claude-dev-env 2.30.1 → 2.31.0

package/hooks/blocking/test_stale_comment_reference_blocker.py

@@ -207,6 +207,77 @@ def test_allows_old_string_not_found(tmp_path: Path) -> None:
     assert outcome.stdout == ""
 
 
+def test_multi_edit_denies_when_the_first_edit_writes_the_stale_comment(
+    tmp_path: Path,
+) -> None:
+    """The comment the second edit orphans is one the first edit just wrote.
+
+    A non-cumulative check reads the ORIGINAL "# Old note" comment and finds
+    nothing to orphan; only applying the first edit before the second reveals
+    "# Mock asyncio" above the removed line.
+    """
+    written_module_path = _write_module(
+        tmp_path,
+        "def launch_export() -> None:\n    # Old note\n" + PATCHED_SLEEP_LINE,
+    )
+    all_edits = [
+        {"old_string": "    # Old note\n", "new_string": KEPT_COMMENT_LINE},
+        {
+            "old_string": PATCHED_SLEEP_LINE.rstrip("\n"),
+            "new_string": PATCHED_POLL_LINE.rstrip("\n"),
+        },
+    ]
+    outcome = _run_hook(
+        "MultiEdit", {"file_path": str(written_module_path), "edits": all_edits}
+    )
+    assert outcome.returncode == 0
+    decision = json.loads(outcome.stdout)
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "asyncio" in decision["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_multi_edit_allows_two_unrelated_edits(tmp_path: Path) -> None:
+    written_module_path = _write_module(
+        tmp_path,
+        "def launch_export() -> None:\n" + KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+    )
+    all_edits = [
+        {
+            "old_string": "def launch_export() -> None:",
+            "new_string": "def launch_export_now() -> None:",
+        },
+        {
+            "old_string": PATCHED_SLEEP_LINE,
+            "new_string": KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+        },
+    ]
+    outcome = _run_hook(
+        "MultiEdit", {"file_path": str(written_module_path), "edits": all_edits}
+    )
+    assert outcome.returncode == 0
+    assert outcome.stdout == ""
+
+
+def test_multi_edit_skips_a_step_whose_old_string_is_absent(tmp_path: Path) -> None:
+    """A MultiEdit step whose old_string never occurs in the current content is skipped."""
+    written_module_path = _write_module(
+        tmp_path,
+        "def launch_export() -> None:\n" + KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+    )
+    all_edits = [
+        {"old_string": "never present anywhere", "new_string": "still never present"},
+        {
+            "old_string": PATCHED_SLEEP_LINE,
+            "new_string": KEPT_COMMENT_LINE + PATCHED_SLEEP_LINE,
+        },
+    ]
+    outcome = _run_hook(
+        "MultiEdit", {"file_path": str(written_module_path), "edits": all_edits}
+    )
+    assert outcome.returncode == 0
+    assert outcome.stdout == ""
+
+
 def test_deny_payload_logs_the_block(tmp_path: Path) -> None:
     """One record lands in the block journal for each denial built through
     evaluate plus build_deny_payload.

package/hooks/blocking/test_state_description_blocker.py

@@ -295,6 +295,74 @@ def test_clean_edit_passes():
     assert result.stdout == ""
 
