@thedecipherist/claude-packs 1.0.0 → 1.1.0

package/packs/base/hooks/git-guard.mjs

@@ -5,8 +5,8 @@
 // branch's upstream, and `remote add/set-url`, `clone`, `submodule` and `config` store it as a remote; the token then
 // sits in .git/config in plain text. Pushing to a token URL WITHOUT -u stores nothing and is allowed.
 //
-// THE HOUSE LAWS, when the project switches them on (.claude/layout.json "guards": { "git": { "house": true } };
-// a project whose history is on main moves to the branch flow first, then enables them):
+// THE HOUSE LAWS: a new install has them (KF-8). A project installed before 1.1.0 switches them on itself, with .claude/layout.json
+// "enable": ["guards/git-house"] or "guards": { "git": { "house": true } }; one whose history is on main moves to the branch flow first:
 //   1. No `git add -A`, `add .`, `add --all`, `commit -a`. Stage by path.
 //   2. No checkout / restore / stash / reset --hard / clean over uncommitted work; no override lets one through.
 //      `git restore --staged` (unstage only) passes. The project's safe form, if any, is named (guards.git.safeRestore).
@@ -23,14 +23,14 @@
 // first word (after VAR=value) is git or gh. `cd` and `git -C` move the folder the dirty-tree and trunk checks look at.
 // The laws hold in every repo a command reaches. `--selftest` proves both halves.
 import { execFileSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, normalize, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readLayout } from './lib/layout.mjs';
 import { claudeRoot } from './lib/project.mjs';
 import { asHook, isMain } from './lib/hook-log.mjs';
-import { forRepo, sshOwner, stopVerdict, unpushed, unpushedMessage } from './lib/pushed.mjs';
+import { NEW_INSTALL_GIT, ghLaw, pushLaw } from './lib/git-auth.mjs';
+import { forRepo, stopVerdict, unpushed, unpushedMessage } from './lib/pushed.mjs';
 
 // ---------- always: a token never stored ----------
 const URL_USER = /\b[a-z][\w+.-]*:\/\/([^\s/@'"]+)@/gi;
@@ -83,6 +83,7 @@ const real = {
   branch: (cwd) => (gitOut(cwd, 'rev-parse', '--abbrev-ref', 'HEAD') ?? '').trim(),
   hasHead: (cwd) => gitOut(cwd, 'rev-parse', '-q', '--verify', 'HEAD') !== null,
   remoteUrl: (cwd, name) => gitOut(cwd, 'remote', 'get-url', name)?.trim() || null,
+  merging: (cwd) => gitOut(cwd, 'rev-parse', '-q', '--verify', 'MERGE_HEAD') !== null,
 };
 // What a push sends to: the URL in the command, or the URL of the remote it names (null when neither is known).
 const pushTarget = (w, here, env) => { const a = w.slice(w.indexOf('push') + 1).filter((x) => !x.startsWith('-')); return !a.length ? null : /[:/]/.test(a[0]) ? a[0] : env.remoteUrl?.(here, a[0]) ?? null; };
@@ -106,17 +107,20 @@ export function house(cmd, cwd = '.', env = real, cfg = {}) {
     while (w.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w[0]) || ['env', 'command', 'time', 'nohup', 'exec'].includes(w[0]))) w = w.slice(1);
     if (!w.length || !['git', 'gh'].includes(w[0].split('/').pop())) continue;
     const p = w.join(' ');
-    if (/\bgit\b.*\badd\b.*(\s-A\b|\s--all\b|\s\.(\s|$))/.test(p) || (/\bgit\b.*\bcommit\b.*\s-[a-zA-Z]*a[a-zA-Z]*\b(?!\S)/.test(p) && !p.includes('--amend'))) {
+    const sub = w[0].split('/').pop() === 'git' ? subOf(w) : null; // the subcommand, never a word in an argument: `git rev-parse x^{commit}` commits nothing
+    const dryRun = sub === 'add' && /\s(-n|--dry-run)(\s|$)/.test(p); // KF-10: it stages nothing
+    if ((sub === 'add' && !dryRun && /(\s-A\b|\s--all\b|\s\.(\s|$))/.test(p)) || (sub === 'commit' && /\s-[a-zA-Z]*a[a-zA-Z]*\b(?!\S)/.test(p) && !p.includes('--amend'))) {
       return 'Stage by explicit path: `git add <paths>` and `git commit -- <paths>`. `add -A`, `add .` and `commit -a` sweep in other work.';
     }
-    for (const never of c.neverStage ?? []) if (/\bgit\b.*\badd\b/.test(p) && neverRx(never).test(p)) return `Nothing under ${never} is ever committed.`;
+    for (const never of c.neverStage ?? []) if (sub === 'add' && neverRx(never).test(p)) return `Nothing under ${never} is ever committed.`;
     const undo = p.match(/\bgit\b\s+(?:-C\s+\S+\s+)?(checkout|restore|stash|clean|reset)\b(.*)/);
     if (undo) {
       const [, verb, rest] = undo;
       const harmless = (verb === 'stash' && /\b(list|show|pop|apply)\b/.test(rest)) ||
         (verb === 'restore' && /\s--staged\b/.test(rest) && !/\s(--worktree|-W)\b/.test(rest)) ||
         (verb === 'reset' && !rest.includes('--hard')) || (verb === 'checkout' && /\s-b\b/.test(rest)) ||
-        (verb === 'clean' && /\s-[a-zA-Z]*n/.test(rest));
+        (verb === 'clean' && /\s-[a-zA-Z]*n/.test(rest)) ||
+        (verb === 'checkout' && /\s--(?:theirs|ours)\b/.test(rest) && env.merging?.(here)); // KF-21: a conflict resolved, not an undo
       if (!harmless) {
         const d = env.dirty(here);
