claude-dev-env 2.30.0 → 2.31.0

package/hooks/blocking/test_code_rules_enforcer_multi_edit.py

@@ -0,0 +1,118 @@
+"""Behavior tests for code_rules_enforcer's MultiEdit reconstruction.
+
+A MultiEdit payload carries an ``edits`` list rather than a single
+``old_string``/``new_string`` pair. These tests prove the enforcer reconstructs
+the whole post-edit file from every entry in that list — not only the first —
+so a violation introduced by the second or later edit is denied exactly like
+one introduced by the first.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Callable
+
+import pytest
+
+from code_rules_enforcer import main
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
+_TWO_FUNCTION_SOURCE = (
+    "def first_helper() -> int:\n    return 1\n\n\ndef second_helper() -> int:\n    return 2\n"
+)
+
+
+def _production_directory(tmp_path: Path) -> Path:
+    """Return a sibling directory whose path carries no test-name substring.
+
+    ``code_rules_enforcer``'s own path-based exemptions treat any path segment
+    matching a test-name pattern as a test file, and pytest's ``tmp_path``
+    embeds the test function's name, so scanning directly under ``tmp_path``
+    would be silently exempted. A sibling directory named after ordinary
+    production code sidesteps that.
+    """
+    production_directory = tmp_path.parent / "multi-edit-prod"
+    production_directory.mkdir(exist_ok=True)
+    return production_directory
+
+
+def _run_multi_edit(
+    file_path: str,
+    all_edits: list[dict[str, str]],
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> str:
+    stdout_text, _exit_code = run_serialized_payload_entrypoint(
+        main, multi_edit_payload(file_path, all_edits)
+    )
+    return stdout_text
+
+
+def test_violation_in_second_edit_is_denied(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """A library print() introduced only by the second edit is caught and denied."""
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    target_file = _production_directory(tmp_path) / "services.py"
+    target_file.write_text(_TWO_FUNCTION_SOURCE, encoding="utf-8")
+
+    stdout_text = _run_multi_edit(
+        str(target_file),
+        [
+            {"old_string": "return 1", "new_string": "return 11"},
+            {
+                "old_string": "    return 2",
+                "new_string": "    print(2)\n    return 2",
+            },
+        ],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip(), "expected a deny payload, got no output"
+    deny_payload = json.loads(stdout_text)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    deny_reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"].lower()
+    assert "print" in deny_reason
+
+
+def test_multi_edit_on_a_missing_target_is_allowed(
+    tmp_path: Path, multi_edit_payload: Callable[[str, list[dict[str, str]]], str]
+) -> None:
+    """A MultiEdit naming a target file that does not exist on disk is not denied.
+
+    The reconstruction has no prior content to read, so it returns no
+    validatable view rather than crashing or denying a payload it cannot judge.
+    """
+    missing_target = _production_directory(tmp_path) / "not_on_disk.py"
+
+    stdout_text = _run_multi_edit(
+        str(missing_target),
+        [{"old_string": "return 1", "new_string": "return 11"}],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip() == ""
+
+
+def test_clean_multi_edit_is_allowed(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """A MultiEdit whose reconstructed file carries no violation is allowed."""
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    target_file = _production_directory(tmp_path) / "services.py"
+    target_file.write_text(_TWO_FUNCTION_SOURCE, encoding="utf-8")
+
+    stdout_text = _run_multi_edit(
+        str(target_file),
+        [
+            {"old_string": "return 1", "new_string": "return 11"},
+            {"old_string": "return 2", "new_string": "return 22"},
+        ],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip() == ""

