claude-dev-env 2.31.1 → 2.32.0

package/hooks/blocking/tdd_enforcer_parts/content_hash_store.py

@@ -30,6 +30,7 @@ import time
 from pathlib import Path
 
 from atomic_file_writer import write_text_atomically
+from hooks_constants.state_file_lock import hold_state_file_lock
 from hooks_constants.session_edit_stage_gate_constants import (
     SESSION_ID_UNSAFE_CHARACTERS_PATTERN,
     STATE_FILE_ATOMIC_WRITE_SUFFIX,
@@ -45,6 +46,10 @@ from tdd_enforcer_parts.config.tdd_enforcer_constants import (
     REPOSITORY_ROOT_DIGEST_LENGTH,
     STORED_CHANGED_AT_KEY,
     STORED_CONTENT_HASH_KEY,
+    STORED_FAILED_AT_KEY,
+    STORED_FAILURE_COMMAND_KEY,
+    STORED_FAILURE_EXIT_STATUS_KEY,
+    STORED_FAILURE_HASH_KEY,
 )
 
 
@@ -96,6 +101,26 @@ def _recorded_entry(current_hash: str, current_time: float) -> dict[str, object]
     return {STORED_CONTENT_HASH_KEY: current_hash, STORED_CHANGED_AT_KEY: current_time}
 
 
+def _has_matching_recorded_failure(
+    stored_entry: object, current_hash: str, current_time: float, freshness_seconds: int
+) -> bool:
+    """Return whether a recorded test failure still evidences the candidate's content.
+
+    A failure counts as evidence only while the candidate's content is
+    exactly what failed and the record has not aged past the freshness
+    window -- editing the test again, or letting the record go stale, drops
+    it as evidence and falls back to the ordinary content-hash tracking.
+    """
+    if not isinstance(stored_entry, dict):
+        return False
+    if stored_entry.get(STORED_FAILURE_HASH_KEY) != current_hash:
+        return False
+    failed_at = stored_entry.get(STORED_FAILED_AT_KEY)
+    if not isinstance(failed_at, (int, float)):
+        return False
+    return current_time - failed_at <= freshness_seconds
+
+
 def _is_qualifying_first_sight(
     candidate_path: Path, candidate_text: str, current_time: float, freshness_seconds: int
 ) -> bool:
@@ -107,6 +132,34 @@ def _is_qualifying_first_sight(
     return git_tracking.has_uncommitted_change_from_head(candidate_path)
 
 
+def _first_sight_decision(
+    candidate_path: Path,
+    candidate_text: str,
+    current_time: float,
+    freshness_seconds: int,
+    current_hash: str,
+) -> tuple[bool, dict[str, object] | None]:
+    if not _is_qualifying_first_sight(
+        candidate_path, candidate_text, current_time, freshness_seconds
+    ):
+        return False, None
+    return True, _recorded_entry(current_hash, current_time)
+
+
+def _content_hash_decision(
+    all_stored_entry_fields: dict[str, object],
+    current_hash: str,
+    current_time: float,
+    freshness_seconds: int,
+) -> tuple[bool, dict[str, object] | None]:
+    if current_hash != all_stored_entry_fields.get(STORED_CONTENT_HASH_KEY):
+        return True, _recorded_entry(current_hash, current_time)
+    stored_changed_at = all_stored_entry_fields.get(STORED_CHANGED_AT_KEY)
+    if not isinstance(stored_changed_at, (int, float)):
+        return False, None
+    return current_time - stored_changed_at <= freshness_seconds, None
+
+
 def _evaluate_candidate(
     candidate_path: Path,
     stored_entry: object,
@@ -117,18 +170,15 @@ def _evaluate_candidate(
     if candidate_text is None:
         return False, None
     current_hash = _content_hash(candidate_text)
-    if not isinstance(stored_entry, dict):
-        if _is_qualifying_first_sight(
-            candidate_path, candidate_text, current_time, freshness_seconds
-        ):
-            return True, _recorded_entry(current_hash, current_time)
-        return False, None
-    if current_hash != stored_entry.get(STORED_CONTENT_HASH_KEY):
-        return True, _recorded_entry(current_hash, current_time)
-    stored_changed_at = stored_entry.get(STORED_CHANGED_AT_KEY)
-    if not isinstance(stored_changed_at, (int, float)):
-        return False, None
-    return current_time - stored_changed_at <= freshness_seconds, None
+    if _has_matching_recorded_failure(
+        stored_entry, current_hash, current_time, freshness_seconds
+    ):
+        return True, None
+    if not isinstance(stored_entry, dict) or STORED_CONTENT_HASH_KEY not in stored_entry:
+        return _first_sight_decision(
+            candidate_path, candidate_text, current_time, freshness_seconds, current_hash
+        )
+    return _content_hash_decision(stored_entry, current_hash, current_time, freshness_seconds)
 