         if (d.length) {
@@ -130,29 +134,27 @@ export function house(cmd, cwd = '.', env = real, cfg = {}) {
     if (/\bgit\b.*\bbranch\b.*\s(-D|-d|--delete)\b/.test(p) || /\bgit\b.*\bpush\b.*(\s--delete\b|\s:[\w/.-]+)/.test(p)) {
       return 'A branch is never deleted. Branches are the record of the build; they stay, here and on GitHub.';
     }
-    if (/\bgit\b.*\b(rebase|filter-branch)\b/.test(p) || /\bgit\b.*\bcommit\b.*--amend/.test(p)) return 'Nothing is rebased or amended. Make a new commit.';
-    if (/\bgit\b.*\s(--no-verify|-n)(\s|$)/.test(p) && /\bgit\b.*\b(commit|push|merge|am)\b/.test(p)) {
+    if (['rebase', 'filter-branch'].includes(sub) || (sub === 'commit' && p.includes('--amend'))) return 'Nothing is rebased or amended. Make a new commit.';
+    if (['commit', 'push', 'merge', 'am'].includes(sub) && /\s(--no-verify|-n)(\s|$)/.test(p)) {
       return 'Never --no-verify (or -n): the pre-commit hook is the gate. When it refuses, fix what it names; if a commit must hold something that fails the gates (a planted fault for a test), do not commit it: work on an uncommitted copy.';
     }
-    if (c.refuseTrunk && /\bgit\b.*\bcommit\b/.test(p) && (c.trunks ?? []).includes(env.branch(here)) && env.hasHead(here)) {
+    if (c.refuseTrunk && sub === 'commit' && (c.trunks ?? []).includes(env.branch(here)) && env.hasHead(here)) {
       return `This is the trunk. Every task is built on its own branch and merged when complete: ${c.branchStart}.`;
     }
     // WB-107: an agent's isolated worktree cannot push (its harness refuses), so the lead pushes its branch; Stop still holds it
-    if (!pushedBefore && env.unpushed && subOf(w) === 'commit' && !/\/\.claude\/worktrees\/agent-[^/]+(\/|$)/.test(here) && !(c.trunkNeedsYes && (c.trunks ?? []).includes(env.branch(here)))) {
+    if (!pushedBefore && env.unpushed && sub === 'commit' && !/\/\.claude\/worktrees\/agent-[^/]+(\/|$)/.test(here) && !(c.trunkNeedsYes && (c.trunks ?? []).includes(env.branch(here)))) {
       const u = env.unpushed(here, c);
       if (u?.error) env.warn?.(`git-guard: GitHub was not checked before this commit (${u.error}); the commit goes ahead unchecked. Push when it is back (KWB-26).`);
       else if (u?.commits?.length) return unpushedMessage(u, c);
     }
     if (/\bgit\b.*\bpush\b/.test(p)) {
       if (/\s(-f|--force|--force-with-lease)\b/.test(p)) return 'Never force a push. Nothing pushed is rebased or amended.';
-      const ssh = sshOwner(pushTarget(w, here, env)) === owner; // over SSH the key picks the account; the URL names the repo (KWB-39)
-      if (owner && !ssh && !new RegExp(`github\\.com/${esc(owner)}/[\\w.-]+`).test(p)) {
-        return `A push must name the repo: git push https://x-access-token:$${tok}@github.com/${owner}/<repo>.git <branch>, or a remote whose URL is git@github.com:${owner}/<repo>.git (SSH). ${c.accountNote}`;
-      }
-      if (!ssh && !p.includes(`$${tok}`) && !p.includes(`\${${tok}}`)) return `A push names the token as $${tok}, never a pasted one.`;
+      const refused = pushLaw(p, pushTarget(w, here, env), c);
+      if (refused) return refused;
       pushedBefore = true;
     }
-    if (c.ghAuth !== 'cli' && /(^|\s)gh\s/.test(p) && !cmd.includes(`GH_TOKEN=$${tok}`)) return `Every \`gh\` names the token: source ~/.env && GH_TOKEN=$${tok} gh ... ${c.accountNote}`;
+    const ghRefused = ghLaw(cmd, p, c);
+    if (ghRefused) return ghRefused;
     if (/\bgh\s+repo\s+create\b/.test(p) && ((owner && !p.includes(`${owner}/`)) || !p.includes('--private'))) return `A repo is created as ${owner}/<name> --private.`;
     if (/\bgit\b.*\b(remote\s+(add|set-url)|config)\b/.test(p) && new RegExp(`x-access-token|ghp_|github_pat_|${esc(tok)}`).test(p)) {
       return 'The token is never stored in a remote URL or a config file. Name it on the push only.';
@@ -167,7 +169,8 @@ function main(text) {
   try { payload = JSON.parse(text); } catch { return 0; }
   const command = payload.tool_input?.command ?? '';
   // the project's laws: its own layout (a worktree with its own layout.json is judged by it, else the project's)
-  const cfg = { ...DEFAULTS, ...(readLayout(claudeRoot(join(process.env.CLAUDE_PROJECT_DIR ?? process.cwd(), '.claude', 'layout.json'))).guards?.git ?? {}) };
+  const layout = readLayout(claudeRoot(join(process.env.CLAUDE_PROJECT_DIR ?? process.cwd(), '.claude', 'layout.json')));
+  const cfg = { ...DEFAULTS, ...(layout.enable?.includes('guards/git-house') ? NEW_INSTALL_GIT : {}), ...(layout.guards?.git ?? {}) }; // KF-8: an existing project opts in
   if (payload.hook_event_name === 'Stop') {
     if (!cfg.house) return 0;
     const v = stopVerdict(resolve(process.env.CLAUDE_PROJECT_DIR ?? process.cwd()), cfg, payload.session_id);
@@ -195,95 +198,5 @@ function main(text) {
   return 2;
 }
 
