claude-dev-env 2.30.1 → 2.31.0

package/hooks/blocking/tdd_enforcer_parts/tests/test_content_hash_store.py

@@ -0,0 +1,143 @@
+"""Behavioral tests for the content_hash_store parts module."""
+
+import json
+import os
+import time
+from pathlib import Path
+
+from tdd_enforcer_parts import content_hash_store
+
+
+def _write_fresh_test_file(directory: Path, content: str = "def test_fulfill(): pass\n") -> Path:
+    candidate = directory / "test_orders.py"
+    candidate.write_text(content)
+    return candidate
+
+
+def test_state_file_path_differs_by_repository_root(tmp_path: Path) -> None:
+    first_root_path = content_hash_store._state_file_path("session-a", str(tmp_path / "one"))
+    second_root_path = content_hash_store._state_file_path("session-a", str(tmp_path / "two"))
+    assert first_root_path != second_root_path
+
+
+def test_state_file_path_is_stable_for_the_same_inputs(tmp_path: Path) -> None:
+    first_lookup = content_hash_store._state_file_path("session-a", str(tmp_path))
+    second_lookup = content_hash_store._state_file_path("session-a", str(tmp_path))
+    assert first_lookup == second_lookup
+
+
+def test_first_sight_allows_and_stores_a_fresh_dirty_test(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], "session-1", str(tmp_path), 600
+    )
+
+    assert is_allowed is True
+    state_file = content_hash_store._state_file_path("session-1", str(tmp_path))
+    state = json.loads(state_file.read_text())
+    assert content_hash_store._state_key_for(candidate) in state
+
+
+def test_first_sight_denies_when_test_evidence_is_missing(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path, content="orders = 'not a test'\n")
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], "session-2", str(tmp_path), 600
+    )
+
+    assert is_allowed is False
+
+
+def test_first_sight_denies_when_test_file_is_stale(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], "session-3", str(tmp_path), 600
+    )
+
+    assert is_allowed is False
+
+
+def test_second_sight_denies_a_touch_that_leaves_content_unchanged(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    session_id, repository_root = "session-4", str(tmp_path)
+    assert content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    state = json.loads(state_file.read_text())
+    candidate_key = content_hash_store._state_key_for(candidate)
+    state[candidate_key][content_hash_store.STORED_CHANGED_AT_KEY] -= 700
+    state_file.write_text(json.dumps(state))
+    candidate.touch()
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False
+
+
+def test_second_sight_allows_when_content_actually_changed_after_the_window(
+    tmp_path: Path,
+) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    session_id, repository_root = "session-5", str(tmp_path)
+    assert content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    state = json.loads(state_file.read_text())
+    candidate_key = content_hash_store._state_key_for(candidate)
+    state[candidate_key][content_hash_store.STORED_CHANGED_AT_KEY] -= 700
+    state_file.write_text(json.dumps(state))
+    candidate.write_text("def test_fulfill(): assert True\n")
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is True
+
+
+def test_second_sight_allows_a_repeat_write_within_the_window_untouched(
+    tmp_path: Path,
+) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    session_id, repository_root = "session-6", str(tmp_path)
+    assert content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is True
+
+
+def test_any_candidate_satisfying_the_gate_allows_the_write(tmp_path: Path) -> None:
+    stale_candidate = _write_fresh_test_file(tmp_path)
+    stale_timestamp = time.time() - 700
+    os.utime(stale_candidate, (stale_timestamp, stale_timestamp))
+    fresh_candidate = tmp_path / "orders_test.py"
+    fresh_candidate.write_text("def test_fulfill(): pass\n")
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [stale_candidate, fresh_candidate], "session-7", str(tmp_path), 600
+    )
+
+    assert is_allowed is True
+
+
+def test_denies_when_no_candidate_file_exists(tmp_path: Path) -> None:
+    missing_candidate = tmp_path / "test_missing.py"
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [missing_candidate], "session-8", str(tmp_path), 600
+    )
+
+    assert is_allowed is False

package/hooks/blocking/tdd_enforcer_parts/tests/test_decisions.py

@@ -20,6 +20,18 @@ def test_build_deny_reason_points_exemption_guidance_at_entry_hook() -> None:
     assert "decisions.py" not in reason
 
