claude-dev-env 8.3.0 → 8.4.1

package/scripts/windows/pstack/pstack-command-shim.ps1

@@ -0,0 +1,41 @@
+$command = $args[0]
+$commandArguments = @($args | Select-Object -Skip 1)
+
+if (@("watch-pr", "ship-pr") -notcontains $command) {
+  Write-Error "The command must be watch-pr or ship-pr"
+  exit 1
+}
+
+$codexHome = if ([string]::IsNullOrWhiteSpace($env:CODEX_HOME)) {
+  Join-Path $env:USERPROFILE ".codex"
+} else {
+  $env:CODEX_HOME
+}
+$cacheRoot = Join-Path $codexHome "plugins\cache\pstack-claude\pstack"
+$pluginRoot = Get-ChildItem -LiteralPath $cacheRoot -Directory -ErrorAction SilentlyContinue |
+  Where-Object { $_.Name -match "^\d+\.\d+\.\d+$" } |
+  Sort-Object { [version]$_.Name } -Descending |
+  Select-Object -First 1
+
+if ($null -eq $pluginRoot) {
+  Write-Error "No installed pstack-claude version was found under $cacheRoot"
+  exit 1
+}
+
+$entrypoint = Join-Path $pluginRoot.FullName "skills\poteto-mode\scripts\watch-pr\$command"
+if (-not (Test-Path -LiteralPath $entrypoint -PathType Leaf)) {
+  Write-Error "The pstack entrypoint was not found: $entrypoint"
+  exit 1
+}
+
+$scriptsRoot = Split-Path -Parent (Split-Path -Parent $entrypoint)
+$exitCode = 1
+Push-Location $scriptsRoot
+try {
+  & bun $entrypoint @commandArguments
+  $exitCode = $LASTEXITCODE
+}
+finally {
+  Pop-Location
+}
+exit $exitCode

package/scripts/windows/pstack/ship-pr.cmd

@@ -0,0 +1,3 @@
+@echo off
+pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%~dp0pstack-command-shim.ps1" ship-pr %*
+exit /b %ERRORLEVEL%

package/scripts/windows/pstack/watch-pr.cmd

@@ -0,0 +1,3 @@
+@echo off
+pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%~dp0pstack-command-shim.ps1" watch-pr %*
+exit /b %ERRORLEVEL%

