claude-dev-env 2.30.0 → 2.31.0

package/hooks/blocking/test_pii_prevention_blocker.py

@@ -6,6 +6,7 @@ import json
 import subprocess
 import sys
 from pathlib import Path
+from typing import Callable
 
 import pytest
 
@@ -37,7 +38,6 @@ from pii_prevention_blocker import (  # noqa: E402
 
 HOOK_PATH = _HOOK_DIR / "pii_prevention_blocker.py"
 
-SYNTHETIC_GITHUB_TOKEN = "ghp_" + ("C" * 36)
 SYNTHETIC_REAL_EMAIL = "owner.fixture@acme-corp.example.io"
 SYNTHETIC_HOME_PATH = r"C:\Users\fixture_commit_user\secret.txt"
 SYNTHETIC_PRIVATE_IP = "10.44.12.9"
@@ -173,14 +173,12 @@ def test_gh_body_file_reads_relative_path_from_working_directory(
     assert "email" in deny_reason
 
 
-def test_gh_post_body_with_secret_is_denied() -> None:
-    command = (
-        f'gh pr comment 12 --body "auth material {SYNTHETIC_GITHUB_TOKEN}"'
-    )
+def test_gh_post_body_with_secret_is_denied(synthetic_github_token: str) -> None:
+    command = f'gh pr comment 12 --body "auth material {synthetic_github_token}"'
     deny_reason = evaluate_bash_command(command, working_directory=None)
     assert deny_reason is not None
     assert "secret" in deny_reason
-    assert SYNTHETIC_GITHUB_TOKEN not in deny_reason
+    assert synthetic_github_token not in deny_reason
 
 
 def test_gh_post_clean_body_is_allowed() -> None:
@@ -201,12 +199,12 @@ def test_mcp_github_body_with_private_ip_is_denied() -> None:
     assert "private-ip" in deny_reason
 
 
-def test_subprocess_hook_denies_write_with_token() -> None:
+def test_subprocess_hook_denies_write_with_token(synthetic_github_token: str) -> None:
     payload = {
         "tool_name": "Write",
         "tool_input": {
             "file_path": "src/config.env.example.md",
-            "content": f"TOKEN={SYNTHETIC_GITHUB_TOKEN}\n",
+            "content": f"TOKEN={synthetic_github_token}\n",
         },
     }
     exit_code, stdout_text = _run_hook(payload)
@@ -217,7 +215,7 @@ def test_subprocess_hook_denies_write_with_token() -> None:
     reason = payload_out["hookSpecificOutput"]["permissionDecisionReason"]
     assert decision == "deny"
     assert "secret" in reason
-    assert SYNTHETIC_GITHUB_TOKEN not in reason
+    assert synthetic_github_token not in reason
 
