Add integration tests for multi-hook scenarios in hookify

Create comprehensive pytest integration test suite for the hookify plugin:

- test_integration.py: Multi-hook evaluation, rule priority (blocking over warnings),
  condition AND logic, tool type field extraction, Stop/UserPromptSubmit events
- test_rule_loading.py: YAML frontmatter parsing, rule file loading, event filtering
- test_error_handling.py: Fault tolerance for missing files, invalid regex, malformed input

Also fix a bug discovered through testing: MultiEdit field extraction now
gracefully handles malformed edit entries (non-dict values in edits array).

68 tests covering:
- Multiple rules combining messages
- Blocking rules taking priority over warnings
- Multiple conditions with AND logic
- Different tool types (Bash, Write, Edit, MultiEdit)
- Stop event transcript checking
- UserPromptSubmit validation
- Tool matcher filtering
- Regex pattern matching and caching
- Error handling and edge cases

https://claude.ai/code/session_014B79JcfZHUaTfnThn3o3g2

plugins/hookify/core/rule_engine.py

@@ -247,9 +247,13 @@ class RuleEngine:
             if field == 'file_path':
                 return tool_input.get('file_path', '')
             elif field in ['new_text', 'content']:
-                # Concatenate all edits
+                # Concatenate all edits, handling malformed entries gracefully
                 edits = tool_input.get('edits', [])
-                return ' '.join(e.get('new_string', '') for e in edits)
+                parts = []
+                for e in edits:
+                    if isinstance(e, dict):
+                        parts.append(e.get('new_string', ''))
+                return ' '.join(parts)
 
         return None
 

plugins/hookify/tests/__init__.py

@@ -0,0 +1 @@
+"""Hookify integration tests."""

plugins/hookify/tests/conftest.py

@@ -0,0 +1,208 @@
+"""Pytest fixtures for hookify integration tests."""
+
+import os
+import sys
+import json
+import tempfile
+import shutil
+from pathlib import Path
+from typing import Generator, Dict, Any, List
+
+import pytest
+
+# Add parent directories to path for imports
+PLUGIN_ROOT = Path(__file__).parent.parent
+PLUGINS_DIR = PLUGIN_ROOT.parent
+sys.path.insert(0, str(PLUGINS_DIR))
+sys.path.insert(0, str(PLUGIN_ROOT))
+
+from hookify.core.config_loader import Rule, Condition, load_rules, extract_frontmatter
+from hookify.core.rule_engine import RuleEngine
+
+
+@pytest.fixture
+def rule_engine() -> RuleEngine:
+    """Create a RuleEngine instance."""
+    return RuleEngine()
+
+
+@pytest.fixture
+def temp_project_dir() -> Generator[Path, None, None]:
+    """Create a temporary project directory with .claude folder.
+
+    This fixture creates a clean temp directory and changes to it,
+    then restores the original directory after the test.
+    """
+    original_dir = os.getcwd()
+    temp_dir = tempfile.mkdtemp(prefix="hookify_test_")
+
+    # Create .claude directory for rule files
+    claude_dir = Path(temp_dir) / ".claude"
+    claude_dir.mkdir()
+
+    os.chdir(temp_dir)
+
+    yield Path(temp_dir)
+
+    os.chdir(original_dir)
+    shutil.rmtree(temp_dir)
+
+
+@pytest.fixture
+def sample_rule_file(temp_project_dir: Path) -> Path:
+    """Create a sample rule file for testing."""
+    rule_content = """---
+name: block-rm-rf
+enabled: true
+event: bash
+action: block
+conditions:
+  - field: command
+    operator: regex_match
+    pattern: rm\\s+-rf
+---
+
+**Dangerous command blocked!**
+
+The `rm -rf` command can permanently delete files. Please use safer alternatives.
+"""
+    rule_file = temp_project_dir / ".claude" / "hookify.dangerous-commands.local.md"
+    rule_file.write_text(rule_content)
+    return rule_file
+
+
+@pytest.fixture
+def create_rule_file(temp_project_dir: Path):
+    """Factory fixture to create rule files with custom content."""
+    def _create(name: str, content: str) -> Path:
+        rule_file = temp_project_dir / ".claude" / f"hookify.{name}.local.md"
+        rule_file.write_text(content)
+        return rule_file
+    return _create
+
+
+@pytest.fixture
+def sample_bash_input() -> Dict[str, Any]:
+    """Sample PreToolUse input for Bash tool."""
+    return {
+        "session_id": "test-session-123",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "ls -la"
+        },
+        "cwd": "/test/project"
+    }
+
+
+@pytest.fixture
+def sample_write_input() -> Dict[str, Any]:
+    """Sample PreToolUse input for Write tool."""
+    return {
+        "session_id": "test-session-123",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "Write",
+        "tool_input": {
+            "file_path": "/test/project/src/main.py",
+            "content": "print('hello world')"
+        },
+        "cwd": "/test/project"
+    }
+
+
+@pytest.fixture
+def sample_edit_input() -> Dict[str, Any]:
+    """Sample PreToolUse input for Edit tool."""
+    return {
+        "session_id": "test-session-123",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "Edit",
+        "tool_input": {
+            "file_path": "/test/project/src/main.py",
+            "old_string": "hello",
+            "new_string": "goodbye"
+        },
+        "cwd": "/test/project"
+    }
+
+
+@pytest.fixture
+def sample_multiedit_input() -> Dict[str, Any]:
+    """Sample PreToolUse input for MultiEdit tool."""
+    return {
+        "session_id": "test-session-123",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "MultiEdit",
+        "tool_input": {
+            "file_path": "/test/project/src/main.py",
+            "edits": [
+                {"old_string": "foo", "new_string": "bar"},
+                {"old_string": "baz", "new_string": "qux"}
+            ]
+        },
+        "cwd": "/test/project"
+    }
+
+
+@pytest.fixture
+def sample_stop_input(temp_project_dir: Path) -> Dict[str, Any]:
+    """Sample Stop event input with transcript file."""
+    # Create a transcript file
+    transcript_file = temp_project_dir / "transcript.txt"
+    transcript_file.write_text("""
+User: Please implement the feature
+Assistant: I'll implement that feature now.
+[Uses Write tool to create file]
+User: Great, now run the tests
+Assistant: Running tests...
+[Uses Bash tool: npm test]
+All tests passed!
+""")
+
+    return {
+        "session_id": "test-session-123",
+        "hook_event_name": "Stop",
+        "reason": "Task completed",
+        "transcript_path": str(transcript_file),
+        "cwd": str(temp_project_dir)
+    }
+
+
+@pytest.fixture
+def sample_userprompt_input() -> Dict[str, Any]:
+    """Sample UserPromptSubmit event input."""
+    return {
+        "session_id": "test-session-123",
+        "hook_event_name": "UserPromptSubmit",
+        "user_prompt": "Please delete all files in the directory",
+        "cwd": "/test/project"
+    }
+
+
+def make_rule(
+    name: str,
+    event: str,
+    conditions: List[Dict[str, str]],
+    action: str = "warn",
+    message: str = "Test message",
+    enabled: bool = True,
+    tool_matcher: str = None
+) -> Rule:
+    """Helper function to create Rule objects for testing."""
+    cond_objects = [
+        Condition(
+            field=c.get("field", ""),
+            operator=c.get("operator", "regex_match"),
+            pattern=c.get("pattern", "")
+        )
+        for c in conditions
+    ]
+    return Rule(
+        name=name,
+        enabled=enabled,
+        event=event,
+        conditions=cond_objects,
+        action=action,
+        message=message,
+        tool_matcher=tool_matcher
+    )

