claude-dev-env 1.75.0 → 1.76.0

package/hooks/blocking/test_code_rules_logging_printf_tokens.py

@@ -0,0 +1,134 @@
+"""Tests for the printf-token check on str.format-logger (automation_logging) calls."""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+ENFORCER_FILENAME = "code_rules_enforcer.py"
+ENFORCER_MODULE_NAME = "code_rules_enforcer_printf_under_test"
+PRODUCTION_FILE_PATH = "shared_utils/web_automation/sample.py"
+TEST_FILE_PATH = "shared_utils/web_automation/tests/test_sample.py"
+FORMAT_LOGGER_IMPORT = (
+    "from shared_utils.automation_logging import log_error, log_info, log_debug\n"
+)
+
+
+def load_enforcer_module() -> ModuleType:
+    enforcer_path = Path(__file__).parent / ENFORCER_FILENAME
+    module_spec = importlib.util.spec_from_file_location(ENFORCER_MODULE_NAME, enforcer_path)
+    assert module_spec is not None
+    assert module_spec.loader is not None
+    enforcer_module = importlib.util.module_from_spec(module_spec)
+    module_spec.loader.exec_module(enforcer_module)
+    return enforcer_module
+
+
+enforcer = load_enforcer_module()
+
+
+def test_should_flag_percent_s_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s after error: %s", name, err)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+    assert "printf token" in issues[0]
+
+
+def test_should_flag_percent_d_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_debug("attempt %d of %d", index, total)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_allow_brace_placeholders_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("Processing {} of {}", index, total)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_ignore_percent_token_without_format_logger_import() -> None:
+    source = 'log_error("Skipping %s", name)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_ignore_attribute_style_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'logger.info("delivered %s", message_id)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_inspect_message_literal_not_argument_value() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("status: {}", "100%s done")\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_exempt_test_files() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s", name)\n'
+    issues = enforcer.check_logging_printf_tokens(source, TEST_FILE_PATH)
+    assert issues == []
+
+
+def test_should_resolve_aliased_format_logger_import() -> None:
+    source = (
+        "from shared_utils.automation_logging import log_error as report_error\n"
+        + 'report_error("failed %s", name)\n'
+    )
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_allow_token_bearing_message_with_no_format_args() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("Use %s for string substitution")\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_documentation_style_token_message_with_no_args() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_warning("avoid %s-style tokens here")\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_percent_adjacent_to_word_in_format_message() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("memory 80%free now", host)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_doubled_percent_in_format_message() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("100%% done", host)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_allow_trailing_percent_in_format_message() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_info("100% done", host)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert issues == []
+
+
+def test_should_flag_width_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("item %5d", index)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_flag_precision_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("took %0.2f sec", elapsed)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_flag_float_general_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("ratio %g", ratio)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1
+
+
+def test_should_flag_scientific_token_in_format_logger_call() -> None:
+    source = FORMAT_LOGGER_IMPORT + 'log_error("value %e", measurement)\n'
+    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
+    assert len(issues) == 1

package/hooks/blocking/test_verification_verdict_store.py

@@ -418,7 +418,7 @@ def test_workflow_verdict_covers_surface_false_for_non_verifier_sidecar(
     )
 
 
-def test_workflow_verdict_covers_surface_false_for_missing_sidecar(
+def test_workflow_verdict_covers_surface_false_for_missing_sidecar_with_verdict(
     tmp_path: pathlib.Path,
 ) -> None:
     transcript_path = _session_transcript_path(tmp_path, "sess1")
@@ -438,6 +438,71 @@ def test_workflow_verdict_covers_surface_false_for_missing_sidecar(
     )
 
