claude-dev-env 2.30.0 → 2.31.0

package/hooks/blocking/test_pre_tool_use_dispatcher_native.py

@@ -234,16 +234,21 @@ def test_state_description_native_edit_deny_matches_script_reason() -> None:
     assert native_reason is not None
     assert native_reason == script_reason
 
-def test_state_description_native_non_target_tool_allows_match_script() -> None:
-    """state_description_blocker native allows MultiEdit, matching the script."""
+def test_state_description_native_multi_edit_deny_matches_script() -> None:
+    """state_description_blocker native denies MultiEdit, matching the script.
+
+    MultiEdit is a target tool for this hook: a historical phrase in any edit's
+    new_string denies the same way it would for Write or Edit.
+    """
     payload_dictionary = _multi_edit_payload_dictionary(
         _MARKDOWN_PATH, _STATE_DESCRIPTION_DENY_CONTENT
     )
     native_reason = _evaluate_with_prose_style_opt_in(state_description_blocker.evaluate, payload_dictionary)
     script_stdout = _run_script_subprocess(_STATE_DESCRIPTION_SCRIPT, payload_dictionary)
     script_reason = _deny_reason_from_script_stdout(script_stdout)
-    assert native_reason is None
-    assert script_reason is None
+    assert native_reason is not None
+    assert native_reason == script_reason
+
 
 def test_dispatcher_native_path_denies_state_description() -> None:
     """The dispatcher's native path denies a state_description_blocker violation."""

package/hooks/blocking/test_sensitive_file_protector.py

@@ -98,8 +98,8 @@ def _registered_dispatcher_details(
         f"found {len(dispatcher_registrations)}"
     )
     each_registration, each_hook, command_parts = dispatcher_registrations[0]
-    assert each_registration["matcher"] == "Write|Edit|MultiEdit", (
-        "dispatcher registration must cover exactly Write, Edit, and MultiEdit; "
+    assert each_registration["matcher"] == "Write|Edit|MultiEdit|apply_patch", (
+        "dispatcher registration must cover Write, Edit, MultiEdit, and apply_patch; "
         f"got matcher {each_registration['matcher']!r}"
     )
     assert command_parts[0] == "python3"
@@ -256,6 +256,46 @@ def test_multi_edit_to_a_secrets_file_is_denied(tmp_path: Path) -> None:
     assert _permission_decision(completed) == DENY_DECISION
 
 
+def test_apply_patch_add_targeting_a_secrets_file_is_denied(tmp_path: Path) -> None:
+    payload = json.dumps(
+        {
+            "tool_name": "apply_patch",
+            "cwd": str(tmp_path),
+            "tool_input": {
+                "command": (
+                    "*** Begin Patch\n"
+                    "*** Add File: .env\n"
+                    "+API_TOKEN=your-token-here\n"
+                    "*** End Patch"
+                )
+            },
+        }
+    )
+    completed = _run_hook_with_stdin(payload)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) == DENY_DECISION
+
+
+def test_apply_patch_add_targeting_an_ordinary_file_is_allowed(tmp_path: Path) -> None:
+    payload = json.dumps(
+        {
+            "tool_name": "apply_patch",
+            "cwd": str(tmp_path),
+            "tool_input": {
+                "command": (
+                    "*** Begin Patch\n"
+                    "*** Add File: main.py\n"
+                    "+x = 1\n"
+                    "*** End Patch"
+                )
+            },
+        }
+    )
+    completed = _run_hook_with_stdin(payload)
+    assert completed.returncode == 0, completed.stderr
+    assert _permission_decision(completed) is None
+
+
 def test_hooks_json_registers_exact_dispatcher_matcher_and_timeout() -> None:
     dispatcher_command, dispatcher_timeout_seconds = _registered_dispatcher_details()
     assert dispatcher_command[1] == str(DISPATCHER_SCRIPT_PATH)