-async function selftest() {
-  const bad = [];
-  // the token law (Sub37 WB-3)
-  const tokenCases = [
-    ['git push -u https://x-access-token:abc@github.com/a/b.git work/x', true],
-    ['git push --set-upstream https://me:$TOKEN@github.com/a/b.git main', true],
-    ['cd ../b && git -C ../b push origin x -u https://u:p@github.com/a/b.git', true],
-    ['git remote set-url origin https://ghp_abc@github.com/a/b.git', true],
-    ['git remote add o https://u:${T}@github.com/a/b.git', true],
-    ['git clone https://x-access-token:abc@github.com/a/b.git', true],
-    ['git config remote.origin.url https://u:t@github.com/a/b.git', true],
-    ['git push https://x-access-token:$T@github.com/a/b.git work/x', false],
-    ['git push -u origin work/x', false],
-    ['git remote set-url origin https://github.com/a/b.git', false],
-    ['git remote add o git@github-house:HouseOwner/b.git', false],
-    ['git clone https://me@github.com/a/b.git', false],
-    ['echo https://u:p@x.com/y', false],
-  ];
-  for (const [cmd, block] of tokenCases) if ((problem(cmd) !== null) !== block) bad.push(`token law: ${cmd}`);
-  if (problem('git push -u https://u:SECRET@h/x.git b')?.includes('SECRET')) bad.push('the refusal prints the token');
-
-  // the house laws
-  const isDirty = { dirty: () => [' M design/gen_panel.py'], branch: () => 'step/C1-the-ribbon', hasHead: () => true };
-  const clean = { ...isDirty, dirty: () => [] };
-  const on = (branch, env = clean) => ({ ...env, branch: typeof branch === 'function' ? branch : () => branch });
-  const push = 'git push https://x-access-token:$PERSONAL_GITHUB_TOKEN@github.com/HouseOwner/app.git main';
-  const remote = (url) => ({ ...clean, remoteUrl: () => url });   // a remote whose URL is url (KWB-39: SSH names the repo)
-  const mustBlock = [
-    ['git add -A', clean], ['git add .', clean], ["git commit -am 'x'", clean], ['git add ~/firmware/korg/m1.bin', clean],
-    ['git -C /Users/someone/projects/other add -A', clean], ['cd ~/projects/other && git add -A', clean],
-    ['cd ~/projects/other && git checkout -- tools/bank/kept.json', isDirty],
-    ['git checkout -- design/gen_panel.py', isDirty], ['git stash', isDirty], ['git restore .', isDirty], ['git reset --hard HEAD~1', isDirty],
-    ['git clean -fd', isDirty], ['GUARD_OK=1 git checkout -- x.h', isDirty], ['GUARD_OK=1 git restore build/Testing/Temporary/LastTest.log', isDirty],
-    ['GUARD_OK=1 git restore --staged --worktree a.md', isDirty], ['git restore --staged --worktree a.md', isDirty],
-    ['git push', clean], ['git push origin main', clean], [`${push} --force`, clean],
-    ['git push https://x-access-token:$PERSONAL_GITHUB_TOKEN@github.com/other-org/app.git main', clean],
-    ['gh repo create HouseOwner/app --private', clean],
-    ['source ~/.env && GH_TOKEN=$PERSONAL_GITHUB_TOKEN gh repo create app --private', clean],
-    ['git remote add origin https://x-access-token:$PERSONAL_GITHUB_TOKEN@github.com/HouseOwner/app.git', clean],
-    [`git push https://x-access-token:ghp_${'a'.repeat(30)}@github.com/HouseOwner/app.git main`, clean],
-    ['git branch -D step/C1-x', clean], ['git push origin --delete step/C1-x', clean], ['git rebase main', clean], ['git commit --amend -m x', clean],
-    ["git commit -q -m 'bench' --no-verify", clean], ['GUARD_OK=1 git commit --no-verify -m x -- a.h', clean],
-    ['git push --no-verify https://x@github.com/HouseOwner/app.git main', clean],
-    ['git push -u origin work/x', remote('git@github.com:other-org/app.git')], ['git push origin work/x', remote('https://github.com/HouseOwner/app.git')],
-    ['git push git@github.com:other-org/app.git work/x', clean], ['git push -f origin work/x', remote('git@github.com:HouseOwner/app.git')],
-  ];
-  const mustPass = [
-    ['git add build.md src/Row.h', isDirty], ["git commit -m 'C1: row clock' -- build.md src/Row.h", isDirty],
-    ['cd ~/projects/other && git add tools/bank/kept.json', isDirty], ['git status', isDirty], ['git checkout -- x.h', clean],
-    ['git restore --staged x.h', isDirty], ['python3 tools/safe_restore.py x.h', isDirty], ['git stash list', isDirty],
-    ['git checkout -b c2-filter', isDirty], [push, isDirty],
-    ['source ~/.env && GH_TOKEN=$PERSONAL_GITHUB_TOKEN gh repo create HouseOwner/app --private', clean],
-    ['cmake --build build --target Synth_Standalone -j8', isDirty], ['git log --oneline -6 | sed -n 1,3p', isDirty],
-    ["git branch --list 'step/U5*' | tr -d ' *'", isDirty], ["grep -n 'def push' tools/step.py", isDirty], ["echo 'git push origin main'", isDirty],
-    ["python3 - <<'EOF'\nprint('git add -A')\nEOF", isDirty],
-    ['git push -u origin work/x', remote('git@github.com:HouseOwner/app.git')], ['git push origin work/x', remote('git@github-house:HouseOwner/app.git')],
-    ['git push git@github.com:HouseOwner/app.git work/x', clean], ['git push ssh://git@github.com/HouseOwner/app.git work/x', clean],
-  ];
-  const OWNED = { owner: 'HouseOwner' };
-  for (const [cmd, env] of mustBlock) if (house(cmd, '.', env, OWNED) === null) bad.push(`NOT BLOCKED: ${cmd}`);
-  for (const [cmd, env] of mustPass) { const r = house(cmd, '.', env, OWNED); if (r !== null) bad.push(`WRONGLY BLOCKED: ${cmd} -> ${r}`); }
-  const TRUNK = { refuseTrunk: true };
-  for (const cmd of ["git commit -m 'x' -- a.h", "GUARD_OK=1 git commit -m 'x' -- a.h"]) if (house(cmd, '.', on('main'), TRUNK) === null) bad.push(`NOT BLOCKED on trunk: ${cmd}`);
-  if (house("git commit -m 'x' -- a.h", '.', on('main')) !== null) bad.push('a commit on main with the trunk refusal off (the default)');
-  if (house("git commit -m 'first' -- a.h", '.', { ...on('main'), hasHead: () => false }, TRUNK) !== null) bad.push('the first commit');
-  const byDir = on((c) => (c.endsWith('wt') ? 'work/x' : 'main'));
-  if (house('cd /r/wt && git commit --no-edit', '/r', byDir, TRUNK) !== null) bad.push('a commit after cd into a worktree on a branch');
-  if (house('git -C /r/wt commit --no-edit', '/r', byDir, TRUNK) !== null) bad.push('git -C a worktree on a branch');
-  if (house('cd /r && git commit --no-edit', '/r/wt', byDir, TRUNK) === null) bad.push('cd onto the trunk then commit');
-  // WB-107: an agent's isolated worktree cannot push (its harness refuses), so push-then-commit is the lead's there; elsewhere it holds
-  const ahead = { ...on('work/x'), unpushed: () => ({ branch: 'work/x', url: 'https://github.com/HouseOwner/app.git', commits: [{ sha: 'abc1234', subject: 'x' }] }) };
-  if (house("git commit -m x -- a.h", '/r/.claude/worktrees/agent-a1b2', ahead) !== null) bad.push('a commit in an agent worktree with its branch ahead of GitHub (WB-107)');
-  if (house("git commit -m x -- a.h", '/r/.claude/worktrees/night', ahead) === null) bad.push('NOT BLOCKED: a commit in a lead worktree with its branch ahead of GitHub');
-  if (house("git commit -m x -- a.h", '/r', ahead) === null) bad.push('NOT BLOCKED: a commit in the main checkout with its branch ahead of GitHub');
-  const other = { owner: 'Acme', tokenVar: 'ACME_TOKEN', trunks: ['trunk'], safeRestore: 'python3 tools/safe_restore.py <paths>', branchStart: 'python3 tools/step.py start <STEP> "task"', refuseTrunk: true };
-  for (const [cmd, env, want] of [
-    ['git push https://x-access-token:$ACME_TOKEN@github.com/Acme/app.git b', clean, null], [push, clean, 'Acme'],
-    ['git commit -m x -- a', on('trunk'), 'tools/step.py'], ['git commit -m x -- a', on('main'), null], ['git stash', isDirty, 'safe_restore.py'],
-  ]) {
-    const r = house(cmd, '.', env, other);
-    if ((r === null) !== (want === null) || (want && !r.includes(want))) bad.push(`with a project's own values: ${cmd} -> ${r}`);
-  }
-  // the pushed laws (KWB-26), on a real repo and a bare "GitHub" beside it
-  const pushed = (await import('./lib/git-guard-selftest.mjs')).pushedCases(fileURLToPath(import.meta.url));
-  for (const [label, got, want] of pushed) if (got !== want) bad.push(`pushed law: ${label} (got ${got}, wanted ${want})`);
-  for (const b of bad) console.error(`git-guard selftest FAILED: ${b}`);
-  if (!bad.length) console.log(`git-guard selftest: OK (${tokenCases.length + 1} token cases, ${mustBlock.length + 7} house refusals, ${mustPass.length + 4} passes, ${pushed.length} pushed-law cases)`);
-  return bad.length ? 1 : 0;
-}
-
 export const hook = main; // run-hooks.mjs calls it with the event's text (KWB-24)
-if (isMain(import.meta.url)) process.exit(process.argv.includes('--selftest') ? await selftest() : await asHook('git-guard', main));
+if (isMain(import.meta.url)) process.exit(process.argv.includes('--selftest') ? await (await import('./lib/git-guard-selftest.mjs')).selftest(fileURLToPath(import.meta.url), { problem, house }) : await asHook('git-guard', main));