package/hooks/blocking/pii_payload_scan.py

@@ -1,348 +0,0 @@
-#!/usr/bin/env python3
-"""Scan Write/Edit payloads and durable post bodies for high-confidence PII.
-
-Reused by ``pii_prevention_blocker``: ``build_deny_reason`` composes the deny
-message, and ``evaluate_write_edit_payload`` / ``evaluate_post_body_texts`` judge
-new file content and durable GitHub post bodies against the pure scanners in
-``pii_scanner``.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-try:
-    _blocking_directory = str(Path(__file__).resolve().parent)
-    _hooks_directory = str(Path(__file__).resolve().parent.parent)
-    for each_bootstrap_directory in (_blocking_directory, _hooks_directory):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-    from code_rules_shared import is_ephemeral_path
-    from codex_apply_patch import (
-        CodexPatchError,
-        parse_codex_apply_patch,
-        payload_patch_command,
-    )
-    from pii_prevention_blocker_parts.repository_exemption import (
-        repository_allowlisted_values,
-    )
-    from pii_scanner import (
-        PiiFinding,
-        is_path_exempt_from_pii_scan,
-        scan_text_for_pii,
-    )
-    from precommit_code_rules_gate import resolve_repository_root
-
-    from hooks_constants.local_identity import pii_allowlisted_values_by_repository
-    from hooks_constants.multi_edit_reconstruction import edits_for_tool
-    from hooks_constants.pii_prevention_constants import (
-        ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES,
-        CORRECTIVE_MESSAGE_FOOTER,
-        CORRECTIVE_MESSAGE_HEADER,
-        EDIT_TOOL_NAME,
-        FINDING_LINE_TEMPLATE,
-        MESSAGE_LINE_SEPARATOR,
-        MULTI_EDIT_TOOL_NAME,
-        WRITE_TOOL_NAME,
-    )
-except ImportError as import_error:
-    raise ImportError(
-        "pii_payload_scan: cannot import its sibling modules; "
-        "ensure the blocking and hooks directories are importable."
-    ) from import_error
-
-
-def _apply_patch_post_contents(
-    command: str, working_directory: str | None
-) -> list[tuple[str, str]]:
-    """Return (file_path, post_content) pairs for a Codex apply_patch command."""
-    if not command:
-        return []
-    try:
-        all_patch_files = parse_codex_apply_patch(command, working_directory)
-    except CodexPatchError:
-        return []
-    return [
-        (each_patch_file.file_path, each_patch_file.post_content)
-        for each_patch_file in all_patch_files
-        if each_patch_file.post_content
-    ]
-
-
-def _apply_patch_target_deny_reason(
-    each_file_path: str,
-    each_post_content: str,
-    hook_payload: dict | None,
-) -> str | None:
-    """Return the deny reason for one apply_patch target, or None when it is clean or exempt."""
-    if is_path_exempt_from_pii_scan(each_file_path):
-        return None
-    if _target_is_ephemeral_outside_repository(each_file_path, hook_payload):
-        return None
-    return _write_deny_reason_for_texts([each_post_content], each_file_path, frozenset())
-
-
-def evaluate_apply_patch_payload(
-    all_tool_input: dict[str, object],
-    hook_payload: dict | None = None,
-) -> str | None:
-    """Return a deny reason when a Codex apply_patch payload's post content carries PII.
-
-    Args:
-        all_tool_input: The apply_patch payload's ``command`` and other input fields.
-        hook_payload: The PreToolUse payload carrying ``cwd`` and the session id.
-
-    Returns:
-        Deny reason text for the first target carrying non-allowlisted PII, or
-        None when every target is clean or out of scope.
-    """
-    command, working_directory = payload_patch_command(hook_payload, all_tool_input)
-    for each_file_path, each_post_content in _apply_patch_post_contents(
-        command, working_directory
-    ):
-        deny_reason = _apply_patch_target_deny_reason(
-            each_file_path, each_post_content, hook_payload
-        )
-        if deny_reason is not None:
-            return deny_reason
-    return None
-
-
-def _target_is_ephemeral_outside_repository(
-    file_path: str, hook_payload: dict | None
-) -> bool:
-    """Report whether a write target is a throwaway draft outside every repo.
-
-    ::
-
-        ephemeral path, no repo tree  ->  True   (write scan skipped)
-        ephemeral path inside a repo  ->  False  (write scan kept)
-        ordinary path                 ->  False  (write scan kept)