package/hooks/blocking/test_shell_substitution_blocker.py

@@ -122,3 +122,72 @@ def test_allows_arithmetic_expansion() -> None:
         "tool_input": {"command": "echo $((2+2))"},
     }
     assert _run_hook(payload).stdout == ""
+
+
+def test_allows_arithmetic_expansion_with_nested_parens() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $(( (1+2) * 3 ))"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_arithmetic_expansion_whose_body_bash_itself_rejects() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $((echo hi))"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_arithmetic_lookalike_inside_single_quotes() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo '$((cd /tmp) && pwd)'"},
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_subshell_disguised_as_arithmetic_expansion() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $((cd /tmp) && pwd)"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_parenthesized_command_word_disguised_as_arithmetic() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $((1+2) )"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_command_substitution_nested_inside_arithmetic_expansion() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $(( $(id -u) + 1 ))"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_backtick_substitution_nested_inside_arithmetic_expansion() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $(( `id -u` + 1 ))"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_nested_command_substitution_without_arithmetic() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "echo $(echo $(whoami))"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"

package/hooks/blocking/test_stale_comment_reference_blocker.py

@@ -207,6 +207,77 @@ def test_allows_old_string_not_found(tmp_path: Path) -> None:
     assert outcome.stdout == ""
 
 
+def test_multi_edit_denies_when_the_first_edit_writes_the_stale_comment(
+    tmp_path: Path,
+) -> None:
+    """The comment the second edit orphans is one the first edit just wrote.
+
+    A non-cumulative check reads the ORIGINAL "# Old note" comment and finds
+    nothing to orphan; only applying the first edit before the second reveals
+    "# Mock asyncio" above the removed line.
+    """
+    written_module_path = _write_module(
+        tmp_path,
+        "def launch_export() -> None:\n    # Old note\n" + PATCHED_SLEEP_LINE,
+    )
+    all_edits = [
+        {"old_string": "    # Old note\n", "new_string": KEPT_COMMENT_LINE},
+        {
+            "old_string": PATCHED_SLEEP_LINE.rstrip("\n"),
+            "new_string": PATCHED_POLL_LINE.rstrip("\n"),
+        },
+    ]
+    outcome = _run_hook(
+        "MultiEdit", {"file_path": str(written_module_path), "edits": all_edits}
+    )
+    assert outcome.returncode == 0
+    decision = json.loads(outcome.stdout)
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "asyncio" in decision["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_multi_edit_allows_two_unrelated_edits(tmp_path: Path) -> None:
+    written_module_path = _write_module(
+        tmp_path,
+        "def launch_export() -> None:\n" + KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+    )
+    all_edits = [
+        {
+            "old_string": "def launch_export() -> None:",
+            "new_string": "def launch_export_now() -> None:",
+        },
+        {
+            "old_string": PATCHED_SLEEP_LINE,
+            "new_string": KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+        },
+    ]
+    outcome = _run_hook(
+        "MultiEdit", {"file_path": str(written_module_path), "edits": all_edits}
+    )
+    assert outcome.returncode == 0
+    assert outcome.stdout == ""
+
+
+def test_multi_edit_skips_a_step_whose_old_string_is_absent(tmp_path: Path) -> None:
+    """A MultiEdit step whose old_string never occurs in the current content is skipped."""
+    written_module_path = _write_module(
+        tmp_path,
+        "def launch_export() -> None:\n" + KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+    )
+    all_edits = [
+        {"old_string": "never present anywhere", "new_string": "still never present"},
+        {
+            "old_string": PATCHED_SLEEP_LINE,
+            "new_string": KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+        },
+    ]
+    outcome = _run_hook(
+        "MultiEdit", {"file_path": str(written_module_path), "edits": all_edits}
+    )
+    assert outcome.returncode == 0
+    assert outcome.stdout == ""
+
+
 def test_deny_payload_logs_the_block(tmp_path: Path) -> None:
     """One record lands in the block journal for each denial built through
     evaluate plus build_deny_payload.

package/hooks/blocking/test_state_description_blocker.py

@@ -295,6 +295,74 @@ def test_clean_edit_passes():
     assert result.stdout == ""
 