 
+def test_detects_multi_edit_second_new_string() -> None:
+    """A violation in the second edit of a MultiEdit is denied, not only the first."""
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
+                {"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    output = json.loads(result.stdout)
+    assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "previously" in output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_clean_multi_edit_passes() -> None:
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": CLEAN_PYTHON},
+                {"old_string": "b = 2", "new_string": CLEAN_COMMENT},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_multi_edit_new_strings_join_on_a_separator_not_concatenation() -> None:
+    """Two clean edit fragments stay clean even when one ends where the next begins.
+
+    The first edit's new_string ends in "# describes the previous", and the
+    second's begins with "ly implemented step.". Concatenated with no
+    separator the two would spell "previously" and trip a false deny; joined
+    on a real separator they stay two distinct fragments.
+    """
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "# describes the previous"},
+                {"old_string": "b = 2", "new_string": "ly implemented step."},
+            ],
+        },
+    )
+    assert result.returncode == 0
+    assert result.stdout == ""
+
+
+def test_multi_edit_with_a_single_edit_still_denies() -> None:
+    result = _run_hook(
+        "MultiEdit",
+        {
+            "file_path": "src/main.py",
+            "edits": [{"old_string": "old_comment", "new_string": VIOLATION_PREVIOUSLY_COMMENT}],
+        },
+    )
+    assert result.returncode == 0
+    output = json.loads(result.stdout)
+    assert output["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
 def test_system_message_and_suppress_output():
     result = _run_hook(
         "Write",

package/hooks/blocking/test_subprocess_budget_completeness.py

@@ -586,3 +586,70 @@ def test_full_hook_denies_edit_that_adds_a_timeout_to_a_non_budget_helper(
     hook_output = json.loads(completed_hook.stdout)
     assert hook_output["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert "45s" in hook_output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+_HARMLESS_COMMENT_EDIT = {
+    "old_string": "return git_check.returncode != 0\n",
+    "new_string": "return git_check.returncode != 0  # checked\n",
+}
+_UNCOUNTED_TIMEOUT_EDIT = {
+    "old_string": (
+        '    git_check = subprocess.run(["git", "ls-files", file_path],'
+        " timeout=GIT_CHECK_TIMEOUT_SECONDS)\n"
+    ),
+    "new_string": '    git_check = subprocess.run(["git", "ls-files", file_path], timeout=45)\n',
+}
+
+
+def _run_multi_edit_hook(edited_module_path: pathlib.Path, all_edits: list[dict[str, str]]):
+    hook_input = json.dumps(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {"file_path": str(edited_module_path), "edits": all_edits},
+        }
+    )
+    return subprocess.run(
+        [sys.executable, str(_HOOK_DIR / "subprocess_budget_completeness.py")],
+        input=hook_input,
+        capture_output=True,
+        text=True,
+        timeout=15,
+        check=False,
+    )
+
+
+def test_resolved_content_reconstructs_the_full_file_for_a_multi_edit(
+    tmp_path: pathlib.Path,
+) -> None:
+    """The whole reconstructed file reflects every edit, not only the first."""
+    edited_module_path = tmp_path / "timing_module.py"
+    edited_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    reconstructed_content = resolved_content(
+        {
+            "file_path": str(edited_module_path),
+            "edits": [_HARMLESS_COMMENT_EDIT, _UNCOUNTED_TIMEOUT_EDIT],
+        }
+    )
+    assert "timeout=45" in reconstructed_content
+    assert "# checked" in reconstructed_content
+
+
+def test_full_hook_denies_multi_edit_that_adds_a_timeout_in_the_second_edit(
+    production_module_path: pathlib.Path,
+) -> None:
+    """A new timeout introduced by the second edit of a MultiEdit is caught."""
+    production_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    completed_hook = _run_multi_edit_hook(
+        production_module_path, [_HARMLESS_COMMENT_EDIT, _UNCOUNTED_TIMEOUT_EDIT]
+    )
+    assert completed_hook.returncode == 0
+    hook_output = json.loads(completed_hook.stdout)
+    assert hook_output["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert "45s" in hook_output["hookSpecificOutput"]["permissionDecisionReason"]
+
+
+def test_full_hook_allows_a_clean_multi_edit(production_module_path: pathlib.Path) -> None:
+    production_module_path.write_text(_BUDGET_COUNTS_EVERY_TIMEOUT, encoding="utf-8")
+    completed_hook = _run_multi_edit_hook(production_module_path, [_HARMLESS_COMMENT_EDIT])
+    assert completed_hook.returncode == 0
+    assert completed_hook.stdout == ""

package/hooks/blocking/test_tdd_enforcer.py

@@ -10,6 +10,9 @@ import time
 from pathlib import Path
 
 import pytest
+from tdd_enforcer_parts import content_hash_store
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
 SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
 