package/packs/base/hooks/lesson-checks.mjs

@@ -7,6 +7,8 @@
 //     "mode": "forbid" (default) | "require" | "needs",  "needs": ["<regex>", ...] }
 //   "code": true blanks comments and strings before matching; "strings": true blanks comments only (a check that reads string literals);
 //   "prose": true blanks what a reader does not read as prose in markdown: code, URLs, frontmatter (a check on public text)
+//   "language": "rust" blanks with that row of the language table instead, for a language C's blanker misreads (a Rust lifetime reads as a char
+//   literal there, KWB-75); "notInTests": true also leaves out what that language marks as a test, for a test that lives in the file it tests
 //   mode "needs": when the pattern appears, every regex in "needs" must appear as well (an entry file that listens also
 //   registers shutdown; a gateway that creates a MongoClient also caches and names it). A write is refused only for a need
 //   it newly leaves missing.
@@ -18,6 +20,7 @@ import { writesOf } from './lib/writes.mjs';
 import { blankCode } from './lib/cpp-scan.mjs';
 import { isContent } from './lib/content.mjs';
 import { blankProse } from './lib/prose.mjs';
+import { languageNamed } from './lib/languages.mjs';
 import { matchesAny } from './lib/glob.mjs';
 import { conceptGlobs, readLayout, resolveAliases } from './lib/layout.mjs';
 import { insideProject, checkoutRoot, claudeRoot } from './lib/project.mjs';
@@ -62,7 +65,12 @@ export function loadChecks(root = ROOT) {
 
 // What a check reads: one blanking per kind. strings: comments blanked, strings kept.
 const BLANKING = { prose: blankProse, code: blankCode, strings: (text) => blankCode(text, true) };
-const subjectOf = (c, text) => { const kind = Object.keys(BLANKING).find((k) => c[k]); return kind ? BLANKING[kind](text) : text; };
+function subjectOf(c, text) {
+  const row = c.language && languageNamed(c.language);
+  if (row) return c.notInTests && row.withoutTests ? row.withoutTests(row.blank(text)) : row.blank(text);
+  const kind = Object.keys(BLANKING).find((k) => c[k]);
+  return kind ? BLANKING[kind](text) : text;
+}
 
 // Every match: its line number and that line's text.
 function linesOf(check, text) {

package/packs/base/hooks/lib/code-shapes.mjs

@@ -40,7 +40,9 @@ export function statementsOf(text, lang) {
     const words = tokens.map((t) => t.t);
     const isCode = lang.commands ? words.length >= 2 : words.some((t) => t === '(' || t === '=');
     if (tokens.length >= (lang.commands ? 2 : 3) && words.some(isName) && isCode) {
-      out.push({ tokens, shape: shapeOf(words, lang), line: lineAt(starts, tokens[0].at), end: lineAt(starts, tokens.at(-1).at) });
+      // its line is where its first word is: the `),` a lambda's call leaves behind is the end of the last line, not this statement's start (KF-27)
+      const first = tokens.find((t) => /^[A-Za-z_\d"'*&]/.test(t.t)) ?? tokens[0];
+      out.push({ tokens, shape: shapeOf(words, lang), line: lineAt(starts, first.at), end: lineAt(starts, tokens.at(-1).at) });
     }
     tokens = [];
   };
@@ -50,9 +52,10 @@ export function statementsOf(text, lang) {
     if (lang.lines && depth === 0 && tokens.length && code.slice(last, m.index).includes('\n') && !CONTINUES.test(tokens.at(-1).t) && t !== '.') close();
     tokens.push({ t, at: m.index, to: m.index + t.length });
     last = m.index + t.length;
-    if (t === '(' || t === '[') depth += 1;
-    else if (t === ')' || t === ']') depth = Math.max(depth - 1, 0);
-    if ((t === ';' && depth === 0) || t === '{' || t === '}') close();
+    const dataBrace = lang.braces === false && (t === '{' || t === '}'); // a Python set or dict is one value, not a block (KF-14)
+    if (t === '(' || t === '[' || (dataBrace && t === '{')) depth += 1;
+    else if (t === ')' || t === ']' || (dataBrace && t === '}')) depth = Math.max(depth - 1, 0);
+    if ((t === ';' && depth === 0) || (!dataBrace && (t === '{' || t === '}'))) close();
   }
   close();
   return out;
@@ -102,12 +105,14 @@ function runShapes(list, lang) {
 // One function called again and again on other arguments, in a row.
 function rowShapes(list, lang) {
   const out = [];
-  const callee = (s) => ((lang.commands || s.tokens[1]?.t === '(') && isName(s.tokens[0].t) ? `${s.tokens[0].t} ${s.shape}` : null);
+  // A language whose calls are methods says so: `app.route (...)` six times is a table too, on one receiver.
+  const method = (s) => lang.methodRows && ['.', '::'].includes(s.tokens[1]?.t) && s.tokens[3]?.t === '(' && isName(s.tokens[2].t);
+  const callee = (s) => ((lang.commands || s.tokens[1]?.t === '(' || method(s)) && isName(s.tokens[0].t) ? `${s.tokens.slice(0, method(s) ? 3 : 1).map((t) => t.t).join('')} ${s.shape}` : null);
   for (let i = 0; i < list.length;) {
     const key = callee(list[i]);
     let j = i + 1;
     while (key && j < list.length && callee(list[j]) === key) j += 1;
-    if (j - i >= MIN_ROWS) out.push({ id: `t:${j - i}:${key}`, kind: 'rows', line: list[i].line, end: list[j - 1].end, what: `${list[i].tokens[0].t} (...)`, nodes: j - i });
+    if (j - i >= MIN_ROWS) out.push({ id: `t:${j - i}:${key}`, kind: 'rows', line: list[i].line, end: list[j - 1].end, what: `${key.split(' ')[0]} (...)`, nodes: j - i });
     i = j;
   }
   return out;