plugins/hookify/tests/test_error_handling.py

@@ -0,0 +1,497 @@
+"""Tests for error handling and fault tolerance in hookify.
+
+Tests cover:
+- Graceful handling of missing files
+- Invalid JSON/YAML handling
+- Regex compilation errors
+- Transcript file access errors
+- Import failures
+- Edge cases and boundary conditions
+"""
+
+import pytest
+import os
+from pathlib import Path
+from typing import Dict, Any
+from unittest.mock import patch, mock_open
+
+from hookify.core.config_loader import load_rules, load_rule_file, extract_frontmatter
+from hookify.core.rule_engine import RuleEngine, compile_regex
+
+
+class TestTranscriptFileErrors:
+    """Tests for handling transcript file access errors."""
+
+    def test_missing_transcript_file(self, rule_engine: RuleEngine, temp_project_dir):
+        """Test handling when transcript file doesn't exist."""
+        stop_input = {
+            "hook_event_name": "Stop",
+            "reason": "Done",
+            "transcript_path": "/nonexistent/transcript.txt",
+        }
+
+        rules = [
+            _make_rule(
+                name="check-transcript",
+                event="stop",
+                conditions=[{"field": "transcript", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test message"
+            ),
+        ]
+
+        # Should not crash, transcript returns empty string
+        result = rule_engine.evaluate_rules(rules, stop_input)
+        # Rule shouldn't match since transcript is empty
+        assert result == {}
+
+    def test_unreadable_transcript_file(self, rule_engine: RuleEngine, temp_project_dir):
+        """Test handling when transcript file is unreadable."""
+        # Create file and remove read permissions
+        transcript_file = temp_project_dir / "unreadable.txt"
+        transcript_file.write_text("content")
+        os.chmod(transcript_file, 0o000)
+
+        stop_input = {
+            "hook_event_name": "Stop",
+            "reason": "Done",
+            "transcript_path": str(transcript_file),
+        }
+
+        rules = [
+            _make_rule(
+                name="check-transcript",
+                event="stop",
+                conditions=[{"field": "transcript", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        try:
+            # Should not crash
+            result = rule_engine.evaluate_rules(rules, stop_input)
+            assert result == {}  # No match since transcript couldn't be read
+        finally:
+            # Restore permissions for cleanup
+            os.chmod(transcript_file, 0o644)
+
+
+class TestRegexErrors:
+    """Tests for regex compilation and matching errors."""
+
+    def test_invalid_regex_pattern(self, rule_engine: RuleEngine):
+        """Test handling of invalid regex patterns."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "ls -la"}
+        }
+
+        rules = [
+            _make_rule(
+                name="invalid-regex",
+                event="bash",
+                conditions=[{"field": "command", "operator": "regex_match", "pattern": "[unclosed"}],
+                action="block",
+                message="Should not match"
+            ),
+        ]
+
+        # Should not crash, invalid regex returns False (no match)
+        result = rule_engine.evaluate_rules(rules, input_data)
+        assert result == {}
+
+    def test_catastrophic_backtracking_regex(self, rule_engine: RuleEngine):
+        """Test handling of potentially slow regex patterns."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "a" * 100}
+        }
+
+        # This pattern could cause catastrophic backtracking in some engines
+        # Python's re module handles this reasonably well
+        rules = [
+            _make_rule(
+                name="complex-regex",
+                event="bash",
+                conditions=[{"field": "command", "operator": "regex_match", "pattern": "(a+)+$"}],
+                action="warn",
+                message="Matched"
+            ),
+        ]
+
+        # Should complete without hanging
+        result = rule_engine.evaluate_rules(rules, input_data)
+        assert "Matched" in result.get("systemMessage", "")
+
+    def test_regex_cache(self):
+        """Test that regex patterns are cached."""
+        pattern = r"test\s+pattern"
+
+        # Compile same pattern twice
+        regex1 = compile_regex(pattern)
+        regex2 = compile_regex(pattern)
+
+        # Should be the same object due to caching
+        assert regex1 is regex2
+
+
+class TestMalformedInput:
+    """Tests for handling malformed input data."""
+
+    def test_missing_tool_name(self, rule_engine: RuleEngine):
+        """Test handling input without tool_name."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            # Missing tool_name
+            "tool_input": {"command": "test"}
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Should not crash
+        result = rule_engine.evaluate_rules(rules, input_data)
+        # May or may not match depending on implementation
+
+    def test_missing_tool_input(self, rule_engine: RuleEngine):
+        """Test handling input without tool_input."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            # Missing tool_input
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Should not crash
+        result = rule_engine.evaluate_rules(rules, input_data)
+        assert result == {}  # No match with missing input
+
+    def test_null_values_in_input(self, rule_engine: RuleEngine):
+        """Test handling None values in tool_input."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {
+                "command": None
+            }
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Should not crash
+        result = rule_engine.evaluate_rules(rules, input_data)
+
+    def test_non_string_field_values(self, rule_engine: RuleEngine):
+        """Test handling non-string values that get converted."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {
+                "command": 123  # Number instead of string
+            }
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "123"}],
+                action="warn",
+                message="Found number"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, input_data)
+        # Should convert to string and match
+        assert "Found number" in result.get("systemMessage", "")
+
+
+class TestRuleFileErrors:
+    """Tests for rule file loading errors."""
+
+    def test_malformed_yaml(self, create_rule_file):
+        """Test handling of malformed YAML in frontmatter."""
+        content = """---
+name: test
+enabled: [unclosed bracket
+---
+message
+"""
+        rule_file = create_rule_file("malformed", content)