 
 def test_subprocess_hook_allows_clean_write() -> None:
@@ -362,7 +360,9 @@ def test_dispatcher_roster_hosts_pii_blocker() -> None:
         if each_entry.script_relative_path == "blocking/pii_prevention_blocker.py"
     ]
     assert len(matching_write_entries) == 1
-    assert matching_write_entries[0].applicable_tool_names == ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES
+    assert matching_write_entries[0].applicable_tool_names == (
+        ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES | {"apply_patch"}
+    )
     assert matching_write_entries[0].is_blocking is True
     matching_bash_entries = [
         each_entry
@@ -1202,3 +1202,73 @@ def test_post_body_still_scans_when_repository_is_exempt(
     )
     assert deny_reason is not None
     assert "email" in deny_reason
+
+
+def test_apply_patch_add_with_real_email_is_denied(
+    tmp_path: Path, init_bare_git_repo: Callable[[Path], None]
+) -> None:
+    repository_root = tmp_path / "repo"
+    init_bare_git_repo(repository_root)
+    deny_reason = evaluate(
+        {
+            "tool_name": "apply_patch",
+            "cwd": str(repository_root),
+            "tool_input": {
+                "command": (
+                    "*** Begin Patch\n"
+                    "*** Add File: notes.md\n"
+                    f"+Reach me at {SYNTHETIC_REAL_EMAIL}\n"
+                    "*** End Patch"
+                )
+            },
+        }
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_apply_patch_add_with_clean_content_is_allowed(
+    tmp_path: Path, init_bare_git_repo: Callable[[Path], None]
+) -> None:
+    repository_root = tmp_path / "repo"
+    init_bare_git_repo(repository_root)
+    deny_reason = evaluate(
+        {
+            "tool_name": "apply_patch",
+            "cwd": str(repository_root),
+            "tool_input": {
+                "command": (
+                    "*** Begin Patch\n"
+                    "*** Add File: notes.md\n"
+                    "+Reach me at user@example.com\n"
+                    "*** End Patch"
+                )
+            },
+        }
+    )
+    assert deny_reason is None
+
+
+def test_subprocess_hook_denies_apply_patch_add_with_token(
+    tmp_path: Path,
+    init_bare_git_repo: Callable[[Path], None],
+    synthetic_github_token: str,
+) -> None:
+    """The standalone hook process denies an apply_patch payload carrying a token."""
+    repository_root = tmp_path / "repo"
+    init_bare_git_repo(repository_root)
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(repository_root),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                f"+token is {synthetic_github_token}\n"
+                "*** End Patch"
+            )
+        },
+    }
+    returncode, stdout = _run_hook(payload)
+    assert returncode == 0
+    assert json.loads(stdout)["hookSpecificOutput"]["permissionDecision"] == "deny"

