claude-dev-env 7.0.0 → 7.2.0

package/hooks/blocking/test_session_edit_stage_gate.py

@@ -1,537 +0,0 @@
-"""Behavior tests for the session_edit_stage_gate PreToolUse hook.
-
-Each test builds a real git repository in a temporary directory, records a
-session-edit set in a redirected temp directory, and runs the hook script as a
-subprocess with a PreToolUse JSON payload on stdin — the exact production
-invocation path. Environment overrides point ``tempfile.gettempdir`` at the
-per-test temp directory (so the hook reads the test's session-edit file) and
-point the home directory at a per-test directory (so the block log stays out of
-the real home).
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-_HOOK_DIR = Path(__file__).resolve().parent
-_HOOKS_TREE = _HOOK_DIR.parent
-for each_path in (str(_HOOKS_TREE),):
-    if each_path not in sys.path:
-        sys.path.insert(0, each_path)
-
-from hooks_constants.session_edit_stage_gate_constants import (  # noqa: E402
-    ALL_EDITED_FILE_PATHS_KEY,
-    SESSION_EDIT_FILE_PREFIX,
-    SESSION_EDIT_FILE_SUFFIX,
-)
-
-HOOK_PATH = _HOOK_DIR / "session_edit_stage_gate.py"
-_SESSION_ID = "gate-session-1"
-
-
-def _clean_git_environment() -> dict[str, str]:
-    return {
-        each_key: each_value
-        for each_key, each_value in os.environ.items()
-        if not each_key.startswith("GIT_")
-    }
-
-
-def run_git(repository_root: Path, *git_arguments: str) -> None:
-    subprocess.run(
-        ["git", "-C", str(repository_root), *git_arguments],
-        check=True,
-        capture_output=True,
-        env=_clean_git_environment(),
-    )
-
-
-def initialize_repository(repository_root: Path) -> None:
-    run_git(repository_root, "init")
-    run_git(repository_root, "config", "user.email", "tests@example.com")
-    run_git(repository_root, "config", "user.name", "Gate Tests")
-
-
-def prepare_repository_with_unstaged_edit(repository_root: Path) -> Path:
-    initialize_repository(repository_root)
-    tracked_file = repository_root / "widget.py"
-    tracked_file.write_text("x = 1\n", encoding="utf-8")
-    run_git(repository_root, "add", "widget.py")
-    run_git(repository_root, "commit", "-m", "add widget")
-    tracked_file.write_text("x = 2\n", encoding="utf-8")
-    return tracked_file
-
-
-def write_session_edits(temp_directory: Path, session_id: str, absolute_paths: list[Path]) -> None:
-    edit_file = temp_directory / f"{SESSION_EDIT_FILE_PREFIX}{session_id}{SESSION_EDIT_FILE_SUFFIX}"
-    payload = {ALL_EDITED_FILE_PATHS_KEY: [str(each_path) for each_path in absolute_paths]}
-    edit_file.write_text(json.dumps(payload), encoding="utf-8")
-
-
-def run_hook(
-    command: str,
-    session_id: str,
-    cwd: Path,
-    temp_directory: Path,
-    home_directory: Path,
-) -> subprocess.CompletedProcess[str]:
-    environment = _clean_git_environment()
-    environment["TMP"] = str(temp_directory)
-    environment["TEMP"] = str(temp_directory)
-    environment["TMPDIR"] = str(temp_directory)
-    environment["USERPROFILE"] = str(home_directory)
-    environment["HOME"] = str(home_directory)
-    payload = json.dumps({"session_id": session_id, "tool_input": {"command": command}})
-    return subprocess.run(
-        [sys.executable, str(HOOK_PATH)],
-        check=False,
-        input=payload,
-        capture_output=True,
-        text=True,
-        cwd=str(cwd),
-        env=environment,
-        timeout=60,
-    )
-
-
-def _make_directories(tmp_path: Path) -> tuple[Path, Path, Path]:
-    repository_root = tmp_path / "repo"
-    repository_root.mkdir()
-    temp_directory = tmp_path / "tmp"
-    temp_directory.mkdir()
-    home_directory = tmp_path / "home"
-    home_directory.mkdir()
-    return repository_root, temp_directory, home_directory
-
-
-def parse_denial(hook_stdout: str) -> dict:
-    return json.loads(hook_stdout)["hookSpecificOutput"]
-
-
-def test_denies_commit_dropping_session_edited_unstaged_file(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_deny_writes_hook_block_log(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    run_hook("git commit -m update", _SESSION_ID, repository_root, temp_directory, home_directory)
-    logs_directory = home_directory / ".claude" / "logs"
-    all_log_files = list(logs_directory.glob("*.log"))
-    assert all_log_files
-    all_log_text = "".join(each_file.read_text(encoding="utf-8") for each_file in all_log_files)
-    assert "session_edit_stage_gate.py" in all_log_text
-
-
