judgetap 0.0.2.dev28__tar.gz → 0.0.2.dev30__tar.gz

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/.github/workflows/release.yml

@@ -26,6 +26,7 @@ jobs:
     outputs:
       released: ${{ steps.rp.outputs.release_created }}
       tag: ${{ steps.rp.outputs.tag_name }}
+      pr_branch: ${{ steps.rp.outputs.pr && fromJSON(steps.rp.outputs.pr).headBranchName || '' }}
     steps:
       - id: rp
         uses: googleapis/release-please-action@v4
@@ -33,6 +34,30 @@ jobs:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
+  # release-please bumps pyproject.toml but can't edit uv.lock's package
+  # table, so relock the release PR's branch whenever release-please updates it.
+  relock:
+    needs: release-please
+    if: github.event_name == 'push' && needs.release-please.outputs.pr_branch != ''
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release-please.outputs.pr_branch }}
+      - uses: astral-sh/setup-uv@v6
+      - run: uv lock
+      - name: Commit the refreshed lockfile
+        env:
+          BRANCH: ${{ needs.release-please.outputs.pr_branch }}
+        run: |
+          git diff --quiet uv.lock && exit 0
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git commit -m "chore: refresh uv.lock for the release" uv.lock
+          git push origin "HEAD:refs/heads/$BRANCH"
+
   # Stable: the release-please release (created with GITHUB_TOKEN, which
   # doesn't trigger `release` events, so no double publish) or a release
   # published by hand in the GitHub UI.

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: judgetap
-Version: 0.0.2.dev28
+Version: 0.0.2.dev30
 Summary: Fast typed decisions (choice, score, yes/no) across Jev-style engines, plus a guard for coding agents. Early development.
 Project-URL: Homepage, https://github.com/mergesafe-ai/judgetap
 Author-email: Omer Bar-Ness <omer@zsquared.io>

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/docs/SPEC.md

@@ -71,7 +71,7 @@ A pre-action hook for coding agents, built on the core.
 
 ## Decided: the guard's default engine (#8)
 
-No engine by default, and nothing downloaded or stored. Rules-only mode fails closed for shell commands (it asks when unsure); without an engine, file writes and edits are only checked for secrets and user rules. `judgetap guard install` uses an engine the user already has, in this order: `$JUDGETAP_ENGINE`, a `TYPESAFE_API_KEY` (Jev), a local AgentJev server on 127.0.0.1:8149. It records the choice as `engine = "..."` in `~/.judgetap/guard.toml`, because agents often run hooks without the user's shell environment. Install never stores a key by itself; when it detects `TYPESAFE_API_KEY` in the environment and runs in a terminal, it offers (opt-in) to copy it into the OS keychain, and engines read the environment first, then the keychain. A local model isn't the default because of the download (Laya pulls PyTorch; AgentJev needs its own server), and the user's LLM key isn't auto-picked because it adds seconds per guarded call. Either is one line in guard.toml.
+No engine by default, and nothing downloaded or stored. Rules-only mode fails closed for shell commands (it asks when unsure); without an engine, file writes and edits are checked for secrets, user rules and writes to the guard's own configuration (guard.toml, agent hook settings), and any shell command that mentions one of those paths (or a word in it that resolves to one through a symlink) asks, since listing every way the shell can write a file isn't possible. `judgetap guard install` uses an engine the user already has, in this order: `$JUDGETAP_ENGINE`, a `TYPESAFE_API_KEY` (Jev), a local AgentJev server on 127.0.0.1:8149. It records the choice as `engine = "..."` in `~/.judgetap/guard.toml`, because agents often run hooks without the user's shell environment. Install never stores a key by itself; when it detects `TYPESAFE_API_KEY` in the environment and runs in a terminal, it offers (opt-in) to copy it into the OS keychain, and engines read the environment first, then the keychain. A local model isn't the default because of the download (Laya pulls PyTorch; AgentJev needs its own server), and the user's LLM key isn't auto-picked because it adds seconds per guarded call. Either is one line in guard.toml.
 
