claude-dev-env 2.30.1 → 2.31.1

package/hooks/blocking/test_code_rules_enforcer_same_file_inline_duplicate.py

@@ -16,6 +16,7 @@ in-process AST scan the production enforcer runs.
 
 from __future__ import annotations
 
+import ast
 import importlib.util
 import pathlib
 import sys
@@ -34,6 +35,20 @@ _hook_module = importlib.util.module_from_spec(_hook_spec)
 _hook_spec.loader.exec_module(_hook_module)
 check_same_file_inline_duplicate_body = _hook_module.check_same_file_inline_duplicate_body
 
+_duplicate_body_spec = importlib.util.spec_from_file_location(
+    "code_rules_duplicate_body",
+    _HOOK_DIRECTORY / "code_rules_duplicate_body.py",
+)
+assert _duplicate_body_spec is not None
+assert _duplicate_body_spec.loader is not None
+_duplicate_body_module = importlib.util.module_from_spec(_duplicate_body_spec)
+_duplicate_body_spec.loader.exec_module(_duplicate_body_module)
+
+MEMO_CORPUS_MODULE_GLOB = "code_rules_*.py"
+TEST_MODULE_NAME_PREFIX = "test_"
+MINIMUM_MEMO_CORPUS_MODULE_COUNT = 20
+EXTRA_DUPLICATE_PAIRS_BEYOND_THE_CEILING = 5
+
 