package/hooks/blocking/test_pr_description_writer_gate.py

@@ -0,0 +1,216 @@
+"""Unit tests for the pr-description-writer PreToolUse gate on gh pr create."""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import sys
+from pathlib import Path
+from unittest import mock
+
+import pytest
+
+_BLOCKING_DIRECTORY = Path(__file__).resolve().parent
+_HOOKS_DIRECTORY = _BLOCKING_DIRECTORY.parent
+for each_directory in (_BLOCKING_DIRECTORY, _HOOKS_DIRECTORY):
+    if str(each_directory) not in sys.path:
+        sys.path.insert(0, str(each_directory))
+
+_GATE_SPEC = importlib.util.spec_from_file_location(
+    "pr_description_writer_gate",
+    _BLOCKING_DIRECTORY / "pr_description_writer_gate.py",
+)
+assert _GATE_SPEC is not None
+assert _GATE_SPEC.loader is not None
+gate_module = importlib.util.module_from_spec(_GATE_SPEC)
+_GATE_SPEC.loader.exec_module(gate_module)
+
+_GATE_CONSTANTS = importlib.import_module(
+    "hooks_constants.pr_description_writer_gate_constants"
+)
+_PR_DESCRIPTION_WRITER_SUBAGENT_TYPE = _GATE_CONSTANTS.PR_DESCRIPTION_WRITER_SUBAGENT_TYPE
+
+_SESSION_ID = "session-abc123"
+_PLAIN_CREATE_COMMAND = 'gh pr create --draft --title "feat: add it" --body-file body.md'
+
+
+def _payload(command: str, tool_name: str = "Bash") -> dict[str, object]:
+    """Build a PreToolUse payload carrying one shell command.
+
+    Args:
+        command: The shell command the gate inspects.
+        tool_name: The tool the command runs through.
+
+    Returns:
+        The payload dictionary the gate reads from stdin.
+    """
+    return {
+        "tool_name": tool_name,
+        "session_id": _SESSION_ID,
+        "tool_input": {"command": command},
+    }
+
+
+def _printed_output_for(command: str, temp_directory: Path, tool_name: str = "Bash") -> str:
+    """Run the gate against one command and return everything it printed.
+
+    Args:
+        command: The shell command the gate inspects.
+        temp_directory: The directory standing in for the system temp root.
+        tool_name: The tool the command runs through.
+
+    Returns:
+        The gate's stripped stdout — empty on an allow.
+    """
+    captured_stdout = io.StringIO()
+    payload_text = json.dumps(_payload(command, tool_name))
+    with (
+        mock.patch("sys.stdin", io.StringIO(payload_text)),
+        mock.patch("sys.stdout", captured_stdout),
+        mock.patch.object(gate_module.tempfile, "gettempdir", return_value=str(temp_directory)),
+        pytest.raises(SystemExit),
+    ):
+        gate_module.main()
+    return captured_stdout.getvalue().strip()
+
+
+def _decision_for(command: str, temp_directory: Path, tool_name: str = "Bash") -> str:
+    """Return the gate's permission decision for one command.
+
+    Args:
+        command: The shell command the gate inspects.
+        temp_directory: The directory standing in for the system temp root.
+        tool_name: The tool the command runs through.
+
+    Returns:
+        The ``permissionDecision`` string, or an empty string on an allow.
+    """
+    printed_text = _printed_output_for(command, temp_directory, tool_name)
+    if not printed_text:
+        return ""
+    hook_output = json.loads(printed_text).get("hookSpecificOutput", {})
+    return str(hook_output.get("permissionDecision", ""))
+
+
+def _record_spawn(temp_directory: Path, session_id: str = _SESSION_ID) -> None:
+    """Write the marker file that stands for a recorded agent spawn.
+
+    Args:
+        temp_directory: The directory standing in for the system temp root.
+    """
+    marker_name = (
+        f"{gate_module.SPAWN_MARKER_FILE_PREFIX}{session_id}{gate_module.SPAWN_MARKER_FILE_SUFFIX}"
+    )
+    (temp_directory / marker_name).touch()
+
+
+def should_deny_pr_create_with_no_recorded_spawn(tmp_path: Path) -> None:
+    """A gh pr create with no recorded spawn is denied."""
+    assert _decision_for(_PLAIN_CREATE_COMMAND, tmp_path) == "deny"
+
+
+def should_allow_pr_create_after_a_recorded_spawn(tmp_path: Path) -> None:
+    """A gh pr create is allowed once this session recorded a spawn."""
+    _record_spawn(tmp_path)
+    assert _decision_for(_PLAIN_CREATE_COMMAND, tmp_path) == ""
+
+
+def should_allow_pr_create_carrying_the_bypass_marker(tmp_path: Path) -> None:
+    """A trailing bypass comment allows the create with no recorded spawn."""
