claude-dev-env 2.4.0 → 2.7.0

package/hooks/blocking/orchestrator_refresh_reschedule_gate.py

@@ -0,0 +1,256 @@
+#!/usr/bin/env python3
+"""PreToolUse gate: deny orchestrator-refresh re-arm when the run is not active.
+
+Fires on ``ScheduleWakeup`` and ``CronCreate`` when the prompt targets
+``/orchestrator-refresh``. Uses the same status-file gate as
+``skills/orchestrator/scripts/status_gate.py`` so idle loops
+cannot be re-armed on the Claude host without an active status file.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import os
+import re
+import sys
+from pathlib import Path
+from types import ModuleType
+from typing import Mapping
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.orchestrator_refresh_reschedule_gate_constants import (  # noqa: E402
+    ALL_HOME_SKILLS_RELATIVE_PARTS,
+    ALL_SCHEDULE_TOOL_NAMES,
+    ALL_SKILL_SCRIPTS_RELATIVE_PARTS,
+    CALLING_HOOK_NAME,
+    CRON_CREATE_TOOL_NAME,
+    CWD_FIELD_NAME,
+    DENY_REASON_TEMPLATE,
+    HOOK_EVENT_NAME,
+    ORCHESTRATOR_REFRESH_PROMPT_TOKEN,
+    PLUGIN_ROOT_ENV_VAR,
+    PROMPT_FIELD_NAME,
+    REASON_CRON_CREATE_FORBIDDEN,
+    RUN_SLUG_PROMPT_FLAG,
+    RUN_SLUG_PROMPT_VALUE_PATTERN,
+    TOOL_INPUT_FIELD_NAME,
+    TOOL_NAME_FIELD_NAME,
+)
+
+
+def _candidate_skill_script_directories() -> list[Path]:
+    """Return ordered paths that may contain status_gate.py.
+
+    Returns:
+        Absolute candidate directories in preference order.
+    """
+    all_candidates: list[Path] = []
+    plugin_root = os.environ.get(PLUGIN_ROOT_ENV_VAR)
+    if plugin_root:
+        all_candidates.append(
+            Path(plugin_root).joinpath(*ALL_SKILL_SCRIPTS_RELATIVE_PARTS)
+        )
+    package_hooks_parent = Path(__file__).resolve().parents[2]
+    all_candidates.append(
+        package_hooks_parent.joinpath(*ALL_SKILL_SCRIPTS_RELATIVE_PARTS)
+    )
+    all_candidates.append(Path.home().joinpath(*ALL_HOME_SKILLS_RELATIVE_PARTS))
+    return all_candidates
+
+
+def _load_status_gate_module() -> ModuleType | None:
+    """Import status_gate from the skill scripts package.
+
+    Returns:
+        The loaded module, or None when no candidate path is usable.
+    """
+    for each_directory in _candidate_skill_script_directories():
+        module_path = each_directory / "status_gate.py"
+        if not module_path.is_file():
+            continue
+        scripts_directory = str(each_directory)
+        if scripts_directory not in sys.path:
+            sys.path.insert(0, scripts_directory)
+        spec = importlib.util.spec_from_file_location(
+            "orchestrator_status_gate_for_reschedule_hook",
+            module_path,
+        )
+        if spec is None or spec.loader is None:
+            continue
+        status_gate_module = importlib.util.module_from_spec(spec)
+        sys.modules[spec.name] = status_gate_module
+        spec.loader.exec_module(status_gate_module)
+        return status_gate_module
+    return None
+
+
+def _prompt_targets_orchestrator_refresh(
+    all_tool_input: Mapping[str, object],
+) -> bool:
+    """Return True when the schedule prompt re-enters orchestrator-refresh.
+
+    Args:
+        all_tool_input: PreToolUse tool_input mapping.
+
+    Returns:
+        True when the prompt field contains the refresh skill token.
+    """
+    prompt_value = all_tool_input.get(PROMPT_FIELD_NAME, "")
+    if not isinstance(prompt_value, str):
+        return False
+    stripped_prompt = prompt_value.lstrip()
+    if not stripped_prompt.startswith(ORCHESTRATOR_REFRESH_PROMPT_TOKEN):
+        return False
+    if len(stripped_prompt) == len(ORCHESTRATOR_REFRESH_PROMPT_TOKEN):
+        return True
+    return stripped_prompt[len(ORCHESTRATOR_REFRESH_PROMPT_TOKEN)] in (" ", "\n", "\t")
+
+
+def _should_evaluate(all_payload_by_field: Mapping[str, object]) -> bool:
+    """Return True for schedule tools re-arming orchestrator-refresh.
+
+    Args:
+        all_payload_by_field: Full PreToolUse payload.
+
+    Returns:
+        True when this gate must run.
+    """
+    tool_name = all_payload_by_field.get(TOOL_NAME_FIELD_NAME, "")
+    if tool_name not in ALL_SCHEDULE_TOOL_NAMES:
+        return False
+    tool_input = all_payload_by_field.get(TOOL_INPUT_FIELD_NAME, {})