 PR_470_SHAPE_SOURCE = (
     "import asyncio\n"
@@ -464,3 +479,232 @@ def test_should_carry_both_helper_and_enclosing_spans_for_the_commit_gate_scoper
         "the union the PreToolUse path scopes on — not the helper span alone, "
         f"got: {matching_issues[0]}"
     )
+
+
+NO_INLINE_DUPLICATE_SOURCE = (
+    "async def _wait_for_content_image_to_render(automation: object) -> None:\n"
+    "    assert automation.detector is not None\n"
+    "    await automation.detector.wait_for_element(selector)\n"
+    "    logger.info('rendered')\n"
+    "\n"
+    "\n"
+    "async def _do_other_work(automation: object) -> None:\n"
+    "    await automation.cdp.reload()\n"
+    "    logger.info('reloaded')\n"
+    "    return None\n"
+)
+
+
+def _memo_corpus_module_paths() -> list[pathlib.Path]:
+    """Return the production code-rules modules used as a statement corpus.
+
+    Returns:
+        Every non-test ``code_rules_*.py`` module in the blocking hook directory,
+        in sorted order, which supplies thousands of real statements of every
+        shape the scan meets in practice.
+    """
+    return sorted(
+        each_path
+        for each_path in _HOOK_DIRECTORY.glob(MEMO_CORPUS_MODULE_GLOB)
+        if not each_path.name.startswith(TEST_MODULE_NAME_PREFIX)
+    )
+
+
+def _all_statements_in_module(module_path: pathlib.Path) -> list[ast.stmt]:
+    """Return every statement node parsed from a repository module.
+
+    The returned list holds the nodes, so they stay alive across both memo passes
+    and the second pass reads the very objects the first pass recorded.
+
+    Args:
+        module_path: The repository module to parse.
+
+    Returns:
+        Every statement node in the module, in walk order.
+    """
+    parsed_module = ast.parse(module_path.read_text(encoding="utf-8"))
+    return [
+        each_node
+        for each_node in ast.walk(parsed_module)
+        if isinstance(each_node, ast.stmt)
+    ]
+
+
+def _memo_disagreements(
+    all_statements: list[ast.stmt],
+    dump_by_statement: dict[ast.stmt, str],
+    module_name: str,
+) -> list[str]:
+    """Return a location for every statement the memo dumps differently.
+
+    Args:
+        all_statements: The statement nodes to compare.
+        dump_by_statement: The memo under test, mutated in place.
+        module_name: The module name to name in a disagreement location.
+
+    Returns:
+        A ``module:line`` location per statement whose memoized dump differs from
+        the uncached dump, and an empty list when the memo is transparent.
+    """
+    return [
+        f"{module_name}:{each_statement.lineno}"
+        for each_statement in all_statements
+        if _duplicate_body_module._memoized_statement_dump(
+            each_statement, dump_by_statement
+        )
+        != _duplicate_body_module._normalized_statement_dump(each_statement)
+    ]
+
+
+def _cold_and_warm_memo_disagreements(
+    all_module_paths: list[pathlib.Path],
+) -> tuple[list[str], list[str]]:
+    """Compare memoized against uncached dumps twice over the same statements.
+
+    The first pass over a module fills the memo and the second reads it warm, so
+    both the computed value and the served value are held against the uncached
+    dump.
+
+    Args:
+        all_module_paths: The corpus modules to parse and compare.
+
+    Returns:
+        The cold-pass disagreement locations and the warm-pass disagreement
+        locations.
+    """
+    dump_by_statement: dict[ast.stmt, str] = {}
+    all_cold_disagreements: list[str] = []
+    all_warm_disagreements: list[str] = []
+    for each_path in all_module_paths:
+        all_statements = _all_statements_in_module(each_path)
+        all_cold_disagreements += _memo_disagreements(
+            all_statements, dump_by_statement, each_path.name
+        )
+        all_warm_disagreements += _memo_disagreements(
+            all_statements, dump_by_statement, each_path.name
+        )
+    assert dump_by_statement, "the memo recorded nothing, so nothing was proven"
+    return all_cold_disagreements, all_warm_disagreements
+
+
+def test_should_memoize_every_repository_statement_dump_transparently() -> None:
+    """The memo must be invisible: every dump it serves equals the uncached dump.
+
+    The inline scan's speed rests on serving each statement's dump from a memo,
+    which makes the memo the one place a behavior change could hide. Real
+    repository modules supply the statements, so the proof covers every statement
+    shape the scan meets in this repository.
+    """
+    all_module_paths = _memo_corpus_module_paths()
+    assert len(all_module_paths) >= MINIMUM_MEMO_CORPUS_MODULE_COUNT, (
+        "the transparency proof needs a real corpus, but the glob found "
+        f"only {len(all_module_paths)} modules"
+    )
+    all_cold, all_warm = _cold_and_warm_memo_disagreements(all_module_paths)
+    assert all_cold == [], (
+        "a cold memo must compute the same dump the uncached helper computes, "
+        f"but these statements disagreed: {all_cold[:10]}"
+    )
+    assert all_warm == [], (
+        "a warm memo must serve the same dump the uncached helper computes, "
+        f"but these statements disagreed: {all_warm[:10]}"
+    )
+
+
+def test_should_report_the_same_verdict_when_an_earlier_scan_used_the_same_path() -> None:
+    """No memo may outlive one scan, so an earlier scan cannot color a later one.
+
+    A dump memo that persisted between calls — keyed on a path, or on a node slot
+    a later parse could reuse — would let one file's statements answer for
+    another's. Two different sources are scanned under one path, then the first is
+    scanned again, so a verdict that shifted on the repeat would expose the leak.
+    """
+    first_duplicate_issues = check_same_file_inline_duplicate_body(
+        PR_470_SHAPE_SOURCE, "account_switcher.py"
+    )
+    clean_issues = check_same_file_inline_duplicate_body(
+        NO_INLINE_DUPLICATE_SOURCE, "account_switcher.py"
+    )
+    repeat_duplicate_issues = check_same_file_inline_duplicate_body(
+        PR_470_SHAPE_SOURCE, "account_switcher.py"
+    )
+    assert first_duplicate_issues, "the duplicate source must flag on its own"
+    assert clean_issues == [], (
+        "the clean source must not inherit a verdict from the duplicate source "
+        f"scanned before it under the same path, got: {clean_issues}"
+    )
+    assert repeat_duplicate_issues == first_duplicate_issues, (
+        "the duplicate source must produce the same verdict on a repeat scan, "
+        f"got {repeat_duplicate_issues} after {first_duplicate_issues}"
+    )
+
+
+def test_should_read_no_function_when_the_file_holds_no_qualifying_helper() -> None:
+    """A file with no candidate helper is answered without reading any function.
+
+    Most files carry no function that clears the helper-window filter, so the scan
+    leaves them after that filter and takes no per-function readings. The memo
+    stays empty in that case, which both proves the readings were skipped and
+    pins the verdict such a file gets.
+    """
+    all_module_functions = ast.parse(NO_INLINE_DUPLICATE_SOURCE).body
+    all_windows = [
+        _duplicate_body_module._helper_match_window_dumps(each_function)
+        for each_function in all_module_functions
+        if isinstance(each_function, ast.FunctionDef | ast.AsyncFunctionDef)
+    ]
+    assert all(each_window is None for each_window in all_windows), (
+        "this source must hold no qualifying helper for the skip to be exercised, "
+        f"got windows: {all_windows}"
+    )
+    issues = check_same_file_inline_duplicate_body(
+        NO_INLINE_DUPLICATE_SOURCE, "module.py"
+    )
+    assert issues == [], f"a file with no qualifying helper must not flag, got: {issues}"
+
+
+def _duplicated_helper_pair_source(pair_index: int) -> str:
+    """Return one helper and one strictly larger function that inlines its body.
+
+    Each pair carries its own variable name, so a helper matches only the
+    enclosing function of its own pair and every pair contributes one report.
+
+    Args:
+        pair_index: The number distinguishing this pair from the others.
+
+    Returns:
+        Source text holding the helper and its enclosing function.
+    """
+    duplicated_block = (
+        "    try:\n"
+        f"        record_{pair_index} = records.load({pair_index})\n"
+        "    except KeyError:\n"
+        "        logger.warning('record missing')\n"
+        f"        record_{pair_index} = None\n"
+        f"    return record_{pair_index}\n"
+    )
+    return (
+        f"def load_record_{pair_index}(records):\n{duplicated_block}\n\n"
+        f"def refresh_record_{pair_index}(records):\n"
+        f"    records.begin({pair_index})\n{duplicated_block}\n\n"
+    )
+
+
+def test_should_cap_the_reported_issue_count_at_the_module_ceiling() -> None:
+    """A file full of inline duplicates reports the ceiling, not one per pair.
+
+    The blocking payload a single write can carry is bounded, so a file holding
+    more duplicated helpers than the ceiling still reports exactly the ceiling.
+    The source is built with more pairs than the ceiling allows, so a lost bound
+    would show up as a longer report.
+    """
+    ceiling = _duplicate_body_module.MAX_DUPLICATE_BODY_ISSUES
+    pair_count = ceiling + EXTRA_DUPLICATE_PAIRS_BEYOND_THE_CEILING
+    source = "".join(
+        _duplicated_helper_pair_source(each_index) for each_index in range(pair_count)
+    )
+    issues = check_same_file_inline_duplicate_body(source, "module.py")
+    assert len(issues) == ceiling, (
+        f"{pair_count} duplicated pairs must report the {ceiling}-issue ceiling, "
+        f"got {len(issues)} issues"
+    )