+    command = f"{_PLAIN_CREATE_COMMAND} {gate_module.SPAWN_BYPASS_MARKER}"
+    assert _decision_for(command, tmp_path) == ""
+
+
+def should_allow_multiline_pr_create_carrying_the_bypass_marker(tmp_path: Path) -> None:
+    """A final bypass comment allows a create after a continued shell line."""
+    command = f"cd . && \\\n+{_PLAIN_CREATE_COMMAND} {gate_module.SPAWN_BYPASS_MARKER}"
+    assert _decision_for(command, tmp_path) == ""
+
+
+def should_deny_when_the_bypass_marker_follows_another_shell_segment(tmp_path: Path) -> None:
+    """A final marker for echo cannot opt a preceding create out."""
+    command = f"{_PLAIN_CREATE_COMMAND} && echo {gate_module.SPAWN_BYPASS_MARKER}"
+    assert _decision_for(command, tmp_path) == "deny"
+
+
+def should_deny_when_only_another_session_has_a_spawn_marker(tmp_path: Path) -> None:
+    """A marker from another session cannot unlock this session's create."""
+    _record_spawn(tmp_path, session_id="earlier-session")
+    assert _decision_for(_PLAIN_CREATE_COMMAND, tmp_path) == "deny"
+
+
+def should_deny_when_the_marker_text_sits_inside_a_quoted_value(tmp_path: Path) -> None:
+    """The bypass text inside a quoted title leaves the gate running."""
+    command = 'gh pr create --title "fix # pr-description-skip" --body-file body.md'
+    assert _decision_for(command, tmp_path) == "deny"
+
+
+def should_deny_a_pr_create_that_follows_another_command(tmp_path: Path) -> None:
+    """A create in a later command segment is still gated."""
+    command = f"cd /repo && {_PLAIN_CREATE_COMMAND}"
+    assert _decision_for(command, tmp_path) == "deny"
+
+
+@pytest.mark.parametrize("shell_tool_name", ["Bash", "PowerShell"])
+def should_gate_each_shell_tool(shell_tool_name: str, tmp_path: Path) -> None:
+    """Both shell tools reach the gate."""
+    decision = _decision_for(_PLAIN_CREATE_COMMAND, tmp_path, tool_name=shell_tool_name)
+    assert decision == "deny"
+
+
+@pytest.mark.parametrize(
+    "unrelated_command",
+    [
+        "gh pr edit 12 --body-file body.md",
+        "gh pr comment 12 --body-file body.md",
+        "gh pr ready 12",
+        "gh issue create --title x --body-file body.md",
+        "git commit -m x",
+        "echo gh pr create",
+    ],
+)
+def should_stay_quiet_for_a_command_that_creates_no_pull_request(
+    unrelated_command: str, tmp_path: Path
+) -> None:
+    """A command other than gh pr create passes untouched."""
+    assert _decision_for(unrelated_command, tmp_path) == ""
+
+
+def should_stay_quiet_for_a_tool_that_runs_no_shell(tmp_path: Path) -> None:
+    """A non-shell tool carrying the same text passes untouched."""
+    assert _decision_for(_PLAIN_CREATE_COMMAND, tmp_path, tool_name="Write") == ""
+
+
+def should_deny_when_the_payload_names_no_session(tmp_path: Path) -> None:
+    """A payload with no session id reads as no record and denies.
+
+    A shared fallback marker would let one session's spawn silently clear a
+    later session's create, so an unusable session id denies instead.
+    """
+    _record_spawn(tmp_path)
+    captured_stdout = io.StringIO()
+    payload = _payload(_PLAIN_CREATE_COMMAND)
+    payload["session_id"] = ""
+    with (
+        mock.patch("sys.stdin", io.StringIO(json.dumps(payload))),
+        mock.patch("sys.stdout", captured_stdout),
+        mock.patch.object(gate_module.tempfile, "gettempdir", return_value=str(tmp_path)),
+        pytest.raises(SystemExit),
+    ):
+        gate_module.main()
+    hook_output = json.loads(captured_stdout.getvalue().strip())["hookSpecificOutput"]
+    assert hook_output["permissionDecision"] == "deny"
+
+
+def should_allow_an_untokenizable_command(tmp_path: Path) -> None:
+    """A command that will not tokenize fails open."""
+    assert _decision_for('gh pr create --title "unclosed', tmp_path) == ""
+
+
+def should_name_both_ways_forward_in_the_denial(tmp_path: Path) -> None:
+    """The denial text names the agent spawn and the bypass marker."""
+    printed_text = _printed_output_for(_PLAIN_CREATE_COMMAND, tmp_path)
+    denial_reason = json.loads(printed_text)["hookSpecificOutput"]["permissionDecisionReason"]
+    assert _PR_DESCRIPTION_WRITER_SUBAGENT_TYPE in denial_reason
+    assert gate_module.SPAWN_BYPASS_MARKER in denial_reason