package/packs/base/hooks/lib/crash-policy.mjs

@@ -0,0 +1,47 @@
+// crash-policy: what a call does when a hook crashed on it (KF-18). Only exit 2 blocks, so a crash used to let the call through in
+// silence, and doctor said so hours later. Now a crash on a tool call refuses that call once and says why, at the time; the same call
+// again goes through, logged, because a broken hook must never stop the write that fixes it (its own bad config, say). An event with
+// nothing to refuse (Stop, a prompt) is told with a systemMessage. A crash is never a verdict on the work, and has its own log.
+//   crashVerdict(root, ev, judged) -> { code?, stderr?, stdout? }   judged: the runner's [{ hook, code, reason }]
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const HELD = join('.claude', 'state', 'crash-held.json');
+const HOLD_MS = 60 * 60 * 1000;
+const ANSWERS = new Set([0, 2]);
+const TOOL_EVENTS = new Set(['PreToolUse', 'PostToolUse', undefined]);
+
+const firstLine = (reason) => (reason ?? '').split('\n')[0].replace(/^run-hooks: \S+ failed: /, '') || 'no message';
+const say = (c) => `${c.hook} crashed, so this call was not judged by it: ${firstLine(c.reason)}`;
+const keyOf = (ev, hook) => createHash('sha1').update(JSON.stringify([hook, ev.hook_event_name, ev.tool_name, ev.tool_input])).digest('hex').slice(0, 16);
+const notice = (message) => JSON.stringify({ systemMessage: message });
+
+function readHeld(root) {
+  try { return JSON.parse(readFileSync(join(root, HELD), 'utf8')); } catch { return {}; } // not a refusal: no list yet
+}
+
+// Records the keys; false when they cannot be kept, since a call refused with no memory of it could never go through.
+function hold(root, held, keys) {
+  if (!existsSync(join(root, '.claude'))) return false;
+  const now = Date.now();
+  const kept = Object.fromEntries(Object.entries(held).filter(([, t]) => now - t < HOLD_MS));
+  for (const k of keys) kept[k] = now;
+  mkdirSync(join(root, '.claude', 'state'), { recursive: true });
+  writeFileSync(join(root, HELD), JSON.stringify(kept));
+  return true;
+}
+
+export function crashVerdict(root, ev, judged) {
+  const crashed = judged.filter((h) => !ANSWERS.has(h.code));
+  if (!crashed.length) return {};
+  const said = crashed.map(say).join('\n');
+  const after = `Clear it once fixed: \`logs clear ${crashed[0].hook} fixed|superseded "<why>"\`.`;
+  if (!ev.tool_name || !TOOL_EVENTS.has(ev.hook_event_name)) return { stdout: notice(`${said}\n${after}`) };
+  const held = readHeld(root);
+  const keys = crashed.map((c) => keyOf(ev, c.hook));
+  if (keys.every((k) => held[k])) return { stdout: notice(`${said}\nThe call went through unjudged, and the crash is logged (\`logs crashes\`). ${after}`) };
+  if (!hold(root, held, keys)) return { stdout: notice(said) };
+  const ran = ev.hook_event_name === 'PostToolUse' ? 'The call has already run.' : 'The call has not run.';
+  return { code: 2, stderr: `${said}\n${ran} This is a fault in the hook, not a verdict on your work. The same call again goes through unjudged, and is logged. Report the fault. ${after}\n` };
+}

package/packs/base/hooks/lib/dup-index.mjs

@@ -176,6 +176,11 @@ function chains(pairs, lines) {
   return out;
 }
 
+// using lines, includes, imports and one-line constants name things: two files that open alike hold no logic to extract, and writing the names out is worse (KF-32).
+const DECLARATION = /^\s*(?:$|using\b|#\s*include\b|import\b|from\s+\S+\s+import\b|namespace\b|[{}]\s*$|(?:static\s+|inline\s+)*(?:constexpr|const)\b[^(){}]*=[^(){}]*;\s*$)/;
+const MIN_LOGIC_LINES = 3;
+const holdsLogic = (text, { start, end }) => text.split('\n').slice(start - 1, end).filter((l) => !DECLARATION.test(l)).length >= MIN_LOGIC_LINES;
+
 export function judgeWrites(root, writes, { layout = {}, shape = null, ignore = [] } = {}) {
   const index = loadIndex(root, { layout, shape });
   const maybe = clonesIn(index, writes, { ignore });
@@ -192,7 +197,7 @@ export function judgeWrites(root, writes, { layout = {}, shape = null, ignore =
     const paths = [...new Set(maybe.map((c) => c.other.file))].filter((f) => !written.has(real(f)));
     const r = scan(root, { extra, ignore, layout, shape, paths });
     if (r.error) return { clones: [], error: r.error, index };
-    return { clones: writes.flatMap((w) => (w.ranges ?? [w.range]).flatMap((range) => clonesOf(r.clones, w.path, range))), index };
+    return { clones: writes.flatMap((w) => (w.ranges ?? [w.range]).flatMap((range) => clonesOf(r.clones, w.path, range)).filter((c) => holdsLogic(w.after, c.at))), index };
   } finally {
     rmSync(tmp, { recursive: true, force: true });
   }

package/packs/base/hooks/lib/dup.mjs

@@ -20,8 +20,8 @@ import { fileURLToPath } from 'node:url';
 import { matchesAny } from './glob.mjs';
 
 export const LIMITS = { tokens: 50, lines: 6, gap: 2 };
-export const SOURCE = /\.(c|cc|cpp|cxx|h|hh|hpp|hxx|inl|mm|m|py|js|mjs|cjs|jsx|ts|tsx)$/i;
-const FORMATS = 'c,c-header,cpp,cpp-header,objectivec,python,javascript,jsx,typescript,tsx';
+export const SOURCE = /\.(c|cc|cpp|cxx|h|hh|hpp|hxx|inl|mm|m|py|js|mjs|cjs|jsx|ts|tsx|rs)$/i;
+const FORMATS = 'c,c-header,cpp,cpp-header,objectivec,python,javascript,jsx,typescript,tsx,rust';
 // A header and a source are one language: a function copied from a .cpp into a .h is a copy (jscpd compares within a format otherwise).
 const CROSS = 'c,c-header,cpp,cpp-header,objectivec;javascript,jsx,typescript,tsx';
 // Generated files, resources and vendored or built code are never judged (and never a match).

package/packs/base/hooks/lib/event-log.mjs

@@ -1,6 +1,6 @@
 // The detail behind hooks.log. Every call is one line of .claude/logs/events.jsonl: who, where, what was attempted, and each hook's time, exit code and reason. Every refusal
-// and crash is also a line of .claude/logs/refusals.jsonl, with an id, the branch and commit, the kit's version and the hash of the hook that decided, so it can be judged
-// later: `claude-packs logs mark <id> right|wrong "<why>"`. Bug logs only record the refusals somebody complained about; this records them all. Secrets are masked. File
+// is also a line of .claude/logs/refusals.jsonl, with an id, the branch and commit, the kit's version and the hash of the hook that decided, so it can be judged
+// later: `claude-packs logs mark <id> right|wrong "<why>"`. A crash refused nothing and is no verdict on the work, so it has its own log, crashes.jsonl (KF-40). Bug logs only record the refusals somebody complained about; this records them all. Secrets are masked. File
 // contents are not kept, only their size. Logs rotate and are never cleared.
 //   logCall(root, text, [{ hook, ms, code, reason, out }], append, total)
 import { createHash } from 'node:crypto';
@@ -10,6 +10,7 @@ import { maskSecrets } from './secret-patterns.mjs';
 