 
+def test_build_deny_reason_names_content_not_only_modification_time() -> None:
+    reason = decisions.build_deny_reason(Path("pkg/orders.py"), [Path("pkg/test_orders.py")])
+    assert "content" in reason.lower()
+
+
+def test_build_deny_reason_covers_first_sight_and_stale_hash_and_names_the_fix() -> None:
+    reason = decisions.build_deny_reason(Path("pkg/orders.py"), [Path("pkg/test_orders.py")]).lower()
+    assert "fresh" in reason
+    assert "change" in reason
+    assert "touch" in reason
+
+
 def test_emit_allow_writes_allow_decision(capsys: pytest.CaptureFixture[str]) -> None:
     decisions.emit_allow()
     parsed = json.loads(capsys.readouterr().out)

package/hooks/blocking/tdd_enforcer_parts/tests/test_git_tracking.py

@@ -46,3 +46,66 @@ def test_absent_but_tracked_false_when_file_present(tmp_path: Path) -> None:
     _git(tmp_path, "add", "-A")
     _git(tmp_path, "commit", "-q", "-m", "init")
     assert git_tracking.is_absent_but_tracked(present) is False
+
+
+def test_has_uncommitted_change_from_head_true_for_untracked_file(tmp_path: Path) -> None:
+    _init_repository(tmp_path)
+    untracked = tmp_path / "test_orders.py"
+    untracked.write_text("def test_fulfill(): pass\n")
+    assert git_tracking.has_uncommitted_change_from_head(untracked) is True
+
+
+def test_has_uncommitted_change_from_head_true_for_tracked_modified_file(tmp_path: Path) -> None:
+    _init_repository(tmp_path)
+    tracked = tmp_path / "test_orders.py"
+    tracked.write_text("def test_fulfill(): pass\n")
+    _git(tmp_path, "add", "-A")
+    _git(tmp_path, "commit", "-q", "-m", "init")
+    tracked.write_text("def test_fulfill(): assert True\n")
+    assert git_tracking.has_uncommitted_change_from_head(tracked) is True
+
+
+def test_has_uncommitted_change_from_head_false_for_tracked_clean_file(tmp_path: Path) -> None:
+    _init_repository(tmp_path)
+    tracked = tmp_path / "test_orders.py"
+    tracked.write_text("def test_fulfill(): pass\n")
+    _git(tmp_path, "add", "-A")
+    _git(tmp_path, "commit", "-q", "-m", "init")
+    tracked.touch()
+    assert git_tracking.has_uncommitted_change_from_head(tracked) is False
+
+
+def test_has_uncommitted_change_from_head_true_outside_a_git_repository(tmp_path: Path) -> None:
+    stray = tmp_path / "test_orders.py"
+    stray.write_text("def test_fulfill(): pass\n")
+    assert git_tracking.has_uncommitted_change_from_head(stray) is True
+
+
+def test_has_uncommitted_change_from_head_true_for_staged_new_file_never_committed(
+    tmp_path: Path,
+) -> None:
+    """A brand-new file only ``git add``-ed carries content HEAD never had.
+
+    Regression guard: comparing the working tree to the index (rather than to
+    HEAD) reads a freshly staged file as unchanged, since staging makes the
+    index match the working tree exactly. That misses every staged-but-never-
+    committed file, which is exactly how a RED-step test file is staged.
+    """
+    _init_repository(tmp_path)
+    _git(tmp_path, "commit", "--allow-empty", "-q", "-m", "baseline")
+    staged_new_test = tmp_path / "test_orders.py"
+    staged_new_test.write_text("def test_fulfill(): pass\n")
+    _git(tmp_path, "add", "-A")
+    assert git_tracking.has_uncommitted_change_from_head(staged_new_test) is True
+
+
+def test_has_uncommitted_change_from_head_true_for_staged_modification(tmp_path: Path) -> None:
+    """A tracked test's staged edit still differs from HEAD, not only the index."""
+    _init_repository(tmp_path)
+    tracked = tmp_path / "test_orders.py"
+    tracked.write_text("def test_fulfill(): pass\n")
+    _git(tmp_path, "add", "-A")
+    _git(tmp_path, "commit", "-q", "-m", "init")
+    tracked.write_text("def test_fulfill(): assert True\n")
+    _git(tmp_path, "add", "-A")
+    assert git_tracking.has_uncommitted_change_from_head(tracked) is True