 
+def test_detects_multi_edit_second_new_string() -> None:
+    """A violation in the second edit of a MultiEdit is denied, not only the first."""
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
+                {"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    output = json.loads(result.stdout)
+    assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "previously" in output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_clean_multi_edit_passes() -> None:
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
+                {"old_string": "b = 2", "new_string": CLEAN_COMMENT},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_multi_edit_new_strings_join_on_a_separator_not_concatenation() -> None:
+    """Two clean edit fragments stay clean even when one ends where the next begins.
+
+    The first edit's new_string ends in "# describes the previous", and the
+    second's begins with "ly implemented step.". Concatenated with no
+    separator the two would spell "previously" and trip a false deny; joined
+    on a real separator they stay two distinct fragments.
+    """
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "# describes the previous"},
+                {"old_string": "b = 2", "new_string": "ly implemented step."},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_multi_edit_with_a_single_edit_still_denies() -> None:
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [{"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT}],
+        },
+    )
+    assert result.returncode == 0
+    output = json.loads(result.stdout)
+    assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
 def test_system_message_and_suppress_output():
     result = _run_hook(
         "Write",

package/hooks/blocking/test_subprocess_budget_completeness.py

@@ -586,3 +586,70 @@ def test_full_hook_denies_edit_that_adds_a_timeout_to_a_non_budget_helper(
     hook_output = json.loads(completed_hook.stdout)
     assert hook_output["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert "45s" in hook_output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+_HARMLESS_COMMENT_EDIT = {
+    "old_string": "return git_check.returncode != 0\n",
+    "new_string": "return git_check.returncode != 0  # checked\n",
+}
+_UNCOUNTED_TIMEOUT_EDIT = {
+    "old_string": (
+        '    git_check = subprocess.run(["git", "ls-files", file_path],'
+        " timeout=GIT_CHECK_TIMEOUT_SECONDS)\n"
+    ),
+    "new_string": '    git_check = subprocess.run(["git", "ls-files", file_path], timeout=45)\n',
+}
+
+
+def _run_multi_edit_hook(edited_module_path: pathlib.Path, all_edits: list[dict[str, str]]):
+    hook_input = json.dumps(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {"file_path": str(edited_module_path), "edits": all_edits},
+        }
+    )
+    return subprocess.run(
+        [sys.executable, str(_HOOK_DIR / "subprocess_budget_completeness.py")],
+        input=hook_input,
+        capture_output=True,
+        text=True,
+        timeout=15,
+        check=False,
+    )
+
+
+def test_resolved_content_reconstructs_the_full_file_for_a_multi_edit(
+    tmp_path: pathlib.Path,
+) -> None:
+    """The whole reconstructed file reflects every edit, not only the first."""
+    edited_module_path = tmp_path / "timing_module.py"
+    edited_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    reconstructed_content = resolved_content(
+        {
+            "file_path": str(edited_module_path),
+            "edits": [_HARMLESS_COMMENT_EDIT, _UNCOUNTED_TIMEOUT_EDIT],
+        }
+    )
+    assert "timeout=45" in reconstructed_content
+    assert "# checked" in reconstructed_content
+
+
+def test_full_hook_denies_multi_edit_that_adds_a_timeout_in_the_second_edit(
+    production_module_path: pathlib.Path,
+) -> None:
+    """A new timeout introduced by the second edit of a MultiEdit is caught."""
+    production_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    completed_hook = _run_multi_edit_hook(
+        production_module_path, [_HARMLESS_COMMENT_EDIT, _UNCOUNTED_TIMEOUT_EDIT]
+    )
+    assert completed_hook.returncode == 0
+    hook_output = json.loads(completed_hook.stdout)
+    assert hook_output["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "45s" in hook_output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_full_hook_allows_a_clean_multi_edit(production_module_path: pathlib.Path) -> None:
+    production_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    completed_hook = _run_multi_edit_hook(production_module_path, [_HARMLESS_COMMENT_EDIT])
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""

package/hooks/blocking/test_tdd_enforcer.py

@@ -10,6 +10,9 @@ import time
 from pathlib import Path
 
 import pytest
+from tdd_enforcer_parts import content_hash_store
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
 SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
 
