claude-dev-env 1.92.1 → 1.93.1

package/hooks/blocking/code_rules_dead_module_constant.py

@@ -33,12 +33,20 @@ The scan is deliberately conservative to keep false positives near zero:
   ``from <module> import`` whose final dotted segment equals the written
   module's filename stem, so a genuine cross-tree consumer of this constants
   module keeps the constant live while a same-named constant exported by an
-  unrelated module never masks a dead one. A module outside any repository is
+  unrelated module never masks a dead one. The widened pass reads a repository
+  file only to test whether its text names the written module's filename stem;
+  a file that never mentions the stem cannot carry such an import, so it is
+  skipped without spending scan-cap budget, keeping the widened pass bounded to
+  the handful of candidate importer files even in a large repository. A module
+  outside any repository is
   judged on the package-tree scan alone, and the widened pass skips the package
   subtree the first pass already covered, so no file is read twice.
-- The combined file count of the package-tree and widened passes is bounded by a
-  cap, so a write under an unexpectedly large tree cannot stall the hook; a write
-  whose scan hits the cap is treated as "cannot prove dead" and flags nothing.
+- Two caps bound the widened pass: a read-attempt cap bounds how many files
+  the pass opens and reads at all while testing for the stem, and a separate
+  parse cap bounds how many of those files (the ones that do name the stem)
+  get parsed and have their names collected. Either cap bounds the pass even
+  under an unexpectedly large tree; a write whose scan hits either cap is
+  treated as "cannot prove dead" and flags nothing.
 - Test modules under the scanned tree still count as references, so a constant
   used only by a test stays live.
 """
@@ -71,6 +79,7 @@ from hooks_constants.dead_module_constant_constants import (  # noqa: E402
     GIT_DIRECTORY_NAME,
     MAX_DEAD_MODULE_CONSTANT_ISSUES,
     MAX_SCAN_ROOT_FILE_COUNT,
+    MAX_SCAN_ROOT_READ_COUNT,
     MINIMUM_UPPER_SNAKE_LENGTH,
     PYTHON_SOURCE_SUFFIX,
 )
@@ -328,6 +337,42 @@ def _is_under_directory(candidate_path: Path, ancestor_directory: Path) -> bool:
     return True
 
 
+def _read_candidate_source(file_path: Path, required_substring: str | None) -> str | None:
+    """Return a module's text, or None when it is not a reference-scan candidate.
+
+    ::
+
+        required_substring = None                 -> read and keep every file
+        required_substring = the module stem      -> keep only files naming it
+            from pkg.foo_constants import BAR  ->  names the stem  ->  candidate
+            def unrelated() -> int: ...        ->  no stem mention ->  skipped
+
+    The widened repository pass looks only for a ``from <module> import`` whose
+    final dotted segment equals the constants module's filename stem, and such an
+    import always spells that stem in the file's text. A file whose text never
+    mentions the stem cannot carry the import, so returning None for it lets the
+    caller skip the file without spending scan-cap budget, which keeps the widened
+    pass bounded to the candidate importer files even under a large repository.
+
+    Args:
+        file_path: The ``.py`` module to read.
+        required_substring: A stem every candidate file's text must contain, or
+            None to keep every readable file (the package-tree pass keeps all).
+
+    Returns:
+        The file's text when it is readable and, when ``required_substring`` is
+        set, contains that stem; None when the file cannot be read or does not
+        name the stem.
+    """
+    try:
+        source_text = file_path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return None
+    if required_substring is not None and required_substring not in source_text:
+        return None
+    return source_text
+
+
 def _collect_names_under_root(
     scan_root: Path,
     written_path: Path,
@@ -335,17 +380,33 @@ def _collect_names_under_root(
     extract_names: Callable[[str], set[str]],
     already_scanned_count: int = 0,
     excluded_subtree: Path | None = None,
+    required_substring: str | None = None,
 ) -> tuple[set[str], int, bool]:
     """Collect referenced names under the scan root via a per-module extractor.
 