@@ -49,6 +52,14 @@ def _make_write_payload(file_path: Path, content: str = "") -> dict:
     }
 
 
+def _make_apply_patch_payload(working_directory: Path, patch_command: str) -> dict:
+    return {
+        "tool_name": "apply_patch",
+        "cwd": str(working_directory),
+        "tool_input": {"command": patch_command},
+    }
+
+
 def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
     if not completed.stdout:
         return None
@@ -76,6 +87,49 @@ def test_should_allow_when_sibling_test_file_exists_and_recent(tmp_path: Path) -
     assert _decision_from(completed) == "allow"
 
 
+def test_should_deny_apply_patch_add_with_no_fresh_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Add File: orders.py\n"
+        "+def fulfill(): pass\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_apply_patch_payload(sandbox, patch_command),
+        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+    )
+
+    assert _decision_from(completed) == "deny"
+    parsed = json.loads(completed.stdout)
+    reason = parsed["hookSpecificOutput"]["permissionDecisionReason"]
+    assert "test_orders.py" in reason
+
+
+def test_should_allow_apply_patch_update_with_fresh_sibling_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Update File: orders.py\n"
+        "@@\n"
+        "-def fulfill(): pass\n"
+        "+def fulfill(): return True\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_apply_patch_payload(sandbox, patch_command),
+        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
 def test_should_deny_when_no_test_file_exists(tmp_path: Path) -> None:
     sandbox = _sandbox(tmp_path)
     production_file = sandbox / "orders.py"
@@ -834,8 +888,9 @@ def _run_hook_with_payload_and_env(
 _BEHAVIOR_BEARING_CONTENT = "def fulfill_order(order: str) -> str:\n    return order\n"
 
 
-def test_should_exit_zero_for_ephemeral_scratch_python() -> None:
+def test_should_exit_zero_for_ephemeral_scratch_python(monkeypatch: pytest.MonkeyPatch) -> None:
     """B16: behavior-bearing scratch .py under root-anchored /tmp exits 0 with no deny."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
     ephemeral_path = "/tmp/scratch_work.py"
     payload = _make_write_payload(Path(ephemeral_path), _BEHAVIOR_BEARING_CONTENT)
     completed = _run_hook_with_payload(payload)
@@ -844,8 +899,9 @@ def test_should_exit_zero_for_ephemeral_scratch_python() -> None:
     )
 
 
-def test_should_exit_zero_for_ephemeral_scratch_typescript() -> None:
+def test_should_exit_zero_for_ephemeral_scratch_typescript(monkeypatch: pytest.MonkeyPatch) -> None:
     """B17: ephemeral .ts scratch file under root-anchored /tmp exits 0 with no deny."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
     ephemeral_path = "/tmp/scratch_work.ts"
     payload = {
         "tool_name": "Write",
@@ -1194,3 +1250,127 @@ def test_should_deny_changing_a_future_import_on_a_constants_only_file(tmp_path:
     )
 