+        rule = load_rule_file(str(rule_file))
+
+        # Should handle gracefully (may return None or partial data)
+        # The custom YAML parser is lenient
+
+    def test_unicode_errors(self, temp_project_dir):
+        """Test handling of files with invalid unicode."""
+        rule_file = temp_project_dir / ".claude" / "hookify.unicode.local.md"
+
+        # Write binary content that's not valid UTF-8
+        with open(rule_file, 'wb') as f:
+            f.write(b"---\nname: test\n---\n\xff\xfe invalid unicode")
+
+        rule = load_rule_file(str(rule_file))
+        assert rule is None  # Should return None for encoding errors
+
+    def test_empty_file(self, create_rule_file):
+        """Test handling of empty rule file."""
+        rule_file = create_rule_file("empty", "")
+        rule = load_rule_file(str(rule_file))
+
+        assert rule is None
+
+
+class TestFieldExtractionErrors:
+    """Tests for field extraction edge cases."""
+
+    def test_unknown_field_name(self, rule_engine: RuleEngine):
+        """Test handling of unknown field names."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "test"}
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "nonexistent_field", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Should not crash, unknown field returns None -> no match
+        result = rule_engine.evaluate_rules(rules, input_data)
+        assert result == {}
+
+    def test_multiedit_with_empty_edits(self, rule_engine: RuleEngine):
+        """Test MultiEdit tool with empty edits array."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "/test/file.py",
+                "edits": []  # Empty edits
+            }
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="file",
+                conditions=[{"field": "new_text", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Should not crash
+        result = rule_engine.evaluate_rules(rules, input_data)
+        assert result == {}
+
+    def test_multiedit_with_malformed_edits(self, rule_engine: RuleEngine):
+        """Test MultiEdit tool with malformed edit entries."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "MultiEdit",
+            "tool_input": {
+                "file_path": "/test/file.py",
+                "edits": [
+                    {"invalid": "entry"},  # Missing new_string
+                    None,  # Null entry
+                    "not a dict"  # Wrong type
+                ]
+            }
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="file",
+                conditions=[{"field": "new_text", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Should handle gracefully
+        result = rule_engine.evaluate_rules(rules, input_data)
+
+
+class TestOperatorEdgeCases:
+    """Tests for operator edge cases."""
+
+    def test_unknown_operator(self, rule_engine: RuleEngine):
+        """Test handling of unknown operator."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "test"}
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "unknown_op", "pattern": "test"}],
+                action="warn",
+                message="Test"
+            ),
+        ]
+
+        # Unknown operator returns False -> no match
+        result = rule_engine.evaluate_rules(rules, input_data)
+        assert result == {}
+
+    def test_empty_pattern(self, rule_engine: RuleEngine):
+        """Test handling of empty pattern."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "test"}
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": ""}],
+                action="warn",
+                message="Empty pattern"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, input_data)
+        # Empty string is contained in any string
+        assert "Empty pattern" in result.get("systemMessage", "")
+
+    def test_special_characters_in_pattern(self, rule_engine: RuleEngine):
+        """Test patterns with special regex characters when using 'contains'."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "echo $HOME"}
+        }
+
+        rules = [
+            _make_rule(
+                name="test-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "$HOME"}],
+                action="warn",
+                message="Found $HOME"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, input_data)
+        # 'contains' does literal string matching, not regex
+        assert "Found $HOME" in result.get("systemMessage", "")
+
+
+class TestConcurrentRuleEvaluation:
+    """Tests for multiple rules with various states."""
+
+    def test_mixed_match_states(self, rule_engine: RuleEngine):
+        """Test evaluation with mix of matching and non-matching rules."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "ls -la"}
+        }
+
+        rules = [
+            _make_rule(
+                name="match-ls",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "ls"}],
+                action="warn",
+                message="Found ls"
+            ),
+            _make_rule(
+                name="no-match-rm",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "rm"}],
+                action="block",
+                message="Found rm"
+            ),
+            _make_rule(
+                name="match-dash",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "-"}],
+                action="warn",
+                message="Found dash"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, input_data)
+
+        # Should have warnings from matching rules
+        assert "Found ls" in result.get("systemMessage", "")
+        assert "Found dash" in result.get("systemMessage", "")
+        # Should not have blocking (rm rule didn't match)
+        assert "hookSpecificOutput" not in result
+
+    def test_empty_rules_list(self, rule_engine: RuleEngine):
+        """Test evaluation with empty rules list."""
+        input_data = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "ls"}
+        }
+
+        result = rule_engine.evaluate_rules([], input_data)
+        assert result == {}
+
+
+# Helper function to create rules for tests
+def _make_rule(name, event, conditions, action="warn", message="Test", enabled=True, tool_matcher=None):
+    """Helper to create Rule objects."""
+    from hookify.core.config_loader import Rule, Condition
+
+    cond_objects = [
+        Condition(
+            field=c.get("field", ""),
+            operator=c.get("operator", "regex_match"),
+            pattern=c.get("pattern", "")
+        )
+        for c in conditions
+    ]
+    return Rule(
+        name=name,
+        enabled=enabled,
+        event=event,
+        conditions=cond_objects,
+        action=action,
+        message=message,
+        tool_matcher=tool_matcher
+    )