 
+def test_workflow_verdict_covers_surface_false_for_corrupt_sidecar_with_verdict(
+    tmp_path: pathlib.Path,
+) -> None:
+    transcript_path = _session_transcript_path(tmp_path, "sess1")
+    subagents_dir = tmp_path / "projects" / "demo" / "sess1" / "subagents"
+    _write_agent_transcript(
+        subagents_dir,
+        "01",
+        VERIFIER_AGENT_TYPE,
+        _verdict_transcript_text(True, MATCHING_MANIFEST_SHA256),
+        should_write_sidecar=False,
+    )
+    corrupt_sidecar = (
+        subagents_dir / "workflows" / "wf_x" / "agent-01.meta.json"
+    )
+    corrupt_sidecar.write_text("{not valid json", encoding="utf-8")
+    assert (
+        workflow_verdict_covers_surface(
+            str(transcript_path), MATCHING_MANIFEST_SHA256
+        )
+        is False
+    )
+
+
+def test_workflow_verdict_covers_surface_false_for_invalid_utf8_sidecar(
+    tmp_path: pathlib.Path,
+) -> None:
+    transcript_path = _session_transcript_path(tmp_path, "sess1")
+    subagents_dir = tmp_path / "projects" / "demo" / "sess1" / "subagents"
+    _write_agent_transcript(
+        subagents_dir,
+        "01",
+        VERIFIER_AGENT_TYPE,
+        _verdict_transcript_text(True, MATCHING_MANIFEST_SHA256),
+        should_write_sidecar=False,
+    )
+    invalid_utf8_sidecar = subagents_dir / "workflows" / "wf_x" / "agent-01.meta.json"
+    invalid_utf8_sidecar.write_bytes(b'{"agentType": "\xff\xfe bad"}')
+    assert (
+        workflow_verdict_covers_surface(
+            str(transcript_path), MATCHING_MANIFEST_SHA256
+        )
+        is False
+    )
+
+
+def test_workflow_verdict_covers_surface_false_for_invalid_utf8_transcript(
+    tmp_path: pathlib.Path,
+) -> None:
+    transcript_path = _session_transcript_path(tmp_path, "sess1")
+    subagents_dir = tmp_path / "projects" / "demo" / "sess1" / "subagents"
+    workflow_dir = subagents_dir / "workflows" / "wf_x"
+    workflow_dir.mkdir(parents=True, exist_ok=True)
+    (workflow_dir / "agent-01.jsonl").write_bytes(b'{"type": "assistant"}\xff\xfe\n')
+    (workflow_dir / "agent-01.meta.json").write_text(
+        json.dumps({"agentType": VERIFIER_AGENT_TYPE}), encoding="utf-8"
+    )
+    assert (
+        workflow_verdict_covers_surface(
+            str(transcript_path), MATCHING_MANIFEST_SHA256
+        )
+        is False
+    )
+
+
 def test_workflow_verdict_covers_surface_false_for_missing_subagents_dir(
     tmp_path: pathlib.Path,
 ) -> None:

package/hooks/blocking/test_verifier_verdict_minter.py

@@ -7,11 +7,13 @@ SubagentStop payload names the stopping subagent's own transcript
 tests build that sidecar and assert the minter gates on the resolved type and
 on the shared MINTING_AGENT_TYPE constant, so a rename in config propagates to
 the minter without a second edit. A malformed or non-string sidecar resolves
-nothing, and an absent sidecar mints nothing — the main session writes neither
-the transcript nor the sidecar, so it cannot forge a passing verdict. A
-further test holds the shipped settings.json to the minter docstring's
-anti-forgery claim: the main session is denied writes to the verdict
-directory, so only this hook can mint a passing verdict.
+nothing, and an absent sidecar mints nothing even when the transcript carries a
+verdict fence — the main session controls the prompt of any Agent-tool subagent
+it spawns, so a verdict fence in the transcript proves nothing about the agent
+type, and only the harness-written sidecar attests a code-verifier. A further
+test holds the shipped settings.json to the minter docstring's anti-forgery
+claim: the main session is denied writes to the verdict directory, so only this
+hook can mint a passing verdict.
 """
 
 import importlib.util
@@ -290,6 +292,63 @@ def test_minter_refuses_when_recomputed_surface_is_empty(
     assert mint_for_payload(payload) is None
 
