claude-dev-env 2.31.0 → 2.32.0

package/hooks/blocking/test_code_rules_enforcer_ephemeral_repository_root.py

@@ -0,0 +1,118 @@
+"""Repository-root exemption tests for code_rules_enforcer and the classifier.
+
+A path inside the session's repository root is never ephemeral, whatever
+directory the repository itself is checked out under. These tests cover the
+classifier directly and the enforcer's real PreToolUse Write path, plus the
+guard cases a too-broad fix could break: an absent cwd, a cwd that covers no
+repository, and an unrelated sibling worktree that merely shares a name
+prefix under /tmp.
+"""
+
+from __future__ import annotations
+
+import json
+
+from blocking import _path_setup  # noqa: F401  (pins this checkout ahead of sibling worktrees)
+from blocking.code_rules_enforcer import main as enforcer_main
+from blocking.code_rules_shared import is_ephemeral_script_path
+from code_rules_enforcer_test_support import run_serialized_payload_entrypoint
+
+_VIOLATING_PRODUCTION_SOURCE = "def process_data(payload: str) -> None:\n    print(payload)\n"
+
+
+def _build_write_payload_with_cwd(file_path: str, content: str, cwd: str) -> str:
+    """Build the JSON payload for a Write tool call that also carries a cwd."""
+    return json.dumps(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": file_path, "content": content},
+            "cwd": cwd,
+        }
+    )
+
+
+def _run_main_with_write_payload_and_cwd(
+    file_path: str,
+    content: str,
+    cwd: str,
+) -> tuple[str, int]:
+    """Drive enforcer_main through its stdin entry point for a Write payload carrying cwd."""
+    captured_stdout, exit_code = run_serialized_payload_entrypoint(
+        enforcer_main, _build_write_payload_with_cwd(file_path, content, cwd)
+    )
+    return captured_stdout, int(exit_code or 0)
+
+
+def test_should_return_false_for_file_inside_repository_root_under_tmp() -> None:
+    """R1: a path inside repository_root is never ephemeral, even under /tmp."""
+    repository_root = "/tmp/pr-alpha"
+    file_path = "/tmp/pr-alpha/hooks/blocking/orders.py"
+    assert is_ephemeral_script_path(file_path, repository_root) is False
+
+
+def test_should_return_true_for_sibling_directory_outside_repository_root() -> None:
+    """R2: a /tmp sibling that merely shares repository_root's name prefix stays ephemeral."""
+    repository_root = "/tmp/pr-alpha"
+    sibling_file_path = "/tmp/pr-alpha-sibling/hooks/orders.py"
+    assert is_ephemeral_script_path(sibling_file_path, repository_root) is True
+
+
+def test_should_return_true_when_repository_root_does_not_cover_target() -> None:
+    """R3: an unrelated cwd must not blanket-exempt a /tmp target outside it."""
+    unrelated_repository_root = "/tmp/scratch-workspace"
+    scratch_target = "/tmp/scratch-elsewhere/notes.py"
+    assert is_ephemeral_script_path(scratch_target, unrelated_repository_root) is True
+
+
+def test_should_deny_pretooluse_target_inside_repository_root_under_tmp() -> None:
+    """B22: a production file inside a repository checked out under /tmp is gated for real."""
+    repository_root = "/tmp/pr-alpha"
+    file_path = f"{repository_root}/hooks/blocking/orders.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        file_path,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert "deny" in captured_stdout.lower(), (
+        f"enforcer must gate a repository file under /tmp, got exit_code={exit_code}, "
+        f"stdout={captured_stdout!r}"
+    )
+
+
+def test_should_stay_exempt_for_scratch_outside_repository_root() -> None:
+    """B23: a genuine scratch file outside the repository stays exempt."""
+    repository_root = "/tmp/pr-alpha"
+    scratch_target = "/tmp/scratch/one_off.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        scratch_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()
+
+
+def test_should_stay_exempt_when_working_directory_covers_no_repository() -> None:
+    """B24: a cwd that covers no repository must not exempt an unrelated /tmp target."""
+    unrelated_working_directory = "/tmp/scratch-workspace"
+    scratch_target = "/tmp/scratch-elsewhere/notes.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        scratch_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        unrelated_working_directory,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()
+
+
+def test_should_stay_exempt_for_unrelated_worktree_sibling_under_tmp() -> None:
+    """B25: a sibling worktree sharing repository_root's name prefix stays exempt."""
+    repository_root = "/tmp/pr-alpha"
+    unrelated_sibling_target = "/tmp/pr-alpha-sibling/hooks/orders.py"
+    captured_stdout, exit_code = _run_main_with_write_payload_and_cwd(
+        unrelated_sibling_target,
+        _VIOLATING_PRODUCTION_SOURCE,
+        repository_root,
+    )
+    assert exit_code == 0
+    assert "deny" not in captured_stdout.lower()