 export const EVENTS = join('.claude', 'logs', 'events.jsonl');
 export const REFUSALS = join('.claude', 'logs', 'refusals.jsonl');
+export const CRASHES = join('.claude', 'logs', 'crashes.jsonl');
 const KEEP = { command: 4000, prompt: 1000, reason: 4000, out: 500 };
 
 const cut = (text, n) => { const t = maskSecrets(text ?? ''); return t.length > n ? `${t.slice(0, n)}... [${t.length} chars]` : t; };
@@ -61,7 +62,7 @@ export function logCall(root, text, hooks, append, total) {
     append(root, EVENTS, `${JSON.stringify({ t, ...where, ...what, ...(total ? { ms: Math.round(total) } : {}), hooks: judged })}\n`);
     for (const h of judged.filter((x) => x.code !== 0)) {
       const id = createHash('sha1').update(`${t}${h.hook}${h.reason ?? ''}`).digest('hex').slice(0, 8);
-      append(root, REFUSALS, `${JSON.stringify({ id, t, hook: h.hook, code: h.code, reason: h.reason, ...where, ...what, ...headOf(ev.cwd ?? root), ...lawOf(root, h.hook) })}\n`);
+      append(root, h.code === 2 ? REFUSALS : CRASHES, `${JSON.stringify({ id, t, hook: h.hook, code: h.code, reason: h.reason, ...where, ...what, ...headOf(ev.cwd ?? root), ...lawOf(root, h.hook) })}\n`);
     }
   } catch { /* the log never stops a hook */ }
 }

package/packs/base/hooks/lib/git-adds.mjs

@@ -14,7 +14,8 @@ export function gitAdds(command, cwd) {
       if (w[at] === '-C') dir = resolve(dir, w[at + 1] ?? '.');
       at += ['-C', '-c'].includes(w[at]) ? 2 : 1;
     }
-    if (w[at] === 'add') out.push({ dir, args: w.slice(at + 1) });
+    const args = w.slice(at + 1);
+    if (w[at] === 'add' && !args.some((a) => a === '-n' || a === '--dry-run')) out.push({ dir, args }); // a dry run stages nothing (KF-10)
   }
   return out;
 }

package/packs/base/hooks/lib/git-auth.mjs

@@ -0,0 +1,44 @@
+// git-auth: how a push and a `gh` call prove who they act as, for git-guard's house laws (KF-12). The laws used to assume one machine: a
+// token variable, and `GH_TOKEN=$X` passed as text even with X unset, which proves nothing about the account. A project either
+// names a token (ghAuth "token") or uses this machine's own git and gh login (ghAuth "cli"), and a refusal says which login that is.
+//   NEW_INSTALL_GIT             what a new install's guards.git holds (KF-8); lib/layout.mjs writes it, "enable": ["guards/git-house"] applies it
+//   pushLaw(p, target, c)       a refusal for a push, or null. p: the words of the push; target: its URL; c: guards.git
+//   ghLaw(cmd, p, c, login)     a refusal for a `gh` call, or null. cmd: the whole command, since a `source` before it may set the token
+import { execFileSync } from 'node:child_process';
+import { sshOwner } from './pushed.mjs';
+
+export const NEW_INSTALL_GIT = { house: true, ghAuth: 'cli', trunkNeedsYes: true };
+
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const LOADS_ENV = /(?:^|[;&|(\s])(?:source|\.)\s+\S/;
+
+export function pushLaw(p, target, c) {
+  const { owner, tokenVar: tok } = c;
+  const cli = c.ghAuth === 'cli';
+  const ssh = !owner || sshOwner(target) === owner; // over SSH the key picks the account; the URL names the repo (KWB-39). No owner: no repo to hold it to
+  const named = new RegExp(`github\\.com/${esc(owner ?? '')}/[\\w.-]+`);
+  if (owner && !ssh && !named.test(p) && !(cli && named.test(target ?? ''))) {
+    return `A push must name the repo: git push https://x-access-token:$${tok}@github.com/${owner}/<repo>.git <branch>, or a remote whose URL is git@github.com:${owner}/<repo>.git (SSH). ${c.accountNote}`;
+  }
+  if (!cli && !ssh && !p.includes(`$${tok}`) && !p.includes(`\${${tok}}`)) return `A push names the token as $${tok}, never a pasted one.`;
+  return null;
+}
+
+function loggedInAs() {
+  try {
+    return execFileSync('gh', ['config', 'get', 'user', '-h', 'github.com'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }).trim();
+  } catch {
+    return ''; // no gh here, or no login: the refusal says less, and still refuses
+  }
+}
+
+export function ghLaw(cmd, p, c, login = loggedInAs) {
+  if (c.ghAuth === 'cli' || !/(^|\s)gh\s/.test(p)) return null;
+  const tok = c.tokenVar;
+  const named = cmd.includes(`GH_TOKEN=$${tok}`);
+  if (named && (process.env[tok] || LOADS_ENV.test(cmd))) return null;
+  const who = login();
+  const wayOut = `If this machine's own login is the right account${who ? ` (gh is logged in as ${who})` : ''}, set "ghAuth": "cli" in guards.git in .claude/layout.json, and no call names a token.`;
+  if (named) return `$${tok} is not set here, so GH_TOKEN would be empty and gh would act as whichever account is logged in. ${wayOut}`;
+  return `Every \`gh\` names the token: source ~/.env && GH_TOKEN=$${tok} gh ... ${c.accountNote} ${wayOut}`;
+}