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -18,6 +18,7 @@ import os
 import subprocess
 import sys
 from pathlib import Path
+from typing import Callable
 
 import pytest
 
@@ -30,6 +31,8 @@ if str(_HOOKS_ROOT) not in sys.path:
 
 from hooks_constants.pre_tool_use_dispatcher_constants import (  # noqa: E402, I001
     ALL_HOSTED_HOOK_ENTRIES,
+    ALL_IMMEDIATE_HARM_SCRIPT_PATHS,
+    APPLY_PATCH_TOOL_NAME,
     BLOCKING_CRASH_DENY_REASON,
     BLOCKING_CRASH_EXIT_CODE,
     DENY_DECISION,
@@ -49,6 +52,8 @@ from pre_tool_use_dispatcher import (  # noqa: E402, I001
     unique_first_seen_strings,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 _DISPATCHER_SCRIPT = str(_BLOCKING_DIR / "pre_tool_use_dispatcher.py")
 
 _PROSE_STYLE_ENV_VAR = "CLAUDE_PROSE_STYLE_ENFORCEMENT"
@@ -216,20 +221,21 @@ def _edit_payload(file_path: str, old_string: str, new_string: str) -> str:
     )
 
 
-def _multi_edit_payload(file_path: str, edits: list[dict[str, str]]) -> str:
-    """Build a MultiEdit tool payload JSON string.
+def _apply_patch_payload(working_directory: str, command: str) -> str:
+    """Build an apply_patch tool payload JSON string.
 
     Args:
-        file_path: The target file path.
-        edits: List of edit dicts with old_string and new_string keys.
+        working_directory: The Codex patch's working directory (top-level cwd).
+        command: The Codex-format patch text naming each file operation.
 
     Returns:
         JSON-encoded payload string.
     """
     return json.dumps(
         {
-            "tool_name": MULTI_EDIT_TOOL_NAME,
-            "tool_input": {"file_path": file_path, "edits": edits},
+            "tool_name": APPLY_PATCH_TOOL_NAME,
+            "cwd": working_directory,
+            "tool_input": {"command": command},
         }
     )
 
@@ -281,9 +287,11 @@ def test_clean_write_allows_on_edit_tool() -> None:
     _assert_dispatcher_matches_individual_hooks(payload_text, EDIT_TOOL_NAME)
 
 
-def test_clean_write_allows_on_multi_edit_tool() -> None:
+def test_clean_write_allows_on_multi_edit_tool(
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
     """Dispatcher allows a multi-edit that all hosted hooks allow on MultiEdit tool."""
-    payload_text = _multi_edit_payload(
+    payload_text = multi_edit_payload(
         _TEMP_FILE_PATH,
         [{"old_string": "old", "new_string": "new"}],
     )
@@ -299,13 +307,16 @@ def test_dispatcher_docstring_points_at_roster_not_hardcoded_counts() -> None:
     assert "-> 9 hooks" not in dispatcher_source
 
 
-def test_multi_edit_runs_only_group_b_hooks() -> None:
-    """Dispatcher invokes only Group-B hooks on MultiEdit, not Group-A hooks.
+def test_multi_edit_payload_runs_only_group_b_hooks(
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """Dispatcher invokes only the hooks registered for MultiEdit, and each allows a clean edit.
 
-    The write_existing_file_blocker (Group A only) must not run on MultiEdit,
-    so a MultiEdit to any path that would trip a Group-A hook must still allow.
-    This test proves Group A is absent from MultiEdit and the remaining Group-B
-    hooks stay in the applicable set.
+    A hook whose applicable set omits MultiEdit stays absent from the
+    dispatcher's MultiEdit roster, so a MultiEdit to any path such a hook would
+    otherwise guard still allows. This test derives the excluded set from the
+    live roster rather than a hardcoded name list, so it holds as hooks move
+    between applicable sets.
     """
     all_multi_edit_entries = _applicable_entries_for_tool(MULTI_EDIT_TOOL_NAME)
     all_write_only_entries = [
@@ -321,7 +332,7 @@ def test_multi_edit_runs_only_group_b_hooks() -> None:
             f"Group-A hook {each_group_a_entry.script_relative_path!r} "
             "appears in the MultiEdit applicable set — it must not"
         )
-    clean_payload = _multi_edit_payload(
+    clean_payload = multi_edit_payload(
         _MARKDOWN_FILE_PATH,
         [{"old_string": "old line", "new_string": "New text."}],
     )
@@ -378,15 +389,18 @@ def test_write_existing_file_blocker_denies_on_write_tool() -> None:
     _assert_dispatcher_matches_individual_hooks(payload_text, WRITE_TOOL_NAME)
 