-
-    A draft under the harness scratchpad or an ephemeral scratch root turns
-    durable only through a surface that keeps its own scan, so scanning it at
-    write time is a false positive. A draft that resolves inside a git tree
-    still carries that repository's own allowlist, so the scan stays.
-
-    Args:
-        file_path: The write target path to classify.
-        hook_payload: The PreToolUse payload carrying the session id, or None to
-            read the session id from the environment alone.
-
-    Returns:
-        True only when the path is ephemeral and no enclosing git repository
-        resolves.
-    """
-    if not file_path:
-        return False
-    if not is_ephemeral_path(file_path, hook_payload):
-        return False
-    resolution_directory = _existing_ancestor_directory(file_path)
-    if resolution_directory is None:
-        return True
-    return resolve_repository_root(resolution_directory) is None
-
-
-def build_deny_reason(all_findings: list[PiiFinding], gate_surface: str) -> str:
-    """Return the deny message listing each finding for *gate_surface*.
-
-    Args:
-        all_findings: Findings returned by ``scan_text_for_pii``.
-        gate_surface: Human-readable surface (write, post body, staged commit).
-
-    Returns:
-        Multi-line deny reason for ``permissionDecisionReason``.
-    """
-    all_lines = [
-        CORRECTIVE_MESSAGE_HEADER,
-        f"Surface: {gate_surface}",
-    ]
-    for each_finding in all_findings:
-        all_lines.append(
-            FINDING_LINE_TEMPLATE.format(
-                category=each_finding.category,
-                preview=each_finding.preview,
-            )
-        )
-    all_lines.append(CORRECTIVE_MESSAGE_FOOTER)
-    message_line_separator = MESSAGE_LINE_SEPARATOR
-    return message_line_separator.join(all_lines)
-
-
-def _new_strings_from_edits(
-    tool_name: str, all_tool_input: dict[str, object]
-) -> list[str]:
-    """Return each non-empty ``new_string`` from an Edit/MultiEdit payload."""
-    all_texts: list[str] = []
-    for each_edit in edits_for_tool(tool_name, all_tool_input):
-        if not isinstance(each_edit, dict):
-            continue
-        new_string = each_edit.get("new_string", "")
-        if isinstance(new_string, str) and new_string:
-            all_texts.append(new_string)
-    return all_texts
-
-
-def _collect_write_edit_texts(
-    tool_name: str, all_tool_input: dict[str, object]
-) -> tuple[str, list[str]]:
-    raw_file_path = all_tool_input.get("file_path", "")
-    file_path = raw_file_path if isinstance(raw_file_path, str) else ""
-    if is_path_exempt_from_pii_scan(file_path):
-        return file_path, []
-    if tool_name == WRITE_TOOL_NAME:
-        write_content = all_tool_input.get("content", "")
-        if isinstance(write_content, str) and write_content:
-            return file_path, [write_content]
-        return file_path, []
-    if tool_name in (EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME):
-        return file_path, _new_strings_from_edits(tool_name, all_tool_input)
-    return file_path, []
-
-
-def _findings_after_allowlist(
-    text: str, all_allowlisted_values: frozenset[str]
-) -> list[PiiFinding]:
-    """Return PII findings in *text* whose matched text is not allowlisted."""
-    return [
-        each_finding
-        for each_finding in scan_text_for_pii(text)
-        if each_finding.matched_text not in all_allowlisted_values
-    ]
-
-
-def _first_findings_in_texts(
-    all_texts: list[str], all_allowlisted_values: frozenset[str] = frozenset()
-) -> list[PiiFinding]:
-    for each_text in all_texts:
-        all_findings = _findings_after_allowlist(each_text, all_allowlisted_values)
-        if all_findings:
-            return all_findings
-    return []
-
-
-def _existing_ancestor_directory(file_path: str) -> str | None:
-    """Return the nearest existing ancestor directory of *file_path*, or None.
-
-    PreToolUse runs before Write creates nested parents, so the immediate parent
-    may not exist yet; git resolution needs a directory that is already on disk.
-    """
-    starting_directory = Path(file_path).parent
-    for each_ancestor in (starting_directory, *starting_directory.parents):
-        if each_ancestor.exists():
-            return str(each_ancestor)
-    return None
-
-