package/hooks/blocking/test_code_rules_enforcer_same_file_inline_duplicate.py

@@ -16,6 +16,7 @@ in-process AST scan the production enforcer runs.
 
 from __future__ import annotations
 
+import ast
 import importlib.util
 import pathlib
 import sys
@@ -34,6 +35,20 @@ _hook_module = importlib.util.module_from_spec(_hook_spec)
 _hook_spec.loader.exec_module(_hook_module)
 check_same_file_inline_duplicate_body = _hook_module.check_same_file_inline_duplicate_body
 
+_duplicate_body_spec = importlib.util.spec_from_file_location(
+    "code_rules_duplicate_body",
+    _HOOK_DIRECTORY / "code_rules_duplicate_body.py",
+)
+assert _duplicate_body_spec is not None
+assert _duplicate_body_spec.loader is not None
+_duplicate_body_module = importlib.util.module_from_spec(_duplicate_body_spec)
+_duplicate_body_spec.loader.exec_module(_duplicate_body_module)
+
+MEMO_CORPUS_MODULE_GLOB = "code_rules_*.py"
+TEST_MODULE_NAME_PREFIX = "test_"
+MINIMUM_MEMO_CORPUS_MODULE_COUNT = 20
+EXTRA_DUPLICATE_PAIRS_BEYOND_THE_CEILING = 5
+
 