+    if not isinstance(tool_input, dict):
+        return False
+    return _prompt_targets_orchestrator_refresh(tool_input)
+
+
+def _run_slug_from_prompt(prompt_value: str) -> str:
+    """Extract ``--run-slug`` from a ScheduleWakeup prompt when present.
+
+    Args:
+        prompt_value: The schedule tool prompt text.
+
+    Returns:
+        The slug string, or empty when the flag is absent.
+    """
+    run_slug_from_prompt_pattern = re.compile(
+        re.escape(RUN_SLUG_PROMPT_FLAG) + RUN_SLUG_PROMPT_VALUE_PATTERN
+    )
+    matched = run_slug_from_prompt_pattern.search(prompt_value)
+    if matched is None:
+        return ""
+    return matched.group(1)
+
+
+def _resolve_status_file_path(
+    status_gate_module: ModuleType,
+    all_payload_by_field: Mapping[str, object],
+) -> Path:
+    """Resolve the run status file for this schedule attempt without chdir.
+
+    Args:
+        status_gate_module: Loaded status_gate module.
+        all_payload_by_field: PreToolUse payload (may carry cwd and prompt).
+
+    Returns:
+        Absolute status file path.
+    """
+    base_directory: Path | None = None
+    working_directory_value = all_payload_by_field.get(CWD_FIELD_NAME)
+    if isinstance(working_directory_value, str) and working_directory_value:
+        base_directory = Path(working_directory_value)
+    run_slug = ""
+    tool_input = all_payload_by_field.get(TOOL_INPUT_FIELD_NAME, {})
+    if isinstance(tool_input, dict):
+        prompt_value = tool_input.get(PROMPT_FIELD_NAME, "")
+        if isinstance(prompt_value, str):
+            run_slug = _run_slug_from_prompt(prompt_value)
+    return status_gate_module.resolve_status_file_path(
+        None, base_directory, run_slug
+    )
+
+
+def build_denial_response(reason_code: str) -> dict[str, dict[str, str]]:
+    """Build the PreToolUse deny payload.
+
+    Args:
+        reason_code: Machine reason from decide_should_reschedule.
+
+    Returns:
+        Hook-specific deny JSON structure.
+    """
+    denial_reason = DENY_REASON_TEMPLATE.format(reason=reason_code)
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": HOOK_EVENT_NAME,
+            "permissionDecision": "deny",
+            "permissionDecisionReason": denial_reason,
+        }
+    }
+
+
+def _emit_denial(
+    reason_code: str,
+    all_payload_by_field: Mapping[str, object],
+) -> None:
+    """Log and print a deny decision for the current schedule attempt.
+
+    Args:
+        reason_code: Machine reason string.
+        all_payload_by_field: PreToolUse payload for logging context.
+    """
+    denial = build_denial_response(reason_code)
+    hook_specific_output = denial["hookSpecificOutput"]
+    block_reason = hook_specific_output["permissionDecisionReason"]
+    log_hook_block(
+        calling_hook_name=CALLING_HOOK_NAME,
+        hook_event=HOOK_EVENT_NAME,
+        block_reason=block_reason,
+        tool_name=str(all_payload_by_field.get(TOOL_NAME_FIELD_NAME, "")),
+        offending_input_preview=str(
+            all_payload_by_field.get(TOOL_INPUT_FIELD_NAME, {})
+        ),
+    )
+    print(json.dumps(denial))
+
+
+def main() -> None:
+    """Read PreToolUse stdin and deny idle orchestrator-refresh re-arms."""
+    try:
+        payload_by_field = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        sys.exit(0)
+
+    if not isinstance(payload_by_field, dict):
+        sys.exit(0)
+    if not _should_evaluate(payload_by_field):
+        sys.exit(0)
+
+    tool_name = payload_by_field.get(TOOL_NAME_FIELD_NAME, "")
+    if tool_name == CRON_CREATE_TOOL_NAME:
+        _emit_denial(REASON_CRON_CREATE_FORBIDDEN, payload_by_field)
+        sys.exit(0)
+
+    status_gate_module = _load_status_gate_module()
+    if status_gate_module is None:
+        _emit_denial("status_gate_unavailable", payload_by_field)
+        sys.exit(0)
+
+    status_file_path = _resolve_status_file_path(status_gate_module, payload_by_field)
+    is_reschedule_allowed, reason_code = status_gate_module.decide_should_reschedule(
+        status_file_path
+    )
+    if is_reschedule_allowed:
+        sys.exit(0)
+
+    _emit_denial(reason_code, payload_by_field)
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/pre_tool_use_dispatcher.py