plugins/hookify/tests/test_integration.py

@@ -0,0 +1,662 @@
+"""Integration tests for multi-hook scenarios in hookify.
+
+Tests cover:
+- Multiple hooks running against same input
+- Hook priority (blocking rules over warnings)
+- Cross-event state management
+- Different tool types with varying field structures
+- Error handling and fault tolerance
+"""
+
+import pytest
+from typing import Dict, Any, List
+
+from hookify.core.config_loader import Rule, Condition, load_rules
+from hookify.core.rule_engine import RuleEngine
+
+
+def make_rule(
+    name: str,
+    event: str,
+    conditions: List[Dict[str, str]],
+    action: str = "warn",
+    message: str = "Test message",
+    enabled: bool = True,
+    tool_matcher: str = None
+) -> Rule:
+    """Helper function to create Rule objects for testing."""
+    cond_objects = [
+        Condition(
+            field=c.get("field", ""),
+            operator=c.get("operator", "regex_match"),
+            pattern=c.get("pattern", "")
+        )
+        for c in conditions
+    ]
+    return Rule(
+        name=name,
+        enabled=enabled,
+        event=event,
+        conditions=cond_objects,
+        action=action,
+        message=message,
+        tool_matcher=tool_matcher
+    )
+
+
+class TestMultipleRulesEvaluation:
+    """Tests for evaluating multiple rules against the same input."""
+
+    def test_multiple_warning_rules_combined(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Multiple warning rules should combine their messages."""
+        rules = [
+            make_rule(
+                name="warn-ls",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "ls"}],
+                action="warn",
+                message="ls command detected"
+            ),
+            make_rule(
+                name="warn-la-flag",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "-la"}],
+                action="warn",
+                message="-la flag detected"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+
+        assert "systemMessage" in result
+        assert "warn-ls" in result["systemMessage"]
+        assert "warn-la-flag" in result["systemMessage"]
+        assert "ls command detected" in result["systemMessage"]
+        assert "-la flag detected" in result["systemMessage"]
+
+    def test_blocking_rule_takes_priority(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Blocking rules should take priority over warnings."""
+        # Modify input to trigger blocking rule
+        sample_bash_input["tool_input"]["command"] = "rm -rf /tmp/test"
+
+        rules = [
+            make_rule(
+                name="warn-rm",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "rm"}],
+                action="warn",
+                message="rm command detected"
+            ),
+            make_rule(
+                name="block-rm-rf",
+                event="bash",
+                conditions=[{"field": "command", "operator": "regex_match", "pattern": r"rm\s+-rf"}],
+                action="block",
+                message="Dangerous rm -rf blocked!"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+
+        # Should have blocking output, not warning
+        assert "hookSpecificOutput" in result
+        assert result["hookSpecificOutput"]["permissionDecision"] == "deny"
+        assert "block-rm-rf" in result["systemMessage"]
+        assert "Dangerous rm -rf blocked!" in result["systemMessage"]
+
+    def test_multiple_blocking_rules_combined(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Multiple blocking rules should combine their messages."""
+        sample_bash_input["tool_input"]["command"] = "sudo rm -rf /"
+
+        rules = [
+            make_rule(
+                name="block-sudo",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "sudo"}],
+                action="block",
+                message="sudo is blocked"
+            ),
+            make_rule(
+                name="block-rm-rf",
+                event="bash",
+                conditions=[{"field": "command", "operator": "regex_match", "pattern": r"rm\s+-rf"}],
+                action="block",
+                message="rm -rf is blocked"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+
+        assert result["hookSpecificOutput"]["permissionDecision"] == "deny"
+        assert "block-sudo" in result["systemMessage"]
+        assert "block-rm-rf" in result["systemMessage"]
+
+    def test_no_matching_rules_returns_empty(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """When no rules match, result should be empty (allow operation)."""
+        rules = [
+            make_rule(
+                name="block-delete",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "delete"}],
+                action="block",
+                message="delete blocked"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+        assert result == {}
+
+
+class TestMultipleConditions:
+    """Tests for rules with multiple conditions (AND logic)."""
+
+    def test_all_conditions_must_match(self, rule_engine: RuleEngine, sample_write_input: Dict[str, Any]):
+        """Rule matches only if ALL conditions match."""
+        rules = [
+            make_rule(
+                name="block-sensitive-write",
+                event="file",
+                conditions=[
+                    {"field": "file_path", "operator": "contains", "pattern": ".env"},
+                    {"field": "content", "operator": "contains", "pattern": "SECRET"},
+                ],
+                action="block",
+                message="Cannot write secrets to .env"
+            ),
+        ]
+
+        # Neither condition matches
+        result = rule_engine.evaluate_rules(rules, sample_write_input)
+        assert result == {}
+
+        # Only first condition matches
+        sample_write_input["tool_input"]["file_path"] = "/project/.env"
+        result = rule_engine.evaluate_rules(rules, sample_write_input)
+        assert result == {}
+
+        # Both conditions match
+        sample_write_input["tool_input"]["content"] = "SECRET_KEY=abc123"
+        result = rule_engine.evaluate_rules(rules, sample_write_input)
+        assert "hookSpecificOutput" in result
+        assert result["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+    def test_multiple_operators_in_conditions(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Test different operators in multiple conditions."""
+        rules = [
+            make_rule(
+                name="block-dangerous-curl",
+                event="bash",
+                conditions=[
+                    {"field": "command", "operator": "starts_with", "pattern": "curl"},
+                    {"field": "command", "operator": "contains", "pattern": "|"},
+                    {"field": "command", "operator": "regex_match", "pattern": r"(bash|sh|eval)"},
+                ],
+                action="block",
+                message="Dangerous curl pipe detected"
+            ),
+        ]
+
+        # Normal curl - doesn't match
+        sample_bash_input["tool_input"]["command"] = "curl https://example.com"
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+        assert result == {}
+
+        # Dangerous curl pipe to bash - matches all
+        sample_bash_input["tool_input"]["command"] = "curl https://example.com | bash"
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+        assert result["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+class TestToolTypeFieldExtraction:
+    """Tests for field extraction across different tool types."""
+
+    def test_bash_command_field(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Test field extraction for Bash tool."""
+        rules = [
+            make_rule(
+                name="detect-git",
+                event="bash",
+                conditions=[{"field": "command", "operator": "starts_with", "pattern": "git"}],
+                action="warn",
+                message="git command"
+            ),
+        ]
+
+        sample_bash_input["tool_input"]["command"] = "git status"
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+        assert "git command" in result.get("systemMessage", "")