 PR_470_SHAPE_SOURCE = (
     "import asyncio\n"
@@ -464,3 +479,239 @@ def test_should_carry_both_helper_and_enclosing_spans_for_the_commit_gate_scoper
         "the union the PreToolUse path scopes on — not the helper span alone, "
         f"got: {matching_issues[0]}"
     )
+
+
+NO_INLINE_DUPLICATE_SOURCE = (
+    "async def _wait_for_content_image_to_render(automation: object) -> None:\n"
+    "    assert automation.detector is not None\n"
+    "    await automation.detector.wait_for_element(selector)\n"
+    "    logger.info('rendered')\n"
+    "\n"
+    "\n"
+    "async def _do_other_work(automation: object) -> None:\n"
+    "    await automation.cdp.reload()\n"
+    "    logger.info('reloaded')\n"
+    "    return None\n"
+)
+
+
+def _memo_corpus_module_paths() -> list[pathlib.Path]:
+    """Return the production code-rules modules used as a statement corpus.
+
+    Returns:
+        Every non-test ``code_rules_*.py`` module in the blocking hook directory,
+        in sorted order, which supplies thousands of real statements of every
+        shape the scan meets in practice.
+    """
+    return sorted(
+        each_path
+        for each_path in _HOOK_DIRECTORY.glob(MEMO_CORPUS_MODULE_GLOB)
+        if not each_path.name.startswith(TEST_MODULE_NAME_PREFIX)
+    )
+
+
+def _all_statements_in_module(module_path: pathlib.Path) -> list[ast.stmt]:
+    """Return every statement node parsed from a repository module.
+
+    The returned list holds the nodes, so they stay alive across both memo passes
+    and the second pass reads the very objects the first pass recorded.
+
+    Args:
+        module_path: The repository module to parse.
+
+    Returns:
+        Every statement node in the module, in walk order.
+    """
+    parsed_module = ast.parse(module_path.read_text(encoding="utf-8"))
+    return [
+        each_node
+        for each_node in ast.walk(parsed_module)
+        if isinstance(each_node, ast.stmt)
+    ]
+
+
+def _memo_disagreements(
+    all_statements: list[ast.stmt],
+    dump_by_statement: dict[ast.stmt, str],
+    module_name: str,
+) -> list[str]:
+    """Return a location for every statement the memo dumps differently.
+
+    Args:
+        all_statements: The statement nodes to compare.
+        dump_by_statement: The memo under test, mutated in place.
+        module_name: The module name to name in a disagreement location.
+
+    Returns:
+        A ``module:line`` location per statement whose memoized dump differs from
+        the uncached dump, and an empty list when the memo is transparent.
+    """
+    return [
+        f"{module_name}:{each_statement.lineno}"
+        for each_statement in all_statements
+        if _duplicate_body_module._memoized_statement_dump(
+            each_statement, dump_by_statement
+        )
+        != _duplicate_body_module._normalized_statement_dump(each_statement)
+    ]
+
+
+def _cold_and_warm_memo_disagreements(
+    all_module_paths: list[pathlib.Path],
+) -> tuple[list[str], list[str]]:
+    """Compare memoized against uncached dumps twice over the same statements.
+
+    The first pass over a module fills the memo and the second reads it warm, so
+    both the computed value and the served value are held against the uncached
+    dump.
+
+    Args:
+        all_module_paths: The corpus modules to parse and compare.
+
+    Returns:
+        The cold-pass disagreement locations and the warm-pass disagreement
+        locations.
+    """
+    dump_by_statement: dict[ast.stmt, str] = {}
+    all_cold_disagreements: list[str] = []
+    all_warm_disagreements: list[str] = []
+    for each_path in all_module_paths:
+        all_statements = _all_statements_in_module(each_path)
+        all_cold_disagreements += _memo_disagreements(
+            all_statements, dump_by_statement, each_path.name
+        )
+        all_warm_disagreements += _memo_disagreements(
+            all_statements, dump_by_statement, each_path.name
+        )
+    assert dump_by_statement, "the memo recorded nothing, so nothing was proven"
+    return all_cold_disagreements, all_warm_disagreements
+
+
+def test_should_memoize_every_repository_statement_dump_transparently() -> None:
+    """The memo must be invisible: every dump it serves equals the uncached dump.
+
+    The inline scan's speed rests on serving each statement's dump from a memo,
+    which makes the memo the one place a behavior change could hide. Real
+    repository modules supply the statements, so the proof covers every statement
+    shape the scan meets in this repository.
+    """
+    all_module_paths = _memo_corpus_module_paths()
+    assert len(all_module_paths) >= MINIMUM_MEMO_CORPUS_MODULE_COUNT, (
+        "the transparency proof needs a real corpus, but the glob found "
+        f"only {len(all_module_paths)} modules"
+    )
+    all_cold, all_warm = _cold_and_warm_memo_disagreements(all_module_paths)
+    assert all_cold == [], (
+        "a cold memo must compute the same dump the uncached helper computes, "