     Walks every ``.py`` module under ``scan_root`` (excluding the written module
     itself, and any module under ``excluded_subtree``), applies ``extract_names``
-    to each module's text, and unions the result onto ``all_seed_names``. Reading
-    stops once the running file count exceeds the configured cap so a write under
-    an unexpectedly large tree cannot stall the hook; the boolean signals the
-    caller to treat that case as "cannot prove dead". The ``excluded_subtree``
-    skip keeps the widened repository scan from re-reading a file the
-    package-tree scan already covered.
+    to each module's text, and unions the result onto ``all_seed_names``. Two
+    caps bound the walk so a write under an unexpectedly large tree cannot
+    stall the hook:
+
+    ::
+
+        read_attempt_count  -> every file this call opens and reads,
+                                whether or not it turns out to be a
+                                candidate -> capped by MAX_SCAN_ROOT_READ_COUNT
+        scanned_file_count  -> only the files that pass the candidate
+                                filter and get parsed for names       -> capped
+                                by MAX_SCAN_ROOT_FILE_COUNT
+
+    Either cap tripping returns ``cap_was_hit=True``, which signals the caller
+    to treat the write as "cannot prove dead". The ``excluded_subtree`` skip
+    keeps the widened repository scan from re-reading a file the package-tree
+    scan already covered. When ``required_substring`` is set, a module whose
+    text never contains that stem is skipped after being read but before it is
+    counted toward ``scanned_file_count`` or parsed, so the parse-and-collect
+    work stays bounded to the candidate importer files even though the read
+    cap still bounds the raw disk reads across the whole tree.
 
     Args:
         scan_root: The directory tree to scan.
@@ -357,10 +418,17 @@ def _collect_names_under_root(
         extract_names: Maps one module's source text to the set of names it
             contributes — the generous reference collector for the package-tree
             pass, the stem-bound import collector for the widened pass.
-        already_scanned_count: The file count accumulated by a prior pass, so the
-            cap bounds the combined work of the package-tree and widened passes.
+        already_scanned_count: The parsed-file count accumulated by a prior
+            pass, so the parse cap bounds the combined work of the
+            package-tree and widened passes.
         excluded_subtree: A resolved directory whose ``.py`` modules are skipped,
             or None to scan every file under the root.
+        required_substring: A stem a file's text must contain to count as a
+            scan candidate, or None to scan every file. The widened pass passes
+            the written module's filename stem so a file that never names the
+            module is skipped before it is counted or parsed, spending parse
+            budget only on the candidate importer files, while the read cap
+            still bounds how many files get read looking for that stem.
 
     Returns:
         A (collected_names, running_count, cap_was_hit) triple. collected_names
@@ -372,6 +440,7 @@ def _collect_names_under_root(
     collected_names = set(all_seed_names)
     written_path_key = os.path.normcase(str(written_path))
     scanned_file_count = already_scanned_count
+    read_attempt_count = 0
     for each_path in scan_root.rglob("*" + PYTHON_SOURCE_SUFFIX):
         if not each_path.is_file():
             continue
@@ -380,13 +449,15 @@ def _collect_names_under_root(
             continue
         if excluded_subtree is not None and _is_under_directory(resolved_path, excluded_subtree):
             continue
+        read_attempt_count += 1
+        if read_attempt_count > MAX_SCAN_ROOT_READ_COUNT:
+            return collected_names, scanned_file_count, True
+        sibling_source = _read_candidate_source(each_path, required_substring)
+        if sibling_source is None:
+            continue
         scanned_file_count += 1
         if scanned_file_count > MAX_SCAN_ROOT_FILE_COUNT:
             return collected_names, scanned_file_count, True
-        try:
-            sibling_source = each_path.read_text(encoding="utf-8")
-        except (OSError, UnicodeDecodeError):
-            continue
         collected_names |= extract_names(sibling_source)
     return collected_names, scanned_file_count, False
 
@@ -550,6 +621,7 @@ def check_dead_module_constants(
                 collect_qualified_imports,
                 already_scanned_count=scanned_file_count,
                 excluded_subtree=scan_root,
+                required_substring=written_path.stem,
             )
             if widened_cap_was_hit:
                 return []