 
-def test_write_existing_file_blocker_does_not_run_on_multi_edit() -> None:
-    """Group-A write_existing_file_blocker does not run on MultiEdit.
+def test_write_existing_file_blocker_allows_multi_edit_to_an_existing_path(
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """write_existing_file_blocker runs on MultiEdit but never denies it.
 
-    The dispatcher must allow a MultiEdit to an existing file path even though
-    write_existing_file_blocker would deny the same path on a Write.
-    Uses a non-markdown file so markdown-only hooks stay silent.
+    MultiEdit carries no create-or-clobber path the hook needs to guard, so it
+    always allows a MultiEdit to an existing file path, even though the same
+    hook would deny that path on a Write. Uses a non-markdown file so
+    markdown-only hooks stay silent.
     """
     existing_file_path = str(Path(__file__).resolve())
-    payload_text = _multi_edit_payload(
+    payload_text = multi_edit_payload(
         existing_file_path,
         [{"old_string": "old text", "new_string": "new text"}],
     )
@@ -720,8 +734,13 @@ def test_dispatcher_edit_applies_both_groups() -> None:
     )
 
 
-def test_dispatcher_multi_edit_applies_only_group_b() -> None:
-    """MultiEdit applies to 9 hosted Group-B hooks, including the sensitive protector."""
+def test_dispatcher_multi_edit_reaches_the_sensitive_protector() -> None:
+    """A MultiEdit onto a sensitive path meets the same gate a Write does.
+
+    test_edit_and_multi_edit_applicable_sets_are_equal in the constants suite
+    holds the Edit and MultiEdit rosters equal, so this pins the one hook whose
+    absence would let a secret through a MultiEdit.
+    """
     all_multi_edit_entries = _applicable_entries_for_tool(MULTI_EDIT_TOOL_NAME)
     all_multi_edit_script_paths = {
         each_entry.script_relative_path for each_entry in all_multi_edit_entries
@@ -729,8 +748,24 @@ def test_dispatcher_multi_edit_applies_only_group_b() -> None:
     assert "blocking/sensitive_file_protector.py" in all_multi_edit_script_paths, (
         "sensitive_file_protector belongs in the MultiEdit applicable set"
     )
-    assert len(all_multi_edit_entries) == 9, (
-        f"MultiEdit tool must apply to exactly 9 Group-B hooks, got {len(all_multi_edit_entries)}"
+
+
+def test_dispatcher_apply_patch_applies_immediate_harm_hooks() -> None:
+    """apply_patch applies to exactly the immediate-harm roster.
+
+    apply_patch reaches only the immediate-harm-plus-TDD roster the constants
+    module names, not the full Write/Edit/MultiEdit lint surface.
+    """
+    all_apply_patch_entries = _applicable_entries_for_tool(APPLY_PATCH_TOOL_NAME)
+    all_apply_patch_script_paths = {
+        each_entry.script_relative_path for each_entry in all_apply_patch_entries
+    }
+    assert "blocking/sensitive_file_protector.py" in all_apply_patch_script_paths, (
+        "sensitive_file_protector belongs in the apply_patch applicable set"
+    )
+    assert all_apply_patch_script_paths == set(ALL_IMMEDIATE_HARM_SCRIPT_PATHS), (
+        "apply_patch must apply to exactly the immediate-harm roster, got: "
+        f"{sorted(all_apply_patch_script_paths)}"
     )
 