 
 def _apply_candidate_decisions(
@@ -142,7 +192,10 @@ def _apply_candidate_decisions(
     for each_candidate in all_candidates:
         candidate_key = _state_key_for(each_candidate)
         candidate_allowed, updated_entry = _evaluate_candidate(
-            each_candidate, all_stored_hashes.get(candidate_key), current_time, freshness_seconds
+            each_candidate,
+            all_stored_hashes.get(candidate_key),
+            current_time,
+            freshness_seconds,
         )
         if candidate_allowed:
             is_allowed = True
@@ -162,19 +215,84 @@ def has_recorded_or_fresh_test(
 
     Args:
         all_candidates: Candidate test paths for the production file.
-        session_id: Raw ``session_id`` from the hook payload.
-        repository_root: Raw ``cwd`` from the hook payload.
+        session_id: Raw session_id from the hook payload.
+        repository_root: Raw cwd from the hook payload.
         freshness_seconds: Maximum age, in seconds, a stored hash may have.
 
     Returns:
-        True when at least one candidate is a fresh, dirty first sighting, a
-        recorded hash that now differs, or a recorded hash still in window.
+        True when at least one candidate carries a matching recorded test
+        failure, is a fresh dirty first sighting, has a recorded hash that
+        now differs, or has a recorded hash still in window.
     """
     state_file = _state_file_path(session_id, repository_root)
-    all_stored_hashes = _load_state(state_file)
-    is_allowed, state_changed = _apply_candidate_decisions(
-        all_candidates, all_stored_hashes, time.time(), freshness_seconds
-    )
-    if state_changed:
-        _atomic_write_state(state_file, all_stored_hashes)
+    with hold_state_file_lock(state_file):
+        all_stored_hashes = _load_state(state_file)
+        is_allowed, state_changed = _apply_candidate_decisions(
+            all_candidates, all_stored_hashes, time.time(), freshness_seconds
+        )
+        if state_changed:
+            _atomic_write_state(state_file, all_stored_hashes)
     return is_allowed
+
+
+def _merged_failure_entry(
+    existing_entry: object,
+    candidate_text: str,
+    command: str,
+    exit_status: int,
+    current_time: float,
+) -> dict[str, object]:
+    merged_entry = dict(existing_entry) if isinstance(existing_entry, dict) else {}
+    merged_entry[STORED_FAILURE_HASH_KEY] = _content_hash(candidate_text)
+    merged_entry[STORED_FAILED_AT_KEY] = current_time
+    merged_entry[STORED_FAILURE_COMMAND_KEY] = command
+    merged_entry[STORED_FAILURE_EXIT_STATUS_KEY] = exit_status
+    return merged_entry
+
+
+def _record_one_test_file_failure(
+    test_file_path: Path,
+    all_stored_hashes: dict[str, object],
+    command: str,
+    exit_status: int,
+    current_time: float,
+) -> bool:
+    candidate_text = freshness._read_candidate_text(test_file_path)
+    if candidate_text is None:
+        return False
+    candidate_key = _state_key_for(test_file_path)
+    all_stored_hashes[candidate_key] = _merged_failure_entry(
+        all_stored_hashes.get(candidate_key),
+        candidate_text,
+        command,
+        exit_status,
+        current_time,
+    )
+    return True
+
+
+def record_test_command_failure(
+    all_test_file_paths: list[Path],
+    command: str,
+    exit_status: int,
+    session_id: str,
+    repository_root: str,
+) -> None:
+    """Record a failing test command as gate evidence, one entry per test file.
+
+    Keyed exactly as the gate looks candidates up, so a failure satisfies the
+    gate only for the file it names, never a sibling the command also ran.
+    Existing content-hash fields on that entry are preserved, not overwritten.
+    """
+    state_file = _state_file_path(session_id, repository_root)
+    current_time = time.time()
+    with hold_state_file_lock(state_file):
+        all_stored_hashes = _load_state(state_file)
+        all_recorded = [
+            _record_one_test_file_failure(
+                each_path, all_stored_hashes, command, exit_status, current_time
+            )
+            for each_path in all_test_file_paths
+        ]
+        if any(all_recorded):
+            _atomic_write_state(state_file, all_stored_hashes)

