claude-dev-env 2.30.1 → 2.31.1

package/hooks/blocking/config/codex_apply_patch_constants.py

@@ -0,0 +1,13 @@
+"""Shared operation-name constants for codex_apply_patch.py.
+
+A Codex apply_patch command names three operations — add, update, and
+delete — by a literal marker line. These three constants are the single
+source of truth for those spellings, so every caller that branches on one
+compares against one value rather than a second local copy that could drift.
+"""
+
+from __future__ import annotations
+
+CODEX_ADD_OPERATION = "add"
+CODEX_UPDATE_OPERATION = "update"
+CODEX_DELETE_OPERATION = "delete"

package/hooks/blocking/conftest.py

@@ -0,0 +1,70 @@
+"""Add hooks/blocking and hooks/ to sys.path for every test collected under this directory."""
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+from typing import Callable
+
+import pytest
+
+_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
+_HOOKS_DIRECTORY = str(Path(_BLOCKING_DIRECTORY).parent)
+for each_directory in (_BLOCKING_DIRECTORY, _HOOKS_DIRECTORY):
+    if each_directory not in sys.path:
+        sys.path.insert(0, each_directory)
+
+
+@pytest.fixture
+def three_operation_patch() -> str:
+    """Build a patch naming one update, one add, and one delete section."""
+    return (
+        "*** Begin Patch\n"
+        "*** Update File: updated.py\n"
+        "@@\n"
+        "-before\n"
+        "+after\n"
+        " keep\n"
+        "*** Add File: added.py\n"
+        "+new\n"
+        "*** Delete File: deleted.py\n"
+        "*** End of File\n"
+        "*** End Patch"
+    )
+
+
+@pytest.fixture
+def init_bare_git_repo() -> Callable[[Path], None]:
+    """Return a helper that initializes an empty git repository at a given path.
+
+    The PII scanner reads an apply_patch payload's ``cwd`` as a git
+    repository root, so a dispatcher-level apply_patch test needs a real
+    repository there rather than a bare temp directory.
+    """
+
+    def _init_bare_git_repo(repository_root: Path) -> None:
+        repository_root.mkdir(parents=True, exist_ok=True)
+        subprocess.run(["git", "init"], cwd=repository_root, check=True, capture_output=True)
+
+    return _init_bare_git_repo
+
+
+@pytest.fixture
+def synthetic_github_token() -> str:
+    """Return a fixture-only GitHub token shape, safe to embed in test payloads."""
+    return "ghp_" + ("C" * 36)
+
+
+@pytest.fixture
+def multi_edit_payload() -> Callable[[str, list[dict[str, str]]], str]:
+    """Return a helper that builds a MultiEdit tool payload JSON string."""
+
+    def _multi_edit_payload(file_path: str, all_edits: list[dict[str, str]]) -> str:
+        return json.dumps(
+            {
+                "tool_name": "MultiEdit",
+                "tool_input": {"file_path": file_path, "edits": all_edits},
+            }
+        )
+
+    return _multi_edit_payload

package/hooks/blocking/duplicate_rmtree_helper_blocker.py

@@ -27,20 +27,28 @@ import json
 import sys
 from pathlib import Path
 
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from hooks_constants.duplicate_rmtree_helper_blocker_constants import (  # noqa: E402
-    ALL_EXEMPT_PATH_FRAGMENTS,
-    ALL_EXEMPT_TEST_FILE_PREFIXES,
-    ALL_EXEMPT_TEST_FILE_SUFFIXES,
-    HELPER_DEFINITION_PATTERN,
-    PYTHON_FILE_EXTENSION,
-    TRIPLE_QUOTED_STRING_PATTERN,
-)
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
+try:
+    _hooks_dir = str(Path(__file__).resolve().parent.parent)
+    if _hooks_dir not in sys.path:
+        sys.path.insert(0, _hooks_dir)
+
+    from hooks_constants.duplicate_rmtree_helper_blocker_constants import (
+        ALL_APPLICABLE_TOOL_NAMES,
+        ALL_EXEMPT_PATH_FRAGMENTS,
+        ALL_EXEMPT_TEST_FILE_PREFIXES,
+        ALL_EXEMPT_TEST_FILE_SUFFIXES,
+        HELPER_DEFINITION_PATTERN,
+        PYTHON_FILE_EXTENSION,
+        TRIPLE_QUOTED_STRING_PATTERN,
+    )
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.multi_edit_reconstruction import joined_new_strings
+    from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+except ImportError as import_error:
+    raise ImportError(
+        "duplicate_rmtree_helper_blocker: cannot import its sibling modules; "
+        "ensure the hooks directory is importable."
+    ) from import_error
 