 
@@ -953,6 +988,161 @@ def test_folded_write_edit_hooks_have_no_standalone_hooks_json_entry() -> None:
         )
 
 
+def _standalone_apply_patch_code_rules_commands(all_pre_tool_use_groups: list[dict]) -> list[str]:
+    """Return every standalone apply_patch command naming code_rules_enforcer.py."""
+    return [
+        each_hook["command"]
+        for each_group in all_pre_tool_use_groups
+        if each_group["matcher"] == APPLY_PATCH_TOOL_NAME
+        for each_hook in each_group["hooks"]
+        if "code_rules_enforcer.py" in each_hook["command"]
+    ]
+
+
+def _dispatcher_matchers(all_pre_tool_use_groups: list[dict]) -> list[str]:
+    """Return every PreToolUse matcher whose command runs the dispatcher script."""
+    return [
+        each_group["matcher"]
+        for each_group in all_pre_tool_use_groups
+        if "pre_tool_use_dispatcher.py" in each_group["hooks"][0]["command"]
+    ]
+
+
+def test_apply_patch_has_no_standalone_code_rules_enforcer_hooks_json_entry() -> None:
+    """apply_patch's code_rules_enforcer coverage comes only from the dispatcher.
+
+    hooks.json once registered a standalone apply_patch to code_rules_enforcer.py
+    PreToolUse command. That entry is now folded into the dispatcher's own
+    Write|Edit|MultiEdit|apply_patch matcher, so no separate command may still
+    spawn code_rules_enforcer.py for apply_patch on its own.
+    """
+    hooks_json_text = (_HOOKS_ROOT / "hooks.json").read_text(encoding="utf-8")
+    all_pre_tool_use_groups = json.loads(hooks_json_text)["hooks"]["PreToolUse"]
+
+    standalone_commands = _standalone_apply_patch_code_rules_commands(all_pre_tool_use_groups)
+    assert not standalone_commands, (
+        "apply_patch must have no standalone code_rules_enforcer.py hooks.json "
+        f"entry — coverage comes from the dispatcher. Found: {standalone_commands!r}"
+    )
+
+    dispatcher_matchers = _dispatcher_matchers(all_pre_tool_use_groups)
+    assert APPLY_PATCH_TOOL_NAME in "".join(dispatcher_matchers), (
+        f"the dispatcher's own matcher must still name apply_patch, got: {dispatcher_matchers!r}"
+    )
+
+
+def _codex_add_patch(relative_file_path: str, file_body: str) -> str:
+    """Build a Codex apply_patch "add" command text for one new file.
+
+    Args:
+        relative_file_path: Path (relative to the patch's cwd) to create.
+        file_body: The full contents the new file should hold.
+
+    Returns:
+        The Codex-format patch command text.
+    """
+    added_lines = "\n".join(f"+{each_line}" for each_line in file_body.splitlines())
+    return (
+        "*** Begin Patch\n"
+        f"*** Add File: {relative_file_path}\n"
+        f"{added_lines}\n"
+        "*** End Patch"
+    )
+
+
+def test_dispatcher_denies_apply_patch_add_with_hardcoded_secret(
+    tmp_path: Path,
+    init_bare_git_repo: Callable[[Path], None],
+    synthetic_github_token: str,
+) -> None:
+    """The dispatcher denies an apply_patch "add" that writes a hardcoded token.
+
+    Proves Done-when scenario 1 (hardcoded secret/PII denied) reaches apply_patch
+    through the real dispatcher subprocess, not only the standalone
+    pii_prevention_blocker test.
+    """
+    repository_root = tmp_path / "repo"
+    init_bare_git_repo(repository_root)
+    patch_command = _codex_add_patch("leaked.py", f"token is {synthetic_github_token}\n")
+    payload_text = _apply_patch_payload(str(repository_root), patch_command)
+
+    dispatcher_result = _run_dispatcher(payload_text)
+    is_deny, reason_text = _parse_hook_decision(dispatcher_result)
+    assert is_deny, (