 **Experimental, opt-in: task-done check.** `judgetap guard install --with stop` adds a Claude Code `Stop` hook that asks the engine whether the user's task is actually finished. Only a confident "not done" (p(done) <= `stop_threshold`, default 0.15, set in `~/.judgetap/guard.toml`) blocks the stop, at most twice per session, and never while a previous block is being handled. It needs an engine and is off by default until an eval set shows it's reliable.
 

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "judgetap"
-version = "0.0.2.dev28"
+version = "0.0.2.dev30"
 description = "Fast typed decisions (choice, score, yes/no) across Jev-style engines, plus a guard for coding agents. Early development."
 readme = "README.md"
 license = "Apache-2.0"

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/release-please-config.json

@@ -7,12 +7,7 @@
       "bump-patch-for-minor-pre-major": false,
       "changelog-path": "CHANGELOG.md",
       "extra-files": [
-        "src/judgetap/__init__.py",
-        {
-          "type": "toml",
-          "path": "uv.lock",
-          "jsonpath": "$.package[?(@.name=='judgetap')].version"
-        }
+        "src/judgetap/__init__.py"
       ]
     }
   },

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/src/judgetap/__init__.py

@@ -23,7 +23,7 @@ from judgetap.errors import (
 )
 from judgetap.types import Decision, Question
 
-__version__ = "0.0.2.dev28"  # x-release-please-version
+__version__ = "0.0.2.dev30"  # x-release-please-version
 
 __all__ = [
     "Cascade",

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/src/judgetap/guard/core.py

@@ -13,7 +13,9 @@ from judgetap.engine import Engine
 from judgetap.guard.rules import (
     Outcome,
     check_command,
+    check_command_writes,
     check_content,
+    check_path,
     rules_only_check,
 )
 from judgetap.types import Question
@@ -62,6 +64,7 @@ class Action:
     content: str | None = None
     task: str | None = None
     project_rules: str | None = None
+    unreadable: bool = False  # a Bash call with no readable command
 
 
 @dataclass
@@ -85,8 +88,13 @@ class UserRule:
     reason: str
 
 
-def load_user_rules(path: Path) -> list[UserRule]:
-    """[[rule]] tables from guard.toml: pattern (regex), outcome, reason."""
+def load_user_rules(path: Path, *, trusted: bool = True) -> list[UserRule]:
+    """[[rule]] tables from guard.toml: pattern (regex), outcome, reason.
+
+    A repo's own guard.toml (trusted=False) may only tighten: its `allow`
+    rules are dropped, since anything in a cloned repo, or written by the
+    agent, could otherwise switch the built-in rules off. Only the user's
+    ~/.judgetap/guard.toml can allow. `dropped_allows(path)` reports them."""
     if not path.is_file():
         return []
     with path.open("rb") as fh:
@@ -98,6 +106,8 @@ def load_user_rules(path: Path) -> list[UserRule]:
             raise ValueError(
                 f"{path}: outcome must be hold, ask or allow, not {outcome!r}"
             )
+        if outcome == "allow" and not trusted:
+            continue  # a repo can't loosen the guard
         rules.append(
             UserRule(
                 re.compile(entry["pattern"]),
@@ -117,7 +127,8 @@ def check(
     engine: Engine | None = None,
     user_rules: list[UserRule] | None = None,
 ) -> Verdict:
-    # User rules first: an explicit "allow" is how a team overrides a built-in.
+    # User rules first: an explicit "allow" is how a team overrides a built-in,
+    # but only from the user's own config (see load_user_rules' `trusted`).
     subject = _subject(action)
     for rule in user_rules or []:
         if rule.pattern.search(subject):
@@ -126,9 +137,11 @@ def check(
             )
     hit = None
     if action.command is not None:
-        hit = check_command(action.command, action.cwd)
-    elif action.content is not None:
-        hit = check_content(action.content)
+        hit = check_command(action.command, action.cwd) or check_command_writes(
+            action.command, action.cwd
+        )
+    else:
+        hit = check_content(action.content or "") or check_path(action.path, action.cwd)
     if hit:
         outcome, name, reason = hit
         return Verdict(outcome, "rules", reason, rule=name)
@@ -214,3 +227,12 @@ def project_rules(cwd: Path) -> str | None:
         if (directory / ".git").exists():
             break
     return None
+
+
+def dropped_allows(path: Path) -> int:
+    """How many `allow` rules a repo guard.toml has (ignored when loaded untrusted)."""
+    if not path.is_file():
+        return 0
+    with path.open("rb") as fh:
+        data = tomllib.load(fh)
+    return sum(1 for e in data.get("rule", []) if e.get("outcome", "hold") == "allow")

