claude-dev-env 8.24.0 → 8.25.1

package/docs/CODE_RULES.md

@@ -31,7 +31,7 @@ A keep marker is the one comment that may be added and kept: a comment that open
 
 The staged policy lint reports each of these through `code_rules_enforcer.py` and names the specific breach; exact patterns and exemption lists live in that module:
 
-no new comments · imports at top · logging format args (`log_*("...", arg)`) · no `%s`/`%d` printf tokens in a `str.format`-logger message (`log_*` imported from `automation_logging`; `str.format` drops the args — use `{}`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · must-check returns (`find_and_click`, `write_outcome`) assigned and checked · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks are ruff's job (F401, isort I001), not this hook's · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
+no new comments · imports at top · logging format args (`log_*("...", arg)`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks belong to ruff (F401, isort I001) · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
 
 Test files follow the comment policy above; other test-specific exemptions are listed here. The one annotation the test-file exemption does NOT cover is a known pytest builtin fixture parameter: `tmp_path`, `monkeypatch`, `capsys`, `capfd`, `caplog`, `request`, and `tmp_path_factory` each have a single documented injected type, so the gate requires that annotation (`tmp_path: Path`) even inside a test file. The same set of fixtures is also subject to a use check: a pytest-collected test function that declares one of these parameters and never references it in its body fails the gate, because pytest materializes the fixture's setup (the temp directory, the monkeypatch context, the output capture) on every run whether or not the body reads the value — drop the unused parameter. A parameter counts as referenced when its name is read, augmented-assigned, or deleted anywhere in the body, including inside a nested function or comprehension. Only pytest-collectable functions are inspected — those at module top level or defined directly in a class body; a function nested inside another function's body is a local helper pytest never collects, so its fixture-named parameter is exempt. A `@pytest.fixture`-decorated function is exempt from the use check, since injecting one fixture into another purely to order its setup is intentional. Ordinary test parameters stay exempt from both checks.
 

package/hooks/blocking/code_rules_boolean_mustcheck.py

@@ -1,4 +1,4 @@
-"""Boolean naming-prefix and ignored must-check-return checks."""
+"""Boolean naming-prefix checks."""
 
 import ast
 import sys
@@ -21,12 +21,8 @@ from code_rules_shared import (  # noqa: E402
     is_workflow_registry_file,
 )
 
-from hooks_constants.blocking_check_limits import (  # noqa: E402
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-)
 from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     ALL_BOOLEAN_NAME_PREFIXES,
-    ALL_MUST_CHECK_RETURN_FUNCTION_NAMES,
     ALL_SELF_AND_CLS_PARAMETER_NAMES,
     UPPER_SNAKE_CONSTANT_PATTERN,
 )
@@ -271,80 +267,3 @@ def _called_terminal_name(call_node: ast.Call) -> str | None:
     if isinstance(callee, ast.Attribute):
         return callee.attr
     return None
-
-
-def check_ignored_must_check_return(
-    content: str,
-    file_path: str,
-    all_changed_lines: set[int] | None = None,
-    defer_scope_to_caller: bool = False,
-) -> list[str]:
-    """Flag bare-expression calls whose discarded return is the only failure signal.
-
-    Functions in ``ALL_MUST_CHECK_RETURN_FUNCTION_NAMES`` report success or failure
-    solely through their return value. A bare-statement call discards that value,
-    so the caller silently proceeds on failure. Bare ``ast.Expr`` calls are flagged,
-    including a bare ``await``-wrapped call (``await find_and_click(...)`` as a
-    statement); an assigned or branched-on call is exempt.
-
-    The caller passes the reconstructed full file as *content* so ``ast.parse``
-    sees a complete module rather than an Edit's ``new_string`` fragment, which is
-    rarely valid standalone Python (a bare ``await find_and_click(...)`` line is a
-    SyntaxError on its own). Findings are then scoped to *all_changed_lines* so an
-    Edit blocks on the discarded return it just introduced while a pre-existing
-    violation on an untouched line does not block the edit.
-
-    Args:
-        content: The source text to inspect — the reconstructed full file on an
-            Edit so the parse succeeds.
-        file_path: The path the source will be written to, used for exemptions.
-        all_changed_lines: Post-edit line numbers the current edit touched, or
-            None to treat the whole file as in scope. When provided, a violation
-            blocks only when the bare call's line intersects the changed lines.
-        defer_scope_to_caller: When True, return every violation so the
-            commit/push gate's ``split_violations_by_scope`` can scope by added
-            line.
-
-    Returns:
-        One issue per discarded must-check return, scoped to the changed lines
-        unless *defer_scope_to_caller* is True or *all_changed_lines* is None. When
-        *defer_scope_to_caller* is True every violation is returned uncapped so the
-        gate can scope by added line and apply its own ceiling; otherwise the
-        terminal result is capped at the module limit.
-    """
-    if is_test_file(file_path):
-        return []
-    try:
-        tree = ast.parse(content)
-    except SyntaxError:
-        return []
-    all_violations_in_walk_order: list[tuple[range, str]] = []
-    for each_node in ast.walk(tree):
-        if not isinstance(each_node, ast.Expr):
-            continue
-        expression_value = each_node.value
-        call_node = (
-            expression_value.value
-            if isinstance(expression_value, ast.Await)
-            else expression_value
-        )
-        if not isinstance(call_node, ast.Call):
-            continue
-        called_name = _called_terminal_name(call_node)
-        if called_name is None or called_name not in ALL_MUST_CHECK_RETURN_FUNCTION_NAMES:
-            continue
-        end_line_number = each_node.end_lineno or each_node.lineno
-        line_span = range(each_node.lineno, end_line_number + 1)
-        message = (
-            f"Line {each_node.lineno}: return value of {called_name}() is discarded - "
-            "assign and check it (the boolean/outcome is the only failure signal)"
-        )
-        all_violations_in_walk_order.append((line_span, message))
-    scoped_issues = _scope_violations_to_changed_lines(
-        all_violations_in_walk_order,
-        all_changed_lines,
-        defer_scope_to_caller,
-    )
-    if defer_scope_to_caller:
-        return scoped_issues
-    return scoped_issues[:MAX_IGNORED_MUST_CHECK_RETURN_ISSUES]