 
+def test_resolves_none_when_sidecar_absent_even_with_verdict_fence(
+    tmp_path: pathlib.Path,
+) -> None:
+    agent_transcript = tmp_path / "agent-7.jsonl"
+    agent_transcript.write_text(
+        json.dumps(
+            {
+                "type": "assistant",
+                "message": {
+                    "content": [
+                        {
+                            "type": "text",
+                            "text": 'ok\n```verdict\n{"all_pass": true, "findings": []}\n```\n',
+                        }
+                    ]
+                },
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    payload = {"agent_transcript_path": str(agent_transcript)}
+    assert resolved_subagent_type(payload) is None
+
+
+def test_does_not_mint_when_sidecar_absent_but_transcript_has_verdict(
+    tmp_path: pathlib.Path,
+) -> None:
+    repo_root = tmp_path / "repo"
+    repo_root.mkdir()
+    _init_repo_with_upstream_and_edit(repo_root)
+    agent_transcript = tmp_path / "agent-7.jsonl"
+    agent_transcript.write_text(
+        json.dumps(
+            {
+                "type": "assistant",
+                "message": {
+                    "content": [
+                        {
+                            "type": "text",
+                            "text": 'ok\n```verdict\n{"all_pass": true, "findings": []}\n```\n',
+                        }
+                    ]
+                },
+            }
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+    payload = {
+        "agent_transcript_path": str(agent_transcript),
+        "cwd": str(repo_root),
+        "agent_id": "no-sidecar-1",
+    }
+    assert mint_for_payload(payload) is None
+
+
 def test_attested_manifest_hash_binds_over_cwd_surface(tmp_path: pathlib.Path) -> None:
     repo_root = tmp_path / "repo"
     repo_root.mkdir()

package/hooks/blocking/verification_verdict_store.py

@@ -423,17 +423,29 @@ def _subagents_directory_for_transcript(transcript_path: str) -> Path | None:
 def _agent_type_for_transcript(transcript_file: Path) -> str | None:
     """Read an agent transcript's sidecar to learn the agent type it ran as.
 
+    The agent type comes solely from the harness-written
+    ``agent-<id>.meta.json`` sidecar, which only the harness writes — the main
+    session can neither write the sidecar nor forge the agentType it records. A
+    verdict fence in the transcript is never used to infer the type, because the
+    main session controls the prompt of any Agent-tool subagent it spawns and
+    could instruct one to print such a fence.
+
     Args:
         transcript_file: An ``agent-*.jsonl`` transcript path.
 
     Returns:
-        The ``agentType`` recorded in the ``<stem>.meta.json`` sidecar, or
-        None when the sidecar is missing, unreadable, or carries no type.
+        The ``agentType`` recorded in the ``<stem>.meta.json`` sidecar, or None
+        when the sidecar is absent, unreadable, or unparseable, it does not hold
+        a JSON object, or it names no string ``agentType``.
     """
     sidecar_file = transcript_file.with_suffix(AGENT_META_SIDECAR_SUFFIX)
     try:
-        sidecar_record = json.loads(sidecar_file.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
+        sidecar_text = sidecar_file.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return None
+    try:
+        sidecar_record = json.loads(sidecar_text)
+    except json.JSONDecodeError:
         return None
     if not isinstance(sidecar_record, dict):
         return None
@@ -452,7 +464,9 @@ def _assistant_text_blocks(transcript_file: Path) -> list[str]:
         when the file is missing, unreadable, or holds no assistant text.
     """
     try:
-        transcript_lines = transcript_file.read_text(encoding="utf-8").splitlines()
+        transcript_lines = (
+            transcript_file.read_text(encoding="utf-8", errors="replace").splitlines()
+        )
     except OSError:
         return []
     all_text_blocks: list[str] = []

package/hooks/blocking/verifier_verdict_minter.py

@@ -6,14 +6,14 @@ SubagentStop payload names the stopping subagent's own transcript
 (``agent_transcript_path``), which sits beside a harness-written
 ``agent-<id>.meta.json`` sidecar naming the spawning ``agentType``. The hook
 reads that type from the sidecar, so it resolves identically in interactive,
-background, and worktree-switched sessions. When that type is
+background, and worktree-switched sessions; only the harness writes the
+sidecar, so the type it records cannot be forged. When that type is
 ``code-verifier``, the hook pulls the verdict block out of the agent's own
-transcript (``agent_transcript_path``); the main session writes neither that
-transcript nor the sidecar, so text it prints can never mint — recomputes the
-live change-surface hash for the session repository, and writes the verdict
-bound to that hash. The companion ``verified_commit_gate.py`` (PreToolUse)
-then allows ``git commit`` / ``git push`` only while the work tree still
-matches the verified state.
+transcript (``agent_transcript_path``), recomputes the live change-surface
+hash for the session repository, and writes the verdict bound to that hash.
+The companion ``verified_commit_gate.py`` (PreToolUse) then allows ``git
+commit`` / ``git push`` only while the work tree still matches the verified
+state.
 
