claude-dev-env 2.30.1 → 2.31.1

package/hooks/blocking/test_tdd_enforcer.py

@@ -10,6 +10,9 @@ import time
 from pathlib import Path
 
 import pytest
+from tdd_enforcer_parts import content_hash_store
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
 SCRIPT_PATH = Path(__file__).parent / "tdd_enforcer.py"
 
@@ -49,6 +52,14 @@ def _make_write_payload(file_path: Path, content: str = "") -> dict:
     }
 
 
+def _make_apply_patch_payload(working_directory: Path, patch_command: str) -> dict:
+    return {
+        "tool_name": "apply_patch",
+        "cwd": str(working_directory),
+        "tool_input": {"command": patch_command},
+    }
+
+
 def _decision_from(completed: subprocess.CompletedProcess[str]) -> str | None:
     if not completed.stdout:
         return None
@@ -76,6 +87,49 @@ def test_should_allow_when_sibling_test_file_exists_and_recent(tmp_path: Path) -
     assert _decision_from(completed) == "allow"
 
 
+def test_should_deny_apply_patch_add_with_no_fresh_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Add File: orders.py\n"
+        "+def fulfill(): pass\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_apply_patch_payload(sandbox, patch_command),
+        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+    )
+
+    assert _decision_from(completed) == "deny"
+    parsed = json.loads(completed.stdout)
+    reason = parsed["hookSpecificOutput"]["permissionDecisionReason"]
+    assert "test_orders.py" in reason
+
+
+def test_should_allow_apply_patch_update_with_fresh_sibling_test(tmp_path: Path) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Update File: orders.py\n"
+        "@@\n"
+        "-def fulfill(): pass\n"
+        "+def fulfill(): return True\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(
+        _make_apply_patch_payload(sandbox, patch_command),
+        extra_env={"CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT": "1"},
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
 def test_should_deny_when_no_test_file_exists(tmp_path: Path) -> None:
     sandbox = _sandbox(tmp_path)
     production_file = sandbox / "orders.py"
@@ -834,8 +888,9 @@ def _run_hook_with_payload_and_env(
 _BEHAVIOR_BEARING_CONTENT = "def fulfill_order(order: str) -> str:\n    return order\n"
 
 
-def test_should_exit_zero_for_ephemeral_scratch_python() -> None:
+def test_should_exit_zero_for_ephemeral_scratch_python(monkeypatch: pytest.MonkeyPatch) -> None:
     """B16: behavior-bearing scratch .py under root-anchored /tmp exits 0 with no deny."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
     ephemeral_path = "/tmp/scratch_work.py"
     payload = _make_write_payload(Path(ephemeral_path), _BEHAVIOR_BEARING_CONTENT)
     completed = _run_hook_with_payload(payload)
@@ -844,8 +899,9 @@ def test_should_exit_zero_for_ephemeral_scratch_python() -> None:
     )
 
 
-def test_should_exit_zero_for_ephemeral_scratch_typescript() -> None:
+def test_should_exit_zero_for_ephemeral_scratch_typescript(monkeypatch: pytest.MonkeyPatch) -> None:
     """B17: ephemeral .ts scratch file under root-anchored /tmp exits 0 with no deny."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
     ephemeral_path = "/tmp/scratch_work.ts"
     payload = {
         "tool_name": "Write",
@@ -1194,3 +1250,191 @@ def test_should_deny_changing_a_future_import_on_a_constants_only_file(tmp_path:
     )
 