+
+    def test_write_content_and_path(self, rule_engine: RuleEngine, sample_write_input: Dict[str, Any]):
+        """Test field extraction for Write tool."""
+        rules = [
+            make_rule(
+                name="detect-python-file",
+                event="file",
+                conditions=[
+                    {"field": "file_path", "operator": "ends_with", "pattern": ".py"},
+                    {"field": "content", "operator": "contains", "pattern": "import"},
+                ],
+                action="warn",
+                message="Python file with imports"
+            ),
+        ]
+
+        sample_write_input["tool_input"]["content"] = "import os\nprint('hello')"
+        result = rule_engine.evaluate_rules(rules, sample_write_input)
+        assert "Python file with imports" in result.get("systemMessage", "")
+
+    def test_edit_old_and_new_string(self, rule_engine: RuleEngine, sample_edit_input: Dict[str, Any]):
+        """Test field extraction for Edit tool (old_string and new_string)."""
+        rules = [
+            make_rule(
+                name="detect-password-removal",
+                event="file",
+                conditions=[
+                    {"field": "old_string", "operator": "contains", "pattern": "password"},
+                ],
+                action="warn",
+                message="Removing password-related code"
+            ),
+        ]
+
+        sample_edit_input["tool_input"]["old_string"] = "password = 'secret'"
+        sample_edit_input["tool_input"]["new_string"] = "# removed"
+        result = rule_engine.evaluate_rules(rules, sample_edit_input)
+        assert "Removing password-related code" in result.get("systemMessage", "")
+
+    def test_multiedit_concatenated_content(self, rule_engine: RuleEngine, sample_multiedit_input: Dict[str, Any]):
+        """Test field extraction for MultiEdit tool (concatenated edits)."""
+        rules = [
+            make_rule(
+                name="detect-eval",
+                event="file",
+                conditions=[
+                    {"field": "new_text", "operator": "contains", "pattern": "eval("},
+                ],
+                action="block",
+                message="eval() is dangerous"
+            ),
+        ]
+
+        # Add an edit containing eval
+        sample_multiedit_input["tool_input"]["edits"] = [
+            {"old_string": "process()", "new_string": "eval(user_input)"},
+            {"old_string": "foo", "new_string": "bar"},
+        ]
+        result = rule_engine.evaluate_rules(rules, sample_multiedit_input)
+        assert result["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+
+class TestStopEventIntegration:
+    """Tests for Stop event hook scenarios."""
+
+    def test_stop_with_transcript_check(self, rule_engine: RuleEngine, sample_stop_input: Dict[str, Any]):
+        """Test Stop event that checks transcript content."""
+        rules = [
+            make_rule(
+                name="require-tests",
+                event="stop",
+                conditions=[
+                    {"field": "transcript", "operator": "not_contains", "pattern": "npm test"},
+                ],
+                action="block",
+                message="Please run tests before stopping"
+            ),
+        ]
+
+        # Transcript contains "npm test", so rule should NOT match
+        result = rule_engine.evaluate_rules(rules, sample_stop_input)
+        assert result == {}
+
+    def test_stop_blocks_without_tests(self, rule_engine: RuleEngine, temp_project_dir):
+        """Test Stop event blocks when tests weren't run."""
+        # Create transcript without test command
+        transcript_file = temp_project_dir / "no_tests_transcript.txt"
+        transcript_file.write_text("""
+User: Implement the feature
+Assistant: Done!
+""")
+
+        stop_input = {
+            "hook_event_name": "Stop",
+            "reason": "Task completed",
+            "transcript_path": str(transcript_file),
+        }
+
+        rules = [
+            make_rule(
+                name="require-tests",
+                event="stop",
+                conditions=[
+                    {"field": "transcript", "operator": "not_contains", "pattern": "test"},
+                ],
+                action="block",
+                message="Please run tests before stopping"
+            ),
+        ]
+
+        rule_engine = RuleEngine()
+        result = rule_engine.evaluate_rules(rules, stop_input)
+
+        assert result["decision"] == "block"
+        assert "require-tests" in result["systemMessage"]
+
+    def test_stop_reason_field(self, rule_engine: RuleEngine, sample_stop_input: Dict[str, Any]):
+        """Test Stop event checking the reason field."""
+        rules = [
+            make_rule(
+                name="no-early-exit",
+                event="stop",
+                conditions=[
+                    {"field": "reason", "operator": "contains", "pattern": "giving up"},
+                ],
+                action="block",
+                message="Don't give up! Try a different approach."
+            ),
+        ]
+
+        # Normal reason - doesn't match
+        result = rule_engine.evaluate_rules(rules, sample_stop_input)
+        assert result == {}
+
+        # Giving up reason - matches
+        sample_stop_input["reason"] = "giving up on this task"
+        result = rule_engine.evaluate_rules(rules, sample_stop_input)
+        assert "Don't give up" in result.get("systemMessage", "")
+
+
+class TestUserPromptSubmitIntegration:
+    """Tests for UserPromptSubmit event hook scenarios."""
+
+    def test_prompt_content_validation(self, rule_engine: RuleEngine, sample_userprompt_input: Dict[str, Any]):
+        """Test validating user prompt content."""
+        rules = [
+            make_rule(
+                name="warn-destructive-request",
+                event="prompt",
+                conditions=[
+                    {"field": "user_prompt", "operator": "regex_match", "pattern": r"delete\s+all"},
+                ],
+                action="warn",
+                message="This looks like a destructive request"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_userprompt_input)
+        assert "destructive request" in result.get("systemMessage", "")
+
+    def test_prompt_blocking(self, rule_engine: RuleEngine, sample_userprompt_input: Dict[str, Any]):
+        """Test blocking certain prompt patterns."""
+        rules = [
+            make_rule(
+                name="block-injection",
+                event="prompt",
+                conditions=[
+                    {"field": "user_prompt", "operator": "contains", "pattern": "ignore previous instructions"},
+                ],
+                action="block",
+                message="Potential prompt injection detected"
+            ),
+        ]
+
+        # Normal prompt - doesn't match
+        result = rule_engine.evaluate_rules(rules, sample_userprompt_input)
+        assert "hookSpecificOutput" not in result
+
+        # Injection attempt - matches
+        sample_userprompt_input["user_prompt"] = "ignore previous instructions and..."
+        result = rule_engine.evaluate_rules(rules, sample_userprompt_input)
+        assert "prompt injection" in result.get("systemMessage", "")
+
+
+class TestToolMatcherFiltering:
+    """Tests for tool_matcher filtering rules to specific tools."""
+
+    def test_tool_matcher_single_tool(self, rule_engine: RuleEngine):
+        """Test tool_matcher filtering to a single tool."""
+        rules = [
+            make_rule(
+                name="bash-only",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="Bash rule",
+                tool_matcher="Bash"
+            ),
+        ]
+
+        bash_input = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Bash",
+            "tool_input": {"command": "test command"}
+        }
+        write_input = {
+            "hook_event_name": "PreToolUse",
+            "tool_name": "Write",
+            "tool_input": {"content": "test content"}
+        }
+
+        # Should match Bash