 The verifier's final message must end with a fenced block::
 
@@ -125,7 +125,8 @@ def _agent_type_from_meta_sidecar(agent_transcript_path: str) -> str | None:
     ``agent-<id>.meta.json`` naming the spawning ``agentType``. Reading the type
     from this sidecar binds it to the stopping subagent itself, so it resolves
     identically in interactive, background, and worktree-switched sessions and
-    needs no parent-transcript scan or flush retry.
+    needs no parent-transcript scan or flush retry. Only the harness writes this
+    sidecar, so a session cannot forge the type it reports.
 
     Args:
         agent_transcript_path: The stopping subagent's own transcript path from
@@ -133,7 +134,7 @@ def _agent_type_from_meta_sidecar(agent_transcript_path: str) -> str | None:
 
     Returns:
         The recorded ``agentType``, or None when the path is empty, the sidecar
-        is absent or cannot be read or parsed, it does not hold a JSON object,
+        is absent, unreadable, or unparseable, it does not hold a JSON object,
         or it names no string ``agentType``.
     """
     if not agent_transcript_path:
@@ -155,17 +156,19 @@ def resolved_subagent_type(subagent_stop_payload: dict) -> str | None:
 
     The stopping subagent's own transcript (``agent_transcript_path``) sits
     beside a harness-written ``agent-<id>.meta.json`` sidecar naming its
-    ``agentType``. Reading the type from that sidecar binds it to the subagent
-    itself, so it resolves the same across interactive, background, and
-    worktree-switched sessions.
+    ``agentType``. The type comes solely from that sidecar, which only the
+    harness writes — the main session can neither write the sidecar nor forge
+    the agentType it records. A verdict fence in the transcript is never used to
+    infer the type, because the main session controls the prompt of any
+    Agent-tool subagent it spawns and could instruct one to print such a fence.
 
     Args:
         subagent_stop_payload: The SubagentStop hook payload.
 
     Returns:
-        The agent type this subagent was spawned with, or None when the
-        ``agent_transcript_path`` is empty, the sidecar is absent or cannot be
-        read or parsed, it does not hold a JSON object, or it names no string
+        The agent type the sidecar records, or None when the
+        ``agent_transcript_path`` is empty, the sidecar is absent, unreadable,
+        or unparseable, it does not hold a JSON object, or it names no string
         ``agentType``.
     """
     return _agent_type_from_meta_sidecar(

package/hooks/hooks_constants/blocking_check_limits.py

@@ -7,7 +7,6 @@ under the file-global-constants use-count rule (CODE_RULES §file-global-constan
 