package/hooks/blocking/code_rules_enforcer.py

@@ -181,6 +181,10 @@ from code_rules_test_branching_except import (  # noqa: E402
 from code_rules_test_isolation import (  # noqa: E402
     check_tests_use_isolated_filesystem_paths,
 )
+from code_rules_test_layout import (  # noqa: E402
+    check_dead_test_module_constant,
+    check_unused_test_helper_parameter,
+)
 from code_rules_type_escape import (  # noqa: E402
     check_boundary_types,
     check_type_escape_hatches,
@@ -324,6 +328,8 @@ def validate_content(
         all_issues.extend(check_stub_implementations(effective_content, file_path))
         all_issues.extend(check_typed_dict_encode_decode(effective_content, file_path))
         all_issues.extend(check_test_branching_in_production(effective_content, file_path))
+        all_issues.extend(check_dead_test_module_constant(effective_content, file_path))
+        all_issues.extend(check_unused_test_helper_parameter(effective_content, file_path))
         all_issues.extend(check_bare_except(effective_content, file_path))
         all_issues.extend(check_thin_wrapper_files(effective_content, file_path))
         all_issues.extend(check_zero_payload_function_alias(effective_content, file_path))

package/hooks/blocking/code_rules_imports_logging.py

@@ -115,7 +115,16 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
 
 
 def check_imports_at_top(content: str) -> list[str]:
-    """Check for imports inside functions (Python only).
+    """Check for imports below the top import block (Python only).
+
+    Two placements are flagged. First, an import inside a function body. Second,
+    a module-scope import (indent zero) that sits below the first top-level
+    ``def`` or ``class`` definition — the "imports mid-file after functions"
+    drift, where the imports never enter a function body yet still break the
+    imports-at-top rule. An indented import inside a guarded block below a
+    definition (an ``if __name__ == "__main__":`` guard, a ``try`` fallback) is
+    left alone because only indent-zero module-scope imports are checked for the
+    below-definition case.
 
     An import lexically inside an ``if TYPE_CHECKING:`` block is exempt.
     An import inside a function body is flagged even if the file uses TYPE_CHECKING
@@ -146,7 +155,9 @@ def check_imports_at_top(content: str) -> list[str]:
     issues: list[str] = []
     lines = content.split("\n")
     is_inside_function = False
+    has_seen_top_level_definition = False
     function_indent = 0
+    module_scope_indent = 0
     type_checking_block_indent = NOT_INSIDE_TYPE_CHECKING_BLOCK
     active_triple_quote_delimiter: str | None = None
 
@@ -180,6 +191,16 @@ def check_imports_at_top(content: str) -> list[str]:
         if function_match:
             is_inside_function = True
             function_indent = len(function_match.group(1)) if function_match.group(1) else 0
+            if function_indent == module_scope_indent:
+                has_seen_top_level_definition = True
+            active_triple_quote_delimiter = _update_triple_quote_state_for_line(
+                each_line, active_triple_quote_delimiter
+            )
+            continue
+
+        class_match = re.match(r"^(\s*)class\s+\w+", each_line)
+        if class_match and len(class_match.group(1)) == module_scope_indent:
+            has_seen_top_level_definition = True
             active_triple_quote_delimiter = _update_triple_quote_state_for_line(
                 each_line, active_triple_quote_delimiter
             )
@@ -194,6 +215,18 @@ def check_imports_at_top(content: str) -> list[str]:
             if stripped.startswith(ALL_IMPORT_STATEMENT_PREFIXES):
                 issues.append(f"Line {each_line_number}: Import inside function - move to top of file")
 
+        is_module_scope_import = (
+            current_indent == module_scope_indent
+            and not is_inside_function
+            and not is_inside_type_checking_block
+            and stripped.startswith(ALL_IMPORT_STATEMENT_PREFIXES)
+        )
+        if is_module_scope_import and has_seen_top_level_definition:
+            issues.append(
+                f"Line {each_line_number}: Import after top-level definition - "
+                "move imports to top of file"
+            )
+
         active_triple_quote_delimiter = _update_triple_quote_state_for_line(
             each_line, active_triple_quote_delimiter
         )

package/hooks/blocking/code_rules_paths_syspath.py

@@ -40,7 +40,7 @@ from hooks_constants.sys_path_insert_constants import (  # noqa: E402
 def check_hardcoded_user_paths(content: str, file_path: str) -> list[str]:
     """Flag string literals naming a specific user's home directory.
 