package/hooks/blocking/test_code_rules_enforcer_split_constants_config.py

@@ -6,6 +6,8 @@ import sys
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
+
 _BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
 _HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
 if _BLOCKING_DIRECTORY not in sys.path:
@@ -103,7 +105,19 @@ def test_scan_function_body_constants_does_not_flag_module_level() -> None:
     assert advisory_issues == []
 
 
-def test_advisory_should_not_flag_class_attribute_after_method_def() -> None:
+def _advisory_stderr(source: str, capsys: pytest.CaptureFixture[str]) -> str:
+    """Run the advisory check over source and hand back what it wrote to stderr.
+
+    The check returns nothing, so stderr is the only place a finding shows up.
+    """
+    code_rules_enforcer.check_constants_outside_config_advisory(
+        source,
+        "example_module.py",
+    )
+    return capsys.readouterr().err
+
+
+def test_advisory_should_not_flag_class_attribute_after_method_def(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_class_attribute_after_method = (
         "class ExampleModel:\n"
         "    def method_a(self) -> None:\n"
@@ -111,49 +125,40 @@ def test_advisory_should_not_flag_class_attribute_after_method_def() -> None:
         "\n"
         "    TABLE_NAME = \"example\"\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_class_attribute_after_method,
-        "example_module.py",
-    )
-    assert advisory_issues == [], (
+    flagged_names = _advisory_stderr(source_with_class_attribute_after_method, capsys)
+    assert flagged_names == "", (
         "Class-level TABLE_NAME attribute must not be flagged as function-local"
     )
 
 
-def test_advisory_should_still_flag_actual_method_body_constant() -> None:
+def test_advisory_should_still_flag_actual_method_body_constant(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_method_body_constant = (
         "class ExampleModel:\n"
         "    def method_a(self) -> None:\n"
         "        MAXIMUM_RETRIES = 3\n"
         "        return None\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_method_body_constant,
-        "example_module.py",
-    )
-    assert len(advisory_issues) == 1, (
-        "Method-body UPPER_SNAKE constant must still surface as advisory"
+    flagged_names = _advisory_stderr(source_with_method_body_constant, capsys)
+    assert "MAXIMUM_RETRIES" in flagged_names, (
+        f"Method-body UPPER_SNAKE constant must still surface as advisory, "
+        f"got: {flagged_names!r}"
     )
-    assert "MAXIMUM_RETRIES" in advisory_issues[0]
 