-def _write_path_allowlisted_values(file_path: str) -> frozenset[str]:
-    """Return the exact values allowlisted for the repository *file_path* sits in.
-
-    ::
-
-        no path, or no allowlist configured  ->  frozenset()  (no git call)
-        path inside an allowlisted repo tree  ->  that repo's frozenset of values
-
-    Args:
-        file_path: The write target path whose repository keys the allowlist.
-
-    Returns:
-        The exact values the repository allows past the scan, or an empty set.
-    """
-    if not file_path:
-        return frozenset()
-    if not pii_allowlisted_values_by_repository():
-        return frozenset()
-    resolution_directory = _existing_ancestor_directory(file_path)
-    if resolution_directory is None:
-        return frozenset()
-    repository_root = resolve_repository_root(resolution_directory)
-    if repository_root is None:
-        return frozenset()
-    return repository_allowlisted_values(repository_root)
-
-
-def _write_deny_reason_for_texts(
-    all_texts: list[str],
-    file_path: str,
-    all_allowlisted_values: frozenset[str],
-) -> str | None:
-    """Return the deny reason for the first text carrying non-allowlisted PII.
-
-    Repository allowlist resolution runs once, only after a raw PII hit, so a
-    clean payload triggers no git call.
-    """
-    resolved_allowlisted_values: frozenset[str] | None = None
-    for each_text in all_texts:
-        all_raw_findings = scan_text_for_pii(each_text)
-        if not all_raw_findings:
-            continue
-        if resolved_allowlisted_values is None:
-            resolved_allowlisted_values = (
-                all_allowlisted_values | _write_path_allowlisted_values(file_path)
-            )
-        all_findings = [
-            each_finding
-            for each_finding in all_raw_findings
-            if each_finding.matched_text not in resolved_allowlisted_values
-        ]
-        if all_findings:
-            gate_surface = f"file write ({file_path or 'unknown path'})"
-            return build_deny_reason(all_findings, gate_surface)
-    return None
-
-
-def evaluate_write_edit_payload(
-    tool_name: str,
-    all_tool_input: dict[str, object],
-    all_allowlisted_values: frozenset[str] = frozenset(),
-    hook_payload: dict | None = None,
-) -> str | None:
-    """Return a deny reason when Write/Edit/MultiEdit content carries PII.
-
-    A value in the target repository's PII allowlist is dropped from the
-    findings, so a write under that repository's tree may carry it. A draft
-    under an ephemeral scratch root outside every repository is skipped, since
-    it turns durable only through surfaces that keep their own scans.
-
-    Args:
-        tool_name: The intercepted tool name.
-        all_tool_input: The tool input mapping.
-        all_allowlisted_values: Extra exact values allowed past the scan,
-            unioned with the target repository's own allowlist.
-        hook_payload: The PreToolUse payload carrying the session id, threaded
-            to the ephemeral-path predicate; None reads the session id from the
-            environment alone.
-
-    Returns:
-        Deny reason text, or None when the write is clean or out of scope.
-    """
-    if tool_name not in ALL_WRITE_EDIT_MULTI_EDIT_TOOL_NAMES:
-        return None
-    file_path, all_texts = _collect_write_edit_texts(tool_name, all_tool_input)
-    if not all_texts:
-        return None
-    if _target_is_ephemeral_outside_repository(file_path, hook_payload):
-        return None
-    return _write_deny_reason_for_texts(all_texts, file_path, all_allowlisted_values)
-
-
-def evaluate_post_body_texts(
-    all_body_texts: list[str],
-    all_allowlisted_values: frozenset[str] = frozenset(),
-) -> str | None:
-    """Return a deny reason when any durable post body carries PII.
-
-    Args:
-        all_body_texts: Body strings extracted from a gh or MCP post tool.
-        all_allowlisted_values: Exact values the caller's repository allows;
-            a finding matching one is not a finding. Callers that pass
-            nothing keep every post fully scanned.
-
-    Returns:
-        Deny reason text, or None when every body is clean.
-    """
-    all_findings = _first_findings_in_texts(all_body_texts, all_allowlisted_values)
-    if not all_findings:
-        return None
-    return build_deny_reason(all_findings, "durable GitHub post body")