-    Catches non-portable paths like `C:/Users/jon/...`, `/Users/alice/...`,
+    Catches non-portable paths like `C:/Users/example/...`, `/Users/alice/...`,
     and `/home/bob/...` that surface in production code.
     Test files, config/ files, workflow registry files, migration files,
     and hook infrastructure files are exempt. Hook infrastructure exemption

package/hooks/blocking/code_rules_test_layout.py

@@ -0,0 +1,272 @@
+"""Test-module dead-scaffolding checks: dead constant, unused helper parameter.
+
+Both checks run on a test module where scaffolding left after an edit hides in
+plain sight: when a removed monkeypatch line was the last reader of a module
+constant, or the last user of a private helper's parameter, the leftover is
+dead code the checks flag at Write/Edit time.
+
+The dead-constant check runs only on a ``test_*.py`` / ``*_test.py`` module of
+test functions, which exports nothing, so a single-file scan proves a constant
+no other line reads is dead. A ``conftest.py``, a shared helper module reached
+only through the ``tests/`` directory gate, and a dedicated constants or
+``config/`` module all export their constants to importer modules, so the
+cross-module ``check_dead_module_constants`` governs their constants and the
+dead-constant check leaves them alone.
+"""
+
+import ast
+from typing import TypeGuard
+
+from code_rules_dead_module_constant import _is_dedicated_constants_module
+from code_rules_shared import is_strict_test_file
+from hooks_constants.test_layout_constants import (
+    CLASS_METHOD_FIRST_PARAMETER_NAME,
+    DEAD_TEST_CONSTANT_GUIDANCE,
+    FIXTURE_DECORATOR_MARKER,
+    MAX_TEST_LAYOUT_ISSUES,
+    MINIMUM_CONSTANT_NAME_LENGTH,
+    PRIVATE_NAME_PREFIX,
+    SELF_PARAMETER_NAME,
+    TEST_FUNCTION_MODULE_BASENAME_PATTERN,
+    UNUSED_TEST_HELPER_PARAMETER_GUIDANCE,
+)
+
+_FunctionNode = ast.FunctionDef | ast.AsyncFunctionDef
+
+
+def _parse_module(content: str) -> ast.Module | None:
+    """Return the parsed module, or None when the content does not parse."""
+    try:
+        return ast.parse(content)
+    except SyntaxError:
+        return None
+
+def _is_dead_constant_scan_target(file_path: str) -> bool:
+    """Return whether a single-file dead-constant scan can judge this module.
+
+    ::
+
+        tests/test_report.py                      -> scan  (test functions export nothing)
+        tests/conftest.py                         -> skip  (fixtures shared with siblings)
+        tests/expected_values.py                  -> skip  (a shared module exports)
+        hooks_constants/test_layout_constants.py  -> skip  (a constants module exports)
+
+    A ``test_*`` / ``*_test`` module of test functions exports nothing, so a
+    constant no other line reads is dead. A ``conftest.py``, a shared helper
+    module reached only through the ``tests/`` directory gate, and a dedicated
+    constants or ``config/`` module all export to importer modules, where the
+    cross-module ``check_dead_module_constants`` governs their constants.
+
+    Args:
+        file_path: The destination path of the write.
+
+    Returns:
+        True only for a ``test_*.py`` / ``*_test.py`` module that is not a
+        dedicated constants or ``config/`` module.
+    """
+    if _is_dedicated_constants_module(file_path):
+        return False
+    basename = file_path.lower().replace("\\", "/").rsplit("/", 1)[-1]
+    return TEST_FUNCTION_MODULE_BASENAME_PATTERN.match(basename) is not None
+
+def _is_private_constant_name(name: str) -> bool:
+    """Return whether a name is a private UPPER_SNAKE constant identifier.
+
+    ::
+
+        _ABSENT_DOTENV_FILENAME  ->  private constant, judged
+        EXPECTED_TOTAL           ->  public constant, left alone
+
+    Only a leading-underscore name qualifies. A public module constant exports
+    to importer modules, so the cross-module ``check_dead_module_constants``
+    governs it and this single-file scan leaves it alone.
+    """
+    if not name.startswith(PRIVATE_NAME_PREFIX):
+        return False
+    if len(name) < MINIMUM_CONSTANT_NAME_LENGTH:
+        return False
+    if not name.replace("_", "").isalnum():
+        return False
+    return name == name.upper() and any(each_char.isalpha() for each_char in name)
+
+def _assignment_targets(statement: ast.stmt) -> list[ast.expr]:
+    """Return the assignment targets of a plain or annotated assignment."""
+    if isinstance(statement, ast.Assign):
+        return list(statement.targets)
+    if isinstance(statement, ast.AnnAssign) and statement.value is not None:
+        return [statement.target]
+    return []
+
+def _statement_constant_targets(statement: ast.stmt) -> list[tuple[str, int]]:
+    """Return (name, line) for each private UPPER_SNAKE constant one statement binds."""
+    named_targets: list[tuple[str, int]] = []
+    for each_target in _assignment_targets(statement):
+        if isinstance(each_target, ast.Name) and _is_private_constant_name(each_target.id):
+            named_targets.append((each_target.id, statement.lineno))
+    return named_targets
+
+def _module_constant_targets(tree: ast.Module) -> list[tuple[str, int]]:
+    """Return (name, line) for every module-scope private UPPER_SNAKE constant, in order."""
+    constant_targets: list[tuple[str, int]] = []
+    for each_statement in tree.body:
+        constant_targets.extend(_statement_constant_targets(each_statement))
+    return constant_targets
+
+def _referenced_names(tree: ast.Module) -> set[str]:
+    """Return every name the module reads plus every string literal it holds.
+
+    A ``Load``-context name is a read; a ``Store`` target (the constant's own
+    definition) is not, so a constant read nowhere else stays out of the set.
+    String literals are unioned in so an ``__all__`` or ``getattr`` string name
+    still counts.
+    """
+    all_nodes = list(ast.walk(tree))
+    load_names = {
+        each_node.id
+        for each_node in all_nodes
+        if isinstance(each_node, ast.Name) and isinstance(each_node.ctx, ast.Load)
+    }
+    literal_values = {
+        each_node.value
+        for each_node in all_nodes
+        if isinstance(each_node, ast.Constant) and isinstance(each_node.value, str)
+    }
+    return load_names | literal_values
+
+def _dead_constant_messages(tree: ast.Module, referenced_names: set[str]) -> list[str]:
+    """Return one message per module constant absent from the referenced set."""
+    issues: list[str] = []
+    for each_name, each_line in _module_constant_targets(tree):
+        if each_name in referenced_names:
+            continue
+        issues.append(
+            f"Line {each_line}: constant {each_name!r} - {DEAD_TEST_CONSTANT_GUIDANCE}"
+        )
+        if len(issues) >= MAX_TEST_LAYOUT_ISSUES:
+            break
+    return issues
+
+def check_dead_test_module_constant(content: str, file_path: str) -> list[str]:
+    """Flag a private module-level constant in a test-function module no line reads.
+
+    ::
+
+        tests/test_report.py, a private UPPER_SNAKE constant no Load reference
+        and no string literal names   ->   dead scaffolding, flag it
+        tests/test_report.py, a public constant (EXPECTED_TOTAL)   ->   skip
+        tests/conftest.py / tests/expected_values.py / *_constants.py   ->   skip
+
+    A private constant read by no reference and named in no string literal is
+    dead scaffolding an edit stranded. A public constant, a ``conftest.py``, a
+    shared helper module under ``tests/``, and a dedicated constants or
+    ``config/`` module all export to importer modules, so the cross-module
+    ``check_dead_module_constants`` judges those and this check skips them.
+
+    Args:
+        content: The post-edit file content under validation.
+        file_path: The destination path, used for the test-function-module gate.
+
+    Returns:
+        One message per dead private constant, capped at the configured maximum.
+    """
+    if not _is_dead_constant_scan_target(file_path):
+        return []
+    tree = _parse_module(content)
+    if tree is None:
+        return []
+    return _dead_constant_messages(tree, _referenced_names(tree))