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/src/judgetap/guard/hook.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import shlex
 import sys
 import time
@@ -19,7 +20,14 @@ from pathlib import Path
 from typing import Any
 
 from judgetap._compat import default_home, env
-from judgetap.guard.core import Action, Verdict, check, load_user_rules, project_rules
+from judgetap.guard.core import (
+    Action,
+    Verdict,
+    check,
+    dropped_allows,
+    load_user_rules,
+    project_rules,
+)
 from judgetap.guard.rules import redact
 
 TRANSCRIPT_SCAN_BYTES = 2 * 1024 * 1024
@@ -31,27 +39,47 @@ def home() -> Path:
     return Path(configured) if configured else default_home()
 
 
+def _text(value: Any) -> str:
+    """Hook fields as text, whatever type arrived (None -> "")."""
+    return "" if value is None else value if isinstance(value, str) else str(value)
+
+
 def action_from_hook(payload: dict[str, Any]) -> Action | None:
+    """The action to check. Parsing never raises on odd field types; if the
+    extras (task, project rules) can't be read, the rules still run."""
     tool = payload.get("tool_name")
     if tool not in GUARDED_TOOLS:
         return None
-    inp = payload.get("tool_input") or {}
-    cwd = Path(payload.get("cwd") or os.getcwd())
+    inp = payload.get("tool_input")
+    inp = inp if isinstance(inp, dict) else {}
+    cwd = Path(_text(payload.get("cwd")) or os.getcwd())
     action = Action(tool=tool, cwd=cwd)
     if tool == "Bash":
-        action.command = inp.get("command", "")
+        command = inp.get("command")
+        # None means the command couldn't be read: _decide asks rather than allows.
+        action.command = None if command is None else _text(command)
+        action.unreadable = command is None
     else:
-        action.path = inp.get("file_path")
+        action.path = _text(inp.get("file_path")) or None
         if tool == "Write":
-            action.content = inp.get("content", "")
+            action.content = _text(inp.get("content"))
         elif tool == "Edit":
-            action.content = inp.get("new_string", "")
+            action.content = _text(inp.get("new_string"))
         else:
+            edits = inp.get("edits")
+            edits = edits if isinstance(edits, list) else []
             action.content = "\n".join(
-                e.get("new_string", "") for e in inp.get("edits", [])
+                _text(e.get("new_string")) if isinstance(e, dict) else _text(e)
+                for e in edits
             )
-    action.task = last_user_message(payload.get("transcript_path"))
-    action.project_rules = project_rules(cwd)
+    try:
+        action.task = last_user_message(_text(payload.get("transcript_path")) or None)
+    except Exception:  # noqa: BLE001 -- enrichment only: the rules still run
+        action.task = None
+    try:
+        action.project_rules = project_rules(cwd)
+    except Exception:  # noqa: BLE001 -- enrichment only
+        action.project_rules = None
     return action
 