 from __future__ import annotations
 
-
 MAX_BANNED_PREFIX_ISSUES: int = 3
 MAX_STUB_IMPLEMENTATION_ISSUES: int = 3
 MAX_TYPED_DICT_PAIR_ISSUES: int = 3
@@ -24,8 +23,27 @@ MAX_TYPE_ESCAPE_HATCH_ISSUES: int = 5
 MAX_THIN_WRAPPER_ISSUES: int = 1
 MAX_ZERO_PAYLOAD_ALIAS_ISSUES: int = 3
 MAX_LOGGING_FSTRING_ISSUES: int = 3
+MAX_LOGGING_PRINTF_TOKEN_ISSUES: int = 3
 MAX_WINDOWS_API_NONE_ISSUES: int = 3
 MAX_E2E_TEST_NAMING_ISSUES: int = 3
+MAX_IMPORT_BLOCK_SORT_ISSUES: int = 1
+IMPORT_BLOCK_SORT_RUFF_TIMEOUT_SECONDS: int = 15
+IMPORT_BLOCK_SORT_RULE_CODE: str = "I001"
+RUFF_STDIN_ENCODING: str = "utf-8"
+RUFF_PYPROJECT_CONFIG_FILENAME: str = "pyproject.toml"
+RUFF_PYPROJECT_TOOL_TABLE_MARKER: str = "[tool.ruff"
+ALL_RUFF_STANDALONE_CONFIG_FILENAMES: tuple[str, ...] = ("ruff.toml", ".ruff.toml")
+ALL_IMPORT_BLOCK_SORT_RUFF_COMMAND_PREFIX: tuple[str, ...] = (
+    "ruff",
+    "check",
+    "--select",
+    "I001",
+    "--no-cache",
+    "--output-format",
+    "json",
+)
+MAX_JS_RESUME_TASK_ENUMERATION_ISSUES: int = 5
+MINIMUM_RESUME_TASK_ENUMERATION_ITEMS: int = 2
 DOCSTRING_TRIVIAL_FUNCTION_BODY_LINE_LIMIT: int = 3
 MAX_DOCSTRING_FALLBACK_BRANCH_ISSUES: int = 3
 DOCSTRING_FALLBACK_BRANCH_MINIMUM_ROUTE_COUNT: int = 2
@@ -85,6 +103,17 @@ DOCSTRING_REFERENCE_MARKER_WINDOW: int = 2
 ALL_GENERIC_CHECK_NAME_TOKENS: frozenset[str] = frozenset(
     {"check", "checks", "test", "tests", "in", "for", "and", "the"}
 )
+ALL_FORMAT_LOGGER_FUNCTION_NAMES: frozenset[str] = frozenset(
+    {
+        "log_debug",
+        "log_info",
+        "log_ok",
+        "log_error",
+        "log_warning",
+        "log_batch",
+        "log_background",
+    }
+)
 
 ALL_DOCSTRING_NO_CONSUMER_CLAIM_PHRASES: tuple[str, ...] = (
     "no consumer reads",

package/hooks/hooks_constants/claude_md_orphan_file_blocker_constants.py

@@ -1,15 +1,18 @@
 """Constants for the per-directory CLAUDE.md orphan-file-reference blocker.
 
 A per-directory ``CLAUDE.md`` documents the files reachable from its own
-directory in a markdown table whose first column names each file in backticks.
-When a first-column cell names a bare filename that exists nowhere under the scan
+directory in a markdown table whose first column names each file in backticks,
+and shows run commands inside fenced code blocks that invoke those files. When a
+first-column cell, or an interpreter invocation inside a run-command fence
+(``python script.py``), names a bare filename that exists nowhere under the scan
 root (the CLAUDE.md directory's parent, covering the directory, its
-subdirectories, and its siblings), the table points a reader at a file that is
-not there. This module holds the patterns that find those cells, the filename
-extensions that mark a cell as a file reference, the region-boundary marker that
-scopes a prose region to one section, the relative-path marker that exempts a
-cross-directory table block, the directory names the subtree walk prunes, the
-subtree scan budget, and the block-message text the hook emits.
+subdirectories, and its siblings), the doc points a reader at a file that is not
+there. This module holds the patterns that find those cells and run-command
+invocations, the filename extensions that mark a cell or invocation as a file
+reference, the region-boundary marker that scopes a prose region to one section,
+the relative-path marker that exempts a cross-directory table block, the
+directory names the subtree walk prunes, the subtree scan budget, and the
+block-message text the hook emits.
 """
 
 import re
@@ -22,7 +25,9 @@ __all__ = [
     "SEPARATOR_CELL_PATTERN",
     "REGION_BOUNDARY_PATTERN",
     "RELATIVE_PATH_SOURCE_PATTERN",
+    "RUN_COMMAND_SCRIPT_PATTERN",
     "ALL_REFERENCED_FILE_EXTENSIONS",
+    "ALL_RUN_COMMAND_SCRIPT_EXTENSIONS",
     "ALL_NOISE_DIRECTORY_NAMES",
     "MAX_SUBTREE_FILES_SCANNED",
     "MAX_ORPHAN_FILE_ISSUES",
@@ -45,6 +50,13 @@ REGION_BOUNDARY_PATTERN: re.Pattern[str] = re.compile(r"^\s*#")
 