+
+def _node_names_fixture(node: ast.AST) -> bool:
+    """Return whether one decorator sub-node spells the pytest fixture marker."""
+    if isinstance(node, ast.Name):
+        return FIXTURE_DECORATOR_MARKER in node.id
+    if isinstance(node, ast.Attribute):
+        return FIXTURE_DECORATOR_MARKER in node.attr
+    return False
+
+def _has_fixture_decorator(function_node: _FunctionNode) -> bool:
+    """Return whether a function carries a pytest fixture decorator.
+
+    A fixture parameter is injected by pytest and read by name only, so a
+    fixture must never be judged for unused parameters.
+    """
+    for each_decorator in function_node.decorator_list:
+        if any(
+            _node_names_fixture(each_node) for each_node in ast.walk(each_decorator)
+        ):
+            return True
+    return False
+
+def _is_judged_parameter(parameter_name: str) -> bool:
+    """Return whether a parameter name is worth judging for being unread.
+
+    ``self`` and ``cls`` are receiver names, and an underscore-prefixed name is
+    a conventional throwaway, so none of the three are judged.
+    """
+    if parameter_name in {SELF_PARAMETER_NAME, CLASS_METHOD_FIRST_PARAMETER_NAME}:
+        return False
+    return not parameter_name.startswith(PRIVATE_NAME_PREFIX)
+
+def _candidate_parameters(function_node: _FunctionNode) -> list[ast.arg]:
+    """Return the parameters of a function worth judging for being unread."""
+    arguments = function_node.args
+    all_parameters = arguments.posonlyargs + arguments.args + arguments.kwonlyargs
+    return [each for each in all_parameters if _is_judged_parameter(each.arg)]
+
+def _read_parameter_names(function_node: _FunctionNode) -> set[str]:
+    """Return every name read anywhere in a function body."""
+    return {
+        each_node.id
+        for each_node in ast.walk(function_node)
+        if isinstance(each_node, ast.Name) and isinstance(each_node.ctx, ast.Load)
+    }
+
+def _unused_parameter_messages(function_node: _FunctionNode) -> list[str]:
+    """Return one message per candidate parameter the function body never reads."""
+    read_names = _read_parameter_names(function_node)
+    issues: list[str] = []
+    for each_parameter in _candidate_parameters(function_node):
+        if each_parameter.arg in read_names:
+            continue
+        issues.append(
+            f"Line {each_parameter.lineno}: parameter {each_parameter.arg!r}"
+            f" on {function_node.name!r} - {UNUSED_TEST_HELPER_PARAMETER_GUIDANCE}"
+        )
+    return issues
+
+def _is_private_plain_function(statement: ast.stmt) -> TypeGuard[_FunctionNode]:
+    """Return whether a statement is a private, non-fixture module-level function."""
+    if not isinstance(statement, ast.FunctionDef | ast.AsyncFunctionDef):
+        return False
+    if not statement.name.startswith(PRIVATE_NAME_PREFIX):
+        return False
+    return not _has_fixture_decorator(statement)
+
+def check_unused_test_helper_parameter(content: str, file_path: str) -> list[str]:
+    """Flag a parameter of a private test helper that its body never reads.
+
+    ::
+
+        def _configuration(monkeypatch, tmp_path):   neither read -> flag
+            return DatabaseConfig.from_environment()
+
+    A private module-level function carries no pytest fixture decorator, so its
+    parameter is never injected by name, and one the body never reads is dead.
+
+    Args:
+        content: The post-edit file content under validation.
+        file_path: The destination path, used for the test-file gate.
+
+    Returns:
+        One message per unused private-helper parameter, capped at the maximum.
+    """
+    if not is_strict_test_file(file_path):
+        return []
+    tree = _parse_module(content)
+    if tree is None:
+        return []
+    issues: list[str] = []
+    for each_statement in tree.body:
+        if _is_private_plain_function(each_statement):
+            issues.extend(_unused_parameter_messages(each_statement))
+    return issues[:MAX_TEST_LAYOUT_ISSUES]