 
@@ -265,7 +293,7 @@ def run(
         if action is None:
             out = {"permission": "allow"} if agent == "cursor" else None
         else:
-            verdict = _decide(action, start)
+            verdict = _decide(action, start, payload.get("session_id"))
             if record:
                 try:
                     log(action, verdict, payload.get("session_id"))
@@ -286,7 +314,35 @@ def run(
     return code
 
 
-def _decide(action: Action, start: float) -> Verdict:
+def _warn_once(session: str | None, key: str) -> bool:
+    """True the first time `key` is warned about in this session."""
+    if not isinstance(session, str) or not re.fullmatch(
+        r"[A-Za-z0-9._-]{1,128}", session
+    ):
+        return True  # no usable session id: warn rather than stay silent
+    marker = home() / "sessions" / f"{session}.warned"
+    try:
+        seen = set(marker.read_text().splitlines()) if marker.exists() else set()
+        if key in seen:
+            return False
+        marker.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        fd = os.open(marker, os.O_WRONLY | os.O_APPEND | os.O_CREAT, 0o600)
+        with os.fdopen(fd, "a") as fh:
+            fh.write(key + "\n")
+    except OSError:
+        return True
+    return True
+
+
+def _decide(action: Action, start: float, session: str | None = None) -> Verdict:
+    if getattr(action, "unreadable", False):
+        # A Bash call whose command can't be read: fail closed.
+        return Verdict(
+            "ask",
+            "rules",
+            "the command couldn't be read from the hook input",
+            rule="unreadable",
+        )
     try:
         engine = _engine()
     except Exception as err:  # noqa: BLE001 -- bad engine config degrades to rules only
@@ -294,9 +350,18 @@ def _decide(action: Action, start: float) -> Verdict:
     else:
         engine_error = None
     rules, config_error = [], None
-    for path in (home() / "guard.toml", action.cwd / "guard.toml"):
+    for path, trusted in (
+        (home() / "guard.toml", True),
+        (action.cwd / "guard.toml", False),
+    ):
         try:
-            rules += load_user_rules(path)
+            rules += load_user_rules(path, trusted=trusted)
+            if (
+                not trusted
+                and (n := dropped_allows(path))
+                and _warn_once(session, f"repo-allow:{path}")
+            ):
+                config_error = f"ignored {n} allow rule(s) in {path}: a repo can only tighten the guard"
         except Exception as err:  # noqa: BLE001 -- a bad config must not disable built-ins
             config_error = f"ignored {path}: {err}"
     verdict = check(action, engine, rules)

{judgetap-0.0.2.dev28 → judgetap-0.0.2.dev30}/src/judgetap/guard/rules.py

@@ -639,7 +639,15 @@ COMMAND_SECRETS = (
     re.compile(
         r"(?i)(?P<keep>(--)?(password|passwd|token|secret|api[-_]?key)[= ]\s*)[^\s'\"]+"
     ),
-    re.compile(r"(?P<keep>\b[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|API_KEY)=)\S+"),
+    # Env assignments with the keyword anywhere in the name:
+    # AWS_SECRET_ACCESS_KEY=, GH_TOKEN_RW=, PGPASSWORD=, DB_PRIVATE_KEY=.
+    # mysql/mariadb take the password attached: -phunter2 (a bare -p prompts).
+    re.compile(
+        r"(?P<keep>\b(mysql|mariadb|mysqldump|mysqladmin)\b[^;&|\n]*?\s-p)"
+        r"(?:'[^']*'|\"[^\"]*\"|[^\s'\"]+)"
+    ),
+    # sshpass -p <password>.
+    re.compile(r"(?P<keep>\bsshpass\s+-p\s*)(?:'[^']*'|\"[^\"]*\"|[^\s'\"]+)"),
     re.compile(r"(?P<keep>://[^:/\s@]+:)[^@\s]+(?=@)"),
     # Basic auth on the command line: curl -u user:pass, --user=user:pass.
     # Only user:pass values, so `sort -u file` and `git add -u` stay readable.
@@ -724,9 +732,30 @@ def _redact_segment(text: str) -> str:
     return "".join(out)
 