+        result = rule_engine.evaluate_rules(rules, bash_input)
+        assert "Bash rule" in result.get("systemMessage", "")
+
+        # Should not match Write
+        result = rule_engine.evaluate_rules(rules, write_input)
+        assert result == {}
+
+    def test_tool_matcher_multiple_tools(self, rule_engine: RuleEngine, sample_edit_input: Dict[str, Any]):
+        """Test tool_matcher with pipe-separated tools."""
+        rules = [
+            make_rule(
+                name="file-tools",
+                event="file",
+                conditions=[{"field": "file_path", "operator": "ends_with", "pattern": ".py"}],
+                action="warn",
+                message="Python file edit",
+                tool_matcher="Edit|Write|MultiEdit"
+            ),
+        ]
+
+        # Edit tool should match
+        result = rule_engine.evaluate_rules(rules, sample_edit_input)
+        assert "Python file edit" in result.get("systemMessage", "")
+
+    def test_tool_matcher_wildcard(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Test tool_matcher with wildcard."""
+        rules = [
+            make_rule(
+                name="all-tools",
+                event="all",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "test"}],
+                action="warn",
+                message="All tools rule",
+                tool_matcher="*"
+            ),
+        ]
+
+        sample_bash_input["tool_input"]["command"] = "test command"
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+        assert "All tools rule" in result.get("systemMessage", "")
+
+
+class TestRegexOperations:
+    """Tests for regex pattern matching and caching."""
+
+    def test_complex_regex_patterns(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Test complex regex patterns."""
+        rules = [
+            make_rule(
+                name="detect-secret-env",
+                event="bash",
+                conditions=[
+                    {"field": "command", "operator": "regex_match",
+                     "pattern": r"(SECRET|PASSWORD|API_KEY|TOKEN)[\s]*="},
+                ],
+                action="block",
+                message="Secret assignment detected"
+            ),
+        ]
+
+        # Test various patterns
+        test_cases = [
+            ("export SECRET=abc", True),
+            ("export PASSWORD = abc", True),
+            ("export API_KEY=xyz", True),
+            ("export TOKEN=123", True),
+            ("export NAME=test", False),
+            ("echo hello", False),
+        ]
+
+        for command, should_match in test_cases:
+            sample_bash_input["tool_input"]["command"] = command
+            result = rule_engine.evaluate_rules(rules, sample_bash_input)
+            if should_match:
+                assert "hookSpecificOutput" in result, f"Expected match for: {command}"
+            else:
+                assert result == {}, f"Expected no match for: {command}"
+
+    def test_case_insensitive_matching(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Test that regex matching is case-insensitive."""
+        rules = [
+            make_rule(
+                name="detect-sudo",
+                event="bash",
+                conditions=[
+                    {"field": "command", "operator": "regex_match", "pattern": "sudo"},
+                ],
+                action="warn",
+                message="sudo detected"
+            ),
+        ]
+
+        # Should match regardless of case
+        for cmd in ["sudo apt install", "SUDO apt install", "Sudo apt install"]:
+            sample_bash_input["tool_input"]["command"] = cmd
+            result = rule_engine.evaluate_rules(rules, sample_bash_input)
+            assert "sudo detected" in result.get("systemMessage", ""), f"Failed for: {cmd}"
+
+    def test_invalid_regex_handled_gracefully(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Test that invalid regex patterns don't crash."""
+        rules = [
+            make_rule(
+                name="invalid-regex",
+                event="bash",
+                conditions=[
+                    {"field": "command", "operator": "regex_match", "pattern": "[invalid(regex"},
+                ],
+                action="block",
+                message="Should not match"
+            ),
+        ]
+
+        # Should not crash, should return empty (no match)
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+        assert result == {}
+
+
+class TestDisabledRules:
+    """Tests for disabled rule handling."""
+
+    def test_disabled_rules_not_evaluated(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Disabled rules should not be evaluated."""
+        rules = [
+            make_rule(
+                name="disabled-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "ls"}],
+                action="block",
+                message="Should not appear",
+                enabled=False
+            ),
+            make_rule(
+                name="enabled-rule",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "ls"}],
+                action="warn",
+                message="Enabled rule matched",
+                enabled=True
+            ),
+        ]
+
+        # Filter to only enabled rules (as load_rules does)
+        enabled_rules = [r for r in rules if r.enabled]
+        result = rule_engine.evaluate_rules(enabled_rules, sample_bash_input)
+
+        assert "Enabled rule matched" in result.get("systemMessage", "")
+        assert "Should not appear" not in result.get("systemMessage", "")
+
+
+class TestRulesWithNoConditions:
+    """Tests for edge cases with empty conditions."""
+
+    def test_rule_without_conditions_does_not_match(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Rules without conditions should not match anything."""
+        rule = Rule(
+            name="empty-conditions",
+            enabled=True,
+            event="bash",
+            conditions=[],  # Empty conditions
+            action="warn",
+            message="Should not match"
+        )
+
+        result = rule_engine.evaluate_rules([rule], sample_bash_input)
+        assert result == {}
+
+
+class TestOutputFormats:
+    """Tests for correct output format for different event types."""
+
+    def test_pretooluse_blocking_format(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """PreToolUse blocking should use hookSpecificOutput format."""
+        rules = [
+            make_rule(
+                name="block-test",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "ls"}],
+                action="block",
+                message="Blocked"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+
+        assert "hookSpecificOutput" in result
+        assert result["hookSpecificOutput"]["hookEventName"] == "PreToolUse"
+        assert result["hookSpecificOutput"]["permissionDecision"] == "deny"
+        assert "systemMessage" in result
+
+    def test_stop_blocking_format(self, rule_engine: RuleEngine, sample_stop_input: Dict[str, Any]):
+        """Stop blocking should use decision format."""
+        rules = [
+            make_rule(
+                name="block-stop",
+                event="stop",
+                conditions=[{"field": "reason", "operator": "contains", "pattern": "completed"}],
+                action="block",
+                message="Blocked"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_stop_input)
+
+        assert result.get("decision") == "block"
+        assert "reason" in result
+        assert "systemMessage" in result
+
+    def test_warning_format(self, rule_engine: RuleEngine, sample_bash_input: Dict[str, Any]):
+        """Warning should only have systemMessage, not hookSpecificOutput."""
+        rules = [
+            make_rule(
+                name="warn-test",
+                event="bash",
+                conditions=[{"field": "command", "operator": "contains", "pattern": "ls"}],
+                action="warn",
+                message="Warning"
+            ),
+        ]
+
+        result = rule_engine.evaluate_rules(rules, sample_bash_input)
+
+        assert "systemMessage" in result
+        assert "hookSpecificOutput" not in result

