code-context-control 2.76.3__tar.gz → 2.78.0__tar.gz

{code_context_control-2.76.3/code_context_control.egg-info → code_context_control-2.78.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.76.3
+Version: 2.78.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.76.3 → code_context_control-2.78.0}/cli/_hook_utils.py

@@ -359,6 +359,48 @@ def record_unlocked_files(
         save_enforcement_state(state, project_path)
 
 
+# ── Host (IDE runtime) detection ─────────────────────────────────────────────
+# Three hosts drive C3 hooks, and their OUTPUT contracts differ enough that one
+# shared payload shape cannot satisfy all of them:
+#
+#   claude — top-level "tool_result" / "additionalContext" accepted.
+#   gemini — no tool_result; context nests under hookSpecificOutput.
+#   codex  — every hook output schema is additionalProperties:false and
+#            hookSpecificOutput.hookEventName is REQUIRED. Unknown keys are a
+#            hard deserialization error, not a warning, so emitting the Claude
+#            shape makes Codex discard the whole hook response.
+HOST_CLAUDE = "claude"
+HOST_GEMINI = "gemini"
+HOST_CODEX = "codex"
+
+
+def detect_host(data: dict) -> str:
+    """Identify which agent runtime sent this hook payload.
+
+    Codex is detected by `turn_id`, which its wire schema marks required on
+    every turn-scoped event C3 hooks (pre/post tool use, user prompt submit,
+    stop) and documents as "Codex extension". Claude Code never sends it.
+
+    Codex MUST be checked before Gemini: Codex declares `tool_response` as
+    free-form, so an MCP tool that returns an object would otherwise trip the
+    isinstance-dict test and be mistaken for Gemini.
+
+    The CODEX_* env fallback covers a future Codex that drops `turn_id`. A
+    false positive there degrades gracefully — Claude Code also accepts
+    hookSpecificOutput.additionalContext — so guessing "codex" is the safe
+    direction to be wrong in.
+    """
+    if not isinstance(data, dict):
+        return HOST_CLAUDE
+    if data.get("turn_id"):
+        return HOST_CODEX
+    if isinstance(data.get("tool_response"), dict):
+        return HOST_GEMINI
+    if os.environ.get("CODEX_THREAD_ID") or os.environ.get("CODEX_MANAGED_BY_NPM"):
+        return HOST_CODEX
+    return HOST_CLAUDE
+
+
 # Map Gemini CLI built-in tool names → canonical Claude Code equivalents
 GEMINI_TOOL_MAP = {
     "run_shell_command": "Bash",

{code_context_control-2.76.3 → code_context_control-2.78.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.76.3"
+__version__ = "2.78.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):

{code_context_control-2.76.3 → code_context_control-2.78.0}/cli/docs.html

@@ -1747,11 +1747,17 @@ Background agent system with periodic check loop and AI enhancement.
   ...</code></pre>
 
       <!-- ─── Hooks ──────────────────────── -->
-      <h3 id="hooks">PostToolUse Hooks <span class="badge badge-blue" style="font-size:10px">Claude Code only</span>
+      <h3 id="hooks">PostToolUse Hooks <span class="badge badge-blue" style="font-size:10px">installed for Claude Code</span>
       </h3>
-      <p>C3 registers two PostToolUse hooks in <code>.claude/settings.local.json</code> that run after Claude executes
-        certain tools. These hooks are only installed for Claude Code &mdash; other IDEs rely on the workflow
+      <p>C3 registers its PostToolUse hooks in <code>.claude/settings.local.json</code> that run after Claude executes
+        certain tools. C3 only <em>installs</em> them for Claude Code &mdash; other IDEs rely on the workflow
         instructions in their instructions file instead.</p>
+      <p>The dispatcher itself is not Claude-only. Since v2.78.0 it branches by host and speaks three wire formats:
+        Claude Code, Gemini CLI, and Codex CLI &mdash; so a Codex session with a hand-authored
+        <code>.codex/hooks.json</code> pointing at <code>cli/hook_dispatch.py</code> gets full enforcement and
+        bookkeeping. Codex validates hook output strictly (<code>additionalProperties: false</code>), which is why it
+        needs its own serializer rather than the Claude shape. Output filtering is skipped on Codex: its schema has no
+        <code>tool_result</code> to replace, so tokenizing the payload would be wasted work.</p>
 
       <table>
         <tr>

{code_context_control-2.76.3 → code_context_control-2.78.0}/cli/hook_access_guard.py