package/hooks/blocking/tdd_enforcer_parts/tests/test_content_hash_store.py

@@ -1,4 +1,11 @@
-"""Behavioral tests for the content_hash_store parts module."""
+"""Behavioral tests for the content_hash_store parts module.
+
+Covers the recorded-test-failure evidence path: a genuinely failing test
+command outranks a stale mtime, never satisfies a candidate it did not
+name, expires after the freshness window, and applies only while the
+candidate's content still matches what actually failed. Also covers the
+private decision helpers by name, so a rename keeps its own paired test.
+"""
 
 import json
 import os
@@ -141,3 +148,109 @@ def test_denies_when_no_candidate_file_exists(tmp_path: Path) -> None:
     )
 
     assert is_allowed is False
+
+
+def test_recorded_failure_allows_a_stale_candidate(tmp_path: Path) -> None:
+    """RED-evidence: a genuinely recorded failure outranks a stale mtime."""
+    candidate = _write_fresh_test_file(tmp_path)
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+    session_id, repository_root = "session-failure-1", str(tmp_path)
+    content_hash_store.record_test_command_failure(
+        [candidate], "pytest test_orders.py", 1, session_id, repository_root
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is True
+
+
+def test_recorded_failure_stores_the_command_and_exit_status(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    session_id, repository_root = "session-failure-2", str(tmp_path)
+
+    content_hash_store.record_test_command_failure(
+        [candidate], "pytest test_orders.py -q", 1, session_id, repository_root
+    )
+
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    state = json.loads(state_file.read_text())
+    entry = state[content_hash_store._state_key_for(candidate)]
+    assert entry[content_hash_store.STORED_FAILURE_COMMAND_KEY] == "pytest test_orders.py -q"
+    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1
+
+
+def test_recorded_failure_does_not_satisfy_a_different_candidate(tmp_path: Path) -> None:
+    """Anti-bypass: a failure recorded for one test file must not unlock a sibling."""
+    failing_candidate = tmp_path / "test_bar.py"
+    failing_candidate.write_text("def test_bar(): pass\n")
+    unrelated_candidate = tmp_path / "test_foo.py"
+    unrelated_candidate.write_text("def test_foo(): pass\n")
+    stale_timestamp = time.time() - 700
+    os.utime(unrelated_candidate, (stale_timestamp, stale_timestamp))
+    session_id, repository_root = "session-failure-3", str(tmp_path)
+    content_hash_store.record_test_command_failure(
+        [failing_candidate], "pytest test_bar.py", 1, session_id, repository_root
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [unrelated_candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False
+
+
+def test_recorded_failure_expires_after_the_freshness_window(tmp_path: Path) -> None:
+    candidate = _write_fresh_test_file(tmp_path)
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+    session_id, repository_root = "session-failure-4", str(tmp_path)
+    state_file = content_hash_store._state_file_path(session_id, repository_root)
+    candidate_key = content_hash_store._state_key_for(candidate)
+    stale_failed_at = time.time() - 700
+    state_file.write_text(
+        json.dumps(
+            {
+                candidate_key: {
+                    content_hash_store.STORED_FAILURE_HASH_KEY: content_hash_store._content_hash(
+                        candidate.read_text()
+                    ),
+                    content_hash_store.STORED_FAILED_AT_KEY: stale_failed_at,
+                }
+            }
+        )
+    )
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False
+
+
+def test_recorded_failure_does_not_apply_once_content_no_longer_matches(
+    tmp_path: Path,
+) -> None:
+    """Anti-bypass: editing the test after a recorded RED clears that RED as evidence.
+
+    A bare failure-only entry (no prior content-hash tracking) must not fall
+    through to the unconditional hash-differs allow either -- it still needs a
+    real qualifying first sight (fresh mtime plus a real git-visible edit).
+    """
+    candidate = tmp_path / "test_orders.py"
+    candidate.write_text("def test_fulfill(): pass\n")
+    session_id, repository_root = "session-failure-5", str(tmp_path)
+    content_hash_store.record_test_command_failure(
+        [candidate], "pytest test_orders.py", 1, session_id, repository_root
+    )
+    candidate.write_text("def test_fulfill(): assert True\n")
+    stale_timestamp = time.time() - 700
+    os.utime(candidate, (stale_timestamp, stale_timestamp))
+
+    is_allowed = content_hash_store.has_recorded_or_fresh_test(
+        [candidate], session_id, repository_root, 600
+    )
+
+    assert is_allowed is False