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -222,6 +222,7 @@ def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
         "blocking/cursor_cli_python_misfire_blocker.py",
         "blocking/unscoped_search_blocker.py",
         "blocking/pii_prevention_blocker.py",
+        "blocking/pr_description_writer_gate.py",
     ]
 
 

package/hooks/blocking/test_code_rules_enforcer_cap_meta.py

@@ -24,6 +24,8 @@ consideration will trip this test.
 
 from __future__ import annotations
 
+import ast
+import functools
 import importlib.util
 import inspect
 import pathlib
@@ -31,12 +33,13 @@ import sys
 
 
 _HOOK_DIRECTORY = pathlib.Path(__file__).parent
+_ENFORCER_SOURCE_PATH = _HOOK_DIRECTORY / "code_rules_enforcer.py"
 if str(_HOOK_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(_HOOK_DIRECTORY))
 
 _hook_spec = importlib.util.spec_from_file_location(
     "code_rules_enforcer",
-    _HOOK_DIRECTORY / "code_rules_enforcer.py",
+    _ENFORCER_SOURCE_PATH,
 )
 assert _hook_spec is not None
 assert _hook_spec.loader is not None
@@ -45,11 +48,14 @@ _hook_spec.loader.exec_module(_hook_module)
 
 VOID_ADVISORY_CHECK_FUNCTION_NAMES: frozenset[str] = frozenset(
     {
+        "check_constants_outside_config_advisory",
         "check_duplicated_format_patterns",
         "check_flag_gated_scenario_test_naming",
     }
 )
 
+PAYLOAD_COLLECTING_METHOD_NAMES: frozenset[str] = frozenset({"extend", "append"})
+
 DIFF_SCOPED_CHECK_FUNCTION_NAMES: frozenset[str] = frozenset(
     {
         "check_banned_noun_word_boundary",
@@ -65,7 +71,6 @@ KNOWN_UNCAPPED_CHECKS_PENDING_REVIEW: frozenset[str] = frozenset(
         "check_comment_changes",
         "check_constant_equality_tests",
         "check_constants_outside_config",
-        "check_constants_outside_config_advisory",
         "check_existence_check_tests",
         "check_file_global_constants_use_count",
         "check_imports_at_top",
@@ -174,6 +179,80 @@ def test_void_advisory_checks_are_registered_and_disjoint() -> None:
     )
 