package/hooks/blocking/nas_ssh_binary_enforcer.py

@@ -15,7 +15,7 @@ found by skipping ``VAR=value`` assignments and launcher wrappers (``timeout``,
 ``nohup``, ``nice``, ``stdbuf``, ``setsid``, ``env``) with their flags and duration
 arguments. A segment is evaluated only when its leading program's basename is
 ``ssh``/``scp``/``sftp`` (with or without a ``.exe`` suffix) AND a token in that same
-segment holds the NAS address ``192.168.1.100`` as a connection host — bare,
+segment holds the NAS host (resolved from the ``CLAUDE_NAS_*`` environment variables or ``~/.claude/local-identity.json``) as a connection host — bare,
 ``user@host``, or a ``host:path`` target. The address inside a remote-command
 argument or a remote path component on another host does not count.
 
@@ -30,6 +30,7 @@ without an ssh-family leading program, and a command shlex cannot tokenize.
 """
 
 import json
+import re
 import shlex
 import sys
 from pathlib import Path
@@ -39,19 +40,21 @@ if _hooks_dir not in sys.path:
     sys.path.insert(0, _hooks_dir)
 
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
+from hooks_constants.local_identity import (  # noqa: E402
+    bare_ssh_binary_deny_message,
+    missing_batch_mode_deny_message,
+    nas_host,
+)
 from hooks_constants.nas_ssh_binary_enforcer_constants import (  # noqa: E402
     ALL_LAUNCHER_WRAPPER_COMMANDS,
     ALL_OPENSSH_BINARY_PATH_SUFFIXES,
     ALL_SHELL_CONTROL_OPERATOR_TOKENS,
     ALL_SSH_FAMILY_COMMAND_BASENAMES,
-    BARE_SSH_BINARY_MESSAGE,
     BASH_TOOL_NAME,
     BATCH_MODE_PATTERN,
     CONTROL_OPERATOR_SPLIT_PATTERN,
     LAUNCHER_DURATION_PATTERN,
     LEADING_ASSIGNMENT_PATTERN,
-    MISSING_BATCH_MODE_MESSAGE,
-    NAS_HOST_TOKEN_PATTERN,
 )
 
 
@@ -67,6 +70,10 @@ def _is_openssh_binary_path(token: str) -> bool:
     )
 
 
+def _nas_host_token_pattern() -> re.Pattern[str]:
+    return re.compile(rf"(?:^|@){re.escape(nas_host())}(?::|$)")
+
+
 def _split_into_segments(all_command_tokens: list[str]) -> list[list[str]]:
     all_exploded_tokens: list[str] = []
     for each_token in all_command_tokens:
@@ -101,8 +108,10 @@ def _effective_leading_program(all_segment_tokens: list[str]) -> str | None:
     return None
 
 
-def _segment_references_nas(all_segment_tokens: list[str]) -> bool:
-    return any(NAS_HOST_TOKEN_PATTERN.search(each_token) for each_token in all_segment_tokens)
+def _segment_references_nas(
+    all_segment_tokens: list[str], nas_host_pattern: re.Pattern[str]
+) -> bool:
+    return any(nas_host_pattern.search(each_token) for each_token in all_segment_tokens)
 
 
 def _segment_carries_batch_mode(all_segment_tokens: list[str]) -> bool:
@@ -114,10 +123,10 @@ def _find_nas_ssh_violation(command: str) -> str | None:
 
     ::
 
-        ssh -p 9222 jon@192.168.1.100 "ls"          flag: bare-binary message
-        "…/OpenSSH/ssh.exe" -p 9222 jon@192.168…    flag: missing-batch-mode message
+        ssh -p 22 operator@nas.example.local "ls"          flag: bare-binary message
+        "…/OpenSSH/ssh.exe" -p 22 operator@nas…    flag: missing-batch-mode message
         "…/OpenSSH/ssh.exe" -o BatchMode=yes …NAS   ok:   None
-        ssh jon@example.com "ls"                     ok:   None
+        ssh operator@example.com "ls"                     ok:   None
 
     Tokenizes the command, splits it into simple-command segments, and evaluates
     each segment whose leading program is an ssh-family word AND whose tokens carry
@@ -135,18 +144,19 @@ def _find_nas_ssh_violation(command: str) -> str | None:
         all_command_tokens = shlex.split(command)
     except ValueError:
         return None
+    nas_host_pattern = _nas_host_token_pattern()
     for each_segment in _split_into_segments(all_command_tokens):
         leading_program = _effective_leading_program(each_segment)
         if leading_program is None:
             continue
         if _token_basename(leading_program) not in ALL_SSH_FAMILY_COMMAND_BASENAMES:
             continue
-        if not _segment_references_nas(each_segment):
+        if not _segment_references_nas(each_segment, nas_host_pattern):
             continue
         if not _is_openssh_binary_path(leading_program):
-            return BARE_SSH_BINARY_MESSAGE
+            return bare_ssh_binary_deny_message()
         if not _segment_carries_batch_mode(each_segment):
-            return MISSING_BATCH_MODE_MESSAGE
+            return missing_batch_mode_deny_message()
     return None