package/hooks/blocking/test_bash_post_call_dispatcher.py

@@ -0,0 +1,112 @@
+"""Behavior tests for the Bash PostToolUse dispatcher.
+
+One interpreter start runs every hosted PostToolUse hook a Bash call fires.
+The unit tests pin selection, call order, and crash isolation with a fake
+runner; the end-to-end test drives the real hosted hooks through a real
+payload and confirms the recorder's own real side effect lands.
+``hooks/conftest.py`` already puts the hooks and blocking directories on
+sys.path for test collection, so this file needs no bootstrap of its own.
+"""
+
+import io
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+from bash_post_call_dispatcher import dispatch, main, select_applicable_entries
+from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
+from hooks_constants.hosted_hook_runner import HostedHookRun
+from tdd_enforcer_parts import content_hash_store
+
+
+def test_select_applicable_entries_returns_both_hosted_hooks_for_bash() -> None:
+    all_entries = select_applicable_entries(BASH_TOOL_NAME)
+    all_script_paths = [each_entry.script_relative_path for each_entry in all_entries]
+    assert all_script_paths == [
+        "blocking/gh_pr_author_restore.py",
+        "observability/test_failure_recorder.py",
+    ]
+
+
+def test_select_applicable_entries_returns_none_for_a_write_tool() -> None:
+    assert select_applicable_entries("Write") == []
+
+
+def test_dispatch_runs_every_hosted_hook_in_roster_order(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_call_paths: list[str] = []
+
+    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
+        del payload_text
+        all_call_paths.append(Path(script_path).name)
+        return HostedHookRun(captured_stdout="", did_crash=False)
+
+    monkeypatch.setattr("bash_post_call_dispatcher.run_hook_capturing_output", _fake_run_hook)
+
+    dispatch('{"tool_name": "Bash"}', BASH_TOOL_NAME)
+
+    assert all_call_paths == ["gh_pr_author_restore.py", "test_failure_recorder.py"]
+
+
+def test_dispatch_runs_the_later_hook_after_an_earlier_one_crashes(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_call_paths: list[str] = []
+
+    def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
+        del payload_text
+        script_name = Path(script_path).name
+        all_call_paths.append(script_name)
+        if script_name == "gh_pr_author_restore.py":
+            return HostedHookRun(captured_stdout="", did_crash=True)
+        return HostedHookRun(captured_stdout="", did_crash=False)
+
+    monkeypatch.setattr("bash_post_call_dispatcher.run_hook_capturing_output", _fake_run_hook)
+
+    dispatch('{"tool_name": "Bash"}', BASH_TOOL_NAME)
+
+    assert all_call_paths == ["gh_pr_author_restore.py", "test_failure_recorder.py"]
+
+
+def test_main_exits_zero_and_writes_nothing_to_stdout(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    payload = json.dumps({"tool_name": "Write", "tool_input": {}})
+    monkeypatch.setattr(sys, "stdin", io.StringIO(payload))
+
+    with pytest.raises(SystemExit) as raised_exit:
+        main()
+
+    assert int(raised_exit.value.code or 0) == 0
+    assert capsys.readouterr().out == ""
+
+
+def test_end_to_end_real_hosted_hooks_record_a_real_pytest_failure(tmp_path: Path) -> None:
+    """Drives the real, unfaked roster: both scripts run in one process."""
+    test_file = tmp_path / "test_orders.py"
+    test_file.write_text("def test_fulfill(): assert False\n")
+    session_id = "post-dispatcher-session"
+    failing_output = (
+        "Error: Exit code 1\n"
+        "FAILED test_orders.py::test_fulfill - AssertionError\n"
+        "1 failed in 0.02s"
+    )
+    payload = json.dumps(
+        {
+            "session_id": session_id,
+            "cwd": str(tmp_path),
+            "tool_name": "Bash",
+            "tool_input": {"command": "pytest test_orders.py"},
+            "tool_response": failing_output,
+        }
+    )
+
+    dispatch(payload, BASH_TOOL_NAME)
+
+    state_file = content_hash_store._state_file_path(session_id, str(tmp_path))
+    state = json.loads(state_file.read_text())
+    entry = state[content_hash_store._state_key_for(test_file)]
+    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1