 
-def test_advisory_should_flag_annotated_function_body_constant() -> None:
+def test_advisory_should_flag_annotated_function_body_constant(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_annotated_function_body_constant = (
         "def example_function() -> None:\n"
         "    MAXIMUM_RETRIES: int = 3\n"
         "    return None\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_annotated_function_body_constant,
-        "example_module.py",
+    flagged_names = _advisory_stderr(source_with_annotated_function_body_constant, capsys)
+    assert "MAXIMUM_RETRIES" in flagged_names, (
+        f"Annotated function-body UPPER_SNAKE constant (PEP 526) must surface as advisory, "
+        f"got: {flagged_names!r}"
     )
-    assert len(advisory_issues) == 1, (
-        "Annotated function-body UPPER_SNAKE constant (PEP 526) must surface as advisory"
-    )
-    assert "MAXIMUM_RETRIES" in advisory_issues[0]
 
 
-def test_advisory_should_flag_outer_constants_after_nested_def() -> None:
+def test_advisory_should_flag_outer_constants_after_nested_def(capsys: pytest.CaptureFixture[str]) -> None:
     source_with_nested_def = (
         "def outer():\n"
         "    OUTER_CONST = 1\n"
@@ -161,11 +166,7 @@ def test_advisory_should_flag_outer_constants_after_nested_def() -> None:
         "        INNER_CONST = 2\n"
         "    ANOTHER_OUTER = 3\n"
     )
-    advisory_issues = code_rules_enforcer.check_constants_outside_config_advisory(
-        source_with_nested_def,
-        "example_module.py",
-    )
-    flagged_names = " ".join(advisory_issues)
+    flagged_names = _advisory_stderr(source_with_nested_def, capsys)
     assert "OUTER_CONST" in flagged_names, (
         "OUTER_CONST before nested def must be flagged"
     )

package/hooks/blocking/test_code_rules_enforcer_split_entry_2.py

@@ -36,6 +36,8 @@ code_rules_enforcer = SimpleNamespace(
     validate_content=validate_content,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 def _oversized_function_source(name: str) -> str:
     body_line_count = code_rules_enforcer.FUNCTION_LENGTH_BLOCKING_THRESHOLD - 1
@@ -175,6 +177,28 @@ def test_unreadable_prior_yields_no_prior_and_no_reconstruction() -> None:
     assert post_edit_content is None
 
 
+def test_prior_and_post_edit_content_honors_replace_all(
+    tmp_path_factory: pytest.TempPathFactory,
+) -> None:
+    """An Edit carrying replace_all rewrites every occurrence in the post-edit view.
+
+    The MultiEdit lane reconstructs through apply_edits and has honored the flag
+    since it landed there. The Edit lane must agree, or the enforcer judges a
+    replace_all Edit against a file that never exists on disk.
+    """
+    production_directory = tmp_path_factory.mktemp("replace_all_pkg")
+    source_file = production_directory / "edited_module.py"
+    source_file.write_text("value = 1\nvalue = 1\n", encoding="utf-8")
+    prior_content, post_edit_content = code_rules_enforcer.prior_and_post_edit_content(
+        str(source_file),
+        old_string="value = 1",
+        new_string="value = 2",
+        is_replace_all=True,
+    )
+    assert prior_content == "value = 1\nvalue = 1\n"
+    assert post_edit_content == "value = 2\nvalue = 2\n"
+
+
 def test_edit_with_missing_old_string_runs_whole_file_against_on_disk_content(
     tmp_path_factory: pytest.TempPathFactory,
 ) -> None:

package/hooks/blocking/test_code_rules_enforcer_stage.py

@@ -33,6 +33,8 @@ from code_rules_gate_parts.tests._repo_test_helpers import (  # noqa: E402
     write_commit_and_stage_change,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 
 PRODUCTION_FILE_PATH = "packages/app/services.py"
 ENFORCER_SCRIPT_PATH = Path(__file__).with_name("code_rules_enforcer.py")

package/hooks/blocking/test_code_rules_enforcer_zero_payload_alias_hook_routing.py

@@ -36,6 +36,8 @@ from code_rules_enforcer_test_support import (  # noqa: E402
     run_write_entrypoint,
 )
 