plugins/hookify/tests/test_rule_loading.py

@@ -0,0 +1,410 @@
+"""Tests for rule loading and filtering from .local.md files.
+
+Tests cover:
+- Loading multiple rule files
+- Event-based filtering
+- YAML frontmatter parsing
+- Legacy pattern to conditions conversion
+"""
+
+import pytest
+from pathlib import Path
+
+from hookify.core.config_loader import (
+    Rule, Condition, load_rules, load_rule_file, extract_frontmatter
+)
+
+
+class TestExtractFrontmatter:
+    """Tests for YAML frontmatter extraction."""
+
+    def test_simple_frontmatter(self):
+        """Test parsing simple key-value pairs."""
+        content = """---
+name: test-rule
+enabled: true
+event: bash
+action: warn
+---
+
+Rule message here.
+"""
+        frontmatter, message = extract_frontmatter(content)
+
+        assert frontmatter["name"] == "test-rule"
+        assert frontmatter["enabled"] is True
+        assert frontmatter["event"] == "bash"
+        assert frontmatter["action"] == "warn"
+        assert message == "Rule message here."
+
+    def test_boolean_values(self):
+        """Test boolean value parsing (true/false)."""
+        content = """---
+enabled: true
+disabled: false
+---
+msg
+"""
+        frontmatter, _ = extract_frontmatter(content)
+
+        assert frontmatter["enabled"] is True
+        assert frontmatter["disabled"] is False
+
+    def test_quoted_strings(self):
+        """Test quoted string parsing."""
+        content = """---
+pattern: "rm -rf"
+name: 'test-name'
+---
+msg
+"""
+        frontmatter, _ = extract_frontmatter(content)
+
+        assert frontmatter["pattern"] == "rm -rf"
+        assert frontmatter["name"] == "test-name"
+
+    def test_conditions_list(self):
+        """Test parsing conditions as list of dicts."""
+        content = """---
+name: test
+conditions:
+  - field: command
+    operator: contains
+    pattern: test
+  - field: file_path
+    operator: ends_with
+    pattern: .py
+---
+msg
+"""
+        frontmatter, _ = extract_frontmatter(content)
+
+        assert "conditions" in frontmatter
+        assert len(frontmatter["conditions"]) == 2
+        assert frontmatter["conditions"][0]["field"] == "command"
+        assert frontmatter["conditions"][0]["operator"] == "contains"
+        assert frontmatter["conditions"][1]["pattern"] == ".py"
+
+    def test_inline_dict_conditions(self):
+        """Test parsing inline comma-separated dict items."""
+        content = """---
+name: test
+conditions:
+  - field: command, operator: regex_match, pattern: test
+---
+msg
+"""
+        frontmatter, _ = extract_frontmatter(content)
+
+        assert len(frontmatter["conditions"]) == 1
+        assert frontmatter["conditions"][0]["field"] == "command"
+        assert frontmatter["conditions"][0]["operator"] == "regex_match"
+
+    def test_no_frontmatter(self):
+        """Test handling content without frontmatter."""
+        content = "Just plain text without frontmatter"
+        frontmatter, message = extract_frontmatter(content)
+
+        assert frontmatter == {}
+        assert message == content
+
+    def test_incomplete_frontmatter(self):
+        """Test handling incomplete frontmatter markers."""
+        content = """---
+name: test
+No closing marker
+"""
+        frontmatter, _ = extract_frontmatter(content)
+        assert frontmatter == {}
+
+
+class TestLoadRuleFile:
+    """Tests for loading individual rule files."""
+
+    def test_load_valid_rule(self, create_rule_file):
+        """Test loading a valid rule file."""
+        content = """---
+name: valid-rule
+enabled: true
+event: bash
+action: block
+conditions:
+  - field: command
+    operator: contains
+    pattern: danger
+---
+
+This is a dangerous command!
+"""
+        rule_file = create_rule_file("valid-rule", content)
+        rule = load_rule_file(str(rule_file))
+
+        assert rule is not None
+        assert rule.name == "valid-rule"
+        assert rule.enabled is True
+        assert rule.event == "bash"
+        assert rule.action == "block"
+        assert len(rule.conditions) == 1
+        assert rule.conditions[0].field == "command"
+        assert "dangerous command" in rule.message
+
+    def test_load_legacy_pattern_rule(self, create_rule_file):
+        """Test loading rule with legacy pattern (converts to condition)."""
+        content = """---
+name: legacy-rule
+enabled: true
+event: bash
+pattern: "rm -rf"
+---
+
+Old style rule.
+"""
+        rule_file = create_rule_file("legacy-rule", content)
+        rule = load_rule_file(str(rule_file))
+
+        assert rule is not None
+        assert len(rule.conditions) == 1
+        assert rule.conditions[0].field == "command"  # Inferred from bash event
+        assert rule.conditions[0].operator == "regex_match"
+        assert rule.conditions[0].pattern == "rm -rf"
+
+    def test_load_file_event_legacy_pattern(self, create_rule_file):
+        """Test legacy pattern with file event infers correct field."""
+        content = """---
+name: file-legacy
+enabled: true
+event: file
+pattern: "TODO"
+---
+
+Found TODO.
+"""
+        rule_file = create_rule_file("file-legacy", content)
+        rule = load_rule_file(str(rule_file))
+
+        assert rule.conditions[0].field == "new_text"
+
+    def test_load_missing_frontmatter(self, create_rule_file):
+        """Test loading file without frontmatter returns None."""
+        content = "No frontmatter here"
+        rule_file = create_rule_file("no-frontmatter", content)
+        rule = load_rule_file(str(rule_file))
+
+        assert rule is None
+