package/packs/base/hooks/lib/git-guard-selftest.mjs

@@ -97,3 +97,96 @@ export function pushedCases(hookFile) {
   rmSync(top, { recursive: true, force: true });
   return cases;
 }
+// The token law and the house laws, read from the hook's own exports.
+export async function selftest(hookFile, { problem, house }) {
+  const bad = [];
+  // the token law (Sub37 WB-3)
+  const tokenCases = [
+    ['git push -u https://x-access-token:abc@github.com/a/b.git work/x', true],
+    ['git push --set-upstream https://me:$TOKEN@github.com/a/b.git main', true],
+    ['cd ../b && git -C ../b push origin x -u https://u:p@github.com/a/b.git', true],
+    ['git remote set-url origin https://ghp_abc@github.com/a/b.git', true],
+    ['git remote add o https://u:${T}@github.com/a/b.git', true],
+    ['git clone https://x-access-token:abc@github.com/a/b.git', true],
+    ['git config remote.origin.url https://u:t@github.com/a/b.git', true],
+    ['git push https://x-access-token:$T@github.com/a/b.git work/x', false],
+    ['git push -u origin work/x', false],
+    ['git remote set-url origin https://github.com/a/b.git', false],
+    ['git remote add o git@github-house:HouseOwner/b.git', false],
+    ['git clone https://me@github.com/a/b.git', false],
+    ['echo https://u:p@x.com/y', false],
+  ];
+  for (const [cmd, block] of tokenCases) if ((problem(cmd) !== null) !== block) bad.push(`token law: ${cmd}`);
+  if (problem('git push -u https://u:SECRET@h/x.git b')?.includes('SECRET')) bad.push('the refusal prints the token');
+
+  // the house laws
+  const isDirty = { dirty: () => [' M design/gen_panel.py'], branch: () => 'step/C1-the-ribbon', hasHead: () => true };
+  const clean = { ...isDirty, dirty: () => [] };
+  const on = (branch, env = clean) => ({ ...env, branch: typeof branch === 'function' ? branch : () => branch });
+  const push = 'git push https://x-access-token:$PERSONAL_GITHUB_TOKEN@github.com/HouseOwner/app.git main';
+  const remote = (url) => ({ ...clean, remoteUrl: () => url });   // a remote whose URL is url (KWB-39: SSH names the repo)
+  const mustBlock = [
+    ['git add -A', clean], ['git add .', clean], ["git commit -am 'x'", clean], ['git add ~/firmware/korg/m1.bin', clean],
+    ['git -C /Users/someone/projects/other add -A', clean], ['cd ~/projects/other && git add -A', clean],
+    ['cd ~/projects/other && git checkout -- tools/bank/kept.json', isDirty],
+    ['git checkout -- design/gen_panel.py', isDirty], ['git stash', isDirty], ['git restore .', isDirty], ['git reset --hard HEAD~1', isDirty],
+    ['git clean -fd', isDirty], ['GUARD_OK=1 git checkout -- x.h', isDirty], ['GUARD_OK=1 git restore build/Testing/Temporary/LastTest.log', isDirty],
+    ['GUARD_OK=1 git restore --staged --worktree a.md', isDirty], ['git restore --staged --worktree a.md', isDirty],
+    ['git push', clean], ['git push origin main', clean], [`${push} --force`, clean],
+    ['git push https://x-access-token:$PERSONAL_GITHUB_TOKEN@github.com/other-org/app.git main', clean],
+    ['gh repo create HouseOwner/app --private', clean],
+    ['source ~/.env && GH_TOKEN=$PERSONAL_GITHUB_TOKEN gh repo create app --private', clean],
+    ['git remote add origin https://x-access-token:$PERSONAL_GITHUB_TOKEN@github.com/HouseOwner/app.git', clean],
+    [`git push https://x-access-token:ghp_${'a'.repeat(30)}@github.com/HouseOwner/app.git main`, clean],
+    ['git branch -D step/C1-x', clean], ['git push origin --delete step/C1-x', clean], ['git rebase main', clean], ['git commit --amend -m x', clean],
+    ["git commit -q -m 'bench' --no-verify", clean], ['GUARD_OK=1 git commit --no-verify -m x -- a.h', clean],
+    ['git push --no-verify https://x@github.com/HouseOwner/app.git main', clean],
+    ['git push -u origin work/x', remote('git@github.com:other-org/app.git')], ['git push origin work/x', remote('https://github.com/HouseOwner/app.git')],
+    ['git push git@github.com:other-org/app.git work/x', clean], ['git push -f origin work/x', remote('git@github.com:HouseOwner/app.git')],
+    ['git checkout --theirs a.txt', isDirty],
+  ];
+  const mustPass = [
+    ['git add build.md src/Row.h', isDirty], ["git commit -m 'C1: row clock' -- build.md src/Row.h", isDirty],
+    ['cd ~/projects/other && git add tools/bank/kept.json', isDirty], ['git status', isDirty], ['git checkout -- x.h', clean],
+    ['git restore --staged x.h', isDirty], ['python3 tools/safe_restore.py x.h', isDirty], ['git stash list', isDirty],
+    ['git checkout -b c2-filter', isDirty], [push, isDirty],
+    ['source ~/.env && GH_TOKEN=$PERSONAL_GITHUB_TOKEN gh repo create HouseOwner/app --private', clean],
+    ['cmake --build build --target Synth_Standalone -j8', isDirty], ['git log --oneline -6 | sed -n 1,3p', isDirty],
+    ["git branch --list 'step/U5*' | tr -d ' *'", isDirty], ["grep -n 'def push' tools/step.py", isDirty], ["echo 'git push origin main'", isDirty],
+    ["python3 - <<'EOF'\nprint('git add -A')\nEOF", isDirty],
+    ['git push -u origin work/x', remote('git@github.com:HouseOwner/app.git')], ['git push origin work/x', remote('git@github-house:HouseOwner/app.git')],
+    ['git push git@github.com:HouseOwner/app.git work/x', clean], ['git push ssh://git@github.com/HouseOwner/app.git work/x', clean],
+    ['git add -n .', clean], ['git add --dry-run -A', clean], ['git checkout --theirs a.txt', { ...isDirty, merging: () => true }],
+  ];
+  const OWNED = { owner: 'HouseOwner' };
+  for (const [cmd, env] of mustBlock) if (house(cmd, '.', env, OWNED) === null) bad.push(`NOT BLOCKED: ${cmd}`);
+  for (const [cmd, env] of mustPass) { const r = house(cmd, '.', env, OWNED); if (r !== null) bad.push(`WRONGLY BLOCKED: ${cmd} -> ${r}`); }
+  const TRUNK = { refuseTrunk: true };
+  for (const cmd of ["git commit -m 'x' -- a.h", "GUARD_OK=1 git commit -m 'x' -- a.h"]) if (house(cmd, '.', on('main'), TRUNK) === null) bad.push(`NOT BLOCKED on trunk: ${cmd}`);
+  if (house('git rev-parse HEAD^{commit}', '.', on('main'), TRUNK) !== null) bad.push('a word in an argument read as a commit on the trunk');
+  if (house("git commit -m 'x' -- a.h", '.', on('main')) !== null) bad.push('a commit on main with the trunk refusal off (the default)');
+  if (house("git commit -m 'first' -- a.h", '.', { ...on('main'), hasHead: () => false }, TRUNK) !== null) bad.push('the first commit');
+  const byDir = on((c) => (c.endsWith('wt') ? 'work/x' : 'main'));
+  if (house('cd /r/wt && git commit --no-edit', '/r', byDir, TRUNK) !== null) bad.push('a commit after cd into a worktree on a branch');
+  if (house('git -C /r/wt commit --no-edit', '/r', byDir, TRUNK) !== null) bad.push('git -C a worktree on a branch');
+  if (house('cd /r && git commit --no-edit', '/r/wt', byDir, TRUNK) === null) bad.push('cd onto the trunk then commit');
+  // WB-107: an agent's isolated worktree cannot push (its harness refuses), so push-then-commit is the lead's there; elsewhere it holds
+  const ahead = { ...on('work/x'), unpushed: () => ({ branch: 'work/x', url: 'https://github.com/HouseOwner/app.git', commits: [{ sha: 'abc1234', subject: 'x' }] }) };
+  if (house("git commit -m x -- a.h", '/r/.claude/worktrees/agent-a1b2', ahead) !== null) bad.push('a commit in an agent worktree with its branch ahead of GitHub (WB-107)');
+  if (house("git commit -m x -- a.h", '/r/.claude/worktrees/night', ahead) === null) bad.push('NOT BLOCKED: a commit in a lead worktree with its branch ahead of GitHub');
+  if (house("git commit -m x -- a.h", '/r', ahead) === null) bad.push('NOT BLOCKED: a commit in the main checkout with its branch ahead of GitHub');
+  const other = { owner: 'Acme', tokenVar: 'ACME_TOKEN', trunks: ['trunk'], safeRestore: 'python3 tools/safe_restore.py <paths>', branchStart: 'python3 tools/step.py start <STEP> "task"', refuseTrunk: true };
+  for (const [cmd, env, want] of [
+    ['git push https://x-access-token:$ACME_TOKEN@github.com/Acme/app.git b', clean, null], [push, clean, 'Acme'],
+    ['git commit -m x -- a', on('trunk'), 'tools/step.py'], ['git commit -m x -- a', on('main'), null], ['git stash', isDirty, 'safe_restore.py'],
+  ]) {
+    const r = house(cmd, '.', env, other);
+    if ((r === null) !== (want === null) || (want && !r.includes(want))) bad.push(`with a project's own values: ${cmd} -> ${r}`);
+  }
+  // the pushed laws (KWB-26), on a real repo and a bare "GitHub" beside it
+  const pushed = pushedCases(hookFile);
+  for (const [label, got, want] of pushed) if (got !== want) bad.push(`pushed law: ${label} (got ${got}, wanted ${want})`);
+  for (const b of bad) console.error(`git-guard selftest FAILED: ${b}`);
+  if (!bad.length) console.log(`git-guard selftest: OK (${tokenCases.length + 1} token cases, ${mustBlock.length + 7} house refusals, ${mustPass.length + 4} passes, ${pushed.length} pushed-law cases)`);
+  return bad.length ? 1 : 0;
+}