+        f"but these statements disagreed: {all_cold[:10]}"
+    )
+    assert all_warm == [], (
+        "a warm memo must serve the same dump the uncached helper computes, "
+        f"but these statements disagreed: {all_warm[:10]}"
+    )
+
+
+def test_should_report_the_same_verdict_when_an_earlier_scan_used_the_same_path() -> None:
+    """No memo may outlive one scan, so an earlier scan cannot color a later one.
+
+    A dump memo that persisted between calls — keyed on a path, or on a node slot
+    a later parse could reuse — would let one file's statements answer for
+    another's. Two different sources are scanned under one path, then the first is
+    scanned again, so a verdict that shifted on the repeat would expose the leak.
+    """
+    first_duplicate_issues = check_same_file_inline_duplicate_body(
+        PR_470_SHAPE_SOURCE, "account_switcher.py"
+    )
+    clean_issues = check_same_file_inline_duplicate_body(
+        NO_INLINE_DUPLICATE_SOURCE, "account_switcher.py"
+    )
+    repeat_duplicate_issues = check_same_file_inline_duplicate_body(
+        PR_470_SHAPE_SOURCE, "account_switcher.py"
+    )
+    assert first_duplicate_issues, "the duplicate source must flag on its own"
+    assert clean_issues == [], (
+        "the clean source must not inherit a verdict from the duplicate source "
+        f"scanned before it under the same path, got: {clean_issues}"
+    )
+    assert repeat_duplicate_issues == first_duplicate_issues, (
+        "the duplicate source must produce the same verdict on a repeat scan, "
+        f"got {repeat_duplicate_issues} after {first_duplicate_issues}"
+    )
+
+
+def test_should_read_no_function_when_the_file_holds_no_qualifying_helper() -> None:
+    """A file with no candidate helper is answered without reading any function.
+
+    Most files carry no function that clears the helper-window filter, so the scan
+    leaves them after that filter and takes no per-function readings. The memo
+    stays empty in that case, which both proves the readings were skipped and
+    pins the verdict such a file gets.
+    """
+    all_module_functions = ast.parse(NO_INLINE_DUPLICATE_SOURCE).body
+    dump_by_statement: dict[ast.stmt, str] = {}
+    all_windows = [
+        _duplicate_body_module._helper_match_window_dumps(
+            each_function, dump_by_statement
+        )
+        for each_function in all_module_functions
+        if isinstance(each_function, ast.FunctionDef | ast.AsyncFunctionDef)
+    ]
+    assert all(each_window is None for each_window in all_windows), (
+        "this source must hold no qualifying helper for the skip to be exercised, "
+        f"got windows: {all_windows}"
+    )
+    assert dump_by_statement == {}, (
+        "a source with no qualifying helper must take no statement dumps, "
+        f"got {len(dump_by_statement)} memo entries"
+    )
+    issues = check_same_file_inline_duplicate_body(
+        NO_INLINE_DUPLICATE_SOURCE, "module.py"
+    )
+    assert issues == [], f"a file with no qualifying helper must not flag, got: {issues}"
+
+
+def _duplicated_helper_pair_source(pair_index: int) -> str:
+    """Return one helper and one strictly larger function that inlines its body.
+
+    Each pair carries its own variable name, so a helper matches only the
+    enclosing function of its own pair and every pair contributes one report.
+
+    Args:
+        pair_index: The number distinguishing this pair from the others.
+
+    Returns:
+        Source text holding the helper and its enclosing function.
+    """
+    duplicated_block = (
+        "    try:\n"
+        f"        record_{pair_index} = records.load({pair_index})\n"
+        "    except KeyError:\n"
+        "        logger.warning('record missing')\n"
+        f"        record_{pair_index} = None\n"
+        f"    return record_{pair_index}\n"
+    )
+    return (
+        f"def load_record_{pair_index}(records):\n{duplicated_block}\n\n"
+        f"def refresh_record_{pair_index}(records):\n"
+        f"    records.begin({pair_index})\n{duplicated_block}\n\n"
+    )
+
+
+def test_should_cap_the_reported_issue_count_at_the_module_ceiling() -> None:
+    """A file full of inline duplicates reports the ceiling, not one per pair.
+
+    The blocking payload a single write can carry is bounded, so a file holding
+    more duplicated helpers than the ceiling still reports exactly the ceiling.
+    The source is built with more pairs than the ceiling allows, so a lost bound
+    would show up as a longer report.
+    """
+    ceiling = _duplicate_body_module.MAX_DUPLICATE_BODY_ISSUES
+    pair_count = ceiling + EXTRA_DUPLICATE_PAIRS_BEYOND_THE_CEILING
+    source = "".join(
+        _duplicated_helper_pair_source(each_index) for each_index in range(pair_count)
+    )
+    issues = check_same_file_inline_duplicate_body(source, "module.py")
+    assert len(issues) == ceiling, (
+        f"{pair_count} duplicated pairs must report the {ceiling}-issue ceiling, "
+        f"got {len(issues)} issues"
+    )