package/hooks/blocking/code_rules_enforcer.py

@@ -46,7 +46,6 @@ from code_rules_blast_radius import (  # noqa: E402
 )
 from code_rules_boolean_mustcheck import (  # noqa: E402
     check_boolean_naming,
-    check_ignored_must_check_return,
 )
 from code_rules_command_dispatch import (  # noqa: E402
     check_unanchored_command_dispatch,
@@ -86,7 +85,6 @@ from code_rules_imports_logging import (  # noqa: E402
     check_library_print,
     check_logging_adjacent_string_literals,
     check_logging_fstrings,
-    check_logging_printf_tokens,
     check_naive_datetime_construction,
     check_windows_api_none,
 )
@@ -329,7 +327,6 @@ def _python_comment_and_logging_issues(context: _ValidationContext) -> list[str]
         all_issues.extend(check_comment_changes(old_content, content, file_path))
     all_issues.extend(check_imports_at_top(content))
     all_issues.extend(check_logging_fstrings(content))
-    all_issues.extend(check_logging_printf_tokens(content, file_path))
     all_issues.extend(check_logging_adjacent_string_literals(content, file_path))
     all_issues.extend(check_windows_api_none(content))
     all_issues.extend(check_naive_datetime_construction(content, file_path))
@@ -450,9 +447,6 @@ def _python_boolean_and_test_assertion_issues(context: _ValidationContext) -> li
     )
     changed, defer = context.all_changed_lines, context.defer_scope_to_caller
     all_issues = check_boolean_naming(effective_content, file_path, changed, defer)
-    all_issues.extend(
-        check_ignored_must_check_return(effective_content, file_path, changed, defer)
-    )
     all_issues.extend(check_skip_decorators_in_tests(content, file_path))
     all_issues.extend(
         check_tests_use_isolated_filesystem_paths(

package/hooks/blocking/code_rules_imports_logging.py

@@ -1,4 +1,4 @@
-"""Import and logging convention checks: check_imports_at_top, check_logging_fstrings, check_logging_printf_tokens, check_logging_adjacent_string_literals, check_windows_api_none, check_naive_datetime_construction, check_e2e_test_naming, check_js_resume_task_enumeration_coverage, check_js_returns_object_schemaless_branch, check_js_sibling_return_object_key_drift, check_js_bare_flag_return_directive, and check_library_print."""
+"""Import and logging convention checks: check_imports_at_top, check_logging_fstrings, check_logging_adjacent_string_literals, check_windows_api_none, check_naive_datetime_construction, check_e2e_test_naming, check_js_resume_task_enumeration_coverage, check_js_returns_object_schemaless_branch, check_js_sibling_return_object_key_drift, check_js_bare_flag_return_directive, and check_library_print."""
 
