \"open(bytes.fromhex('{path_text.encode().hex()}'),'w').write('x')\""
+
+
+def _chr_chain_forge_command(path_text: str) -> str:
+    chr_chain = "+".join(f"chr({ord(each_character)})" for each_character in path_text)
+    return f"python -c \"open({chr_chain},'w').write('x')\""
+
+
+def _character_code_forge_command(path_text: str) -> str:
+    comma_separated_codes = ",".join(str(ord(each_character)) for each_character in path_text)
+    return f"python -c \"open(bytes([{comma_separated_codes}]),'w').write('x')\""
+
+
+def test_hex_assembled_stamp_path_write_is_blocked() -> None:
+    assert references_obfuscated_stamp_path(_hex_forge_command(STAMP_PATH_TEXT))
+
+
+def test_character_code_assembled_stamp_path_write_is_blocked() -> None:
+    assert references_obfuscated_stamp_path(_character_code_forge_command(STAMP_PATH_TEXT))
+
+
+def test_chr_chain_assembled_stamp_path_write_is_blocked() -> None:
+    assert references_obfuscated_stamp_path(_chr_chain_forge_command(STAMP_PATH_TEXT))
+
+
+def test_decode_to_other_path_write_is_not_blocked() -> None:
+    assert not references_obfuscated_stamp_path(_hex_forge_command(BENIGN_PATH_TEXT))
+
+
+def test_redirect_only_stamp_reference_is_left_to_literal_matchers() -> None:
+    assert not references_obfuscated_stamp_path("echo x > ~/.claude/code-review-stamps/a.json")