-def test_allows_commit_when_session_edited_file_is_staged(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    run_git(repository_root, "add", "widget.py")
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_commit_all_flag(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -a -m update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_non_commit_command_containing_git_commit_substring(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        'grep -rn "git commit" .',
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_all_flag_commit_after_bare_commit_token_segment(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "echo commit && git commit -a -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_non_git_command_with_git_and_commit_as_arguments(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "echo git commit",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_denies_commit_with_leading_environment_assignment(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "GIT_AUTHOR_NAME=x git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_denies_commit_with_no_space_message_containing_letter_a(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        'git commit -m"add feature"',
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_denies_commit_with_no_space_message_option_form(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -mupdate", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_allows_clustered_all_and_message_flags(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -am update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_commit_when_add_stages_in_same_command(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git add widget.py && git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_commit_when_git_dash_c_add_stages_in_same_command(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        f'git -C "{repository_root}" add widget.py && git commit -m update',
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_denies_commit_when_specific_add_leaves_session_edit_unstaged(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    readme_file = repository_root / "README.md"
-    readme_file.write_text("readme\n", encoding="utf-8")
-    run_git(repository_root, "add", "README.md")
-    run_git(repository_root, "commit", "-m", "add readme")
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git add README.md && git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_allows_commit_when_stage_all_add_precedes(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git add -A && git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_commit_when_dash_named_path_staged_after_end_of_options(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    initialize_repository(repository_root)
-    tracked_file = repository_root / "-weird.py"
-    tracked_file.write_text("x = 1\n", encoding="utf-8")
-    run_git(repository_root, "add", "--", "-weird.py")
-    run_git(repository_root, "commit", "-m", "add weird")
-    tracked_file.write_text("x = 2\n", encoding="utf-8")
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git add -- -weird.py && git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_denies_when_dash_a_filename_staged_after_end_of_options(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    dash_a_file = repository_root / "-A"
-    dash_a_file.write_text("a\n", encoding="utf-8")
-    run_git(repository_root, "add", "--", "-A")
-    run_git(repository_root, "commit", "-m", "add dash-a file")
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git add -- -A && git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_denies_commit_when_add_runs_after_commit_segment(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update ; git add widget.py",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_allows_pathspec_commit(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update widget.py",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_partial_commit_marker(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update # partial-commit",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_denies_when_marker_not_trailing(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "echo # partial-commit && git commit -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_denies_when_marker_only_inside_commit_message(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        'git commit -m "fix # partial-commit substring handling"',
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]
-
-
-def test_denies_commit_dropping_non_ascii_named_file(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    initialize_repository(repository_root)