 import ast
 import re
@@ -25,7 +25,6 @@ from code_rules_shared import (  # noqa: E402
 
 from hooks_constants.blocking_check_limits import (  # noqa: E402
     ALL_ALWAYS_NAIVE_DATETIME_CONSTRUCTORS,
-    ALL_FORMAT_LOGGER_FUNCTION_NAMES,
     DATETIME_CLASS_ATTRIBUTE_NAME,
     FROMTIMESTAMP_POSITIONAL_TIMEZONE_ARGUMENT_COUNT,
     MAX_E2E_TEST_NAMING_ISSUES,
@@ -35,7 +34,6 @@ from hooks_constants.blocking_check_limits import (  # noqa: E402
     MAX_JS_SIBLING_RETURN_OBJECT_KEY_DRIFT_ISSUES,
     MAX_LOGGING_ADJACENT_LITERAL_ISSUES,
     MAX_LOGGING_FSTRING_ISSUES,
-    MAX_LOGGING_PRINTF_TOKEN_ISSUES,
     MAX_NAIVE_DATETIME_ISSUES,
     MAX_WINDOWS_API_NONE_ISSUES,
     MINIMUM_RESUME_TASK_ENUMERATION_ITEMS,
@@ -87,9 +85,7 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     JSDOC_RETURNS_STRUCTURED_OBJECT_PROMISE_PATTERN,
     LOGGING_FSTRING_PATTERN,
     LOGGING_HELPER_FUNCTION_NAME_PATTERN,
-    LOGGING_PRINTF_TOKEN_PATTERN,
     LOGGING_RECEIVER_NAME_PATTERN,
-    MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT,
     NOT_INSIDE_TYPE_CHECKING_BLOCK,
     RESUME_TASK_ENUMERATION_PATTERN,
     RETURN_CALL_OPENING_PARENTHESIS_PATTERN,
@@ -280,121 +276,6 @@ def check_logging_fstrings(content: str) -> list[str]:
     return issues
 
 
-def _format_logger_names_imported(tree: ast.Module) -> set[str]:
-    """Return the local names bound to automation_logging log helpers.
-
-    Scans every ``from ... import ...`` statement for an import whose module
-    path contains ``automation_logging`` and collects the local binding of each
-    imported ``log_*`` helper (the alias when ``as`` is present, otherwise the
-    imported name). Only these names identify a str.format-logger call; a
-    ``log_*`` helper from any other module is not collected, because a
-    ``%``-style logger formats its tokens correctly.
-
-    Args:
-        tree: The parsed module to scan for logger imports.
-
-    Returns:
-        The set of local names bound to automation_logging log helpers.
-    """
-    bound_names: set[str] = set()
-    for each_node in ast.walk(tree):
-        if not isinstance(each_node, ast.ImportFrom):
-            continue
-        if each_node.module is None or "automation_logging" not in each_node.module:
-            continue
-        for each_alias in each_node.names:
-            if each_alias.name in ALL_FORMAT_LOGGER_FUNCTION_NAMES:
-                bound_names.add(each_alias.asname or each_alias.name)
-    return bound_names
-
-
-def _printf_token_log_call_line(
-    node: ast.AST, all_format_logger_names: set[str]
-) -> int | None:
-    """Return the line of a format-logger call carrying a printf token, else None.
-
-    Args:
-        node: The AST node to inspect.
-        all_format_logger_names: Local names bound to automation_logging log
-            helpers.
-
-    Returns:
-        The 1-based line number when ``node`` is a bare-name call to a format
-        logger that has at least one format argument after the message and
-        whose first string-literal argument carries a printf token; otherwise
-        None. A call with only the message and no format arguments never runs
-        ``.format(*args)``, so its token prints intact and is not flagged.
-    """
-    if not isinstance(node, ast.Call):
-        return None
-    function_reference = node.func
-    if (
-        not isinstance(function_reference, ast.Name)
-        or function_reference.id not in all_format_logger_names
-    ):
-        return None
-    if len(node.args) < MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT:
-        return None
-    message_argument = node.args[0]
-    if not isinstance(message_argument, ast.Constant) or not isinstance(
-        message_argument.value, str
-    ):
-        return None
-    if not LOGGING_PRINTF_TOKEN_PATTERN.search(message_argument.value):
-        return None
-    return node.lineno
-
-
-def check_logging_printf_tokens(content: str, file_path: str) -> list[str]:
-    """Flag printf tokens in a str.format-logger (automation_logging) message.
-
-    The ``shared_utils.automation_logging`` helpers (``log_info``, ``log_error``,
-    ...) format with ``str.format`` (``{}`` placeholders) only when format
-    arguments follow the message (``message.format(*args) if args else
-    message``), so a printf-style token such as ``%s`` in the message literal is
-    never substituted: the format arguments are dropped and the literal token
-    prints. The check fires only in a file that imports one of those helpers
-    from an ``automation_logging`` module, and only for a bare-name call to such
-    a helper that passes at least one format argument after the message and
-    whose first argument is a string literal carrying a token. A call with only
-    the message and no format arguments never runs ``.format``, so its token
-    prints intact and is left alone. An attribute call (``logger.info``) or a
-    ``log_*`` helper from any other module formats ``%``-tokens correctly and is
-    left alone. Test files are exempt so a test may exercise the malformed shape.
-
-    Args:
-        content: The Python source under validation.
-        file_path: The destination path, used to skip test files and non-Python.
-
-    Returns:
-        One issue line per offending call, capped at the configured maximum.
-    """
-    if is_test_file(file_path):
-        return []
-    if get_file_extension(file_path) not in ALL_PYTHON_EXTENSIONS:
-        return []
-    try:
-        tree = ast.parse(content)
-    except SyntaxError:
-        return []
-    all_format_logger_names = _format_logger_names_imported(tree)
-    if not all_format_logger_names:
-        return []
-    issues: list[str] = []
-    for each_node in ast.walk(tree):
-        offending_line = _printf_token_log_call_line(each_node, all_format_logger_names)
-        if offending_line is None:
-            continue
-        issues.append(
-            f"Line {offending_line}: printf token in a str.format logger "
-            "message - the automation_logging helpers format with str.format; "
-            "use {} placeholders (the %-arguments are silently dropped)"
-        )
-        if len(issues) >= MAX_LOGGING_PRINTF_TOKEN_ISSUES:
-            break
-    return issues
-
-
 def _logging_call_receiver_name(receiver_node: ast.expr) -> str | None:
     """Return the trailing identifier of a logging-call receiver expression, else None.
 