package/hooks/blocking/test_code_rules_enforcer_same_file_inline_duplicate.py

@@ -648,8 +648,11 @@ def test_should_read_no_function_when_the_file_holds_no_qualifying_helper() -> N
     pins the verdict such a file gets.
     """
     all_module_functions = ast.parse(NO_INLINE_DUPLICATE_SOURCE).body
+    dump_by_statement: dict[ast.stmt, str] = {}
     all_windows = [
-        _duplicate_body_module._helper_match_window_dumps(each_function)
+        _duplicate_body_module._helper_match_window_dumps(
+            each_function, dump_by_statement
+        )
         for each_function in all_module_functions
         if isinstance(each_function, ast.FunctionDef | ast.AsyncFunctionDef)
     ]
@@ -657,6 +660,10 @@ def test_should_read_no_function_when_the_file_holds_no_qualifying_helper() -> N
         "this source must hold no qualifying helper for the skip to be exercised, "
         f"got windows: {all_windows}"
     )
+    assert dump_by_statement == {}, (
+        "a source with no qualifying helper must take no statement dumps, "
+        f"got {len(dump_by_statement)} memo entries"
+    )
     issues = check_same_file_inline_duplicate_body(
         NO_INLINE_DUPLICATE_SOURCE, "module.py"
     )

package/hooks/blocking/test_pre_tool_use_dispatcher_native.py

@@ -46,8 +46,13 @@ import state_description_blocker  # noqa: E402, I001
 _STATE_DESCRIPTION_SCRIPT = str(_BLOCKING_DIR / "state_description_blocker.py")
 _DISPATCHER_SCRIPT = str(_BLOCKING_DIR / "pre_tool_use_dispatcher.py")
 
-_REPOSITORY_ROOT = str(Path(__file__).resolve().parents[4])
-_MARKDOWN_PATH = str(Path(_REPOSITORY_ROOT) / "docs" / "native_equivalence_probe.md")
+from code_rules_enforcer_test_support import (  # noqa: E402
+    repository_file_path,
+    repository_root,
+)
+
+_REPOSITORY_ROOT = str(repository_root())
+_MARKDOWN_PATH = repository_file_path("docs/native_equivalence_probe.md")
 _STATE_DESCRIPTION_ALLOW_CONTENT = "# Guide\n\nThe API uses port 8080.\n"
 _STATE_DESCRIPTION_DENY_CONTENT = "# Guide\n\nPreviously the system used port 8080.\n"
 

package/hooks/blocking/test_shell_substitution_blocker.py

@@ -191,3 +191,108 @@ def test_denies_nested_command_substitution_without_arithmetic() -> None:
     }
     response = json.loads(_run_hook(payload).stdout)
     assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_backtick_inside_single_quoted_heredoc_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cat > notes.md <<'EOF'\n"
+                "reStructuredText markup: ``inert literal``\n"
+                "EOF"
+            )
+        },
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_allows_backtick_inside_tab_stripped_quoted_heredoc_body() -> None:
+    """A ``<<-`` opener closes on a tab-indented terminator, and stays inert.
+
+    The tab-strip rule decides which line ends the body. Getting it wrong
+    swallows the rest of the command or ends the body early, so the branch is
+    pinned here as well as in the shared pipeline that owns the rule.
+    """
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cat > notes.md <<-'EOF'\n"
+                "reStructuredText markup: ``inert literal``\n"
+                "\tEOF\n"
+                "echo done"
+            )
+        },
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_backtick_inside_bare_heredoc_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": "cat > notes.md <<EOF\nnow: `date`\nEOF"},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_command_substitution_inside_bare_heredoc_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cat > notes.md <<EOF\nhead: $(git rev-parse HEAD)\nEOF"
+        },
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_live_substitution_outside_a_quoted_heredoc() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": (
+                "cat > notes.md <<'EOF'\n"
+                "inert ``literal``\n"
+                "EOF\n"
+                'echo "$(git rev-parse HEAD)"'
+            )
+        },
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_allows_backslash_escaped_heredoc_delimiter_body() -> None:
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "cat > notes.md <<\\EOF\ninert `text`\nEOF"
+        },
+    }
+    assert _run_hook(payload).stdout == ""
+
+
+def test_denies_a_substitution_below_an_opener_inside_a_quoted_string() -> None:
+    """An opener spelled inside a quoted string opens no heredoc.
+
+    Bash runs the second line here. Reading the first line as an opener and
+    dropping everything below it hides a live substitution from the scan.
+    """
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": 'echo "<<\'EOF\'"\necho $(whoami)'},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+def test_denies_that_bypass_even_when_a_terminator_line_follows() -> None:
+    """A terminator line below the substitution does not make the strip safe."""
+    payload = {
+        "tool_name": "Bash",
+        "tool_input": {"command": 'echo "<<\'EOF\'"\necho $(whoami)\nEOF'},
+    }
+    response = json.loads(_run_hook(payload).stdout)
+    assert response["hookSpecificOutput"]["permissionDecision"] == "deny"