-    tracked_file = repository_root / "café.py"
-    tracked_file.write_text("x = 1\n", encoding="utf-8")
-    run_git(repository_root, "add", "café.py")
-    run_git(repository_root, "commit", "-m", "add cafe")
-    tracked_file.write_text("x = 2\n", encoding="utf-8")
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "café.py" in denial["permissionDecisionReason"]
-
-
-def test_allows_amend_still_gates(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git commit --amend -m update",
-        _SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-
-
-def test_allows_when_no_tracker_file(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    prepare_repository_with_unstaged_edit(repository_root)
-    completed_hook = run_hook(
-        "git commit -m update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_non_commit_command(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    completed_hook = run_hook(
-        "git status", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_allows_when_unstaged_file_not_session_edited(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    prepare_repository_with_unstaged_edit(repository_root)
-    unrelated_path = repository_root / "unrelated.py"
-    write_session_edits(temp_directory, _SESSION_ID, [unrelated_path.resolve()])
-    completed_hook = run_hook(
-        "git commit -m update", _SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert completed_hook.returncode == 0
-    assert completed_hook.stdout.strip() == ""
-
-
-def test_git_dash_c_form_resolves_repository(tmp_path: Path) -> None:
-    repository_root, temp_directory, home_directory = _make_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    write_session_edits(temp_directory, _SESSION_ID, [tracked_file.resolve()])
-    elsewhere = tmp_path / "elsewhere"
-    elsewhere.mkdir()
-    completed_hook = run_hook(
-        f'git -C "{repository_root}" commit -m update',
-        _SESSION_ID,
-        elsewhere,
-        temp_directory,
-        home_directory,
-    )
-    assert completed_hook.returncode == 0
-    denial = parse_denial(completed_hook.stdout)
-    assert denial["permissionDecision"] == "deny"
-    assert "widget.py" in denial["permissionDecisionReason"]

package/hooks/blocking/test_session_edit_stage_gate_staging.py

@@ -1,64 +0,0 @@
-"""Production-path staging tests for the session-edit stage gate."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-_TEST_DIRECTORY = Path(__file__).resolve().parent
-if str(_TEST_DIRECTORY) not in sys.path:
-    sys.path.insert(0, str(_TEST_DIRECTORY))
-
-from test_session_edit_stage_gate_support import (  # noqa: E402
-    make_test_directories,
-    parse_dispatcher_decision,
-    prepare_repository_with_unstaged_edit,
-    run_bash_dispatcher,
-    run_tracker_event,
-    read_tracker_paths,
-)
-
-SESSION_ID = "staging-production-session"
-
-
-def test_dispatcher_denies_tracker_recorded_unstaged_edit(tmp_path: Path) -> None:
-    """The Bash dispatcher denies a commit for a tracker-recorded edit."""
-    repository_root, temp_directory, home_directory = make_test_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    tracker_run = run_tracker_event(
-        tracked_file, SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert tracker_run.returncode == 0
-    assert read_tracker_paths(temp_directory, SESSION_ID) == [str(tracked_file.resolve())]
-
-    dispatcher_run = run_bash_dispatcher(
-        "git commit -m update",
-        SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert dispatcher_run.returncode == 0
-    decision, reason = parse_dispatcher_decision(dispatcher_run.stdout)
-    assert decision == "deny"
-    assert "widget.py" in reason
-
-
-def test_dispatcher_allows_specific_staging_segment(tmp_path: Path) -> None:
-    """The Bash dispatcher accepts a commit preceded by a specific git add."""
-    repository_root, temp_directory, home_directory = make_test_directories(tmp_path)
-    tracked_file = prepare_repository_with_unstaged_edit(repository_root)
-    tracker_run = run_tracker_event(
-        tracked_file, SESSION_ID, repository_root, temp_directory, home_directory
-    )
-    assert tracker_run.returncode == 0
-
-    dispatcher_run = run_bash_dispatcher(
-        "git add widget.py && git commit -m update",
-        SESSION_ID,
-        repository_root,
-        temp_directory,
-        home_directory,
-    )
-    assert dispatcher_run.returncode == 0
-    assert parse_dispatcher_decision(dispatcher_run.stdout) == ("", "")