 
 def payload_defines_sanctioned_helper(payload_text: str) -> bool:
@@ -87,7 +95,7 @@ def path_is_exempt(file_path: str) -> bool:
 
 
 def extract_payload_text(tool_name: str, tool_input: dict) -> tuple[str, str]:
-    """Return the (file_path, scanned_text) pair for a Write/Edit to a Python file.
+    """Return the (file_path, scanned_text) pair for a Write/Edit/MultiEdit to a Python file.
 
     Args:
         tool_name: The PreToolUse tool name.
@@ -97,11 +105,13 @@ def extract_payload_text(tool_name: str, tool_input: dict) -> tuple[str, str]:
         A pair of the target path and the text to scan. The text is empty for an
         unrelated tool or a non-Python target, so the caller exits without blocking.
     """
-    if tool_name not in {"Write", "Edit"}:
+    if tool_name not in ALL_APPLICABLE_TOOL_NAMES:
         return "", ""
     file_path = tool_input.get("file_path", "") or ""
     if file_path and not file_path.endswith(PYTHON_FILE_EXTENSION):
         return file_path, ""
+    if tool_name == "MultiEdit":
+        return file_path, joined_new_strings(tool_input)
     scanned_text = tool_input.get("content", "") or tool_input.get("new_string", "") or ""
     return file_path, scanned_text
 

package/hooks/blocking/hook_prose_detector_consistency.py

@@ -35,25 +35,33 @@ import re
 import sys
 from pathlib import Path
 
-_hooks_dir = str(Path(__file__).resolve().parent.parent)
-if _hooks_dir not in sys.path:
-    sys.path.insert(0, _hooks_dir)
-
-from blocking.config.prose_style_enforcement_constants import (  # noqa: E402
-    prose_style_enforcement_enabled_in_environment,
-)
-from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
-from hooks_constants.hook_prose_detector_consistency_constants import (  # noqa: E402
-    CONSTANTS_MODULE_SUFFIX,
-    CORRECTIVE_MESSAGE,
-    EDIT_TOOL_NAME,
-    HOOK_MODULE_PATH_SEGMENT,
-    OVERSTATED_OUTPUT_KEY_PHRASE_PATTERN,
-    PATH_SEPARATOR_CLASS_PATTERN,
-    PYTHON_FILE_SUFFIX,
-    TEST_MODULE_PREFIX,
-    WRITE_TOOL_NAME,
-)
+try:
+    _hooks_dir = str(Path(__file__).resolve().parent.parent)
+    if _hooks_dir not in sys.path:
+        sys.path.insert(0, _hooks_dir)
+
+    from blocking.config.prose_style_enforcement_constants import (
+        prose_style_enforcement_enabled_in_environment,
+    )
+    from hooks_constants.hook_block_logger import log_hook_block
+    from hooks_constants.hook_prose_detector_consistency_constants import (
+        CONSTANTS_MODULE_SUFFIX,
+        CORRECTIVE_MESSAGE,
+        EDIT_TOOL_NAME,
+        HOOK_MODULE_PATH_SEGMENT,
+        MULTI_EDIT_TOOL_NAME,
+        OVERSTATED_OUTPUT_KEY_PHRASE_PATTERN,
+        PATH_SEPARATOR_CLASS_PATTERN,
+        PYTHON_FILE_SUFFIX,
+        TEST_MODULE_PREFIX,
+        WRITE_TOOL_NAME,
+    )
+    from hooks_constants.multi_edit_reconstruction import joined_new_strings
+except ImportError as import_error:
+    raise ImportError(
+        "hook_prose_detector_consistency: cannot import its sibling modules; "
+        "ensure the hooks directory is importable."
+    ) from import_error
 
 
 def written_content(tool_name: str, all_tool_input: dict[str, object]) -> str:
@@ -63,6 +71,8 @@ def written_content(tool_name: str, all_tool_input: dict[str, object]) -> str:
     if tool_name == EDIT_TOOL_NAME:
         new_string = all_tool_input.get("new_string", "")
         return new_string if isinstance(new_string, str) else ""
+    if tool_name == MULTI_EDIT_TOOL_NAME:
+        return joined_new_strings(all_tool_input)
     return ""
 