 
+ENV_SECRET = re.compile(
+    r"(?i)\b[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Z0-9_]*="
+)
+
+
+def _redact_env_assignments(text: str) -> str:
+    """Mask the whole value of a secret-named assignment, quoted values and
+    escapes included (`DB_PRIVATE_KEY="two words"`), via the shell-word scanner."""
+    out, pos = [], 0
+    for m in ENV_SECRET.finditer(text):
+        if m.start() < pos:
+            continue
+        end = _shell_word_end(text, m.end())
+        if end > m.end():
+            out.append(text[pos : m.end()] + "[REDACTED]")
+            pos = end
+    out.append(text[pos:])
+    return "".join(out)
+
+
 def redact(text: str) -> str:
     """Mask credential-looking values so a command can be logged."""
     text = _redact_basic_auth(text)
+    text = _redact_env_assignments(text)
     for _name, pattern in SECRET_PATTERNS:
         text = pattern.sub("[REDACTED]", text)
     for pattern in COMMAND_SECRETS:
@@ -853,3 +882,76 @@ def rules_only_check(command: str) -> tuple[Outcome, str, str] | None:
 def _first_command_index(argv: list[str]) -> int:
     """Index of the command a wrapper chain finally runs."""
     return len(argv) - len(_unwrap(argv))
+
+
+# Files that configure the guard (or the agent's hooks). An agent editing
+# them could switch the guard off, so a person should see it first.
+GUARD_CONFIG = re.compile(
+    r"(^|/)(guard\.toml|\.claude/settings[^/]*\.json|\.cursor/hooks\.json"
+    r"|\.codex/hooks\.json|\.codex/config\.toml)$"
+)
+
+
+def _is_guard_config(path: str, cwd: Path | None) -> bool:
+    """The literal path, and where it really points (symlinks followed,
+    relative paths taken from cwd), both checked."""
+    candidates = [path.replace("\\", "/")]
+    try:
+        p = Path(path).expanduser()
+        if cwd is not None and not p.is_absolute():
+            p = cwd / p
+        candidates.append(p.resolve(strict=False).as_posix())
+    except (OSError, RuntimeError, ValueError):
+        pass
+    return any(GUARD_CONFIG.search(c) for c in candidates)
+
+
+def check_path(
+    path: str | None, cwd: Path | None = None
+) -> tuple[Outcome, str, str] | None:
+    """Ask before a write to the guard's own configuration."""
+    if path and _is_guard_config(path, cwd):
+        return "ask", "guard-config", f"edits the guard's own configuration ({path})"
+    return None
+
+
+# Any mention of a guard-config file in a shell command asks. Parsing every
+# way the shell can write a file (fd redirects, --target-directory, dd of=,
+# python -c, ...) is an unbounded list; a mention is not. Reading the config
+# (`cat guard.toml`) asks too: rare, and cheap to approve.
+GUARD_CONFIG_MENTION = re.compile(
+    r"(?:guard\.toml|\.claude/settings[^\s'\"/]*\.json|\.cursor/hooks\.json"
+    r"|\.codex/hooks\.json|\.codex/config\.toml)"
+)
+
+
+REDIRECT_PREFIX = re.compile(r"^(?:\d*|&)(?:>>?|<>?)\|?")
+
+
+def _words(command: str) -> list[str]:
+    """Every shell word, with redirections split off even when attached."""
+    spaced = re.sub(r"(\d*|&)(>>?|<>?)\|?", lambda m: " " + m.group(0) + " ", command)
+    words: list[str] = []
+    for argv in _commands(spaced, unwrap=False) or []:
+        words += argv
+    return words
+
+
+def check_command_writes(
+    command: str, cwd: Path | None = None
+) -> tuple[Outcome, str, str] | None:
+    """Ask when a shell command mentions the guard's own configuration, or
+    a word in it resolves (symlinks followed) to one."""
+    if GUARD_CONFIG_MENTION.search(command.replace("\\", "/")):
+        return "ask", "guard-config", "touches the guard's own configuration"
+    # Every word, with redirection operators peeled off (`2>alias`, `&>>x`,
+    # `>|y`) and `--opt=` prefixes dropped, is resolved: a symlink with any
+    # name can point at the config.
+    for word in _words(command):
+        word = REDIRECT_PREFIX.sub("", word)
+        # Both the whole word (a file may be named `a=b`) and the value of an
+        # `--opt=value` / `of=value` word.
+        for target in {word, word.split("=", 1)[-1]}:
+            if target and _is_guard_config(target, cwd):
+                return "ask", "guard-config", "touches the guard's own configuration"
+    return None