@@ -7,10 +7,10 @@ declared in the constants module, aggregates the results, and emits one deny
 decision when any hook denied (carrying every denying reason) or exits zero to
 allow.
 
-The per-hook coverage matrix:
-- Write  -> 20 hooks from ALL_HOSTED_HOOK_ENTRIES that list Write
-- Edit   -> 21 hooks from ALL_HOSTED_HOOK_ENTRIES that list Edit
-- MultiEdit -> 9 hooks from ALL_HOSTED_HOOK_ENTRIES that list MultiEdit
+Each tool runs the ``ALL_HOSTED_HOOK_ENTRIES`` whose ``applicable_tool_names``
+list that tool; that roster is the live source of the per-tool coverage, and the
+dispatcher roster tests in ``test_pre_tool_use_dispatcher.py`` assert the counts,
+rather than a hardcoded matrix here that would drift as hooks are added.
 """
 
 from __future__ import annotations
@@ -24,20 +24,18 @@ from collections.abc import Callable
 from dataclasses import dataclass, field
 from pathlib import Path
 
-_hooks_directory = str(Path(__file__).resolve().parent.parent)
-if _hooks_directory not in sys.path:
-    sys.path.insert(0, _hooks_directory)
+import _path_setup  # noqa: F401
 
-from plain_language_blocker import (  # noqa: E402
+from plain_language_blocker import (
     build_deny_payload as build_plain_language_deny_payload,
 )
-from plain_language_blocker import evaluate as evaluate_plain_language  # noqa: E402
-from state_description_blocker import (  # noqa: E402
+from plain_language_blocker import evaluate as evaluate_plain_language
+from state_description_blocker import (
     build_deny_payload as build_state_description_deny_payload,
 )
-from state_description_blocker import evaluate as evaluate_state_description  # noqa: E402
+from state_description_blocker import evaluate as evaluate_state_description
 
-from hooks_constants.pre_tool_use_dispatcher_constants import (  # noqa: E402
+from hooks_constants.pre_tool_use_dispatcher_constants import (
     ALL_HOSTED_HOOK_ENTRIES,
     ALLOW_DECISION,
     BLOCKING_CRASH_DENY_REASON,
@@ -49,7 +47,7 @@ from hooks_constants.pre_tool_use_dispatcher_constants import (  # noqa: E402
     STATE_DESCRIPTION_BLOCKER_MODULE_NAME,
     HostedHookEntry,
 )
-from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
 
 NativeEvaluator = Callable[[dict[str, object]], str | None]
 DenyPayloadBuilder = Callable[[str], dict[str, object]]
@@ -70,6 +68,18 @@ class NativeHook:
     build_deny_payload: DenyPayloadBuilder
 