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -23,6 +23,8 @@ from code_rules_enforcer import (  # noqa: E402
     validate_content_for_full_gate as validate_content,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 PRODUCTION_FILE_PATH = "packages/app/services.py"
 

package/hooks/blocking/test_code_rules_enforcer_precheck_forecast.py

@@ -26,6 +26,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_serialized_payload_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 _ENFORCER_SCRIPT_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"

package/hooks/blocking/test_code_rules_enforcer_split_constants_config.py

@@ -6,6 +6,8 @@ import sys
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
+
 _BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
 _HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
 if _BLOCKING_DIRECTORY not in sys.path:
@@ -103,7 +105,19 @@ def test_scan_function_body_constants_does_not_flag_module_level() -> None:
     assert advisory_issues == []
 
 
-def test_advisory_should_not_flag_class_attribute_after_method_def() -> None:
+def _advisory_stderr(source: str, capsys: pytest.CaptureFixture[str]) -> str:
+    """Run the advisory check over source and hand back what it wrote to stderr.
+
+    The check returns nothing, so stderr is the only place a finding shows up.
+    """
+    code_rules_enforcer.check_constants_outside_config_advisory(
+        source,
+        "example_module.py",
+    )
+    return capsys.readouterr().err
+
+
+def test_advisory_should_not_flag_class_attribute_after_method_def(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_class_attribute_after_method = (
         "class ExampleModel:\n"
         "    def method_a(self) -> None:\n"
@@ -111,49 +125,40 @@ def test_advisory_should_not_flag_class_attribute_after_method_def() -> None:
         "\n"
         "    TABLE_NAME = \"example\"\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_class_attribute_after_method,
-        "example_module.py",
-    )
-    assert advisory_issues == [], (
+    flagged_names = _advisory_stderr(source_with_class_attribute_after_method, capsys)
+    assert flagged_names == "", (
         "Class-level TABLE_NAME attribute must not be flagged as function-local"
     )
 
 
-def test_advisory_should_still_flag_actual_method_body_constant() -> None:
+def test_advisory_should_still_flag_actual_method_body_constant(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_method_body_constant = (
         "class ExampleModel:\n"
         "    def method_a(self) -> None:\n"
         "        MAXIMUM_RETRIES = 3\n"
         "        return None\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_method_body_constant,
-        "example_module.py",
-    )
-    assert len(advisory_issues) == 1, (
-        "Method-body UPPER_SNAKE constant must still surface as advisory"
+    flagged_names = _advisory_stderr(source_with_method_body_constant, capsys)
+    assert "MAXIMUM_RETRIES" in flagged_names, (
+        f"Method-body UPPER_SNAKE constant must still surface as advisory, "
+        f"got: {flagged_names!r}"
     )
-    assert "MAXIMUM_RETRIES" in advisory_issues[0]
 
 
-def test_advisory_should_flag_annotated_function_body_constant() -> None:
+def test_advisory_should_flag_annotated_function_body_constant(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_annotated_function_body_constant = (
         "def example_function() -> None:\n"
         "    MAXIMUM_RETRIES: int = 3\n"
         "    return None\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_annotated_function_body_constant,
-        "example_module.py",
+    flagged_names = _advisory_stderr(source_with_annotated_function_body_constant, capsys)
+    assert "MAXIMUM_RETRIES" in flagged_names, (
+        f"Annotated function-body UPPER_SNAKE constant (PEP 526) must surface as advisory, "
+        f"got: {flagged_names!r}"
     )
-    assert len(advisory_issues) == 1, (
-        "Annotated function-body UPPER_SNAKE constant (PEP 526) must surface as advisory"
-    )
-    assert "MAXIMUM_RETRIES" in advisory_issues[0]
 