     assert _decision_from(completed) == "deny"
+
+
+def _make_write_payload_for_session(
+    file_path: Path, content: str, session_id: str, repository_root: Path
+) -> dict:
+    return {
+        "session_id": session_id,
+        "cwd": str(repository_root),
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(file_path), "content": content},
+    }
+
+
+def _seed_stale_recorded_hash(
+    candidate: Path, session_id: str, repository_root: Path, seconds_past_window: int
+) -> None:
+    """Plant a session record as if the gate had genuinely seen *candidate* long ago."""
+    state_file = content_hash_store._state_file_path(session_id, str(repository_root))
+    candidate_key = content_hash_store._state_key_for(candidate)
+    recorded_hash = content_hash_store._content_hash(candidate.read_text())
+    stale_changed_at = time.time() - FRESHNESS_SECONDS - seconds_past_window
+    state = {
+        candidate_key: {
+            content_hash_store.STORED_CONTENT_HASH_KEY: recorded_hash,
+            content_hash_store.STORED_CHANGED_AT_KEY: stale_changed_at,
+        }
+    }
+    content_hash_store._atomic_write_state(state_file, state)
+
+
+def test_should_deny_when_test_file_was_recorded_then_only_touched_after_window(
+    tmp_path: Path,
+) -> None:
+    """The exact loophole: a session-recorded test, later only touched, stays denied."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "touch-loophole-session"
+    _seed_stale_recorded_hash(sibling_test, session_id, sandbox, seconds_past_window=60)
+
+    sibling_test.touch()
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_allow_when_test_file_content_actually_changed_after_window(
+    tmp_path: Path,
+) -> None:
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "touch-loophole-real-edit-session"
+    _seed_stale_recorded_hash(sibling_test, session_id, sandbox, seconds_past_window=60)
+
+    sibling_test.write_text("def test_fulfill(): assert True\n")
+
+    completed = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(completed) == "allow"
+
+
+def test_should_allow_repeat_production_write_within_window_without_further_test_change(
+    tmp_path: Path,
+) -> None:
+    """GREEN/REFACTOR needs several production writes after one real test edit."""
+    sandbox = _sandbox(tmp_path)
+    production_file = sandbox / "orders.py"
+    production_file.write_text("def fulfill(): pass\n")
+    sibling_test = sandbox / "test_orders.py"
+    sibling_test.write_text("def test_fulfill(): pass\n")
+    session_id = "green-refactor-session"
+
+    first_write = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 1\n", session_id, sandbox
+        )
+    )
+    assert _decision_from(first_write) == "allow"
+
+    second_write = _run_hook_with_payload(
+        _make_write_payload_for_session(
+            production_file, "def fulfill(): return 2\n", session_id, sandbox
+        )
+    )
+
+    assert _decision_from(second_write) == "allow"
+
+
+def test_should_deny_apply_patch_that_adds_test_and_production_file_in_one_transaction(
+    tmp_path: Path,
+) -> None:
+    """One patch adding both files denies: the test is not yet on disk when read.
+
+    ``apply_patch`` is a PreToolUse hook; it sees the patch text before the
+    patch runs, so a same-transaction test file is not readable yet even
+    though it names a real, matching test.
+    """
+    sandbox = _sandbox(tmp_path)
+    patch_command = (
+        "*** Begin Patch\n"
+        "*** Add File: orders.py\n"
+        "+def fulfill(): pass\n"
+        "*** Add File: test_orders.py\n"
+        "+def test_fulfill(): pass\n"
+        "*** End Patch"
+    )
+
+    completed = _run_hook_with_payload(_make_apply_patch_payload(sandbox, patch_command))
+
+    assert _decision_from(completed) == "deny"
+
+
+def test_should_stay_exempt_for_scratch_outside_repository_root(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Repo-root fix: a genuine scratch file outside the repository stays exempt."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_root = "/tmp/pr-alpha"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": "/tmp/scratch/one_off.py",
+            "content": _BEHAVIOR_BEARING_CONTENT,
+        },
+        "cwd": repository_root,
+    }
+    completed = _run_hook_with_payload(payload)
+    assert _decision_from(completed) != "deny", (
+        f"TDD enforcer must not deny scratch outside the repository, got: {completed.stdout!r}"
+    )
+
+
+def test_should_stay_exempt_for_unrelated_worktree_sibling_under_tmp(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Repo-root fix: a sibling sharing the root's name prefix is not inside it.
+
+    Containment is judged by path segment, so /tmp/pr-alpha-sibling is outside
+    /tmp/pr-alpha however much of the name the two share.
+    """
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_root = "/tmp/pr-alpha"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": "/tmp/pr-alpha-sibling/hooks/orders.py",
+            "content": _BEHAVIOR_BEARING_CONTENT,
+        },
+        "cwd": repository_root,
+    }
+    completed = _run_hook_with_payload(payload)
+    assert _decision_from(completed) != "deny", (
+        f"TDD enforcer must not deny an unrelated sibling worktree, got: {completed.stdout!r}"
+    )
+
+
+def test_should_deny_production_file_inside_repository_root_under_tmp(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Repo-root fix: a production file inside a repository under /tmp still needs a test."""
+    monkeypatch.delenv("CLAUDE_CODE_RULES_DISABLE_EPHEMERAL_EXEMPT", raising=False)
+    repository_root = "/tmp/pr-alpha"
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": f"{repository_root}/hooks/blocking/orders.py",
+            "content": _BEHAVIOR_BEARING_CONTENT,
+        },
+        "cwd": repository_root,
+    }
+    completed = _run_hook_with_payload(payload)
+    assert _decision_from(completed) == "deny", (
+        f"TDD enforcer must gate a repository file under /tmp, got: {completed.stdout!r}"
+    )