 
+@functools.lru_cache(maxsize=1)
+def _enforcer_syntax_tree() -> ast.Module:
+    """Parse code_rules_enforcer.py once and hand the same tree to every caller.
+
+    The source does not change while the suite runs, so re-reading and
+    re-parsing it for each test buys nothing.
+    """
+    return ast.parse(_ENFORCER_SOURCE_PATH.read_text(encoding="utf-8"))
+
+
+def _void_advisory_names_called_under(node: ast.AST) -> set[str]:
+    return {
+        each_node.func.id
+        for each_node in ast.walk(node)
+        if isinstance(each_node, ast.Call)
+        and isinstance(each_node.func, ast.Name)
+        and each_node.func.id in VOID_ADVISORY_CHECK_FUNCTION_NAMES
+    }
+
+
+def _payload_collecting_calls(syntax_tree: ast.Module) -> list[ast.Call]:
+    return [
+        each_node
+        for each_node in ast.walk(syntax_tree)
+        if isinstance(each_node, ast.Call)
+        and isinstance(each_node.func, ast.Attribute)
+        and each_node.func.attr in PAYLOAD_COLLECTING_METHOD_NAMES
+    ]
+
+
+def _void_advisory_names_fed_into_the_deny_payload(syntax_tree: ast.Module) -> set[str]:
+    """Return void-advisory names whose result is collected into the blocking payload.
+
+    The enforcer builds its deny payload by extending a list::
+
+        ok:   check_duplicated_format_patterns(content, file_path)
+        flag: all_issues.extend(check_duplicated_format_patterns(content, file_path))
+
+    The flagged form routes a stderr-only advisory into the payload that denies
+    the write, so the advisory stops being advisory.
+    """
+    fed_names: set[str] = set()
+    for each_call in _payload_collecting_calls(syntax_tree):
+        for each_argument in each_call.args:
+            fed_names |= _void_advisory_names_called_under(each_argument)
+    return fed_names
+
+
+def _bare_call_names(syntax_tree: ast.Module) -> set[str]:
+    return {
+        each_node.value.func.id
+        for each_node in ast.walk(syntax_tree)
+        if isinstance(each_node, ast.Expr)
+        and isinstance(each_node.value, ast.Call)
+        and isinstance(each_node.value.func, ast.Name)
+    }
+
+
+def test_void_advisory_checks_never_feed_the_deny_payload() -> None:
+    fed_names = _void_advisory_names_fed_into_the_deny_payload(_enforcer_syntax_tree())
+    assert fed_names == set(), (
+        f"Void-advisory checks must run for their stderr side effect alone, never collected "
+        f"into the blocking payload. Fed into extend/append: {sorted(fed_names)}"
+    )
+
+
+def test_void_advisory_checks_are_each_called_by_the_enforcer() -> None:
+    uncalled_names = VOID_ADVISORY_CHECK_FUNCTION_NAMES - _bare_call_names(_enforcer_syntax_tree())
+    assert uncalled_names == set(), (
+        f"Every void-advisory check must appear as a bare call in code_rules_enforcer.py so "
+        f"its findings reach stderr. Never called: {sorted(uncalled_names)}"
+    )
+
+
 def test_diff_scoped_checks_are_registered_and_disjoint() -> None:
     all_check_names = set(_all_check_function_names())
     assert DIFF_SCOPED_CHECK_FUNCTION_NAMES <= all_check_names, (

package/hooks/blocking/test_code_rules_enforcer_codex_apply_patch.py

@@ -20,6 +20,8 @@ if str(_HOOKS_PARENT) not in sys.path:
 import code_rules_enforcer
 import codex_apply_patch
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 def _run_codex_payload(
     payload: dict[str, object],
@@ -146,6 +148,39 @@ def test_codex_payload_blocks_malformed_patch(
     deny_payload = json.loads(stdout)
     assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert "payload requires accepted patch markers" in deny_payload["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_codex_patch_operation_targets_names_every_section_without_reading_content(
+    tmp_path: Path, three_operation_patch: str
+) -> None:
+    """The path-only helper resolves every section's target without any disk read.
+
+    Unlike ``parse_codex_apply_patch``, it never reads prior file content, so a
+    caller that only needs each target path is not tripped up by an unreadable
+    prior file.
+    """
+    all_targets = codex_apply_patch.codex_patch_operation_targets(
+        three_operation_patch, str(tmp_path)
+    )
+
+    all_target_names = {
+        (each_operation, Path(each_path).name) for each_operation, each_path in all_targets
+    }
+    assert all_target_names == {
+        ("update", "updated.py"),
+        (codex_apply_patch.CODEX_ADD_OPERATION, "added.py"),
+        ("delete", "deleted.py"),
+    }
+
+
+def test_codex_patch_operation_targets_rejects_path_traversal(tmp_path: Path) -> None:
+    """A patch path that escapes the working directory is rejected before any read."""
+    escaping_patch = "*** Begin Patch\n*** Add File: ../outside.py\n+content\n*** End Patch"
+
+    with pytest.raises(codex_apply_patch.CodexPatchError):
+        codex_apply_patch.codex_patch_operation_targets(escaping_patch, str(tmp_path))
+
+
 def test_codex_payload_blocks_a_nul_containing_patch_path(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,

package/hooks/blocking/test_code_rules_enforcer_config_path.py

@@ -4,6 +4,7 @@ Covers:
 - is_config_file: must use directory-segment matching, not filename-stem matching
 - check_constants_outside_config: advisory (not blocking) for function-body UPPER_SNAKE
 - check_constants_outside_config: stable sort order by line number
+- validate_content_for_edit_lane: function-local advisories stay out of the deny payload
 """
 
 from __future__ import annotations
@@ -19,19 +20,22 @@ if _BLOCKING_DIRECTORY not in sys.path:
 if _HOOKS_DIRECTORY not in sys.path:
     sys.path.insert(0, _HOOKS_DIRECTORY)
 