 
-def test_advisory_should_flag_outer_constants_after_nested_def() -> None:
+def test_advisory_should_flag_outer_constants_after_nested_def(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_nested_def = (
         "def outer():\n"
         "    OUTER_CONST = 1\n"
@@ -161,11 +166,7 @@ def test_advisory_should_flag_outer_constants_after_nested_def() -> None:
         "        INNER_CONST = 2\n"
         "    ANOTHER_OUTER = 3\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_nested_def,
-        "example_module.py",
-    )
-    flagged_names = " ".join(advisory_issues)
+    flagged_names = _advisory_stderr(source_with_nested_def, capsys)
     assert "OUTER_CONST" in flagged_names, (
         "OUTER_CONST before nested def must be flagged"
     )

package/hooks/blocking/test_code_rules_enforcer_split_entry_2.py

@@ -36,6 +36,8 @@ code_rules_enforcer = SimpleNamespace(
     validate_content=validate_content,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 def _oversized_function_source(name: str) -> str:
     body_line_count = code_rules_enforcer.FUNCTION_LENGTH_BLOCKING_THRESHOLD - 1

package/hooks/blocking/test_code_rules_enforcer_stage.py

@@ -33,6 +33,8 @@ from code_rules_gate_parts.tests._repo_test_helpers import (  # noqa: E402
     write_commit_and_stage_change,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 PRODUCTION_FILE_PATH = "packages/app/services.py"
 ENFORCER_SCRIPT_PATH = Path(__file__).with_name("code_rules_enforcer.py")

package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias_hook_routing.py

@@ -36,6 +36,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_write_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 PASS_THROUGH_ALIAS_SOURCE = (
     "def find_bare_path_segments(content: str) -> set[str]:\n"
     "    return {part for part in content.split() if part}\n"

package/hooks/blocking/test_code_rules_validation_phase.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import ast
 import contextlib
 import importlib
 import importlib.util
@@ -10,6 +11,7 @@ import re
 import shutil
 import sys
 import tempfile
+import textwrap
 from pathlib import Path
 from types import ModuleType
 from unittest.mock import DEFAULT, MagicMock, patch
@@ -279,3 +281,52 @@ def test_gate_running_selects_the_full_gate(tmp_path: Path) -> None:
     assert scoped_violations is not None
     blocking_violations, _advisory_violations = scoped_violations
     assert any("9999" in each_issue for each_issue in blocking_violations)
+
+
+ALL_CHECK_FUNCTION_NAME_PREFIXES = ("check_", "advise_")
+
+
+def _check_names_called_in(enforcer_function_name: str) -> set[str]:
+    """Return the check-function names called directly inside a phase router.
+
+    Parses the router's own source and collects every direct call to a
+    module-level name beginning with a check prefix, so a roster constant can
+    assert against the calls production really makes rather than against a
+    second hand-written literal.
+
+    Args:
+        enforcer_function_name: The attribute name of the router on the
+            enforcer module, such as ``_python_full_gate_only_issues``.
+
+    Returns:
+        The set of check-function names the router calls directly.
+    """
+    router_source = textwrap.dedent(
+        inspect.getsource(getattr(code_rules_enforcer, enforcer_function_name))
+    )
+    return {
+        each_node.func.id
+        for each_node in ast.walk(ast.parse(router_source))
+        if isinstance(each_node, ast.Call)
+        and isinstance(each_node.func, ast.Name)
+        and each_node.func.id.startswith(ALL_CHECK_FUNCTION_NAME_PREFIXES)
+    }
+
+
+def test_full_gate_only_roster_matches_the_checks_the_router_calls() -> None:
+    """The roster constant tracks the calls in _python_full_gate_only_issues."""
+    assert (
+        _check_names_called_in("_python_full_gate_only_issues")
+        == validation_phase_constants.ALL_FULL_GATE_ONLY_CHECK_NAMES
+    ), "ALL_FULL_GATE_ONLY_CHECK_NAMES must name exactly the router's own calls"
+
+
+def test_hook_infrastructure_edit_lane_roster_matches_the_checks_the_router_calls() -> None:
+    """The roster constant tracks the always-run calls in the hook-infrastructure router."""
+    all_always_run_check_names = _check_names_called_in(
+        "_hook_infrastructure_blocking_issues"
+    ) - validation_phase_constants.ALL_FULL_GATE_ONLY_CHECK_NAMES
+    assert (
+        all_always_run_check_names
+        == validation_phase_constants.ALL_HOOK_INFRASTRUCTURE_EDIT_LANE_CHECK_NAMES
+    ), "ALL_HOOK_INFRASTRUCTURE_EDIT_LANE_CHECK_NAMES must name exactly the router's own calls"