package/hooks/blocking/test_windows_rmtree_blocker.py

@@ -165,6 +165,31 @@ def test_extract_payload_returns_content_for_write_without_file_path() -> None:
     assert extracted == "some python code"
 
 
+def test_extract_payload_reads_every_multi_edit_new_string() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": DANGEROUS_RMTREE_SNIPPET},
+            ],
+        },
+    )
+    assert DANGEROUS_RMTREE_SNIPPET in extracted
+
+
+def test_extract_payload_reads_a_single_item_multi_edit() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [{"old_string": "a = 1", "new_string": DANGEROUS_RMTREE_SNIPPET}],
+        },
+    )
+    assert extracted == DANGEROUS_RMTREE_SNIPPET
+
+
 def _run_hook_with_stdin_text(stdin_text: str) -> tuple[str, str, int]:
     captured_stdout = io.StringIO()
     captured_stderr = io.StringIO()
@@ -207,6 +232,44 @@ def test_main_blocks_unsafe_bash_command() -> None:
     assert "windows-rmtree" in decision_block["permissionDecisionReason"]
 
 
+def test_main_blocks_unsafe_rmtree_introduced_by_second_multi_edit() -> None:
+    """An unsafe rmtree call in the second edit of a MultiEdit is caught, not only the first."""
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "cleanup.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": DANGEROUS_RMTREE_SNIPPET},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    response_payload = json.loads(stdout_text)
+    decision_block = response_payload["hookSpecificOutput"]
+    assert decision_block["permissionDecision"] == "deny"
+    assert "windows-rmtree" in decision_block["permissionDecisionReason"]
+
+
+def test_main_allows_clean_multi_edit() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "cleanup.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": "shutil.rmtree(path, onexc=handler)"},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
 def test_main_passes_through_safe_write() -> None:
     stdout_text, exit_code = _run_hook(
         {

package/hooks/blocking/test_write_existing_file_blocker.py

@@ -0,0 +1,122 @@
+"""Tests for the write_existing_file_blocker hook.
+
+Each case drives the real hook's ``main()`` through its production stdin path,
+feeding it the PreToolUse JSON payload Claude Code sends and reading the
+permission decision back off stdout.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import json
+from collections.abc import Mapping
+from pathlib import Path
+
+import pytest
+
+import write_existing_file_blocker
+
+
+def _run_payload(
+    payload: Mapping[str, object],
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> str:
+    """Run the real hook entry point and return its stdout."""
+    monkeypatch.setattr(write_existing_file_blocker.sys, "stdin", io.StringIO(json.dumps(payload)))
+    with contextlib.suppress(SystemExit):
+        write_existing_file_blocker.main()
+    return capsys.readouterr().out
+
+
+def _is_deny(stdout_text: str) -> bool:
+    if not stdout_text.strip():
+        return False
+    decision = json.loads(stdout_text)
+    return decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_write_denies_an_existing_target(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A Write onto a path that already exists is denied."""
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "Write",
+        "tool_input": {"file_path": str(existing_path), "content": "x = 2\n"},
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert _is_deny(stdout), f"expected a deny, got {stdout!r}"
+
+
+def test_apply_patch_add_denies_an_existing_target(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """An apply_patch 'Add File' section targeting an existing path is denied."""
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(tmp_path),
+        "tool_input": {
+            "command": ("*** Begin Patch\n*** Add File: already_here.py\n+x = 2\n*** End Patch")
+        },
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert _is_deny(stdout), f"expected a deny, got {stdout!r}"
+
+
+def test_apply_patch_update_on_an_existing_target_is_allowed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """An 'Update File' section on an existing path is not an unread overwrite."""
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "apply_patch",
+        "cwd": str(tmp_path),
+        "tool_input": {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Update File: already_here.py\n"
+                "@@\n"
+                "-x = 1\n"
+                "+x = 2\n"
+                "*** End Patch"
+            )
+        },
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert not _is_deny(stdout), f"expected an allow, got {stdout!r}"
+
+
+def test_multi_edit_on_an_existing_target_is_allowed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    """A MultiEdit always targets a file already on disk, so it is never denied here.
+
+    Every MultiEdit edit must match an ``old_string`` already present in the
+    file, so MultiEdit carries no blind create-or-clobber path the way a Write
+    or an apply_patch 'Add File' does — this hook allows it unconditionally.
+    """
+    existing_path = tmp_path / "already_here.py"
+    existing_path.write_text("x = 1\n", encoding="utf-8")
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": str(existing_path),
+            "edits": [{"old_string": "x = 1", "new_string": "x = 2"}],
+        },
+    }
+
+    stdout = _run_payload(payload, monkeypatch, capsys)
+
+    assert not _is_deny(stdout), f"expected an allow, got {stdout!r}"