@@ -49,6 +52,14 @@ def _make_write_payload(file_path: Path, content: str = "") -> dict:
     }
 
 
+def _make_apply_patch_payload(working_directory: Path, patch_command: str) -> dict:
+    return {
+        "tool_name": "apply_patch",
+        "cwd": str(working_directory),
+        "tool_input": {"command": patch_command},
+    }
+
+
 def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
     if not completed.stdout:
         return None
@@ -76,6 +87,49 @@ def test_should_allow_when_sibling_test_file_exists_and_recent(tmp_path: Path) -
     assert _decision_from(completed) == "allow"
 
 
+def test_should_deny_apply_patch_add_with_no_fresh_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Add File: orders.py\n"
+        "+def fulfill(): pass\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_apply_patch_payload(sandbox, patch_command),
+        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+    )
+
+    assert _decision_from(completed) == "deny"
+    parsed = json.loads(completed.stdout)
+    reason = parsed["hookSpecificOutput"]["permissionDecisionReason"]
+    assert "test_orders.py" in reason
+
+
+def test_should_allow_apply_patch_update_with_fresh_sibling_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Update File: orders.py\n"
+        "@@\n"
+        "-def fulfill(): pass\n"
+        "+def fulfill(): return True\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_apply_patch_payload(sandbox, patch_command),
+        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
 def test_should_deny_when_no_test_file_exists(tmp_path: Path) -> None:
     sandbox = _sandbox(tmp_path)
     production_file = sandbox / "orders.py"
@@ -834,8 +888,9 @@ def _run_hook_with_payload_and_env(
 _BEHAVIOR_BEARING_CONTENT = "def fulfill_order(order: str) -> str:\n    return order\n"
 
 
-def test_should_exit_zero_for_ephemeral_scratch_python() -> None:
+def test_should_exit_zero_for_ephemeral_scratch_python(monkeypatch: pytest.MonkeyPatch) -> None:
     """B16: behavior-bearing scratch .py under root-anchored /tmp exits 0 with no deny."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
     ephemeral_path = "/tmp/scratch_work.py"
     payload = _make_write_payload(Path(ephemeral_path), _BEHAVIOR_BEARING_CONTENT)
     completed = _run_hook_with_payload(payload)
@@ -844,8 +899,9 @@ def test_should_exit_zero_for_ephemeral_scratch_python() -> None:
     )
 
 
-def test_should_exit_zero_for_ephemeral_scratch_typescript() -> None:
+def test_should_exit_zero_for_ephemeral_scratch_typescript(monkeypatch: pytest.MonkeyPatch) -> None:
     """B17: ephemeral .ts scratch file under root-anchored /tmp exits 0 with no deny."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
     ephemeral_path = "/tmp/scratch_work.ts"
     payload = {
         "tool_name": "Write",
@@ -1194,3 +1250,127 @@ def test_should_deny_changing_a_future_import_on_a_constants_only_file(tmp_path:
     )
 