 
+_native_hook_by_module_name: dict[str, NativeHook] = {
+    STATE_DESCRIPTION_BLOCKER_MODULE_NAME: NativeHook(
+        evaluate=evaluate_state_description,
+        build_deny_payload=build_state_description_deny_payload,
+    ),
+    PLAIN_LANGUAGE_BLOCKER_MODULE_NAME: NativeHook(
+        evaluate=evaluate_plain_language,
+        build_deny_payload=build_plain_language_deny_payload,
+    ),
+}
+
+
 @dataclass
 class HostedHookResult:
     """Outcome of running one hosted hook inside the dispatcher process.
@@ -477,17 +487,7 @@ def _run_one_hosted_hook(
         The HostedHookResult for this hook's run.
     """
     if each_entry.native_module_name is not None:
-        native_hook_by_module_name: dict[str, NativeHook] = {
-            STATE_DESCRIPTION_BLOCKER_MODULE_NAME: NativeHook(
-                evaluate=evaluate_state_description,
-                build_deny_payload=build_state_description_deny_payload,
-            ),
-            PLAIN_LANGUAGE_BLOCKER_MODULE_NAME: NativeHook(
-                evaluate=evaluate_plain_language,
-                build_deny_payload=build_plain_language_deny_payload,
-            ),
-        }
-        native_hook = native_hook_by_module_name[each_entry.native_module_name]
+        native_hook = _native_hook_by_module_name[each_entry.native_module_name]
         return run_native_hook(native_hook, payload_by_key, each_entry.is_blocking)
     script_path = _resolve_hook_script_path(each_entry.script_relative_path)
     return run_hosted_hook(script_path, payload_text, each_entry.is_blocking)

package/hooks/blocking/shell_substitution_blocker.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""PreToolUse hook: block Bash commands containing shell command substitution.
+
+Root cause: Claude Code's auto-allowlist matcher operates on the raw command
+string, not on parsed syntax, so it does not descend into command substitutions
+such as $(...), unescaped backticks, or bash process substitutions <(...) and
+>(...). A compound of the form
+
+    cd X && echo "$(git rev-parse HEAD)"
+
+therefore falls outside the auto-allowed set for `cd` + `echo` + `git rev-parse`
+and forces a permission prompt, even though every segment would be auto-allowed
+individually. The same mechanics apply to `diff <(cat a) <(cat b)` and
+`tee >(gzip > out.gz)`: each inner command would be auto-allowed on its own,
+but the outer wrapper defeats the matcher. Splitting into two separate Bash
+tool calls, or collapsing to a substitution-free form like
+`git -C X rev-parse HEAD`, avoids the prompt.
+
+Detection: a regex match for `$(`, an unescaped backtick, or `<(` / `>(`, after
+stripping single-quoted literal runs. Single-quoted regions are intentionally
+ignored because bash performs no substitution inside them (for example
+`echo '$(not-executed)'`). Backslash-escaped backticks outside single quotes
+are treated as literal only when the count of preceding backslashes is odd;
+an even count (including zero) means the backtick is a live substitution.
+
+Bash arithmetic expansion ``$((...))`` is explicitly NOT blocked: it does not
+spawn a subshell and does not defeat the allowlist matcher, so the
+``$(`` pattern uses a negative lookahead to skip the ``$((`` case.
+
+False positives are still possible when the user is intentionally writing
+shell-script content (for example, authoring a .sh file via heredoc) and the
+substitution is literal payload rather than something to execute. In that
+case, write via the Write tool instead of a Bash heredoc.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+_hooks_dir = str(Path(__file__).resolve().parent.parent)
+if _hooks_dir not in sys.path:
+    sys.path.insert(0, _hooks_dir)
+
+from hooks_constants.shell_substitution_blocker_constants import (  # noqa: E402
+    BASH_TOOL_NAME,
+    COMMAND_KEY,
+    CORRECTIVE_MESSAGE,
+    DENY_DECISION,
+    DOLLAR_PAREN_PATTERN,
+    EVEN_BACKSLASH_BACKTICK_PATTERN,
+    HOOK_EVENT_NAME,
+    HOOK_EVENT_NAME_KEY,
+    HOOK_SPECIFIC_OUTPUT_KEY,
+    PERMISSION_DECISION_KEY,
+    PERMISSION_DECISION_REASON_KEY,
+    PROCESS_SUBSTITUTION_PATTERN,
+    SINGLE_QUOTED_RUN_PATTERN,
+    STRIPPED_RUN_REPLACEMENT,
+    TOOL_INPUT_KEY,
+    TOOL_NAME_KEY,
+)
+
+
+def _strip_single_quoted_runs(command: str) -> str:
+    return SINGLE_QUOTED_RUN_PATTERN.sub(STRIPPED_RUN_REPLACEMENT, command)
+
+
+def has_shell_substitution(command: str) -> bool:
+    """Return True when a Bash command carries a live shell substitution.
+
+    ::
+
+        echo "$(git rev-parse HEAD)"   flag: command substitution
+        echo `date`                    flag: live backtick
+        diff <(cat a) <(cat b)         flag: process substitution
+        echo '$(not-executed)'         ok:   single-quoted, inert
+        echo $((2 + 2))                ok:   arithmetic expansion
+
+    Single-quoted runs are stripped first because bash substitutes nothing
+    inside them. A backtick preceded by an odd number of backslashes is escaped
+    and stays allowed.
+
+    Args:
+        command: The raw Bash command string from the tool input.
+
+    Returns:
+        True when a substitution the allowlist matcher cannot descend into is
+        present outside single quotes.
+    """
+    scannable_command = _strip_single_quoted_runs(command)
+    if DOLLAR_PAREN_PATTERN.search(scannable_command):
+        return True
+    if EVEN_BACKSLASH_BACKTICK_PATTERN.search(scannable_command):
+        return True
+    if PROCESS_SUBSTITUTION_PATTERN.search(scannable_command):
+        return True
+    return False
+
+
+def main() -> None:
+    try:
+        hook_input = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        sys.exit(0)
+
+    tool_name = hook_input.get(TOOL_NAME_KEY, "")
+    if tool_name != BASH_TOOL_NAME:
+        sys.exit(0)
+
+    command = hook_input.get(TOOL_INPUT_KEY, {}).get(COMMAND_KEY, "")
+    if not command or not has_shell_substitution(command):
+        sys.exit(0)
+
+    deny_payload = {
+        HOOK_SPECIFIC_OUTPUT_KEY: {
+            HOOK_EVENT_NAME_KEY: HOOK_EVENT_NAME,
+            PERMISSION_DECISION_KEY: DENY_DECISION,
+            PERMISSION_DECISION_REASON_KEY: CORRECTIVE_MESSAGE,
+        }
+    }
+    print(json.dumps(deny_payload))
+    sys.stdout.flush()
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/hooks/blocking/state_description_blocker.py