 RELATIVE_PATH_SOURCE_PATTERN: re.Pattern[str] = re.compile(r"\.\.[\\/]")
 
+RUN_COMMAND_SCRIPT_PATTERN: re.Pattern[str] = re.compile(
+    r"(?<![\w.])(?:python(?:\.exe)?|python3|node|pwsh|powershell(?:\.exe)?|bash|sh|ruby|perl)"
+    r"\b(?:\s+-\S+(?:\s+[\w./\\][\w./\\-]*(?=\s+\S))?)*"
+    r"\s+[\"']?"
+    r"([\w./\\-]+\.(?:py|mjs|js|ts|ps1|sh|rb|pl))\b"
+)
+
 ALL_REFERENCED_FILE_EXTENSIONS: frozenset[str] = frozenset(
     {
         ".py",
@@ -66,6 +78,19 @@ ALL_REFERENCED_FILE_EXTENSIONS: frozenset[str] = frozenset(
     }
 )
 
+ALL_RUN_COMMAND_SCRIPT_EXTENSIONS: frozenset[str] = frozenset(
+    {
+        ".py",
+        ".mjs",
+        ".js",
+        ".ts",
+        ".ps1",
+        ".sh",
+        ".rb",
+        ".pl",
+    }
+)
+
 ALL_NOISE_DIRECTORY_NAMES: frozenset[str] = frozenset(
     {
         ".git",
@@ -81,27 +106,30 @@ MAX_SUBTREE_FILES_SCANNED: int = 5000
 MAX_ORPHAN_FILE_ISSUES: int = 20
 
 ORPHAN_FILE_MESSAGE_TEMPLATE: str = (
-    "CLAUDE.md table references files that exist nowhere under {directory}: "
-    "{missing}. A per-directory CLAUDE.md table names files in its own directory "
-    "subtree; a first-column cell naming a file absent from that subtree points a "
-    "reader at something that is not there. Drop the row, or correct the cell to "
-    "name a file that exists in this directory, a subdirectory of it, or a sibling "
-    "directory under its parent."
+    "CLAUDE.md references files that exist nowhere under {directory}: "
+    "{missing}. A per-directory CLAUDE.md names files in its own directory "
+    "subtree, both in its table cells and in the run commands its fenced code "
+    "blocks show; a cell or a run command naming a file absent from that subtree "
+    "points a reader at something that is not there. Drop the row or run command, "
+    "or correct it to name a file that exists in this directory, a subdirectory of "
+    "it, or a sibling directory under its parent."
 )
 
 ORPHAN_FILE_SYSTEM_MESSAGE: str = (
-    "CLAUDE.md table names a file that does not exist in its directory subtree - "
-    "drop the row or name an existing file"
+    "CLAUDE.md names a file that does not exist in its directory subtree - "
+    "drop the row or run command, or name an existing file"
 )
 
 ORPHAN_FILE_ADDITIONAL_CONTEXT: str = (
     "Each first-column table cell wrapped in backticks that ends in a known file "
-    "extension must name a file present under the scan root: this CLAUDE.md's own "
-    "directory, a subdirectory of it, or a sibling directory under its parent. "
-    "Cells holding a path with a slash, a subdirectory ending in '/', or a "
-    "slash-command are out of scope. A table whose own block names an explicit "
-    "relative-path source (a '../' token) documents files outside the subtree and "
-    "is out of scope. For each missing file:\n"
-    "  - delete the table row, or\n"
-    "  - rename the cell to an existing file under the scan root."
+    "extension, and each script an interpreter invocation inside a fenced run "
+    "command names (such as 'python script.py'), must name a file present under "
+    "the scan root: this CLAUDE.md's own directory, a subdirectory of it, or a "
+    "sibling directory under its parent. Cells holding a path with a slash, a "
+    "subdirectory ending in '/', or a slash-command are out of scope. A table "
+    "whose own block names an explicit relative-path source (a '../' token) "
+    "documents files outside the subtree and is out of scope. For each missing "
+    "file:\n"
+    "  - delete the table row or the run command, or\n"
+    "  - rename it to an existing file under the scan root."
 )

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -13,7 +13,7 @@ ALL_PYTHON_TOKENIZE_FAILURE_EXCEPTIONS: tuple[type[BaseException], ...] = (
 )
 