@@ -10,6 +10,7 @@ Bash coverage is a best-effort, existence-gated token scan — advisory by
 design (docs/access-guard.md §3/§6); it catches an agent naming a denied
 path, not an adversary hiding one.
 """
+import os
 import re
 import sys
 from pathlib import Path
@@ -93,6 +94,14 @@ _GIT_CMD_RE = re.compile(r"^\s*(?:[\w.\-]*[/\\])?git(?:\.exe)?\b", re.IGNORECASE
 # call arrives.
 _SEGMENT_SPLIT = re.compile(r"&&|\|\||[;|\n]")
 
+# `cd <dir>` — the segment that moves the ground under every later one. Handles
+# a quoted target, since project paths on this platform contain spaces, and the
+# Windows `/d` flag.
+_CD_RE = re.compile(
+    r"""^\s*cd\s+(?:/d\s+)?(?P<dir>"[^"]+"|'[^']+'|\S+)\s*$""",
+    re.IGNORECASE,
+)
+
 
 def _is_network_token(tok: str) -> bool:
     """True for URLs and IPv6 literals/CIDRs — never for an ADS spelling."""
@@ -199,6 +208,20 @@ def _target(tool_input: dict) -> str:
     )
 
 
+def _cd_target(segment: str, cwd: str) -> str | None:
+    """The directory a `cd` segment moves to, resolved against ``cwd``."""
+    m = _CD_RE.match(segment or "")
+    if not m:
+        return None
+    target = m.group("dir").strip("\"'")
+    if not target or target.startswith("-"):
+        return None
+    try:
+        return os.path.abspath(os.path.join(cwd, os.path.expanduser(target)))
+    except (OSError, ValueError):
+        return None
+
+
 def _scan_shell(cmd: str, base: str):
     """(denial, token) for the first confident deny-rule hit, else (None, '').
 
@@ -218,6 +241,7 @@ def _scan_shell(cmd: str, base: str):
     not have its first token reinterpreted just because a later segment is git.
     """
     budget = _MAX_TOKENS
+    cwd = base
     for segment in _SEGMENT_SPLIT.split(cmd or ""):
         if budget <= 0:
             break
@@ -227,7 +251,10 @@ def _scan_shell(cmd: str, base: str):
             tok = raw.strip("\"'`;,()")
             if not tok or tok.startswith("-"):
                 continue
-            if "/" not in tok and "\\" not in tok and not tok.startswith("."):
+            # A revspec's path half need not contain a separator — `HEAD:.env`
+            # has none, so it used to be dropped here before any rule saw it.
+            if ("/" not in tok and "\\" not in tok and not tok.startswith(".")
+                    and not (is_git and _GIT_REVSPEC_RE.match(tok))):
                 continue
             # Order matters only for readability: a URL is also syntax-free, so
             # either check alone would skip 'https://x'. Both are kept because
@@ -249,11 +276,22 @@ def _scan_shell(cmd: str, base: str):
                 tok = revspec_path
             if re.match(r"^/[a-z]/", tok):  # MSYS /c/foo → C:/foo
                 tok = f"{tok[1]}:{tok[2:]}"
-            denial = ag.check(tok, "read", base)
+            # Resolve against the cwd the command will actually run in, not the
+            # session root. `cd /elsewhere && cat .env` used to compute the
+            # denial correctly and then throw it away, because the existence
+            # gate looked for `.env` under the project root where it does not
+            # live (#82). The rule base stays `base` — policy is the project's;
+            # only the path being judged follows the shell.
+            probe = tok
+            if not os.path.isabs(probe):
+                try:
+                    probe = os.path.join(cwd, probe)
+                except (OSError, ValueError):
+                    probe = tok
+            denial = ag.check(probe, "read", base)
             if denial and denial.kind == "deny":
                 try:
-                    p = Path(tok)
-                    exists = (p if p.is_absolute() else Path(base) / p).exists()
+                    exists = Path(probe).exists()
                 except OSError:
                     exists = False
                 # A revspec names a path in HISTORY, so the working tree is the
@@ -262,6 +300,11 @@ def _scan_shell(cmd: str, base: str):
                 # existence-gating it would be a hole this rewrite opened.
                 if exists or from_revspec or denial.rule.startswith("<"):
                     return denial, tok
+        # AFTER the segment's own tokens: `cd x` moves the ground for what
+        # follows, not for its own argument.
+        moved = _cd_target(segment, cwd)
+        if moved is not None:
+            cwd = moved
     return None, ""
 
 

{code_context_control-2.76.3 → code_context_control-2.78.0}/cli/hook_dispatch.py

@@ -14,12 +14,20 @@ Matcher granularity that previously lived in .claude/settings.local.json
 routing tables below — install-mcp registers the dispatcher once per matcher,
 and the dispatcher decides which sub-hook logic applies.
 