package/hooks/blocking/reply_length_gate.py

@@ -4,6 +4,11 @@
 The gate reads the ``text`` field of the chat tools that post to the user.
 It denies the call when the text holds more than MAXIMUM_SENTENCE_COUNT
 sentences, or a sentence longer than MAXIMUM_WORDS_PER_SENTENCE words.
+It also denies a pull request number the reader cannot open::
+
+    flag: Both land in PR 5256.
+    flag: It merged in #4347.
+    ok:   Both land in [PR 5256](https://github.com/owner/repo/pull/5256).
 Each non-empty line counts as its own sentence, so a list counts one
 sentence per item. URLs, markdown link targets, inline code spans, and
 fenced blocks carry no words.
@@ -34,6 +39,7 @@ from hooks_constants.reply_length_gate_constants import (
     LINE_BREAK_PATTERN,
     LINK_TARGET_PATTERN,
     LONG_SENTENCE_MESSAGE,
+    MARKDOWN_LINK_PATTERN,
     MAXIMUM_SENTENCE_COUNT,
     MAXIMUM_WORDS_PER_SENTENCE,
     RETRY_INSTRUCTION,
@@ -44,6 +50,8 @@ from hooks_constants.reply_length_gate_constants import (
     TOO_MANY_SENTENCES_MESSAGE,
     TOOL_INPUT_KEY,
     TOOL_NAME_KEY,
+    UNLINKED_PULL_REQUEST_MESSAGE,
+    UNLINKED_PULL_REQUEST_PATTERN,
     URL_PATTERN,
     WORD_PATTERN,
     WORD_SEPARATOR,
@@ -87,6 +95,17 @@ def length_violation(reply_text: str) -> str | None:
     return None
 
 
+def unlinked_pull_request_violation(reply_text: str) -> str | None:
+    """Return the deny reason for a pull request number outside a link, or None."""
+    without_fences = FENCED_BLOCK_PATTERN.sub(" ", reply_text)
+    without_code = INLINE_CODE_PATTERN.sub(" ", without_fences)
+    without_links = MARKDOWN_LINK_PATTERN.sub(" ", without_code)
+    unlinked_match = UNLINKED_PULL_REQUEST_PATTERN.search(URL_PATTERN.sub(" ", without_links))
+    if unlinked_match is None:
+        return None
+    return UNLINKED_PULL_REQUEST_MESSAGE.format(reference=unlinked_match.group(0))
+
+
 def main() -> int:
     hook_input = read_hook_input_dictionary_from_stdin()
     if hook_input is None:
@@ -100,7 +119,7 @@ def main() -> int:
     reply_text = tool_input.get(TEXT_KEY)
     if not isinstance(reply_text, str):
         return ALLOW_EXIT_CODE
-    violation = length_violation(reply_text)
+    violation = length_violation(reply_text) or unlinked_pull_request_violation(reply_text)
     if violation is None:
         return ALLOW_EXIT_CODE
     block_reason = violation + RETRY_INSTRUCTION