     assert _decision_from(completed) == "deny"
+
+
+def _make_write_payload_for_session(
+    file_path: Path, content: str, session_id: str, repository_root: Path
+) -> dict:
+    return {
+        "session_id": session_id,
+        "cwd": str(repository_root),
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(file_path), "content": content},
+    }
+
+
+def _seed_stale_recorded_hash(
+    candidate: Path, session_id: str, repository_root: Path, seconds_past_window: int
+) -> None:
+    """Plant a session record as if the gate had genuinely seen *candidate* long ago."""
+    state_file = content_hash_store._state_file_path(session_id, str(repository_root))
+    candidate_key = content_hash_store._state_key_for(candidate)
+    recorded_hash = content_hash_store._content_hash(candidate.read_text())
+    stale_changed_at = time.time() - FRESHNESS_SECONDS - seconds_past_window
+    state = {
+        candidate_key: {
+            content_hash_store.STORED_CONTENT_HASH_KEY: recorded_hash,
+            content_hash_store.STORED_CHANGED_AT_KEY: stale_changed_at,
+        }
+    }
+    content_hash_store._atomic_write_state(state_file, state)
+
+
+def test_should_deny_when_test_file_was_recorded_then_only_touched_after_window(
+    tmp_path: Path,
+) -> None:
+    """The exact loophole: a session-recorded test, later only touched, stays denied."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "touch-loophole-session"
+    _seed_stale_recorded_hash(sibling_test, session_id, sandbox, seconds_past_window=60)
+
+    sibling_test.touch()
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_allow_when_test_file_content_actually_changed_after_window(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "touch-loophole-real-edit-session"
+    _seed_stale_recorded_hash(sibling_test, session_id, sandbox, seconds_past_window=60)
+
+    sibling_test.write_text("def test_fulfill(): assert True\n")
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_allow_repeat_production_write_within_window_without_further_test_change(
+    tmp_path: Path,
+) -> None:
+    """GREEN/REFACTOR needs several production writes after one real test edit."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "green-refactor-session"
+
+    first_write = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+    assert _decision_from(first_write) == "allow"
+
+    second_write = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 2\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(second_write) == "allow"
+
+
+def test_should_deny_apply_patch_that_adds_test_and_production_file_in_one_transaction(
+    tmp_path: Path,
+) -> None:
+    """One patch adding both files denies: the test is not yet on disk when read.
+
+    ``apply_patch`` is a PreToolUse hook; it sees the patch text before the
+    patch runs, so a same-transaction test file is not readable yet even
+    though it names a real, matching test.
+    """
+    sandbox = _sandbox(tmp_path)
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Add File: orders.py\n"
+        "+def fulfill(): pass\n"
+        "*** Add File: test_orders.py\n"
+        "+def test_fulfill(): pass\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(_make_apply_patch_payload(sandbox, patch_command))
+
+    assert _decision_from(completed) == "deny"

package/hooks/blocking/test_windows_rmtree_blocker.py

@@ -165,6 +165,31 @@ def test_extract_payload_returns_content_for_write_without_file_path() -> None:
     assert extracted == "some python code"
 
 
+def test_extract_payload_reads_every_multi_edit_new_string() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": DANGEROUS_RMTREE_SNIPPET},
+            ],
+        },
+    )
+    assert DANGEROUS_RMTREE_SNIPPET in extracted
+
+
+def test_extract_payload_reads_a_single_item_multi_edit() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [{"old_string": "a = 1", "new_string": DANGEROUS_RMTREE_SNIPPET}],
+        },
+    )
+    assert extracted == DANGEROUS_RMTREE_SNIPPET
+
+
 def _run_hook_with_stdin_text(stdin_text: str) -> tuple[str, str, int]:
     captured_stdout = io.StringIO()
     captured_stderr = io.StringIO()
@@ -207,6 +232,44 @@ def test_main_blocks_unsafe_bash_command() -> None:
     assert "windows-rmtree" in decision_block["permissionDecisionReason"]
 
 
+def test_main_blocks_unsafe_rmtree_introduced_by_second_multi_edit() -> None:
+    """An unsafe rmtree call in the second edit of a MultiEdit is caught, not only the first."""
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "cleanup.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": DANGEROUS_RMTREE_SNIPPET},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    response_payload = json.loads(stdout_text)
+    decision_block = response_payload["hookSpecificOutput"]
+    assert decision_block["permissionDecision"] == "deny"
+    assert "windows-rmtree" in decision_block["permissionDecisionReason"]
+
+
+def test_main_allows_clean_multi_edit() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "cleanup.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": "shutil.rmtree(path, onexc=handler)"},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
 def test_main_passes_through_safe_write() -> None:
     stdout_text, exit_code = _run_hook(
         {