package/hooks/blocking/precommit_code_rules_gate.py

@@ -1,50 +0,0 @@
-"""Library helper that resolves a directory to its Git repository root.
-
-``pii_payload_scan.py`` imports ``resolve_repository_root`` for staged scans.
-This module has no hook entry point. Native ``git-hooks/pre_commit.py`` shows
-the local verification advisory and does not enforce CODE_RULES.
-"""
-
-import subprocess
-import sys
-from pathlib import Path
-
-_hooks_directory = str(Path(__file__).resolve().parent.parent)
-if _hooks_directory not in sys.path:
-    sys.path.insert(0, _hooks_directory)
-
-from hooks_constants.precommit_code_rules_gate_constants import (  # noqa: E402
-    ALL_GIT_REPOSITORY_ROOT_COMMAND,
-    GIT_COMMAND_TIMEOUT_SECONDS,
-)
-
-from hooks_constants.subprocess_window import hidden_window_creation_flags
-
-
-def resolve_repository_root(working_directory: str | None) -> Path | None:
-    """Resolve the Git repository root for a directory.
-
-    Args:
-        working_directory: Directory inside the repository.
-
-    Returns:
-        Repository root. Returns None when Git cannot resolve the directory.
-    """
-    try:
-        completed_process = subprocess.run(
-            list(ALL_GIT_REPOSITORY_ROOT_COMMAND),
-            check=False,
-            capture_output=True,
-            text=True,
-            timeout=GIT_COMMAND_TIMEOUT_SECONDS,
-            cwd=working_directory,
-            creationflags=hidden_window_creation_flags(),
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
-        return None
-    if completed_process.returncode != 0:
-        return None
-    top_level_text = completed_process.stdout.strip()
-    if not top_level_text:
-        return None
-    return Path(top_level_text)