 ALL_PYTHON_EXTENSIONS = {".py"}
-ALL_JAVASCRIPT_EXTENSIONS = {".js", ".ts", ".tsx", ".jsx"}
+ALL_JAVASCRIPT_EXTENSIONS = {".js", ".ts", ".tsx", ".jsx", ".mjs", ".cjs", ".mts", ".cts"}
 ALL_CODE_EXTENSIONS = ALL_PYTHON_EXTENSIONS | ALL_JAVASCRIPT_EXTENSIONS
 
 ALL_TEST_PATH_PATTERNS = {"test_", "_test.", ".test.", ".spec.", "/tests/", "\\tests\\", "/tests.py", "\\tests.py"}
@@ -119,6 +119,46 @@ LOGGING_FSTRING_PATTERN = re.compile(
     r'|(?:logger|logging|log)\.(?:debug|info|warning|error|critical|exception))'
     r'\s*\(\s*(?:[rR][fF]|[fF][rR]?)["\']'
 )
+LOGGING_PRINTF_TOKEN_PATTERN: re.Pattern[str] = re.compile(
+    r"(?<!%)%[#0\- +]?[0-9.*]*[sdrixfgeEcoX](?![a-zA-Z])"
+)
+MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT = 2
+SPAWN_AGENT_WITH_JSDOC_PATTERN: re.Pattern[str] = re.compile(
+    r"/\*\*(?P<jsdoc>(?:(?!\*/).)*?)\*/\s*"
+    r"(?:async\s+)?function\s+spawn(?P<role>\w+?)Agent\s*\(",
+    re.DOTALL,
+)
+RESUME_TASK_ENUMERATION_PATTERN: re.Pattern[str] = re.compile(
+    r"(?<![A-Za-z])resume\s*\((?P<enumeration>[^)]*?)\)",
+    re.DOTALL,
+)
+TASK_DISPATCH_NAME_PATTERN: re.Pattern[str] = re.compile(
+    r"""(?<![A-Za-z0-9_])task\s*===\s*['"](?P<task>[a-z0-9-]+)['"]"""
+)
+ENUMERATION_LIST_ITEM_SEPARATOR_PATTERN: re.Pattern[str] = re.compile(
+    r"\s*,\s*|\s+and\s+"
+)
+ENUMERATION_LEADING_CONJUNCTION_PATTERN: re.Pattern[str] = re.compile(
+    r"^and\s+"
+)
+ALL_JAVASCRIPT_STRING_DELIMITERS: frozenset[str] = frozenset({"'", '"', "`"})
+JAVASCRIPT_STRING_ESCAPE_CHARACTER: str = "\\"
+JAVASCRIPT_LINE_COMMENT_OPENER: str = "//"
+JAVASCRIPT_BLOCK_COMMENT_OPENER: str = "/*"
+JAVASCRIPT_BLOCK_COMMENT_CLOSER: str = "*/"
+JAVASCRIPT_REGEX_DELIMITER: str = "/"
+ALL_JAVASCRIPT_REGEX_PRECEDING_CHARACTERS: frozenset[str] = frozenset(
+    {"(", ",", "=", ":", "[", "{", "}", ";", "!", "&", "|", "?", "+", "-", "*", "%", "<", ">", "~", "^", "\n"}
+)
+ALL_JAVASCRIPT_REGEX_PRECEDING_KEYWORDS: frozenset[str] = frozenset(
+    {"return", "typeof", "case", "in", "of", "do", "else", "void", "delete", "instanceof", "new", "yield", "await", "throw"}
+)
+ENUMERATION_TASK_ITEM_PATTERN: re.Pattern[str] = re.compile(
+    r"^[a-z0-9]+(?:-[a-z0-9]+)*$"
+)
+HYPHENATED_TASK_ITEM_PATTERN: re.Pattern[str] = re.compile(
+    r"^[a-z0-9]+(?:-[a-z0-9]+)+$"
+)
 ALL_BUILTIN_DICT_METHOD_NAMES: frozenset[str] = frozenset({
     "get", "items", "keys", "values", "update", "pop",
     "setdefault", "copy", "clear",