 
@@ -125,7 +135,7 @@ def main() -> None:
         sys.exit(0)
 
     tool_name = hook_input.get("tool_name", "")
-    if tool_name not in (WRITE_TOOL_NAME, EDIT_TOOL_NAME):
+    if tool_name not in (WRITE_TOOL_NAME, EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME):
         sys.exit(0)
 
     all_tool_input = hook_input.get("tool_input", {})

package/hooks/blocking/pii_payload_scan.py

@@ -19,6 +19,11 @@ try:
         if each_bootstrap_directory not in sys.path:
             sys.path.insert(0, each_bootstrap_directory)
     from code_rules_shared import is_ephemeral_path
+    from codex_apply_patch import (
+        CodexPatchError,
+        parse_codex_apply_patch,
+        payload_patch_command,
+    )
     from pii_prevention_blocker_parts.repository_exemption import (
         repository_allowlisted_values,
     )
@@ -48,6 +53,62 @@ except ImportError as import_error:
     ) from import_error
 
 
+def _apply_patch_post_contents(
+    command: str, working_directory: str | None
+) -> list[tuple[str, str]]:
+    """Return (file_path, post_content) pairs for a Codex apply_patch command."""
+    if not command:
+        return []
+    try:
+        all_patch_files = parse_codex_apply_patch(command, working_directory)
+    except CodexPatchError:
+        return []
+    return [
+        (each_patch_file.file_path, each_patch_file.post_content)
+        for each_patch_file in all_patch_files
+        if each_patch_file.post_content
+    ]
+
+
+def _apply_patch_target_deny_reason(
+    each_file_path: str,
+    each_post_content: str,
+    hook_payload: dict | None,
+) -> str | None:
+    """Return the deny reason for one apply_patch target, or None when it is clean or exempt."""
+    if is_path_exempt_from_pii_scan(each_file_path):
+        return None
+    if _target_is_ephemeral_outside_repository(each_file_path, hook_payload):
+        return None
+    return _write_deny_reason_for_texts([each_post_content], each_file_path, frozenset())
+
+
+def evaluate_apply_patch_payload(
+    all_tool_input: dict[str, object],
+    hook_payload: dict | None = None,
+) -> str | None:
+    """Return a deny reason when a Codex apply_patch payload's post content carries PII.
+
+    Args:
+        all_tool_input: The apply_patch payload's ``command`` and other input fields.
+        hook_payload: The PreToolUse payload carrying ``cwd`` and the session id.
+
+    Returns:
+        Deny reason text for the first target carrying non-allowlisted PII, or
+        None when every target is clean or out of scope.
+    """
+    command, working_directory = payload_patch_command(hook_payload, all_tool_input)
+    for each_file_path, each_post_content in _apply_patch_post_contents(
+        command, working_directory
+    ):
+        deny_reason = _apply_patch_target_deny_reason(
+            each_file_path, each_post_content, hook_payload
+        )
+        if deny_reason is not None:
+            return deny_reason
+    return None
+
+
 def _target_is_ephemeral_outside_repository(
     file_path: str, hook_payload: dict | None
 ) -> bool:

package/hooks/blocking/pii_prevention_blocker.py

@@ -40,6 +40,7 @@ try:
     )
     from pii_payload_scan import (
         build_deny_reason,
+        evaluate_apply_patch_payload,
         evaluate_post_body_texts,
         evaluate_write_edit_payload,
     )
@@ -66,6 +67,7 @@ try:
         ALL_STAGED_BLOB_SHOW_COMMAND_PREFIX,
         ALL_STAGED_FILES_COMMAND,
         ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
+        APPLY_PATCH_TOOL_NAME,
         BODY_FILE_ENCODING,
         GIT_COMMAND_TIMEOUT_SECONDS,
         HOOK_SCRIPT_BASENAME,
@@ -92,6 +94,7 @@ except ImportError as import_error:
 