package/hooks/blocking/windows_rmtree_blocker.py

@@ -17,13 +17,22 @@ import re
 import sys
 from pathlib import Path
 
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
-from hooks_constants.windows_rmtree_blocker_constants import PYTHON_FILE_EXTENSION  # noqa: E402
+try:
+    _hooks_dir = str(Path(__file__).resolve().parent.parent)
+    if _hooks_dir not in sys.path:
+        sys.path.insert(0, _hooks_dir)
+
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.multi_edit_reconstruction import joined_new_strings
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.windows_rmtree_blocker_constants import (
+        PYTHON_FILE_EXTENSION,
+    )
+except ImportError as import_error:
+    raise ImportError(
+        "windows_rmtree_blocker: cannot import its sibling modules; "
+        "ensure the hooks directory is importable."
+    ) from import_error
 
 
 def payload_contains_unsafe_rmtree(payload_text: str) -> bool:
@@ -37,6 +46,11 @@ def payload_contains_unsafe_rmtree(payload_text: str) -> bool:
 
 
 def extract_payload_text(tool_name: str, tool_input: dict) -> str:
+    if tool_name == "MultiEdit":
+        file_path = tool_input.get("file_path", "")
+        if file_path and not file_path.endswith(PYTHON_FILE_EXTENSION):
+            return ""
+        return joined_new_strings(tool_input)
     if tool_name in {"Write", "Edit"}:
         file_path = tool_input.get("file_path", "")
         if file_path and not file_path.endswith(PYTHON_FILE_EXTENSION):

package/hooks/blocking/write_existing_file_blocker.py

@@ -1,8 +1,14 @@
 #!/usr/bin/env python3
-"""PreToolUse:Write hook — blocks Write tool when the target file already exists.
+"""PreToolUse hook — blocks Write and apply_patch "Add File" onto an existing target.
 
-Agents should use Edit for modifying existing files. Write is only for new file creation.
+Agents should use Edit for modifying existing files, and an apply_patch
+"Update File" section rather than "Add File" for a path that already exists.
 Exemptions: Jupyter notebooks (.ipynb) and files in ~/.claude/hooks/ (standalone scripts).
+
+MultiEdit carries no create-or-clobber path this hook needs to guard: every
+MultiEdit edit must match an ``old_string`` already present in the target file,
+so a MultiEdit can never introduce content nobody read the way a blind Write or
+an apply_patch "Add File" can. This hook allows MultiEdit unconditionally.
 """
 
 import json
@@ -14,7 +20,22 @@ _hooks_dir = str(Path(__file__).resolve().parent.parent)
 if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+try:
+    from codex_apply_patch import (
+        CODEX_ADD_OPERATION,
+        CodexPatchError,
+        codex_patch_operation_targets,
+        payload_patch_command,
+    )
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+    from hooks_constants.pre_tool_use_dispatcher_constants import APPLY_PATCH_TOOL_NAME
+    from sensitive_file_protector import build_deny_response
+except ImportError as import_error:
+    raise ImportError(
+        "write_existing_file_blocker: cannot import its sibling modules; "
+        "ensure the hooks directory is importable."
+    ) from import_error
 