-from code_rules_constants_config import (  # noqa: E402
-    check_constants_outside_config,
-    check_constants_outside_config_advisory,
-)
+from code_rules_constants_config import check_constants_outside_config  # noqa: E402
+from code_rules_enforcer import validate_content_for_edit_lane  # noqa: E402
 from code_rules_path_utils import is_config_file  # noqa: E402
 
 code_rules_enforcer = SimpleNamespace(
     check_constants_outside_config=check_constants_outside_config,
-    check_constants_outside_config_advisory=check_constants_outside_config_advisory,
     is_config_file=is_config_file,
 )
 
 PRODUCTION_FILE_PATH = "packages/claude-dev-env/src/example.py"
+FUNCTION_LOCAL_UPPER_SNAKE_SOURCE = (
+    "def fetch_data():\n"
+    "    MAX_RETRIES = 3\n"
+    "    for attempt in range(MAX_RETRIES):\n"
+    "        pass\n"
+)
 
 
 def test_should_return_false_for_filename_named_config_dot_py() -> None:
@@ -63,22 +67,22 @@ def test_should_return_true_for_config_dir_backslash() -> None:
 
 
 def test_should_produce_advisory_not_blocking_for_function_local_upper_snake() -> None:
-    source = (
-        "def fetch_data():\n"
-        "    MAX_RETRIES = 3\n"
-        "    for attempt in range(MAX_RETRIES):\n"
-        "        pass\n"
-    )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source, PRODUCTION_FILE_PATH
-    )
     blocking_issues = code_rules_enforcer.check_constants_outside_config(
-        source, PRODUCTION_FILE_PATH
+        FUNCTION_LOCAL_UPPER_SNAKE_SOURCE, PRODUCTION_FILE_PATH
     )
-    assert any("MAX_RETRIES" in issue for issue in advisory_issues)
     assert not any("MAX_RETRIES" in issue for issue in blocking_issues)
 
 
+def test_function_local_upper_snake_advisory_never_reaches_the_deny_payload() -> None:
+    edit_lane_issues = validate_content_for_edit_lane(
+        FUNCTION_LOCAL_UPPER_SNAKE_SOURCE, PRODUCTION_FILE_PATH
+    )
+    assert not any("MAX_RETRIES" in issue for issue in edit_lane_issues), (
+        f"Expected function-local MAX_RETRIES to stay out of the deny payload, "
+        f"got: {edit_lane_issues}"
+    )
+
+
 def test_should_produce_blocking_for_module_level_upper_snake_outside_config() -> None:
     source = "MAX_RETRIES = 3\n\ndef fetch_data():\n    pass\n"
     blocking_issues = code_rules_enforcer.check_constants_outside_config(
@@ -87,6 +91,15 @@ def test_should_produce_blocking_for_module_level_upper_snake_outside_config() -
     assert any("MAX_RETRIES" in issue for issue in blocking_issues)
 
 
+def test_module_level_upper_snake_still_reaches_the_deny_payload() -> None:
+    source = "MAXIMUM_RETRIES = 3\n\ndef fetch_data() -> int:\n    return MAXIMUM_RETRIES\n"
+    edit_lane_issues = validate_content_for_edit_lane(source, PRODUCTION_FILE_PATH)
+    assert any(
+        "MAXIMUM_RETRIES" in issue and "move to config/" in issue
+        for issue in edit_lane_issues
+    ), f"Expected module-level MAXIMUM_RETRIES to keep denying the write, got: {edit_lane_issues}"
+
+
 def test_should_produce_stable_ordering_sorted_by_line_number() -> None:
     source = (
         "ALPHA_CONSTANT = 1\n"

package/hooks/blocking/test_code_rules_enforcer_duplicate_body_hook_routing.py

@@ -36,6 +36,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_write_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 SHARED_HELPER_SOURCE = (
     "import re\n"
     "\n"