 __all__ = [
     "evaluate",
+    "evaluate_apply_patch_payload",
     "evaluate_bash_command",
     "evaluate_post_body_texts",
     "evaluate_staged_commit",
@@ -332,6 +335,8 @@ def evaluate(payload_by_key: dict[str, object]) -> str | None:
         return evaluate_write_edit_payload(
             tool_name, all_tool_input, hook_payload=payload_by_key
         )
+    if tool_name == APPLY_PATCH_TOOL_NAME:
+        return evaluate_apply_patch_payload(all_tool_input, hook_payload=payload_by_key)
     if tool_name in ALL_SHELL_TOOL_NAMES:
         return _evaluate_shell_tool(all_tool_input, payload_by_key)
     if tool_name.startswith(MCP_GITHUB_TOOL_PREFIX):

package/hooks/blocking/pr_description_writer_gate.py

@@ -0,0 +1,256 @@
+#!/usr/bin/env python3
+"""PreToolUse hook: block gh pr create when no pr-description-writer spawn is recorded.
+
+Picture a reviewer opening a fresh pull request and meeting a body that repeats
+the branch name. The ``pr-description-writer`` agent exists to write that body
+from the diff, and the spawn tracker records each time this session runs it.
+
+This gate reads that record when the session runs ``gh pr create``::
+
+    gh pr create --body-file body.md            flag: no spawn recorded
+    gh pr create --body-file body.md            ok:   a spawn recorded earlier
+    gh pr create ... # pr-description-skip      ok:   the author opted out
+
+Detection strategy: tokenize the command, then check each position that opens a
+command segment for a ``gh`` executable followed by ``pr`` and ``create``. The
+bypass marker counts only as the command's final tokens, so the same text
+inside a quoted title leaves the gate running.
+
+The gate fails OPEN on anything it cannot read: a command that will not
+tokenize, a payload that is not a shell tool, or a missing command. Only a
+recognized ``gh pr create`` with no recorded spawn and no bypass marker denies.
+"""
+
+from __future__ import annotations
+
+import json
+import shlex
+import sys
+from pathlib import Path
+
+_blocking_dir = str(Path(__file__).resolve().parent)
+if _blocking_dir not in sys.path:
+    sys.path.insert(0, _blocking_dir)
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import (  # noqa: E402
+    ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
+)
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import (  # noqa: E402
+    read_hook_input_dictionary_from_stdin,
+)
+from hooks_constants.pr_description_writer_gate_constants import (  # noqa: E402
+    ALL_GH_EXECUTABLE_BASENAMES,
+    COMMAND_FIELD_NAME,
+    CORRECTIVE_MESSAGE,
+    CREATE_SUBCOMMAND_TOKEN,
+    GH_PR_CREATE_MINIMUM_TOKEN_COUNT,
+    PR_SUBCOMMAND_TOKEN,
+    SPAWN_BYPASS_MARKER,
+    TOOL_INPUT_FIELD_NAME,
+    TOOL_NAME_FIELD_NAME,
+    spawn_marker_path,
+)
+from hooks_constants.session_edit_stage_gate_constants import (  # noqa: E402
+    ALL_COMMAND_SEPARATOR_TOKENS,
+)
+from sensitive_file_protector import build_deny_response  # noqa: E402
+
+
+def _all_command_tokens(shell_command: str) -> list[str] | None:
+    """Return the command's tokens, or None when it will not tokenize.
+
+    Args:
+        shell_command: The raw shell command string.
+
+    Returns:
+        The token list, or None when shlex rejects the command.
+    """
+    try:
+        return shlex.split(shell_command, posix=True)
+    except ValueError:
+        return None
+
+
+def _carries_trailing_bypass_marker(all_tokens: list[str]) -> bool:
+    """Report whether the bypass marker sits at the very end of the command.
+
+    The marker opts out only as a trailing shell comment the author adds on
+    purpose, so its parts are the command's final tokens. The same text inside
+    a quoted title tokenizes into the middle of the list and does not match.
+
+    Args:
+        all_tokens: The tokens of the whole command.
+
+    Returns:
+        True when the marker's tokens close the command.
+    """
+    all_marker_tokens = SPAWN_BYPASS_MARKER.split()
+    marker_length = len(all_marker_tokens)
+    if marker_length > len(all_tokens):
+        return False
+    return all_tokens[-marker_length:] == all_marker_tokens
+
+
+def _opens_pull_request_creation(all_leading_tokens: list[str]) -> bool:
+    """Report whether these leading tokens open a gh pr create invocation.
+
+    Args:
+        all_leading_tokens: The tokens that open one command segment.
+
+    Returns:
+        True when they name a gh executable, then ``pr``, then ``create``.
+    """
+    if len(all_leading_tokens) < GH_PR_CREATE_MINIMUM_TOKEN_COUNT:
+        return False
+    executable_basename = Path(all_leading_tokens[0]).name
+    if executable_basename not in ALL_GH_EXECUTABLE_BASENAMES:
+        return False
+    return all_leading_tokens[1:] == [PR_SUBCOMMAND_TOKEN, CREATE_SUBCOMMAND_TOKEN]
+
+
+def _all_command_segments(all_tokens: list[str]) -> list[list[str]]:
+    """Return the command's token segments in their original order.
+
+    A shell separator ends the current segment and starts the next one.
+
+    Args:
+        all_tokens: The tokens of the whole command.
+
+    Returns:
+        One token list for each command segment.
+    """
+    all_segments: list[list[str]] = [[]]
+    for each_token in all_tokens:
+        if each_token in ALL_COMMAND_SEPARATOR_TOKENS:
+            all_segments.append([])
+            continue
+        all_segments[-1].append(each_token)
+    return all_segments
+
+
+def _all_pull_request_creation_segment_indexes(all_segments: list[list[str]]) -> list[int]:
+    """Return indexes for segments that open a gh pr create command.
+
+    Args:
+        all_segments: The shell command's token segments.
+
+    Returns:
+        The indexes of segments that open a gh pr create command.
+    """
+    return [
+        each_index
+        for each_index, each_segment in enumerate(all_segments)
+        if _opens_pull_request_creation(each_segment[:GH_PR_CREATE_MINIMUM_TOKEN_COUNT])
+    ]
+
+
+def _only_final_create_carries_bypass(
+    all_tokens: list[str],
+    all_segments: list[list[str]],
+    all_creation_segment_indexes: list[int],
+) -> bool:
+    """Report whether one final gh pr create carries the final bypass comment.
+
+    The marker belongs to the command segment that creates the pull request.
+    A marker after another command, or after a second create, cannot opt an
+    earlier create out.
+
+    Args:
+        all_tokens: The tokens of the whole command.
+        all_segments: The command's token segments, already split by the caller.
+        all_creation_segment_indexes: Indexes of segments that create pull requests.
+
+    Returns:
+        True when one final create segment carries the final bypass marker.
+    """
+    if not _carries_trailing_bypass_marker(all_tokens):
+        return False
+    final_segment_index = len(all_segments) - 1
+    return all_creation_segment_indexes == [final_segment_index]
+
+
+def _spawn_is_recorded(session_id: str) -> bool:
+    """Report whether this session recorded a pr-description-writer spawn.
+
+    A payload naming no session reads as no record, so the gate denies rather
+    than falling back to a shared marker a different session could have left.
+
+    Args:
+        session_id: Raw ``session_id`` from the hook payload.
+
+    Returns:
+        True when this session's marker file is present.
+    """
+    marker_file = spawn_marker_path(session_id)
+    return marker_file is not None and marker_file.exists()
+
+
+def _shell_command_or_none(all_hook_payload: dict[str, object]) -> str | None:
+    """Return the shell command this payload carries, or None.
+
+    Args:
+        all_hook_payload: The parsed PreToolUse payload.
+
+    Returns:
+        The command string, or None when the payload runs no shell command.
+    """
+    if all_hook_payload.get(TOOL_NAME_FIELD_NAME, "") not in ALL_BASH_AND_POWERSHELL_TOOL_NAMES:
+        return None
+    tool_input = all_hook_payload.get(TOOL_INPUT_FIELD_NAME, {})
+    if not isinstance(tool_input, dict):
+        return None
+    shell_command = tool_input.get(COMMAND_FIELD_NAME, "")
+    if not isinstance(shell_command, str) or not shell_command:
+        return None
+    return shell_command
+
+
+def _emit_denial() -> None:
+    """Write the PreToolUse deny payload to stdout and log the block."""
+    log_hook_block(
+        calling_hook_name="pr_description_writer_gate.py",
+        hook_event="PreToolUse",
+        block_reason=CORRECTIVE_MESSAGE,
+    )
+    sys.stdout.write(json.dumps(build_deny_response(CORRECTIVE_MESSAGE)) + "\n")
+    sys.stdout.flush()
+
+
+def main() -> None:
+    """Deny a gh pr create that no recorded agent spawn or bypass marker covers.
+
+    Reads the PreToolUse payload from stdin and exits zero on every branch. A
+    tool that runs no shell, a missing command, a command that will not
+    tokenize, a command opening no pull request, a trailing bypass marker, and
+    a recorded spawn each pass through untouched.
+    """
+    hook_payload = read_hook_input_dictionary_from_stdin()
+    if hook_payload is None:
+        sys.exit(0)
+    shell_command = _shell_command_or_none(hook_payload)
+    if shell_command is None:
+        sys.exit(0)
+    all_tokens = _all_command_tokens(shell_command)
+    if all_tokens is None:
+        sys.exit(0)
+    all_segments = _all_command_segments(all_tokens)
+    all_creation_segment_indexes = _all_pull_request_creation_segment_indexes(all_segments)
+    if not all_creation_segment_indexes:
+        sys.exit(0)
+    if _only_final_create_carries_bypass(
+        all_tokens, all_segments, all_creation_segment_indexes
+    ):
+        sys.exit(0)
+    if _spawn_is_recorded(str(hook_payload.get("session_id") or "")):
+        sys.exit(0)
+    _emit_denial()
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pre_tool_use_dispatcher.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""PreToolUse dispatcher that hosts Write, Edit, and MultiEdit blocking hooks.
+"""PreToolUse dispatcher that hosts Write, Edit, MultiEdit, and apply_patch blocking hooks.
 