@@ -345,7 +345,7 @@ def build_deny_payload(deny_reason: str) -> dict[str, object]:
                 "only the current state. For example:\n"
                 '  BAD: "Uses X instead of Y"  →  GOOD: "Uses X"\n'
                 '  BAD: "Previously configured via Z"  →  GOOD: "Configured via Z"\n'
-                "See ~/.claude/rules/no-historical-clutter.md for full rules."
+                "See ~/.claude/rules/doc-prose-cuts.md for full rules."
             ),
         },
         "systemMessage": "Agent wrote comparative/historical language - describe current state only",

package/hooks/blocking/stop_dispatcher.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Stop-hook dispatcher that hosts the five Stop-chain hooks in one process.
+"""Stop-hook dispatcher that hosts the six Stop-chain hooks in one process.
 
 Reads the Stop payload from stdin once, runs each hosted hook in registration
 order via the shared hosted-hook runner, and emits the first block decision the

package/hooks/blocking/test_bash_pre_tool_use_dispatcher.py

@@ -212,16 +212,15 @@ def test_additional_context_is_collected_from_deciding_hooks() -> None:
     assert aggregated.all_additional_context == ["see docs/runbook.md"]
 
 
-def test_powershell_selects_the_three_shared_hooks() -> None:
+def test_powershell_selects_the_shared_hooks_in_registration_order() -> None:
     """Selecting for PowerShell yields the shared hooks in registration order."""
     powershell_paths = [
         each_entry.script_relative_path
         for each_entry in select_applicable_entries(POWERSHELL_TOOL_NAME)
     ]
     assert powershell_paths == [
+        "blocking/unscoped_search_blocker.py",
         "blocking/pii_prevention_blocker.py",
-        "blocking/verified_commit_gate.py",
-        "blocking/verdict_directory_write_blocker.py",
         "blocking/code_review_push_gate.py",
         "blocking/code_review_pr_create_gate.py",
         "blocking/code_review_stamp_directory_write_blocker.py",

package/hooks/blocking/test_code_review_pr_create_gate.py

@@ -43,6 +43,12 @@ store_module = _load_module("code_review_stamp_store")
 deny_module = _load_module("code_review_gate_deny")
 