package/hooks/blocking/test_codex_apply_patch.py

@@ -0,0 +1,43 @@
+"""Tests for the Codex apply_patch path-only target resolver."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from codex_apply_patch import (
+    CODEX_ADD_OPERATION,
+    CodexPatchError,
+    codex_patch_operation_targets,
+)
+
+
+def test_codex_patch_operation_targets_names_every_section_without_reading_content(
+    tmp_path: Path, three_operation_patch: str
+) -> None:
+    """The path-only helper resolves every section's target without any disk read.
+
+    Unlike ``parse_codex_apply_patch``, it never reads prior file content, so a
+    caller that only needs each target path is not tripped up by an unreadable
+    prior file.
+    """
+    all_targets = codex_patch_operation_targets(three_operation_patch, str(tmp_path))
+
+    all_target_names = {
+        (each_operation, str(each_path).rsplit("/", 1)[-1])
+        for each_operation, each_path in all_targets
+    }
+    assert all_target_names == {
+        ("update", "updated.py"),
+        (CODEX_ADD_OPERATION, "added.py"),
+        ("delete", "deleted.py"),
+    }
+
+
+def test_codex_patch_operation_targets_rejects_path_traversal(tmp_path: Path) -> None:
+    """A patch path that escapes the working directory is rejected before any read."""
+    escaping_patch = "*** Begin Patch\n*** Add File: ../outside.py\n+content\n*** End Patch"
+
+    with pytest.raises(CodexPatchError):
+        codex_patch_operation_targets(escaping_patch, str(tmp_path))

package/hooks/blocking/test_duplicate_rmtree_helper_blocker.py

@@ -205,6 +205,74 @@ def test_extract_payload_text_returns_empty_for_unknown_tool() -> None:
     assert extracted == ("", "")
 
 
+def test_every_applicable_tool_name_reads_payload_text() -> None:
+    """extract_payload_text reads content for every name the shared constant lists."""
+    for each_applicable_tool_name in hook_module.ALL_APPLICABLE_TOOL_NAMES:
+        _file_path, scanned_text = extract_payload_text(
+            each_applicable_tool_name,
+            {
+                "file_path": "foo.py",
+                "content": "abc",
+                "new_string": "abc",
+                "edits": [{"old_string": "a", "new_string": "abc"}],
+            },
+        )
+        assert scanned_text, f"{each_applicable_tool_name} must read some scanned text"
+
+
+def test_extract_payload_text_reads_every_multi_edit_new_string() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": "def force_rmtree(target_path):\n    pass"},
+            ],
+        },
+    )
+    assert extracted[0] == "foo.py"
+    assert "force_rmtree" in extracted[1]
+
+
+def test_main_blocks_trio_copy_introduced_by_second_multi_edit() -> None:
+    """A helper definition in the second edit of a MultiEdit is caught, not only the first."""
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "shared_utils/samsung_utils/cert_failure_processor/parser.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": COPIED_TRIO},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    response_payload = json.loads(stdout_text)
+    decision_block = response_payload["hookSpecificOutput"]
+    assert decision_block["permissionDecision"] == "deny"
+    assert "duplicate-rmtree-helper" in decision_block["permissionDecisionReason"]
+
+
+def test_main_allows_clean_multi_edit() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "shared_utils/samsung_utils/cert_failure_processor/parser.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": "b = 22"},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
 def _run_hook_with_stdin_text(stdin_text: str) -> tuple[str, str, int]:
     captured_stdout = io.StringIO()
     captured_stderr = io.StringIO()

package/hooks/blocking/test_hook_prose_detector_consistency.py

@@ -193,6 +193,16 @@ def test_written_content_reads_edit_new_string() -> None:
     assert written_content("Edit", edit_input) == "edited body"
 