 Reads the tool payload from stdin once, selects the hosted hooks applicable to
 the payload's tool name, runs each hook in-process via runpy in the fixed order

package/hooks/blocking/sensitive_file_protector.py

@@ -34,9 +34,11 @@ import sys
 
 import _path_setup  # noqa: F401
 
+from codex_apply_patch import payload_patch_target_paths
 from hooks_constants.hook_block_logger import log_hook_block
 from hooks_constants.pre_tool_use_dispatcher_constants import (
-    ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
+    ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES,
+    APPLY_PATCH_TOOL_NAME,
 )
 from hooks_constants.sensitive_file_protector_constants import (
     ALL_SENSITIVE_PATTERNS,
@@ -108,7 +110,7 @@ def deny_write(file_path: str, matched_pattern: str) -> None:
     """Record the block in the hook-blocks log and emit the deny decision.
 
     Args:
-        file_path: The path the Write, Edit, or MultiEdit targets.
+        file_path: The path the Write, Edit, MultiEdit, or apply_patch targets.
         matched_pattern: The sensitive pattern the basename matched.
     """
     deny_reason = DENY_REASON_TEMPLATE.format(
@@ -124,6 +126,15 @@ def deny_write(file_path: str, matched_pattern: str) -> None:
     sys.stdout.write(json.dumps(build_deny_response(deny_reason)))
 
 
+def _deny_apply_patch_sensitive_target(hook_input: dict, tool_input: dict) -> None:
+    """Deny the first apply_patch target path whose basename names a sensitive file."""
+    for each_target_path in payload_patch_target_paths(hook_input, tool_input):
+        matched_pattern = is_sensitive_file(each_target_path)
+        if matched_pattern is not None:
+            deny_write(each_target_path, matched_pattern)
+            return
+
+
 def main() -> None:
     """Deny the write when the stdin payload targets a sensitive filename."""
     try:
@@ -134,7 +145,11 @@ def main() -> None:
     tool_name = hook_input.get("tool_name", "")
     tool_input = hook_input.get("tool_input", {})
 
-    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
+    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_APPLY_PATCH_TOOL_NAMES:
+        sys.exit(0)
+
+    if tool_name == APPLY_PATCH_TOOL_NAME:
+        _deny_apply_patch_sensitive_target(hook_input, tool_input)
         sys.exit(0)
 
     file_path = tool_input.get("file_path", "")