judgetap-0.0.2.dev30/tests/test_guard_trust.py

@@ -0,0 +1,320 @@
+"""Audit fixes: repo guard.toml can't loosen (#64), odd input doesn't fail
+open (#65), common secrets are redacted (#66)."""
+
+import io
+import json
+
+import pytest
+
+from judgetap.guard import hook
+from judgetap.guard.rules import redact
+
+
+@pytest.fixture(autouse=True)
+def _home(tmp_path, monkeypatch):
+    monkeypatch.setenv("JUDGETAP_HOME", str(tmp_path / "home"))
+    monkeypatch.delenv("JUDGETAP_ENGINE", raising=False)
+    monkeypatch.delenv("SNAPJUDGE_ENGINE", raising=False)
+
+
+def run(payload):
+    out = io.StringIO()
+    hook.run(io.StringIO(json.dumps(payload)), out)
+    return json.loads(out.getvalue()) if out.getvalue() else {}
+
+
+def decision(out):
+    return out.get("hookSpecificOutput", {}).get("permissionDecision", "allow")
+
+
+def bash(cmd, cwd):
+    return {"tool_name": "Bash", "tool_input": {"command": cmd}, "cwd": str(cwd)}
+
+
+# --- #64 ------------------------------------------------------------------
+
+
+def test_repo_guard_toml_cannot_allow_everything(tmp_path):
+    (tmp_path / "guard.toml").write_text(
+        '[[rule]]\npattern = ".*"\noutcome = "allow"\n'
+    )
+    out = run(bash("rm -rf ~", tmp_path))
+    assert decision(out) == "deny"
+    assert "repo can only tighten" in out.get("systemMessage", "")
+
+
+def test_repo_guard_toml_can_still_tighten(tmp_path):
+    (tmp_path / "guard.toml").write_text(
+        '[[rule]]\npattern = "kubectl"\noutcome = "hold"\n'
+    )
+    assert decision(run(bash("kubectl get pods", tmp_path))) == "deny"
+
+
+def test_user_guard_toml_can_allow(tmp_path):
+    home = tmp_path / "home"
+    home.mkdir()
+    (home / "guard.toml").write_text(
+        '[[rule]]\npattern = "git push origin main"\noutcome = "allow"\n'
+    )
+    assert decision(run(bash("git push origin main", tmp_path))) == "allow"
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "guard.toml",
+        "/r/.claude/settings.json",
+        "/r/.claude/settings.local.json",
+        "/r/.cursor/hooks.json",
+        "/r/.codex/hooks.json",
+        "/r/.codex/config.toml",
+    ],
+)
+def test_writing_guard_config_asks(tmp_path, path):
+    out = run(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": path, "content": "x"},
+            "cwd": str(tmp_path),
+        }
+    )
+    assert decision(out) == "ask"
+
+
+def test_ordinary_writes_are_not_affected(tmp_path):
+    out = run(
+        {
+            "tool_name": "Write",
+            "tool_input": {"file_path": "src/app.toml", "content": "x"},
+            "cwd": str(tmp_path),
+        }
+    )
+    assert decision(out) == "allow"
+
+
+# --- #65 ------------------------------------------------------------------
+
+
+def test_null_multiedit_value_still_runs_the_rules(tmp_path):
+    secret = "AKIA" + "B" * 16
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/x",
+            "edits": [{"old_string": "a", "new_string": None}, {"new_string": secret}],
+        },
+        "cwd": str(tmp_path),
+    }
+    out = run(payload)
+    assert "failed and allowed" not in out.get("systemMessage", "")
+    assert decision(out) == "deny"  # the secret in the second edit is still caught
+
+
+def test_audit_repro_null_new_string_is_not_a_crash(tmp_path):