-Output composition follows Claude Code hook semantics:
+Output composition merges sub-hook results the same way for every host:
   - a permissionDecision "deny" from any sub-hook wins over allows;
   - additionalContext strings from all sub-hooks are concatenated;
-  - a tool_result replacement (hook_filter) is preserved;
-  - plain-text (user-visible) messages are printed only when no structured
-    JSON output exists, matching the old per-hook stdout behavior.
+  - a tool_result replacement (hook_filter) is captured.
+
+Serialization then branches by host, because the three runtimes do NOT share
+a wire contract (see _hook_utils.detect_host):
+  - Claude Code — top-level tool_result / additionalContext; plain-text
+    messages print raw when no structured JSON output exists;
+  - Gemini CLI — no tool_result; context nests under hookSpecificOutput;
+  - Codex CLI — every hook output schema is additionalProperties:false with a
+    required hookEventName, so output is built from a per-event whitelist and
+    Codex never sees a tool_result. Codex also skips hook_filter entirely:
+    it is the only sub-hook that tokenizes the full tool payload.
 
 Failure visibility: a sub-hook crash is logged to .c3/hook_errors.log and
 never kills the remaining sub-hooks. CRITICAL failures — a sub-hook module
@@ -44,10 +52,40 @@ from cli import _hook_utils  # noqa: E402
 # spellings share ONE module instance (state warnings must not split).
 sys.modules.setdefault("_hook_utils", _hook_utils)
 
-from cli._hook_utils import log_hook_error, normalize_tool_name  # noqa: E402
+from cli._hook_utils import (  # noqa: E402
+    HOST_CLAUDE,
+    HOST_CODEX,
+    HOST_GEMINI,
+    detect_host,
+    log_hook_error,
+    normalize_tool_name,
+)
 
 VALID_EVENTS = ("pretool", "posttool", "stop", "prompt")
 
+# ── Codex wire contract ─────────────────────────────────────────────────────
+# Codex validates hook output against additionalProperties:false schemas, so
+# the Codex branch emits by WHITELIST rather than by "drop the keys we know
+# about". A sub-hook that invents a new output key can then never break Codex
+# — the key is simply not forwarded.
+_CODEX_EVENT_NAMES = {
+    "pretool": "PreToolUse",
+    "posttool": "PostToolUse",
+    "prompt": "UserPromptSubmit",
+    "stop": "Stop",
+}
+
+# Keys each event's hookSpecificOutput accepts. "stop" is absent deliberately:
+# stop.command.output has no hookSpecificOutput member at all.
+_CODEX_HSO_KEYS = {
+    "pretool": {
+        "hookEventName", "additionalContext",
+        "permissionDecision", "permissionDecisionReason", "updatedInput",
+    },
+    "posttool": {"hookEventName", "additionalContext", "updatedMCPToolOutput"},
+    "prompt": {"hookEventName", "additionalContext"},
+}
+
 # ── Routing tables (parity with the pre-v2.42 per-matcher registration) ─────
 
 # c3 tools whose completion refreshes the enforcement signal — exactly the
@@ -77,9 +115,15 @@ _GHOST_TOOLS = {
 }
 
 
-def _routes(event: str, raw_tool: str, norm_tool: str):
+def _routes(event: str, raw_tool: str, norm_tool: str, host: str = HOST_CLAUDE):
     """Yield sub-hook module names applicable to this event + tool, in the
-    same relative order the separate hook commands used to run."""
+    same relative order the separate hook commands used to run.
+
+    `host` gates hooks that cannot pay their way on a given runtime — see the
+    hook_filter carve-out below. Every other sub-hook is host-agnostic: they
+    do bookkeeping (ledger, artifact, signal, unlock, ghost sweep) without
+    parsing or tokenizing the tool payload, so they stay on for all hosts.
+    """
     if event == "pretool":
         # Access Guard runs FIRST: merge_outputs keeps the first deny, so a
         # policy denial here cannot be readmitted by sticky-unlock allows.
@@ -87,7 +131,13 @@ def _routes(event: str, raw_tool: str, norm_tool: str):
         # hook_pretool_enforce self-filters via its _PREREQS table.
         yield "hook_pretool_enforce"
     elif event == "posttool":
-        if norm_tool == "Bash":
+        # hook_filter is the ONE sub-hook that reads the whole tool payload:
+        # it tiktoken-encodes the entire Bash output to measure savings, a
+        # Rust-side allocation proportional to output size. On Codex that work
+        # is also pointless — its schema has no tool_result, so the filtered
+        # text could never replace the output anyway. Skip it entirely rather
+        # than risk an allocation failure for a result we must discard.
+        if norm_tool == "Bash" and host != HOST_CODEX:
             yield "hook_filter"
         if norm_tool == "Read":
             yield "hook_read"
@@ -155,18 +205,66 @@ def _load_run(module_name: str):
     return result
 