 
+def test_written_content_reads_every_multi_edit_new_string() -> None:
+    multi_edit_input = {
+        "edits": [
+            {"old_string": "a = 1", "new_string": "a = 11"},
+            {"old_string": "b = 2", "new_string": _OVERSTATED_MESSAGE_MODULE},
+        ]
+    }
+    assert _OVERSTATED_MESSAGE_MODULE in written_content("MultiEdit", multi_edit_input)
+
+
 def _run_main_with_io(
     input_text: str, *, is_prose_style_enabled: bool = True
 ) -> str:
@@ -248,6 +258,37 @@ def test_main_blocks_overstated_hook_module_edit() -> None:
     assert payload["hookSpecificOutput"]["permissionDecision"] == "deny"
 
 
+def test_main_blocks_overstatement_introduced_by_second_multi_edit() -> None:
+    """An overstated claim in the second edit of a MultiEdit is caught, not only the first."""
+    hook_input = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/repo/hooks/hooks_constants/some_blocker_constants.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": _OVERSTATED_MESSAGE_MODULE},
+            ],
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    payload = json.loads(output_text)
+    assert payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_main_passes_clean_multi_edit() -> None:
+    hook_input = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/repo/hooks/hooks_constants/some_blocker_constants.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": _FIXED_MESSAGE_MODULE},
+            ],
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
 def test_main_passes_fixed_hook_module_write() -> None:
     hook_input = {
         "tool_name": "Write",

package/hooks/blocking/test_pii_payload_scan.py

@@ -13,12 +13,22 @@ _HOOK_DIR = Path(__file__).parent
 _HOOKS_DIR = _HOOK_DIR.parent
 
 try:
-    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+    from pii_payload_scan import (
+        evaluate_apply_patch_payload,
+        evaluate_post_body_texts,
+        evaluate_write_edit_payload,
+    )
 except ImportError:
     for each_bootstrap_directory in (str(_HOOK_DIR), str(_HOOKS_DIR)):
         if each_bootstrap_directory not in sys.path:
             sys.path.insert(0, each_bootstrap_directory)
-    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+    from pii_payload_scan import (
+        evaluate_apply_patch_payload,
+        evaluate_post_body_texts,
+        evaluate_write_edit_payload,
+    )
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
 _ALLOW_SLUG = "AllowOwner/allow-repo"
 _OTHER_SLUG = "OtherOwner/other-repo"
@@ -166,3 +176,56 @@ def test_allowlisted_value_under_missing_nested_parent_is_allowed(
     nested_target = repository_root / "new_dir" / "deeper" / "notes.md"
     assert not nested_target.parent.exists()
     assert _write_deny_reason(nested_target, allowed_value) is None
+
+
+def test_apply_patch_add_with_pii_is_denied(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = evaluate_apply_patch_payload(
+        {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                f"+Reach me at {_assembled_fixture_email()}\n"
+                "*** End Patch"
+            )
+        },
+        hook_payload={"cwd": str(repository_root)},
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_apply_patch_add_with_clean_content_is_allowed(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = evaluate_apply_patch_payload(
+        {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                "+nothing sensitive here\n"
+                "*** End Patch"
+            )
+        },
+        hook_payload={"cwd": str(repository_root)},
+    )
+    assert deny_reason is None
+
+
+def test_apply_patch_payload_accepts_the_tool_input_keyword(tmp_path: Path) -> None:
+    """evaluate_apply_patch_payload's first parameter is named all_tool_input."""
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = evaluate_apply_patch_payload(
+        all_tool_input={
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                "+nothing sensitive here\n"
+                "*** End Patch"
+            )
+        },
+        hook_payload={"cwd": str(repository_root)},
+    )
+    assert deny_reason is None