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
+
 PASS_THROUGH_ALIAS_SOURCE = (
     "def find_bare_path_segments(content: str) -> set[str]:\n"
     "    return {part for part in content.split() if part}\n"

package/hooks/blocking/test_codex_apply_patch.py

@@ -0,0 +1,43 @@
+"""Tests for the Codex apply_patch path-only target resolver."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from codex_apply_patch import (
+    CODEX_ADD_OPERATION,
+    CodexPatchError,
+    codex_patch_operation_targets,
+)
+
+
+def test_codex_patch_operation_targets_names_every_section_without_reading_content(
+    tmp_path: Path, three_operation_patch: str
+) -> None:
+    """The path-only helper resolves every section's target without any disk read.
+
+    Unlike ``parse_codex_apply_patch``, it never reads prior file content, so a
+    caller that only needs each target path is not tripped up by an unreadable
+    prior file.
+    """
+    all_targets = codex_patch_operation_targets(three_operation_patch, str(tmp_path))
+
+    all_target_names = {
+        (each_operation, str(each_path).rsplit("/", 1)[-1])
+        for each_operation, each_path in all_targets
+    }
+    assert all_target_names == {
+        ("update", "updated.py"),
+        (CODEX_ADD_OPERATION, "added.py"),
+        ("delete", "deleted.py"),
+    }
+
+
+def test_codex_patch_operation_targets_rejects_path_traversal(tmp_path: Path) -> None:
+    """A patch path that escapes the working directory is rejected before any read."""
+    escaping_patch = "*** Begin Patch\n*** Add File: ../outside.py\n+content\n*** End Patch"
+
+    with pytest.raises(CodexPatchError):
+        codex_patch_operation_targets(escaping_patch, str(tmp_path))

package/hooks/blocking/test_duplicate_rmtree_helper_blocker.py

@@ -205,6 +205,74 @@ def test_extract_payload_text_returns_empty_for_unknown_tool() -> None:
     assert extracted == ("", "")
 
 
+def test_every_applicable_tool_name_reads_payload_text() -> None:
+    """extract_payload_text reads content for every name the shared constant lists."""
+    for each_applicable_tool_name in hook_module.ALL_APPLICABLE_TOOL_NAMES:
+        _file_path, scanned_text = extract_payload_text(
+            each_applicable_tool_name,
+            {
+                "file_path": "foo.py",
+                "content": "abc",
+                "new_string": "abc",
+                "edits": [{"old_string": "a", "new_string": "abc"}],
+            },
+        )
+        assert scanned_text, f"{each_applicable_tool_name} must read some scanned text"
+
+
+def test_extract_payload_text_reads_every_multi_edit_new_string() -> None:
+    extracted = extract_payload_text(
+        "MultiEdit",
+        {
+            "file_path": "foo.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": "def force_rmtree(target_path):\n    pass"},
+            ],
+        },
+    )
+    assert extracted[0] == "foo.py"
+    assert "force_rmtree" in extracted[1]
+
+
+def test_main_blocks_trio_copy_introduced_by_second_multi_edit() -> None:
+    """A helper definition in the second edit of a MultiEdit is caught, not only the first."""
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "shared_utils/samsung_utils/cert_failure_processor/parser.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": COPIED_TRIO},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    response_payload = json.loads(stdout_text)
+    decision_block = response_payload["hookSpecificOutput"]
+    assert decision_block["permissionDecision"] == "deny"
+    assert "duplicate-rmtree-helper" in decision_block["permissionDecisionReason"]
+
+
+def test_main_allows_clean_multi_edit() -> None:
+    stdout_text, exit_code = _run_hook(
+        {
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "shared_utils/samsung_utils/cert_failure_processor/parser.py",
+                "edits": [
+                    {"old_string": "a = 1", "new_string": "a = 11"},
+                    {"old_string": "b = 2", "new_string": "b = 22"},
+                ],
+            },
+        }
+    )
+    assert exit_code == 0
+    assert stdout_text == ""
+
+
 def _run_hook_with_stdin_text(stdin_text: str) -> tuple[str, str, int]:
     captured_stdout = io.StringIO()
     captured_stderr = io.StringIO()

package/hooks/blocking/test_hook_prose_detector_consistency.py

@@ -193,6 +193,16 @@ def test_written_content_reads_edit_new_string() -> None:
     assert written_content("Edit", edit_input) == "edited body"
 