package/hooks/blocking/test_pii_payload_scan.py

@@ -1,231 +0,0 @@
-"""Behavior tests for the Write/Edit payload PII evaluation."""
-
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-_HOOK_DIR = Path(__file__).parent
-_HOOKS_DIR = _HOOK_DIR.parent
-
-try:
-    from pii_payload_scan import (
-        evaluate_apply_patch_payload,
-        evaluate_post_body_texts,
-        evaluate_write_edit_payload,
-    )
-except ImportError:
-    for each_bootstrap_directory in (str(_HOOK_DIR), str(_HOOKS_DIR)):
-        if each_bootstrap_directory not in sys.path:
-            sys.path.insert(0, each_bootstrap_directory)
-    from pii_payload_scan import (
-        evaluate_apply_patch_payload,
-        evaluate_post_body_texts,
-        evaluate_write_edit_payload,
-    )
-
-pytestmark = pytest.mark.usefixtures("ephemeral_exempt_off")
-
-_ALLOW_SLUG = "AllowOwner/allow-repo"
-_OTHER_SLUG = "OtherOwner/other-repo"
-
-
-def test_post_body_with_pii_is_blocked_by_default() -> None:
-    deny_reason = evaluate_post_body_texts([_assembled_fixture_email()])
-    assert deny_reason is not None
-    assert "post body" in deny_reason
-
-
-def test_post_body_allowlisted_values_plumb_through_to_the_scan() -> None:
-    allowed_value = _assembled_fixture_email()
-    deny_reason = evaluate_post_body_texts(
-        [allowed_value], all_allowlisted_values=frozenset({allowed_value})
-    )
-    assert deny_reason is None
-
-
-def test_post_body_unlisted_value_still_blocked_beside_allowlist() -> None:
-    deny_reason = evaluate_post_body_texts(
-        [_assembled_unlisted_email()],
-        all_allowlisted_values=frozenset({_assembled_fixture_email()}),
-    )
-    assert deny_reason is not None
-    assert "post body" in deny_reason
-
-
-def _assembled_fixture_email() -> str:
-    return "owner.fixture" + "@" + "acme-corp" + ".example" + ".io"
-
-
-def _assembled_unlisted_email() -> str:
-    return "other.person" + "@" + "different-co" + ".example" + ".io"
-
-
-def _write_allowlist_identity(identity_path: Path, slug: str, value: str) -> None:
-    identity_path.write_text(
-        json.dumps({"pii_allowlisted_values": {slug: [value]}}),
-        encoding="utf-8",
-    )
-
-
-def _init_repo_with_github_origin(repository_root: Path, origin_slug: str) -> None:
-    repository_root.mkdir(parents=True, exist_ok=True)
-    subprocess.run(["git", "init", "-q"], cwd=repository_root, check=True)
-    origin_url = "https://github.com/" + origin_slug + ".git"
-    subprocess.run(
-        ["git", "remote", "add", "origin", origin_url],
-        cwd=repository_root,
-        check=True,
-    )
-
-
-def _write_deny_reason(target_path: Path, value: str) -> str | None:
-    content = "owner email " + value + "\n"
-    return evaluate_write_edit_payload(
-        "Write", {"file_path": str(target_path), "content": content}
-    )
-
-
-def test_write_payload_with_a_fixture_email_is_flagged(tmp_path: Path) -> None:
-    deny_reason = _write_deny_reason(tmp_path / "notes.md", _assembled_fixture_email())
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_allowlisted_value_under_the_allowlisted_repo_is_allowed(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    allowed_value = _assembled_fixture_email()
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    assert _write_deny_reason(repository_root / "notes.md", allowed_value) is None
-
-
-def test_allowlisted_value_in_a_different_repo_is_blocked(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    allowed_value = _assembled_fixture_email()
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _OTHER_SLUG)
-    deny_reason = _write_deny_reason(repository_root / "notes.md", allowed_value)
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_unlisted_value_in_the_allowlisted_repo_is_blocked(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = _write_deny_reason(
-        repository_root / "notes.md", _assembled_unlisted_email()
-    )
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_clean_write_payload_skips_repository_resolution(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, _assembled_fixture_email())
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-
-    def _fail_if_called(_working_directory: str | None) -> None:
-        raise AssertionError(
-            "resolve_repository_root should not run for a payload with no PII"
-        )
-
-    monkeypatch.setattr(
-        sys.modules["pii_payload_scan"], "resolve_repository_root", _fail_if_called
-    )
-    deny_reason = evaluate_write_edit_payload(
-        "Write",
-        {
-            "file_path": str(repository_root / "notes.md"),
-            "content": "nothing sensitive here\n",
-        },
-    )
-    assert deny_reason is None
-
-
-def test_allowlisted_value_under_missing_nested_parent_is_allowed(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    allowed_value = _assembled_fixture_email()
-    identity_path = tmp_path / "local-identity.json"
-    _write_allowlist_identity(identity_path, _ALLOW_SLUG, allowed_value)
-    monkeypatch.setenv("CLAUDE_LOCAL_IDENTITY_PATH", str(identity_path))
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    nested_target = repository_root / "new_dir" / "deeper" / "notes.md"
-    assert not nested_target.parent.exists()
-    assert _write_deny_reason(nested_target, allowed_value) is None
-
-
-def test_apply_patch_add_with_pii_is_denied(tmp_path: Path) -> None:
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = evaluate_apply_patch_payload(
-        {
-            "command": (
-                "*** Begin Patch\n"
-                "*** Add File: notes.md\n"
-                f"+Reach me at {_assembled_fixture_email()}\n"
-                "*** End Patch"
-            )
-        },
-        hook_payload={"cwd": str(repository_root)},
-    )
-    assert deny_reason is not None
-    assert "email" in deny_reason
-
-
-def test_apply_patch_add_with_clean_content_is_allowed(tmp_path: Path) -> None:
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = evaluate_apply_patch_payload(
-        {
-            "command": (
-                "*** Begin Patch\n"
-                "*** Add File: notes.md\n"
-                "+nothing sensitive here\n"
-                "*** End Patch"
-            )
-        },
-        hook_payload={"cwd": str(repository_root)},
-    )
-    assert deny_reason is None
-
-
-def test_apply_patch_payload_accepts_the_tool_input_keyword(tmp_path: Path) -> None:
-    """evaluate_apply_patch_payload's first parameter is named all_tool_input."""
-    repository_root = tmp_path / "repo"
-    _init_repo_with_github_origin(repository_root, _ALLOW_SLUG)
-    deny_reason = evaluate_apply_patch_payload(
-        all_tool_input={
-            "command": (
-                "*** Begin Patch\n"
-                "*** Add File: notes.md\n"
-                "+nothing sensitive here\n"
-                "*** End Patch"
-            )
-        },
-        hook_payload={"cwd": str(repository_root)},
-    )
-    assert deny_reason is None