     assert _decision_from(completed) == "deny"
+
+
+def _make_write_payload_for_session(
+    file_path: Path, content: str, session_id: str, repository_root: Path
+) -> dict:
+    return {
+        "session_id": session_id,
+        "cwd": str(repository_root),
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(file_path), "content": content},
+    }
+
+
+def _seed_stale_recorded_hash(
+    candidate: Path, session_id: str, repository_root: Path, seconds_past_window: int
+) -> None:
+    """Plant a session record as if the gate had genuinely seen *candidate* long ago."""
+    state_file = content_hash_store._state_file_path(session_id, str(repository_root))
+    candidate_key = content_hash_store._state_key_for(candidate)
+    recorded_hash = content_hash_store._content_hash(candidate.read_text())
+    stale_changed_at = time.time() - FRESHNESS_SECONDS - seconds_past_window
+    state = {
+        candidate_key: {
+            content_hash_store.STORED_CONTENT_HASH_KEY: recorded_hash,
+            content_hash_store.STORED_CHANGED_AT_KEY: stale_changed_at,
+        }
+    }
+    content_hash_store._atomic_write_state(state_file, state)
+
+
+def test_should_deny_when_test_file_was_recorded_then_only_touched_after_window(
+    tmp_path: Path,
+) -> None:
+    """The exact loophole: a session-recorded test, later only touched, stays denied."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "touch-loophole-session"
+    _seed_stale_recorded_hash(sibling_test, session_id, sandbox, seconds_past_window=60)
+
+    sibling_test.touch()
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_allow_when_test_file_content_actually_changed_after_window(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "touch-loophole-real-edit-session"
+    _seed_stale_recorded_hash(sibling_test, session_id, sandbox, seconds_past_window=60)
+
+    sibling_test.write_text("def test_fulfill(): assert True\n")
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_allow_repeat_production_write_within_window_without_further_test_change(
+    tmp_path: Path,
+) -> None:
+    """GREEN/REFACTOR needs several production writes after one real test edit."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "green-refactor-session"
+
+    first_write = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+    assert _decision_from(first_write) == "allow"
+
+    second_write = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 2\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(second_write) == "allow"
+
+
+def test_should_deny_apply_patch_that_adds_test_and_production_file_in_one_transaction(
+    tmp_path: Path,
+) -> None:
+    """One patch adding both files denies: the test is not yet on disk when read.
+
+    ``apply_patch`` is a PreToolUse hook; it sees the patch text before the
+    patch runs, so a same-transaction test file is not readable yet even
+    though it names a real, matching test.
+    """
+    sandbox = _sandbox(tmp_path)
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Add File: orders.py\n"
+        "+def fulfill(): pass\n"
+        "*** Add File: test_orders.py\n"
+        "+def test_fulfill(): pass\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(_make_apply_patch_payload(sandbox, patch_command))
+
+    assert _decision_from(completed) == "deny"

package/hooks/blocking/test_windows_rmtree_blocker.py

@@ -165,6 +165,31 @@ def test_extract_payload_returns_content_for_write_without_file_path() -> None:
     assert extracted == "some python code"
 
 
+def test_extract_payload_reads_every_multi_edit_new_string() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": DANGEROUS_RMTREE_SNIPPET},
+            ],
+        },
+    )
+    assert DANGEROUS_RMTREE_SNIPPET in extracted
+
+
+def test_extract_payload_reads_a_single_item_multi_edit() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [{"old_string": "a = 1", "new_string": DANGEROUS_RMTREE_SNIPPET}],
+        },
+    )
+    assert extracted == DANGEROUS_RMTREE_SNIPPET
+
+
 def _run_hook_with_stdin_text(stdin_text: str) -> tuple[str, str, int]:
     captured_stdout = io.StringIO()
     captured_stderr = io.StringIO()
@@ -207,6 +232,44 @@ def test_main_blocks_unsafe_bash_command() -> None:
     assert "windows-rmtree" in decision_block["permissionDecisionReason"]
 
 
+def test_main_blocks_unsafe_rmtree_introduced_by_second_multi_edit() -> None:
+    """An unsafe rmtree call in the second edit of a MultiEdit is caught, not only the first."""
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "cleanup.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": DANGEROUS_RMTREE_SNIPPET},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    response_payload = json.loads(stdout_text)
+    decision_block = response_payload["hookSpecificOutput"]
+    assert decision_block["permissionDecision"] == "deny"
+    assert "windows-rmtree" in decision_block["permissionDecisionReason"]
+
+
+def test_main_allows_clean_multi_edit() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "cleanup.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": "shutil.rmtree(path, onexc=handler)"},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
 def test_main_passes_through_safe_write() -> None:
     stdout_text, exit_code = _run_hook(
         {