package/hooks/blocking/test_code_rules_enforcer_split_entry_2.py

@@ -177,6 +177,28 @@ def test_unreadable_prior_yields_no_prior_and_no_reconstruction() -> None:
     assert post_edit_content is None
 
 
+def test_prior_and_post_edit_content_honors_replace_all(
+    tmp_path_factory: pytest.TempPathFactory,
+) -> None:
+    """An Edit carrying replace_all rewrites every occurrence in the post-edit view.
+
+    The MultiEdit lane reconstructs through apply_edits and has honored the flag
+    since it landed there. The Edit lane must agree, or the enforcer judges a
+    replace_all Edit against a file that never exists on disk.
+    """
+    production_directory = tmp_path_factory.mktemp("replace_all_pkg")
+    source_file = production_directory / "edited_module.py"
+    source_file.write_text("value = 1\nvalue = 1\n", encoding="utf-8")
+    prior_content, post_edit_content = code_rules_enforcer.prior_and_post_edit_content(
+        str(source_file),
+        old_string="value = 1",
+        new_string="value = 2",
+        is_replace_all=True,
+    )
+    assert prior_content == "value = 1\nvalue = 1\n"
+    assert post_edit_content == "value = 2\nvalue = 2\n"
+
+
 def test_edit_with_missing_old_string_runs_whole_file_against_on_disk_content(
     tmp_path_factory: pytest.TempPathFactory,
 ) -> None:

package/hooks/blocking/test_pr_description_writer_gate.py

@@ -68,7 +68,7 @@ def _printed_output_for(command: str, temp_directory: Path, tool_name: str = "Ba
     with (
         mock.patch("sys.stdin", io.StringIO(payload_text)),
         mock.patch("sys.stdout", captured_stdout),
-        mock.patch.object(gate_module.tempfile, "gettempdir", return_value=str(temp_directory)),
+        mock.patch.object(_GATE_CONSTANTS.tempfile, "gettempdir", return_value=str(temp_directory)),
         pytest.raises(SystemExit),
     ):
         gate_module.main()
@@ -100,7 +100,8 @@ def _record_spawn(temp_directory: Path, session_id: str = _SESSION_ID) -> None:
         temp_directory: The directory standing in for the system temp root.
     """
     marker_name = (
-        f"{gate_module.SPAWN_MARKER_FILE_PREFIX}{session_id}{gate_module.SPAWN_MARKER_FILE_SUFFIX}"
+        f"{_GATE_CONSTANTS.SPAWN_MARKER_FILE_PREFIX}{session_id}"
+        f"{_GATE_CONSTANTS.SPAWN_MARKER_FILE_SUFFIX}"
     )
     (temp_directory / marker_name).touch()
 
@@ -195,7 +196,7 @@ def should_deny_when_the_payload_names_no_session(tmp_path: Path) -> None:
     with (
         mock.patch("sys.stdin", io.StringIO(json.dumps(payload))),
         mock.patch("sys.stdout", captured_stdout),
-        mock.patch.object(gate_module.tempfile, "gettempdir", return_value=str(tmp_path)),
+        mock.patch.object(_GATE_CONSTANTS.tempfile, "gettempdir", return_value=str(tmp_path)),
         pytest.raises(SystemExit),
     ):
         gate_module.main()
@@ -214,3 +215,20 @@ def should_name_both_ways_forward_in_the_denial(tmp_path: Path) -> None:
     denial_reason = json.loads(printed_text)["hookSpecificOutput"]["permissionDecisionReason"]
     assert _PR_DESCRIPTION_WRITER_SUBAGENT_TYPE in denial_reason
     assert gate_module.SPAWN_BYPASS_MARKER in denial_reason
+
+
+def should_read_the_marker_path_the_shared_builder_produces(tmp_path: Path) -> None:
+    """The gate reads exactly the file the shared path builder names.
+
+    The tracker writes through `spawn_marker_path` and the gate reads through it,
+    so neither side owns a private copy of the marker file name.
+    """
+    marker_file = _GATE_CONSTANTS.spawn_marker_path(_SESSION_ID, temp_directory=tmp_path)
+    assert marker_file is not None
+    marker_file.touch()
+    assert _decision_for(_PLAIN_CREATE_COMMAND, tmp_path) == ""
+
+
+def should_deny_when_the_session_id_names_no_marker(tmp_path: Path) -> None:
+    """A session id that sanitizes to nothing yields no path, so the gate denies."""
+    assert _GATE_CONSTANTS.spawn_marker_path("", temp_directory=tmp_path) is None

package/hooks/blocking/test_pre_tool_use_dispatcher_native.py

@@ -7,7 +7,10 @@ text. It also asserts the dispatcher reaches the same decision through its nativ
 path.
 