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/x",
+            "edits": [{"old_string": "a", "new_string": None}],
+        },
+        "cwd": str(tmp_path),
+    }
+    assert "failed and allowed" not in run(payload).get("systemMessage", "")
+
+
+def test_unreadable_bash_command_asks(tmp_path):
+    out = run({"tool_name": "Bash", "tool_input": {}, "cwd": str(tmp_path)})
+    assert decision(out) == "ask"
+
+
+def test_non_string_fields_are_coerced(tmp_path):
+    out = run(
+        {
+            "tool_name": "Bash",
+            "tool_input": {"command": ["git", "push", "-f"]},
+            "cwd": str(tmp_path),
+        }
+    )
+    assert "failed and allowed" not in out.get("systemMessage", "")
+
+
+def test_enrichment_failure_still_runs_rules(tmp_path, monkeypatch):
+    monkeypatch.setattr(hook, "last_user_message", lambda p: 1 / 0)
+    monkeypatch.setattr(hook, "project_rules", lambda p: 1 / 0)
+    assert decision(run(bash("git push --force", tmp_path))) == "deny"
+
+
+# --- #66 ------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("command", "leak"),
+    [
+        ("AWS_SECRET_ACCESS_KEY=abcd1234 aws s3 ls", "abcd1234"),
+        ("export AWS_SECRET_ACCESS_KEY=abcd1234", "abcd1234"),
+        ("DB_PRIVATE_KEY_PEM=zzz9 ./run", "zzz9"),
+        ("PGPASSWORD=s3cret psql -h db", "s3cret"),
+        ("mysql -u root -phunter2 db", "hunter2"),
+        ("mysqldump -h h -u u -pverysecret app", "verysecret"),
+        ("sshpass -p hunter2 ssh host", "hunter2"),
+        ("sshpass -phunter2 ssh host", "hunter2"),
+    ],
+)
+def test_common_secrets_are_redacted(command, leak):
+    assert leak not in redact(command)
+
+
+@pytest.mark.parametrize(
+    "command", ["git add -p", "mkdir -p build/out", "cp -p a b", "mysql -p db"]
+)
+def test_harmless_dash_p_is_kept(command):
+    assert redact(command) == command
+
+
+def test_symlinked_path_to_guard_config_asks(tmp_path):
+    from judgetap.guard.rules import check_path
+
+    (tmp_path / "guard.toml").write_text("")
+    (tmp_path / "guard-alias").symlink_to(tmp_path / "guard.toml")
+    assert check_path("guard-alias", tmp_path)[1] == "guard-config"
+    assert check_path(str(tmp_path / "guard-alias"))[1] == "guard-config"
+    assert check_path("notes.md", tmp_path) is None
+
+
+@pytest.mark.parametrize(
+    ("command", "leak"),
+    [
+        ("db_private_key=zzz ./run", "zzz"),
+        ("aws_secret_access_key=abc123 aws s3 ls", "abc123"),
+        ("sshpass -p 'hunter2' ssh host", "hunter2"),
+        ('sshpass -p "pa ss" ssh host', "pa ss"),
+        ("mysql -u root -p'hunter2' db", "hunter2"),
+        ('mysql -u root -p"pw 1" db', "pw 1"),
+    ],
+)
+def test_round2_redaction(command, leak):
+    from judgetap.guard.rules import redact
+
+    assert leak not in redact(command)
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "printf x > .claude/settings.json",
+        "echo '{}' >> guard.toml",
+        "cat new | tee .cursor/hooks.json",
+        "cp evil.toml guard.toml",
+        "mv x .codex/hooks.json",
+        "sed -i 's/ask/allow/' guard.toml",
+    ],
+)
+def test_bash_writes_to_guard_config_ask(tmp_path, command):
+    from judgetap.guard.core import Action, check
+
+    v = check(Action(tool="Bash", cwd=tmp_path, command=command), None)