 
+@pytest.fixture(autouse=True)
+def enable_code_review_enforcement(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Behavior tests exercise the gates with enforcement on."""
+    monkeypatch.setattr(gate_module, "CODE_REVIEW_ENFORCEMENT_ENABLED", True)
+
+
 def _run_git(repository_directory: Path, *git_arguments: str) -> None:
     subprocess.run(
         ["git", "-C", str(repository_directory), *git_arguments],
@@ -183,3 +189,11 @@ def test_build_deny_payload_shape() -> None:
     deny_payload = deny_module.build_code_review_deny_payload("blocked reason")
     assert deny_payload["hookSpecificOutput"]["permissionDecision"] == "deny"
     assert deny_payload["hookSpecificOutput"]["permissionDecisionReason"] == "blocked reason"
+
+
+def test_enforcement_off_allows_pr_create_without_stamp(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setattr(gate_module, "CODE_REVIEW_ENFORCEMENT_ENABLED", False)
+    work_directory = _prepared_repo(monkeypatch, tmp_path)
+    assert gate_module.deny_reason_for_directory(str(work_directory)) is None

package/hooks/blocking/test_code_review_push_gate.py

@@ -46,6 +46,12 @@ gate_module = _load_module("code_review_push_gate")
 store_module = _load_module("code_review_stamp_store")
 
 
+@pytest.fixture(autouse=True)
+def enable_code_review_enforcement(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Behavior tests exercise the gates with enforcement on."""
+    monkeypatch.setattr(gate_module, "CODE_REVIEW_ENFORCEMENT_ENABLED", True)
+
+
 def _run_git(repository_directory: Path, *git_arguments: str) -> None:
     subprocess.run(
         ["git", "-C", str(repository_directory), *git_arguments],
@@ -187,3 +193,13 @@ def test_code_review_skip_marker_allows_push(
     work_directory = _prepared_code_repo(monkeypatch, tmp_path)
     emitted = _run_main(monkeypatch, f"git push origin main {BYPASS_MARKER}", work_directory)
     assert emitted == ""
+
+
+def test_enforcement_off_allows_push_without_stamp(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setattr(gate_module, "CODE_REVIEW_ENFORCEMENT_ENABLED", False)
+    work_directory = _prepared_code_repo(monkeypatch, tmp_path)
+    assert gate_module.deny_reason_for_directory(str(work_directory)) is None
+    emitted = _run_main(monkeypatch, "git push origin main", work_directory)
+    assert emitted == ""

package/hooks/blocking/test_code_review_stamp_directory_write_blocker.py

@@ -53,6 +53,12 @@ def _load_module(module_name: str) -> ModuleType:
 blocker_module = _load_module("code_review_stamp_directory_write_blocker")
 
 
+@pytest.fixture(autouse=True)
+def enable_code_review_enforcement(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Behavior tests exercise the write-blocker with enforcement on."""
+    monkeypatch.setattr(blocker_module, "CODE_REVIEW_ENFORCEMENT_ENABLED", True)
+
+
 def _isolate_home(monkeypatch: pytest.MonkeyPatch, fake_home: Path) -> None:
     home_text = str(fake_home)
     monkeypatch.setenv("HOME", home_text)
@@ -178,3 +184,16 @@ def test_chr_chain_obfuscated_stamp_path_is_blocked() -> None:
 
 def test_benign_decode_to_other_path_is_not_blocked() -> None:
     assert not blocker_module.references_stamp_directory(_hex_forge(BENIGN_OBFUSCATION_PATH))
+
+
+def test_enforcement_off_allows_stamp_directory_access(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(blocker_module, "CODE_REVIEW_ENFORCEMENT_ENABLED", False)
+    decision = blocker_module.decision_for_payload(
+        {
+            "tool_name": "Bash",
+            "tool_input": {"command": "rm -rf ~/.claude/code-review-stamps"},
+        }
+    )
+    assert decision is None