package/hooks/blocking/test_code_rules_enforcer_multi_edit.py

@@ -0,0 +1,118 @@
+"""Behavior tests for code_rules_enforcer's MultiEdit reconstruction.
+
+A MultiEdit payload carries an ``edits`` list rather than a single
+``old_string``/``new_string`` pair. These tests prove the enforcer reconstructs
+the whole post-edit file from every entry in that list — not only the first —
+so a violation introduced by the second or later edit is denied exactly like
+one introduced by the first.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Callable
+
+import pytest
+
+from code_rules_enforcer import main
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
+_TWO_FUNCTION_SOURCE = (
+    "def first_helper() -> int:\n    return 1\n\n\ndef second_helper() -> int:\n    return 2\n"
+)
+
+
+def _production_directory(tmp_path: Path) -> Path:
+    """Return a sibling directory whose path carries no test-name substring.
+
+    ``code_rules_enforcer``'s own path-based exemptions treat any path segment
+    matching a test-name pattern as a test file, and pytest's ``tmp_path``
+    embeds the test function's name, so scanning directly under ``tmp_path``
+    would be silently exempted. A sibling directory named after ordinary
+    production code sidesteps that.
+    """
+    production_directory = tmp_path.parent / "multi-edit-prod"
+    production_directory.mkdir(exist_ok=True)
+    return production_directory
+
+
+def _run_multi_edit(
+    file_path: str,
+    all_edits: list[dict[str, str]],
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> str:
+    stdout_text, _exit_code = run_serialized_payload_entrypoint(
+        main, multi_edit_payload(file_path, all_edits)
+    )
+    return stdout_text
+
+
+def test_violation_in_second_edit_is_denied(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """A library print() introduced only by the second edit is caught and denied."""
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    target_file = _production_directory(tmp_path) / "services.py"
+    target_file.write_text(_TWO_FUNCTION_SOURCE, encoding="utf-8")
+
+    stdout_text = _run_multi_edit(
+        str(target_file),
+        [
+            {"old_string": "return 1", "new_string": "return 11"},
+            {
+                "old_string": "    return 2",
+                "new_string": "    print(2)\n    return 2",
+            },
+        ],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip(), "expected a deny payload, got no output"
+    deny_payload = json.loads(stdout_text)
+    assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+    deny_reason = deny_payload["hookSpecificOutput"]["permissionDecisionReason"].lower()
+    assert "print" in deny_reason
+
+
+def test_multi_edit_on_a_missing_target_is_allowed(
+    tmp_path: Path, multi_edit_payload: Callable[[str, list[dict[str, str]]], str]
+) -> None:
+    """A MultiEdit naming a target file that does not exist on disk is not denied.
+
+    The reconstruction has no prior content to read, so it returns no
+    validatable view rather than crashing or denying a payload it cannot judge.
+    """
+    missing_target = _production_directory(tmp_path) / "not_on_disk.py"
+
+    stdout_text = _run_multi_edit(
+        str(missing_target),
+        [{"old_string": "return 1", "new_string": "return 11"}],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip() == ""
+
+
+def test_clean_multi_edit_is_allowed(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    multi_edit_payload: Callable[[str, list[dict[str, str]]], str],
+) -> None:
+    """A MultiEdit whose reconstructed file carries no violation is allowed."""
+    monkeypatch.setenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", "1")
+    target_file = _production_directory(tmp_path) / "services.py"
+    target_file.write_text(_TWO_FUNCTION_SOURCE, encoding="utf-8")
+
+    stdout_text = _run_multi_edit(
+        str(target_file),
+        [
+            {"old_string": "return 1", "new_string": "return 11"},
+            {"old_string": "return 2", "new_string": "return 22"},
+        ],
+        multi_edit_payload,
+    )
+
+    assert stdout_text.strip() == ""

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -23,6 +23,8 @@ from code_rules_enforcer import (  # noqa: E402
     validate_content_for_full_gate as validate_content,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 PRODUCTION_FILE_PATH = "packages/app/services.py"
 

package/hooks/blocking/test_code_rules_enforcer_precheck_forecast.py

@@ -26,6 +26,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_serialized_payload_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 _ENFORCER_SCRIPT_PATH = Path(__file__).resolve().parent / "code_rules_enforcer.py"
 
 _VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"