+    assert (v.outcome, v.rule) == ("ask", "guard-config")
+
+
+def test_ordinary_redirects_are_untouched(tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    assert check_command_writes("echo hi > out.txt; cp a b", tmp_path) is None
+
+
+def test_repo_allow_warning_once_per_session(tmp_path, monkeypatch):
+    import io
+    import json
+
+    from judgetap.guard import hook
+
+    monkeypatch.setenv("JUDGETAP_HOME", str(tmp_path / "home"))
+    monkeypatch.delenv("JUDGETAP_ENGINE", raising=False)
+    (tmp_path / "guard.toml").write_text('[[rule]]\npattern = "x"\noutcome = "allow"\n')
+
+    def run():
+        out = io.StringIO()
+        payload = {
+            "tool_name": "Bash",
+            "tool_input": {"command": "make test"},
+            "cwd": str(tmp_path),
+            "session_id": "s1",
+        }
+        hook.run(io.StringIO(json.dumps(payload)), out)
+        return json.loads(out.getvalue()) if out.getvalue() else {}
+
+    assert "ignored" in run().get("systemMessage", "")
+    assert "systemMessage" not in run()
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "echo x 2>guard.toml",
+        "cp settings.json --target-directory=.claude && mv .claude/settings.json .claude/settings.local.json",
+        "dd if=x of=.codex/config.toml",
+        "python3 -c \"open('guard.toml','w').write('')\"",
+        "cat guard.toml",
+    ],
+)
+def test_any_mention_of_guard_config_asks(command, tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    hit = check_command_writes(command, tmp_path)
+    assert hit is not None and hit[0] == "ask"
+
+
+def test_symlinked_config_in_a_shell_word_asks(tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    (tmp_path / "guard.toml").write_text("")
+    (tmp_path / "alias.cfg").symlink_to(tmp_path / "guard.toml")
+    assert check_command_writes("echo x > alias.cfg", tmp_path) is not None
+
+
+def test_unrelated_commands_do_not_ask(tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    assert check_command_writes("echo hi > notes.txt && cp a.py b.py", tmp_path) is None
+
+
+@pytest.mark.parametrize(
+    ("command", "leak"),
+    [
+        ('DB_PRIVATE_KEY="two words" ./run', "words"),
+        ("api_token='a b' make", "a b"),
+        ('X_SECRET="q\\"x" y', 'x"'),
+    ],
+)
+def test_quoted_env_values_fully_redacted(command, leak):
+    from judgetap.guard.rules import redact
+
+    assert leak not in redact(command)
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "echo x 2>alias.cfg",
+        "echo x 2>alias",
+        "echo x &>>alias",
+        "echo x >|alias",
+        "cat < alias",
+    ],
+)
+def test_redirects_to_symlinked_config_ask(command, tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    (tmp_path / "guard.toml").write_text("")
+    for name in ("alias.cfg", "alias"):
+        (tmp_path / name).symlink_to(tmp_path / "guard.toml")
+    assert check_command_writes(command, tmp_path) is not None
+
+
+def test_symlink_with_equals_in_its_name_asks(tmp_path):
+    from judgetap.guard.rules import check_command_writes
+
+    (tmp_path / "guard.toml").write_text("")
+    (tmp_path / "alias=cfg").symlink_to(tmp_path / "guard.toml")
+    assert check_command_writes("echo x >alias=cfg", tmp_path) is not None
+    assert check_command_writes("dd if=x of=alias=cfg", tmp_path) is not None