 
+def _codex_output(event: str, deny_hso, contexts: list, tool_result,
+                  texts: list) -> dict | None:
+    """Serialize merged sub-hook results into Codex's wire contract.
+
+    Codex accepts neither a top-level `tool_result` nor a top-level
+    `additionalContext`, and requires `hookEventName` inside
+    hookSpecificOutput. Anything that has no Codex-legal home is folded into a
+    channel that does exist rather than dropped:
+
+    - a tool_result replacement becomes leading context (it cannot replace the
+      output on Codex, but the filtered text is still worth reading);
+    - "_text" becomes `systemMessage`, the only user-visible string field
+      present on every Codex hook output schema — including Stop, which has no
+      hookSpecificOutput at all, so its context lands there too.
+    """
+    if tool_result is not None:
+        contexts.insert(0, str(tool_result))
+
+    result: dict = {}
+    hso_keys = _CODEX_HSO_KEYS.get(event)
+    joined = "\n".join(c for c in contexts if c)
+
+    if hso_keys is not None:
+        hso = {k: v for k, v in (deny_hso or {}).items() if k in hso_keys}
+        if joined:
+            # A deny's own reason travels in permissionDecisionReason; `joined`
+            # is the non-deny context, so the two never collide.
+            hso["additionalContext"] = joined
+        if hso:
+            hso["hookEventName"] = _CODEX_EVENT_NAMES[event]
+            result["hookSpecificOutput"] = hso
+    elif joined:
+        texts.insert(0, joined)
+
+    if texts:
+        result["systemMessage"] = "\n".join(texts)
+    return result or None
+
+
 def merge_outputs(outputs: list, warnings: list, is_gemini: bool = False,
-                  event: str = "") -> dict | None:
-    """Compose sub-hook outputs per Claude Code hook semantics.
+                  event: str = "", host: str | None = None) -> dict | None:
+    """Compose sub-hook outputs into ONE host-appropriate hook response.
 
+    Collection is host-agnostic:
     - deny beats allow: the first hookSpecificOutput carrying a
-      permissionDecision "deny" is kept verbatim;
+      permissionDecision "deny" is kept;
     - additionalContext strings are concatenated with newlines
       (critical warnings appended last);
-    - tool_result replacement (hook_filter) is preserved;
-    - "_text" plain messages ride along under "_text" — main() prints them
-      raw only when no structured output exists.
+    - a tool_result replacement (hook_filter) is captured.
+
+    Emission is not. Each host gets the shape its parser accepts — Claude
+    takes top-level keys, Gemini nests context and has no tool_result, Codex
+    validates against additionalProperties:false schemas (see _codex_output).
+
+    `is_gemini` is retained for callers that predate `host`; `host` wins when
+    both are given.
     """
+    if host is None:
+        host = HOST_GEMINI if is_gemini else HOST_CLAUDE
+
     deny_hso = None
     contexts: list = []
     texts: list = []
@@ -192,6 +290,10 @@ def merge_outputs(outputs: list, warnings: list, is_gemini: bool = False,
 
     contexts.extend(warnings)
 
+    if host == HOST_CODEX:
+        return _codex_output(event, deny_hso, contexts, tool_result, texts)
+
+    is_gemini = host == HOST_GEMINI
     result: dict = {}
     if deny_hso is not None:
         result["hookSpecificOutput"] = deny_hso
@@ -229,14 +331,14 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
     """Run all applicable sub-hooks in-process and merge their outputs."""
     raw_tool = str(payload.get("tool_name", ""))
     norm_tool = normalize_tool_name(raw_tool)
-    is_gemini = isinstance(payload.get("tool_response", ""), dict)
+    host = detect_host(payload)
 
     outputs: list = []
     warnings: list = []
     # Drain any stale warnings from a previous dispatch in this process.
     _hook_utils.drain_state_warnings()
 