+        "dispatcher must deny an apply_patch add carrying a hardcoded secret, "
+        f"got stdout {dispatcher_result.stdout.strip()!r}"
+    )
+    assert reason_text, "a deny must carry a non-empty reason"
+
+
+def test_dispatcher_denies_apply_patch_targeting_a_sensitive_path(tmp_path: Path) -> None:
+    """The dispatcher denies an apply_patch "add" that targets a sensitive file.
+
+    Proves Done-when scenario 2 (sensitive path denied) reaches apply_patch
+    through the real dispatcher subprocess.
+    """
+    patch_command = _codex_add_patch(".env", "SECRET_KEY=irrelevant\n")
+    payload_text = _apply_patch_payload(str(tmp_path), patch_command)
+
+    dispatcher_result = _run_dispatcher(payload_text)
+    is_deny, reason_text = _parse_hook_decision(dispatcher_result)
+    assert is_deny, (
+        "dispatcher must deny an apply_patch add targeting a sensitive path, "
+        f"got stdout {dispatcher_result.stdout.strip()!r}"
+    )
+    assert reason_text, "a deny must carry a non-empty reason"
+
+
+def test_dispatcher_denies_apply_patch_add_onto_an_existing_path(tmp_path: Path) -> None:
+    """The dispatcher denies an apply_patch "add" that targets a path already on disk.
+
+    Proves Done-when scenario 3 (overwrite-without-reading denied) reaches
+    apply_patch: a Codex "add" operation onto an existing path is caught by
+    code_rules_enforcer's codex-patch reading, blocking/codex_apply_patch.py's
+    _codex_read_patch_file, which raises CodexPatchError for an add already on
+    disk, reported through the dispatcher's aggregate.
+    """
+    existing_target = tmp_path / "already_here.py"
+    existing_target.write_text("value = 1\n", encoding="utf-8")
+    patch_command = _codex_add_patch("already_here.py", "value = 2\n")
+    payload_text = _apply_patch_payload(str(tmp_path), patch_command)
+
+    dispatcher_result = _run_dispatcher(payload_text)
+    is_deny, reason_text = _parse_hook_decision(dispatcher_result)
+    assert is_deny, (
+        "dispatcher must deny an apply_patch add onto an already-existing path, "
+        f"got stdout {dispatcher_result.stdout.strip()!r}"
+    )
+    assert reason_text, "a deny must carry a non-empty reason"
+
+
+def test_dispatcher_allows_clean_apply_patch_add(tmp_path: Path) -> None:
+    """The dispatcher allows an apply_patch "add" whose paired test already exists.
+
+    tdd_enforcer now reaches apply_patch the same way it reaches Write: an
+    untested production file is exactly the immediate-harm case the apply_patch
+    boundary rule names, so "clean" here means test-first was honored before
+    the tool call, not that TDD is skipped for this tool. The paired test file
+    is written to disk first, matching how test_dispatcher_surfaces_migration_
+    warning_for_edit proves a fresh Edit passes tdd_enforcer.
+    """
+    (tmp_path / "test_services.py").write_text(
+        "def test_add_one():\n    assert True\n", encoding="utf-8"
+    )
+    patch_command = _codex_add_patch(
+        "services.py",
+        "def add_one(value: int) -> int:\n    return value + 1\n",
+    )
+    payload_text = _apply_patch_payload(str(tmp_path), patch_command)
+
+    dispatcher_result = _run_dispatcher(payload_text)
+    is_deny, reason_text = _parse_hook_decision(dispatcher_result)
+    assert not is_deny, (
+        f"dispatcher must allow an apply_patch add with a fresh paired test, "
+        f"got deny reason {reason_text!r}"
+    )
+
+
 def test_hosted_hook_set_covers_all_write_edit_blocking_hooks() -> None:
     """The hosted hook set covers all previously-registered Write/Edit blocking hooks.