 
+def test_written_content_reads_every_multi_edit_new_string() -> None:
+    multi_edit_input = {
+        "edits": [
+            {"old_string": "a = 1", "new_string": "a = 11"},
+            {"old_string": "b = 2", "new_string": _OVERSTATED_MESSAGE_MODULE},
+        ]
+    }
+    assert _OVERSTATED_MESSAGE_MODULE in written_content("MultiEdit", multi_edit_input)
+
+
 def _run_main_with_io(
     input_text: str, *, is_prose_style_enabled: bool = True
 ) -> str:
@@ -248,6 +258,37 @@ def test_main_blocks_overstated_hook_module_edit() -> None:
     assert payload["hookSpecificOutput"]["permissionDecision"] == "deny"
 
 
+def test_main_blocks_overstatement_introduced_by_second_multi_edit() -> None:
+    """An overstated claim in the second edit of a MultiEdit is caught, not only the first."""
+    hook_input = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/repo/hooks/hooks_constants/some_blocker_constants.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": _OVERSTATED_MESSAGE_MODULE},
+            ],
+        },
+    }
+    output_text = _run_main_with_io(json.dumps(hook_input))
+    payload = json.loads(output_text)
+    assert payload["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_main_passes_clean_multi_edit() -> None:
+    hook_input = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/repo/hooks/hooks_constants/some_blocker_constants.py",
+            "edits": [
+                {"old_string": "a = 1", "new_string": "a = 11"},
+                {"old_string": "b = 2", "new_string": _FIXED_MESSAGE_MODULE},
+            ],
+        },
+    }
+    assert _run_main_with_io(json.dumps(hook_input)) == ""
+
+
 def test_main_passes_fixed_hook_module_write() -> None:
     hook_input = {
         "tool_name": "Write",

package/hooks/blocking/test_pii_payload_scan.py

@@ -13,12 +13,22 @@ _HOOK_DIR = Path(__file__).parent
 _HOOKS_DIR = _HOOK_DIR.parent
 
 try:
-    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+    from pii_payload_scan import (
+        evaluate_apply_patch_payload,
+        evaluate_post_body_texts,
+        evaluate_write_edit_payload,
+    )
 except ImportError:
     for each_bootstrap_directory in (str(_HOOK_DIR), str(_HOOKS_DIR)):
         if each_bootstrap_directory not in sys.path:
             sys.path.insert(0, each_bootstrap_directory)
-    from pii_payload_scan import evaluate_post_body_texts, evaluate_write_edit_payload
+    from pii_payload_scan import (
+        evaluate_apply_patch_payload,
+        evaluate_post_body_texts,
+        evaluate_write_edit_payload,
+    )
+
+pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
 
 _ALLOW_SLUG = "AllowOwner/allow-repo"
 _OTHER_SLUG = "OtherOwner/other-repo"
@@ -166,3 +176,56 @@ def test_allowlisted_value_under_missing_nested_parent_is_allowed(
     nested_target = repository_root / "new_dir" / "deeper" / "notes.md"
     assert not nested_target.parent.exists()
     assert _write_deny_reason(nested_target, allowed_value) is None
+
+
+def test_apply_patch_add_with_pii_is_denied(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = evaluate_apply_patch_payload(
+        {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                f"+Reach me at {_assembled_fixture_email()}\n"
+                "*** End Patch"
+            )
+        },
+        hook_payload={"cwd": str(repository_root)},
+    )
+    assert deny_reason is not None
+    assert "email" in deny_reason
+
+
+def test_apply_patch_add_with_clean_content_is_allowed(tmp_path: Path) -> None:
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = evaluate_apply_patch_payload(
+        {
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                "+nothing sensitive here\n"
+                "*** End Patch"
+            )
+        },
+        hook_payload={"cwd": str(repository_root)},
+    )
+    assert deny_reason is None
+
+
+def test_apply_patch_payload_accepts_the_tool_input_keyword(tmp_path: Path) -> None:
+    """evaluate_apply_patch_payload's first parameter is named all_tool_input."""
+    repository_root = tmp_path / "repo"
+    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
+    deny_reason = evaluate_apply_patch_payload(
+        all_tool_input={
+            "command": (
+                "*** Begin Patch\n"
+                "*** Add File: notes.md\n"
+                "+nothing sensitive here\n"
+                "*** End Patch"
+            )
+        },
+        hook_payload={"cwd": str(repository_root)},
+    )
+    assert deny_reason is None