package/packs/base/hooks/lib/languages.mjs

@@ -2,6 +2,7 @@
 // to blank a file's comments and strings, where a statement ends, what is not code, and how a function is defined. A new language is one row.
 //   languageOf(ext) -> the row, or null                 ALL_CODE: every extension the table reads
 import { blankCode } from './cpp-scan.mjs';
+import { blankRust, ownDefinitions, withoutTests } from './rust-scan.mjs';
 
 const spaces = (s) => s.replace(/[^\n]/g, ' ');
 
@@ -47,12 +48,13 @@ export const LANGUAGES = [
     define: /^(?:[A-Za-z_][\w:<>,*& ]*[\s*&])?([A-Za-z_]\w*)\s*\([^;{}]*\)\s*(?:const\s*)?(?:noexcept\s*)?\{/gm },
   { name: 'js', exts: ['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.mts', '.cts'], blank: blankCode, lines: true, notCode: /^[ \t]*import\b[^;]*;?$/gm, minTokens: 60,
     define: /^(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function\*?\s+([A-Za-z_$][\w$]*)|(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|class\s+([A-Za-z_$][\w$]*))/gm },
-  { name: 'python', exts: ['.py', '.pyi'], blank: blanker({ line: ['#'], raw: ['"""', "'''"] }), lines: true, notCode: /^[ \t]*(?:from\s+\S+\s+)?import\b.*$/gm, minTokens: 45,
+  { name: 'python', exts: ['.py', '.pyi'], blank: blanker({ line: ['#'], raw: ['"""', "'''"] }), lines: true, braces: false, notCode: /^[ \t]*(?:from\s+\S+\s+)?import\b.*$/gm, minTokens: 45,
     define: /^(?:async\s+)?(?:def|class)\s+([A-Za-z_]\w*)/gm },
   { name: 'shell', exts: ['.sh', '.bash', '.zsh', '.ksh'], blank: blanker({ line: ['#'], hashWord: true, heredoc: true }), lines: true, commands: true, minTokens: 30,
     token: /"\s*"|'\s*'|[^\s;|&()<>{}]+|[;|&()<>{}]/g, notCode: /^[ \t]*(?:\.|source|set|shopt|trap|cd)\s.*$/gm, define: /^(?:function\s+)?([A-Za-z_][\w-]*)\s*(?:\(\s*\))?\s*\{/gm },
   { name: 'go', exts: ['.go'], blank: blanker({ ...SLASHES, raw: ['`'] }), lines: true, notCode: /^(?:package\b.*|import\s*\([^)]*\)|import\b.*)$/gm, minTokens: 50, define: /^func\s+([A-Za-z_]\w*)/gm },
-  { name: 'rust', exts: ['.rs'], blank: blanker({ ...SLASHES, quotes: ['"'] }), notCode: lineStart('use|mod|extern|pub use'), minTokens: 60, define: /^(?:pub(?:\([a-z]+\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_]\w*)/gm },
+  { name: 'rust', exts: ['.rs'], blank: blankRust, withoutTests, ownDefinitions, methodRows: true, notCode: lineStart('use|mod|extern|pub use'), minTokens: 60,
+    define: /^[ \t]*(?:pub(?:\([^)]*\))?\s+)?(?:default\s+)?(?:const\s+)?(?:async\s+)?(?:unsafe\s+)?(?:extern\s+"[^"]*"\s+)?fn\s+([A-Za-z_]\w*)/gm },
   { name: 'java', exts: ['.java', '.cs', '.scala', '.dart'], blank: blanker(SLASHES), notCode: lineStart('import|package|using|namespace'), minTokens: 60,
     define: /^[ \t]*(?:public|private|protected|internal|static|final|async|override|virtual|\s)+[\w<>[\],\s]+\s([A-Za-z_]\w*)\s*\([^;{}]*\)\s*(?:throws [\w, ]+)?\s*\{/gm },
   { name: 'kotlin', exts: ['.kt', '.kts', '.swift'], blank: blanker({ ...SLASHES, raw: ['"""'] }), lines: true, notCode: lineStart('import|package'), minTokens: 50, define: /^(?:(?:public|private|internal)\s+)?(?:fun|func)\s+([A-Za-z_]\w*)/gm },
@@ -63,4 +65,5 @@ export const LANGUAGES = [
 
 const BY_EXT = new Map(LANGUAGES.flatMap((l) => l.exts.map((e) => [e, l])));
 export const languageOf = (ext) => BY_EXT.get(ext) ?? null;
+export const languageNamed = (name) => LANGUAGES.find((l) => l.name === name) ?? null;
 export const ALL_CODE = new Set(BY_EXT.keys());

package/packs/base/hooks/lib/layout.mjs

@@ -41,9 +41,13 @@ export function globsForConcepts(layout, concepts) {
 }
 
 // Folders that may hold source code: every folder except docs/tools, deepest first.
+// src/ is a code folder unless the layout names folders inside it: then a file belongs in one of those (KWB-78: a Python project's src/new.py was refused).
 export function codeFolders(layout) {
-  return Object.entries(layout.folders ?? {})
-    .filter(([name]) => !['docs', 'tools', 'src'].includes(name))
+  const folders = Object.entries(layout.folders ?? {});
+  const src = layout.folders?.src?.path;
+  const split = folders.some(([, f]) => f.path.startsWith(`${src}/`));
+  return folders
+    .filter(([name]) => !['docs', 'tools'].includes(name) && !(name === 'src' && split))
     .map(([, f]) => f.path)
     .sort((a, b) => b.length - a.length);
 }