-    for module_name in _routes(event, raw_tool, norm_tool):
+    for module_name in _routes(event, raw_tool, norm_tool, host):
         run_fn, err = _load_run(module_name)
         if run_fn is None:
             warnings.append(
@@ -263,7 +365,7 @@ def dispatch(event: str, payload: dict, project_path: Path | None = None) -> dic
         # become visible instead of silently disabling enforcement.
         warnings.extend(_hook_utils.drain_state_warnings())
 
-    return merge_outputs(outputs, warnings, is_gemini=is_gemini, event=event)
+    return merge_outputs(outputs, warnings, event=event, host=host)
 
 
 def main() -> None:
@@ -288,14 +390,24 @@ def main() -> None:
     try:
         output = dispatch(event, payload)
     except Exception as exc:
-        # The dispatcher itself failing is critical — say so.
+        # The dispatcher itself failing is critical — say so. Route the notice
+        # through merge_outputs so even the panic path speaks the host's
+        # dialect: a raw {"additionalContext": ...} is itself invalid on Codex,
+        # which would turn one crash into two error reports.
         log_hook_error("hook_dispatch", exc)
-        print(json.dumps({
+        notice = {
             "additionalContext": (
                 f"[c3:hook-error] hook_dispatch: {type(exc).__name__}: {exc}; "
                 "see .c3/hook_errors.log"
             )
-        }))
+        }
+        try:
+            output = merge_outputs([notice], [], event=event,
+                                   host=detect_host(payload))
+        except Exception:
+            output = notice
+        if output:
+            print(json.dumps(output))
         return
 
     if not output:

{code_context_control-2.76.3 → code_context_control-2.78.0/code_context_control.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.76.3
+Version: 2.78.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0

{code_context_control-2.76.3 → code_context_control-2.78.0}/code_context_control.egg-info/SOURCES.txt

@@ -301,6 +301,7 @@ tests/test_ghost_files.py
 tests/test_ghost_generation.py
 tests/test_git_branch_awareness.py
 tests/test_hook_access_guard.py
+tests/test_hook_codex_compat.py
 tests/test_hook_dispatch.py
 tests/test_hook_pretool_enforce.py
 tests/test_hook_prompt_recall.py

{code_context_control-2.76.3 → code_context_control-2.78.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "code-context-control"
-version = "2.76.3"
+version = "2.78.0"
 description = "Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub."
 readme = "README.md"
 requires-python = ">=3.10"

{code_context_control-2.76.3 → code_context_control-2.78.0}/tests/test_access_guard_shell_project.py

@@ -75,6 +75,14 @@ class GuardBase(unittest.TestCase):
         (self.proj / ".c3").mkdir()
         self._gb = mock.patch.object(ag, "_global_base", return_value=None)
         self._gb.start()
+        # delegate's response cache is a module global that outlives a test.
+        # The codex cases below key their task on id(svc), and CPython reuses
+        # an address once the previous svc is collected — so the second test
+        # could hit the FIRST one's cached "CODEX-OUT", return without ever
+        # calling the mocked _run_codex, and assert against an empty capture
+        # (`sandbox` is None, not the pinned value). That is allocator luck,
+        # which is why it only ever failed on some runners.
+        delegate_mod._delegate_cache.clear()
 
     def tearDown(self):
         self._gb.stop()
@@ -354,8 +362,11 @@ class TestDelegateGuard(GuardBase):
                 mock.patch.object(delegate_mod, "_codex_available", True), \
                 mock.patch.object(delegate_mod, "_codex_memory_bridge",
                                   return_value=None):
+            # Key the task on the test name, not id(svc): an address is
+            # reused as soon as the previous svc is collected, which made two
+            # different tests share one cache entry.
             out = delegate_mod.handle_delegate(
-                f"t-codex-{id(svc)}", "ask", "", "", svc, _finalize,
+                f"t-codex-{self.id()}", "ask", "", "", svc, _finalize,
                 backend="codex")
         return out, seen
 

{code_context_control-2.76.3 → code_context_control-2.78.0}/tests/test_hook_access_guard.py