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -49,7 +49,6 @@ ALL_SCOPE_AWARE_RULE_NAMES = frozenset(
         "check_docstring_runon_sentence",
         "check_docstring_prose_wall_without_illustration",
         "check_boolean_naming",
-        "check_ignored_must_check_return",
         "check_tests_use_isolated_filesystem_paths",
         "check_return_annotations",
         "check_function_length",
@@ -70,7 +69,6 @@ NARROW_EDIT_ACCEPTED_RULE_NAMES = frozenset(
         "check_join_separator_string_magic",
         "check_banned_noun_word_boundary",
         "check_boolean_naming",
-        "check_ignored_must_check_return",
     }
 )
 
@@ -80,7 +78,6 @@ EXPECTED_RULE_TEXT_BY_NAME = {
     "check_join_separator_string_magic": "string separator",
     "check_banned_noun_word_boundary": "Identifier",
     "check_boolean_naming": "Boolean",
-    "check_ignored_must_check_return": "return value",
 }
 
 
@@ -139,19 +136,6 @@ ALL_REQUIRED_RULE_FIXTURES = (
         expected_marker="ready",
         rule_name="check_boolean_naming",
     ),
-    NarrowEditFixture(
-        old_fragment=(
-            "def submit_form() -> None:\n"
-            "    if find_and_click('#submit'):\n"
-            "        return\n"
-        ),
-        new_fragment=(
-            "def submit_form() -> None:\n"
-            "    find_and_click('#submit')\n"
-        ),
-        expected_marker="find_and_click",
-        rule_name="check_ignored_must_check_return",
-    ),
 )
 
 

package/hooks/blocking/test_reply_length_gate.py

@@ -191,3 +191,47 @@ def test_should_allow_a_call_without_text(
 def test_should_allow_empty_stdin(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr("sys.stdin", io.TextIOWrapper(io.BytesIO(b"")))
     assert reply_length_gate.main() == 0
+
+
+def test_should_deny_a_pr_number_with_no_link_and_name_it(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "Both land in PR 5256."}
+    )
+    assert exit_code == 2
+    assert "PR 5256" in stderr_text
+
+
+def test_should_deny_a_bare_hash_number(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, POST_TOOL_NAME, {"text": "It merged in #4347."}
+    )
+    assert exit_code == 2
+    assert "#4347" in stderr_text
+
+
+def test_should_allow_a_pr_number_inside_its_link(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch,
+        capsys,
+        REPLY_TOOL_NAME,
+        {"text": "Both land in [PR 5256](https://github.com/owner/repo/pull/5256)."},
+    )
+    assert (exit_code, stderr_text) == (0, "")
+
+
+def test_should_allow_a_bare_pull_request_url(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    exit_code, _ = run_gate(
+        monkeypatch,
+        capsys,
+        REPLY_TOOL_NAME,
+        {"text": "Pull request: https://github.com/owner/repo/pull/5256"},
+    )
+    assert exit_code == 0