package/hooks/blocking/test_write_existing_file_blocker.py

@@ -0,0 +1,122 @@
+"""Tests for the write_existing_file_blocker hook.
+
+Each case drives the real hook's ``main()`` through its production stdin path,
+feeding it the PreToolUse JSON payload Claude Code sends and reading the
+permission decision back off stdout.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import json
+from collections.abc import Mapping
+from pathlib import Path
+
+import pytest
+
+import write_existing_file_blocker
+
+
+def _run_payload(
+    payload: Mapping[str, object],
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> str:
+    """Run the real hook entry point and return its stdout."""
+    monkeypatch.setattr(write_existing_file_blocker.sys, "stdin", io.StringIO(json.dumps(payload)))
+    with contextlib.suppress(SystemExit):
+        write_existing_file_blocker.main()
+    return capsys.readouterr().out
+
+
+def _is_deny(stdout_text: str) -> bool:
+    if not stdout_text.strip():
+        return False
+    decision = json.loads(stdout_text)
+    return decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_write_denies_an_existing_target(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A Write onto a path that already exists is denied."""
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(existing_path), "content": "x = 2\n"},
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert _is_deny(stdout), f"expected a deny, got {stdout!r}"
+
+
+def test_apply_patch_add_denies_an_existing_target(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """An apply_patch 'Add File' section targeting an existing path is denied."""
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(tmp_path),
+        "tool_input": {
+            "command": ("*** Begin Patch\n*** Add File: already_here.py\n+x = 2\n*** End Patch")
+        },
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert _is_deny(stdout), f"expected a deny, got {stdout!r}"
+
+
+def test_apply_patch_update_on_an_existing_target_is_allowed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """An 'Update File' section on an existing path is not an unread overwrite."""
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(tmp_path),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Update File: already_here.py\n"
+                "@@\n"
+                "-x = 1\n"
+                "+x = 2\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert not _is_deny(stdout), f"expected an allow, got {stdout!r}"
+
+
+def test_multi_edit_on_an_existing_target_is_allowed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A MultiEdit always targets a file already on disk, so it is never denied here.
+
+    Every MultiEdit edit must match an ``old_string`` already present in the
+    file, so MultiEdit carries no blind create-or-clobber path the way a Write
+    or an apply_patch 'Add File' does — this hook allows it unconditionally.
+    """
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": str(existing_path),
+            "edits": [{"old_string": "x = 1", "new_string": "x = 2"}],
+        },
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert not _is_deny(stdout), f"expected an allow, got {stdout!r}"

package/hooks/blocking/windows_rmtree_blocker.py

@@ -17,13 +17,22 @@ import re
 import sys
 from pathlib import Path
 
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
-from hooks_constants.windows_rmtree_blocker_constants import PYTHON_FILE_EXTENSION  # noqa: E402
+try:
+    _hooks_dir = str(Path(__file__).resolve().parent.parent)
+    if _hooks_dir not in sys.path:
+        sys.path.insert(0, _hooks_dir)
+
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.multi_edit_reconstruction import joined_new_strings
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.windows_rmtree_blocker_constants import (
+        PYTHON_FILE_EXTENSION,
+    )
+except ImportError as import_error:
+    raise ImportError(
+        "windows_rmtree_blocker: cannot import its sibling modules; "
+        "ensure the hooks directory is importable."
+    ) from import_error
 
 
 def payload_contains_unsafe_rmtree(payload_text: str) -> bool:
@@ -37,6 +46,11 @@ def payload_contains_unsafe_rmtree(payload_text: str) -> bool:
 
 
 def extract_payload_text(tool_name: str, tool_input: dict) -> str:
+    if tool_name == "MultiEdit":
+        file_path = tool_input.get("file_path", "")
+        if file_path and not file_path.endswith(PYTHON_FILE_EXTENSION):
+            return ""
+        return joined_new_strings(tool_input)
     if tool_name in {"Write", "Edit"}:
         file_path = tool_input.get("file_path", "")
         if file_path and not file_path.endswith(PYTHON_FILE_EXTENSION):