 JUPYTER_EXTENSION = ".ipynb"
 HOOKS_DIRECTORY = os.path.normpath(os.path.expanduser("~/.claude/hooks"))
@@ -29,48 +50,73 @@ def is_inside_hooks_directory(file_path: str) -> bool:
     return normalized_path.startswith(HOOKS_DIRECTORY)
 
 
-def main() -> None:
+def _apply_patch_add_deny(payload: dict, tool_input: dict) -> tuple[str, str] | None:
+    """Return (deny_reason, offending_path) for an apply_patch 'Add File' onto an existing path."""
+    command, working_directory = payload_patch_command(payload, tool_input)
+    if not command:
+        return None
     try:
-        input_payload = json.load(sys.stdin)
-    except json.JSONDecodeError:
-        sys.exit(0)
+        all_operation_targets = codex_patch_operation_targets(command, working_directory)
+    except CodexPatchError:
+        return None
+    for each_operation, each_target_path in all_operation_targets:
+        if each_operation != CODEX_ADD_OPERATION:
+            continue
+        if os.path.exists(each_target_path):
+            deny_reason = (
+                f"BLOCKED: apply_patch 'Add File' on existing file {each_target_path}. "
+                "Use an 'Update File' section instead."
+            )
+            return deny_reason, each_target_path
+    return None
+
+
+def _write_onto_existing_file_deny(tool_input: dict) -> tuple[str, str] | None:
+    """Return (deny_reason, offending_path) for a Write onto an existing target."""
+    target_file_path = tool_input.get("file_path", "")
+    if not target_file_path:
+        return None
+    if is_jupyter_notebook(target_file_path):
+        return None
+    if is_inside_hooks_directory(target_file_path):
+        return None
+    if not os.path.exists(target_file_path):
+        return None
+    deny_reason = f"BLOCKED: Write on existing file {target_file_path}. Use Edit tool instead."
+    return deny_reason, target_file_path
 
-    tool_name = input_payload.get("tool_name", "")
-    tool_input = input_payload.get("tool_input", {})
 
+def _resolve_deny(tool_name: str, payload: dict, tool_input: dict) -> tuple[str, str] | None:
+    """Return (deny_reason, offending_path) for the payload, or None to allow."""
+    if tool_name == APPLY_PATCH_TOOL_NAME:
+        return _apply_patch_add_deny(payload, tool_input)
     if tool_name != "Write":
-        sys.exit(0)
+        return None
+    return _write_onto_existing_file_deny(tool_input)
 
-    target_file_path = tool_input.get("file_path", "")
 
-    if not target_file_path:
-        sys.exit(0)
-
-    if is_jupyter_notebook(target_file_path):
+def main() -> None:
+    input_payload = read_hook_input_dictionary_from_stdin()
+    if input_payload is None:
         sys.exit(0)
 
-    if is_inside_hooks_directory(target_file_path):
-        sys.exit(0)
+    raw_tool_name = input_payload.get("tool_name", "")
+    raw_tool_input = input_payload.get("tool_input", {})
+    tool_name = raw_tool_name if isinstance(raw_tool_name, str) else ""
+    tool_input = raw_tool_input if isinstance(raw_tool_input, dict) else {}
 
-    if not os.path.exists(target_file_path):
+    resolved_deny = _resolve_deny(tool_name, input_payload, tool_input)
+    if resolved_deny is None:
         sys.exit(0)
+    deny_reason, offending_path = resolved_deny
 
-    deny_reason = f"BLOCKED: Write on existing file {target_file_path}. Use Edit tool instead."
-    denial = {
-        "hookSpecificOutput": {
-            "hookEventName": "PreToolUse",
-            "permissionDecision": "deny",
-            "permissionDecisionReason": deny_reason,
-        }
-    }
     log_hook_block(
         calling_hook_name="write_existing_file_blocker.py",
         hook_event="PreToolUse",
         block_reason=deny_reason,
-        tool_name="Write",
-        offending_input_preview=target_file_path,
+        offending_input_preview=offending_path,
     )
-    print(json.dumps(denial))
+    print(json.dumps(build_deny_response(deny_reason)))
     sys.exit(0)