@@ -342,10 +342,102 @@ class TestShellScanSyntaxTokens(HookGuardBase):
 
     def test_a_denied_revspec_is_still_caught_after_a_separator(self):
         denial, tok = hag._scan_shell(
-            "cd /tmp/repo && git show HEAD:secrets/key.txt", str(self.proj))
+            f'cd "{self.proj}" && git show HEAD:secrets/key.txt', str(self.proj))
         self.assertIsNotNone(denial)
         self.assertEqual(tok, "secrets/key.txt")
 
+    def test_a_revspec_path_without_a_separator_now_reaches_the_rules(self):
+        """`HEAD:.env` — no slash, so the token gate used to drop it (#82).
+
+        It also never reached the ADS check, which is the claim #81's body got
+        wrong. It reaches the rules now, and the revspec bypass of the existence
+        gate is what makes the verdict right: a blob in history is denied
+        whether or not that file is in the working tree today.
+        """
+        denial, tok = hag._scan_shell(
+            "git show HEAD:.env", str(self.proj))
+        self.assertIsNotNone(denial)
+        self.assertEqual(tok, ".env")
+
+
+class TestShellScanFollowsCd(HookGuardBase):
+    """#82 — the scan judged paths against the session root, not the cwd.
+
+    `cd <elsewhere> && cat .env` computed the denial correctly and then threw it
+    away, because the existence gate looked for `.env` under the project root
+    where it does not live. The rule was never wrong; the question was asked
+    about the wrong directory.
+    """
+
+    def test_a_denied_file_read_after_cd_is_caught(self):
+        """The reported case, reproduced with the rule that made it reachable.
+
+        Session rooted in one directory, command `cd`-ing to another, and a
+        builtin `**/.env*` deny — builtin because it binds on any path, which is
+        why the live failure was a secret file rather than a project-scoped one.
+        Before this fix the denial was computed and then discarded, because the
+        existence gate looked under the session root.
+        """
+        (self.proj / ".env").write_text("SECRET=x", encoding="utf-8")
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj}" && cat .env', str(self.proj.parent))
+        self.assertIsNotNone(denial)
+        self.assertEqual(denial.rule, "**/.env*")
+
+    def test_cd_out_then_relative_back_in_is_caught(self):
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj.parent}" && cat {self.proj.name}/secrets/key.txt',
+            str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_cd_out_then_absolute_back_in_is_caught(self):
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj.parent}" && cat "{self.proj / "secrets/key.txt"}"',
+            str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_the_existence_gate_still_applies_at_the_new_cwd(self):
+        """Following the shell must not mean flagging files that are not there.
+
+        A `cd` into a directory without the file leaves nothing to read, and a
+        deny on nothing is the false positive this scanner keeps being fixed for.
+        """
+        denial, _ = hag._scan_shell(
+            f'cd "{self.proj.parent}" && cat secrets/key.txt', str(self.proj))
+        self.assertIsNone(denial)
+
+    def test_cd_moves_only_the_segments_after_it(self):
+        """`cat secrets/key.txt && cd /elsewhere` reads before it moves."""
+        denial, _ = hag._scan_shell(
+            "cat secrets/key.txt && cd /tmp", str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_a_quoted_cd_target_with_spaces_is_parsed(self):
+        spaced = self.proj / "a dir"
+        spaced.mkdir()
+        denial, _ = hag._scan_shell(
+            f'cd "{spaced}" && cat ../secrets/key.txt', str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_the_cd_target_itself_is_still_scanned(self):
+        """`cd` into a denied directory is itself a token worth refusing."""
+        denial, tok = hag._scan_shell(
+            f'cd "{self.proj / "secrets"}"', str(self.proj))
+        self.assertIsNotNone(denial)
+
+    def test_a_bare_filename_is_still_out_of_scope(self):
+        """Stated rather than implied: the token gate is unchanged.
+
+        `cd <denied dir> && type key.txt` is caught only incidentally, by the
+        `cd` argument. A separator-free filename still never reaches the rules,
+        which is a known limit of the token gate and not what #82 was about.
+        """
+        self.assertIsNone(hag._cd_target("type key.txt", str(self.proj)))
+        denial, tok = hag._scan_shell(
+            f'cd "{self.proj / "secrets"}" && type key.txt', str(self.proj))
+        self.assertIsNotNone(denial)
+        self.assertNotIn("key.txt", tok)
+
     def test_a_git_segment_does_not_license_rewrites_in_other_segments(self):
         """Per-segment, not per-string: `cat a:b && git status` is two commands.