 The corpus pairs allowing payloads with denying payloads for each hook so the
-equivalence holds across both outcomes.
+equivalence holds across both outcomes. Each payload names an absolute file
+under this repository and carries the repository root as its ``cwd``, so the
+decision belongs to this checkout rather than to the directory pytest runs
+from.
 """
 
 from __future__ import annotations
@@ -43,7 +46,13 @@ import state_description_blocker  # noqa: E402, I001
 _STATE_DESCRIPTION_SCRIPT = str(_BLOCKING_DIR / "state_description_blocker.py")
 _DISPATCHER_SCRIPT = str(_BLOCKING_DIR / "pre_tool_use_dispatcher.py")
 
-_MARKDOWN_PATH = "docs/native_equivalence_probe.md"
+from code_rules_enforcer_test_support import (  # noqa: E402
+    repository_file_path,
+    repository_root,
+)
+
+_REPOSITORY_ROOT = str(repository_root())
+_MARKDOWN_PATH = repository_file_path("docs/native_equivalence_probe.md")
 _STATE_DESCRIPTION_ALLOW_CONTENT = "# Guide\n\nThe API uses port 8080.\n"
 _STATE_DESCRIPTION_DENY_CONTENT = "# Guide\n\nPreviously the system used port 8080.\n"
 
@@ -74,6 +83,7 @@ def _write_payload_dictionary(file_path: str, content: str) -> dict[str, object]
     return {
         "tool_name": WRITE_TOOL_NAME,
         "tool_input": {"file_path": file_path, "content": content},
+        "cwd": _REPOSITORY_ROOT,
     }
 
 def _edit_payload_dictionary(file_path: str, new_string: str) -> dict[str, object]:
@@ -93,6 +103,7 @@ def _edit_payload_dictionary(file_path: str, new_string: str) -> dict[str, objec
             "old_string": "old line",
             "new_string": new_string,
         },
+        "cwd": _REPOSITORY_ROOT,
     }
 
 def _multi_edit_payload_dictionary(file_path: str, new_string: str) -> dict[str, object]:
@@ -111,6 +122,7 @@ def _multi_edit_payload_dictionary(file_path: str, new_string: str) -> dict[str,
             "file_path": file_path,
             "edits": [{"old_string": "old line", "new_string": new_string}],
         },
+        "cwd": _REPOSITORY_ROOT,
     }
 
 

package/hooks/blocking/test_shell_substitution_blocker.py

@@ -191,3 +191,108 @@ def test_denies_nested_command_substitution_without_arithmetic() -> None:
     }
     response = json.loads(_run_hook(payload).stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_backtick_inside_single_quoted_heredoc_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cat > notes.md <<'EOF'\n"
+                "reStructuredText markup: ``inert literal``\n"
+                "EOF"
+            )
+        },
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_backtick_inside_tab_stripped_quoted_heredoc_body() -> None:
+    """A ``<<-`` opener closes on a tab-indented terminator, and stays inert.
+
+    The tab-strip rule decides which line ends the body. Getting it wrong
+    swallows the rest of the command or ends the body early, so the branch is
+    pinned here as well as in the shared pipeline that owns the rule.
+    """
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cat > notes.md <<-'EOF'\n"
+                "reStructuredText markup: ``inert literal``\n"
+                "\tEOF\n"
+                "echo done"
+            )
+        },
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_backtick_inside_bare_heredoc_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "cat > notes.md <<EOF\nnow: `date`\nEOF"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_command_substitution_inside_bare_heredoc_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cat > notes.md <<EOF\nhead: $(git rev-parse HEAD)\nEOF"
+        },
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_live_substitution_outside_a_quoted_heredoc() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cat > notes.md <<'EOF'\n"
+                "inert ``literal``\n"
+                "EOF\n"
+                'echo "$(git rev-parse HEAD)"'
+            )
+        },
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_backslash_escaped_heredoc_delimiter_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cat > notes.md <<\\EOF\ninert `text`\nEOF"
+        },
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_a_substitution_below_an_opener_inside_a_quoted_string() -> None:
+    """An opener spelled inside a quoted string opens no heredoc.
+
+    Bash runs the second line here. Reading the first line as an opener and
+    dropping everything below it hides a live substitution from the scan.
+    """
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": 'echo "<<\'EOF\'"\necho $(whoami)'},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_that_bypass_even_when_a_terminator_line_follows() -> None:
+    """A terminator line below the substitution does not make the strip safe."""
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": 'echo "<<\'EOF\'"\necho $(whoami)\nEOF'},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"