+    def test_load_nonexistent_file(self):
+        """Test loading nonexistent file returns None."""
+        rule = load_rule_file("/nonexistent/path/hookify.test.local.md")
+        assert rule is None
+
+
+class TestLoadRules:
+    """Tests for loading multiple rules with filtering."""
+
+    def test_load_multiple_rules(self, temp_project_dir, create_rule_file):
+        """Test loading multiple rule files."""
+        create_rule_file("rule1", """---
+name: rule-one
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: contains
+    pattern: test1
+---
+Rule 1
+""")
+        create_rule_file("rule2", """---
+name: rule-two
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: contains
+    pattern: test2
+---
+Rule 2
+""")
+
+        rules = load_rules()
+
+        assert len(rules) == 2
+        names = {r.name for r in rules}
+        assert "rule-one" in names
+        assert "rule-two" in names
+
+    def test_filter_by_event(self, temp_project_dir, create_rule_file):
+        """Test filtering rules by event type."""
+        create_rule_file("bash-rule", """---
+name: bash-rule
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: contains
+    pattern: test
+---
+Bash rule
+""")
+        create_rule_file("file-rule", """---
+name: file-rule
+enabled: true
+event: file
+conditions:
+  - field: content
+    operator: contains
+    pattern: test
+---
+File rule
+""")
+        create_rule_file("all-rule", """---
+name: all-rule
+enabled: true
+event: all
+conditions:
+  - field: content
+    operator: contains
+    pattern: test
+---
+All events rule
+""")
+
+        # Filter for bash events
+        bash_rules = load_rules(event="bash")
+        bash_names = {r.name for r in bash_rules}
+        assert "bash-rule" in bash_names
+        assert "all-rule" in bash_names  # 'all' matches any event
+        assert "file-rule" not in bash_names
+
+        # Filter for file events
+        file_rules = load_rules(event="file")
+        file_names = {r.name for r in file_rules}
+        assert "file-rule" in file_names
+        assert "all-rule" in file_names
+        assert "bash-rule" not in file_names
+
+    def test_filter_excludes_disabled(self, temp_project_dir, create_rule_file):
+        """Test that disabled rules are excluded."""
+        create_rule_file("enabled-rule", """---
+name: enabled-rule
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: contains
+    pattern: test
+---
+Enabled
+""")
+        create_rule_file("disabled-rule", """---
+name: disabled-rule
+enabled: false
+event: bash
+conditions:
+  - field: command
+    operator: contains
+    pattern: test
+---
+Disabled
+""")
+
+        rules = load_rules()
+
+        assert len(rules) == 1
+        assert rules[0].name == "enabled-rule"
+
+    def test_load_rules_handles_invalid_file(self, temp_project_dir, create_rule_file):
+        """Test that invalid files are skipped without crashing."""
+        # Valid rule
+        create_rule_file("valid", """---
+name: valid
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: contains
+    pattern: test
+---
+Valid rule
+""")
+        # Invalid rule (no frontmatter)
+        create_rule_file("invalid", "No frontmatter")
+
+        rules = load_rules()
+
+        # Should only load the valid rule
+        assert len(rules) == 1
+        assert rules[0].name == "valid"
+
+    def test_load_with_no_rules(self, temp_project_dir):
+        """Test loading when no rule files exist."""
+        rules = load_rules()
+        assert rules == []
+
+
+class TestRuleFromDict:
+    """Tests for Rule.from_dict construction."""
+
+    def test_defaults(self):
+        """Test default values for optional fields."""
+        frontmatter = {
+            "name": "test",
+            "event": "bash",
+        }
+        rule = Rule.from_dict(frontmatter, "message")
+
+        assert rule.name == "test"
+        assert rule.enabled is True  # Default
+        assert rule.action == "warn"  # Default
+        assert rule.message == "message"
+
+    def test_explicit_values(self):
+        """Test explicit values override defaults."""
+        frontmatter = {
+            "name": "test",
+            "enabled": False,
+            "event": "file",
+            "action": "block",
+            "tool_matcher": "Write|Edit",
+        }
+        rule = Rule.from_dict(frontmatter, "message")
+
+        assert rule.enabled is False
+        assert rule.event == "file"
+        assert rule.action == "block"
+        assert rule.tool_matcher == "Write|Edit"
+
+
+class TestConditionFromDict:
+    """Tests for Condition.from_dict construction."""
+
+    def test_all_fields(self):
+        """Test creating condition with all fields."""
+        data = {
+            "field": "command",
+            "operator": "regex_match",
+            "pattern": r"rm\s+-rf"
+        }
+        condition = Condition.from_dict(data)
+
+        assert condition.field == "command"
+        assert condition.operator == "regex_match"
+        assert condition.pattern == r"rm\s+-rf"
+
+    def test_default_operator(self):
+        """Test default operator is regex_match."""
+        data = {
+            "field": "command",
+            "pattern": "test"
+        }
+        condition = Condition.from_dict(data)
+
+        assert condition.operator == "regex_match"
+
+    def test_missing_fields(self):
+        """Test missing fields default to empty strings."""
+        data = {}
+        condition = Condition.from_dict(data)
+
+        assert condition.field == ""
+        assert condition.pattern == ""