package/hooks/hooks_constants/blocking_check_limits.py

@@ -22,12 +22,10 @@ MAX_DOCSTRING_FORMAT_ISSUES: int = 5
 MAX_DOCSTRING_ARGS_SIGNATURE_ISSUES: int = 5
 MAX_CLASS_DOCSTRING_PUBLIC_METHOD_ISSUES: int = 5
 MINIMUM_PUBLIC_METHODS_FOR_CLASS_DOCSTRING_BREADTH: int = 2
-MAX_IGNORED_MUST_CHECK_RETURN_ISSUES: int = 5
 MAX_TYPE_ESCAPE_HATCH_ISSUES: int = 5
 MAX_THIN_WRAPPER_ISSUES: int = 1
 MAX_ZERO_PAYLOAD_ALIAS_ISSUES: int = 3
 MAX_LOGGING_FSTRING_ISSUES: int = 3
-MAX_LOGGING_PRINTF_TOKEN_ISSUES: int = 3
 MAX_LOGGING_ADJACENT_LITERAL_ISSUES: int = 3
 MAX_CONFIG_DUPLICATE_PATH_ANCHOR_ISSUES: int = 3
 MAX_WINDOWS_API_NONE_ISSUES: int = 3
@@ -204,17 +202,6 @@ DOCSTRING_REFERENCE_MARKER_WINDOW: int = 2
 ALL_GENERIC_CHECK_NAME_TOKENS: frozenset[str] = frozenset(
     {"check", "checks", "test", "tests", "in", "for", "and", "the"}
 )
-ALL_FORMAT_LOGGER_FUNCTION_NAMES: frozenset[str] = frozenset(
-    {
-        "log_debug",
-        "log_info",
-        "log_ok",
-        "log_error",
-        "log_warning",
-        "log_batch",
-        "log_background",
-    }
-)
 DOCSTRING_RUNON_SENTENCE_WORD_LIMIT: int = 30
 MAX_DOCSTRING_RUNON_SENTENCE_ISSUES: int = 5
 ALL_DOCSTRING_RUNON_JOINER_MARKERS: tuple[str, ...] = ("—", " -- ", ";")

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -72,8 +72,6 @@ ALL_POLARITY_ANTONYM_TOKEN_PAIRS: tuple[tuple[str, str], ...] = (
 )
 POLARITY_TOKEN_BOUNDARY_PATTERN: str = r"(?:^|_)%s(?:_|$)"
 
-ALL_MUST_CHECK_RETURN_FUNCTION_NAMES: frozenset[str] = frozenset({"find_and_click", "write_outcome"})
-
 DOCSTRING_ARG_ENTRY_PATTERN: re.Pattern[str] = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)\s*[:(]")
 DOCSTRING_PLURAL_FAMILY_STOP_PATTERN: re.Pattern[str] = re.compile(
     r"\bthe\s+([a-z][a-z]+)\s+stops\b"
@@ -211,14 +209,10 @@ LOGGING_FSTRING_PATTERN = re.compile(
     r'|(?:logger|logging|log)\.(?:debug|info|warning|error|critical|exception))'
     r'\s*\(\s*(?:[rR][fF]|[fF][rR]?)["\']'
 )
-LOGGING_PRINTF_TOKEN_PATTERN: re.Pattern[str] = re.compile(
-    r"(?<!%)%[#0\- +]?[0-9.*]*[sdrixfgeEcoX](?![a-zA-Z])"
-)
 ADJACENT_STRING_LITERAL_PATTERN: re.Pattern[str] = re.compile(
     r'(?<!["\'])[rRbBfFuU]{0,2}(?:"(?:[^"\\\n]|\\.)*"|\'(?:[^\'\\\n]|\\.)*\')'
     r'\s*[rRbBfFuU]{0,2}(?:"(?:[^"\\\n]|\\.)*"|\'(?:[^\'\\\n]|\\.)*\')(?!["\'])'
 )
-MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT = 2
 ALL_LOGGING_CALL_METHOD_NAMES: frozenset[str] = frozenset(
     {"debug", "info", "warning", "error", "critical", "exception"}
 )

package/hooks/hooks_constants/local_identity.py

@@ -1,19 +1,17 @@
-"""Resolve local identity values for NAS ssh and PII exempt-repo hooks.
+"""Resolve local identity values for the PII hooks.
 
-The enforcer hooks ship into ``~/.claude/`` and cannot read a repository file,
-so they read real machine values from the environment or a git-ignored file in
-the Claude home directory. This module supplies NAS host/user/port, the two
-NAS deny messages that quote those values, and the owner/repo slug set used by
-``pii_exempt_repository_slugs`` (``CLAUDE_PII_EXEMPT_REPOS`` /
-``pii_exempt_repositories``). The committed NAS defaults are placeholders.
+The hooks ship into ``~/.claude/`` and cannot read a repository file, so they
+read machine values from the environment or a git-ignored file in the Claude
+home directory. This module supplies the NAS host the PII scanner allowlists
+and the owner/repo slug set used by ``pii_exempt_repository_slugs``
+(``CLAUDE_PII_EXEMPT_REPOS`` / ``pii_exempt_repositories``). The committed NAS
+host default is a placeholder.
 
 ::
 
     CLAUDE_NAS_HOST set to a host              ->  nas_host() returns that host
-    CLAUDE_NAS_SSH_PORT set to 2200            ->  nas_ssh_port() returns 2200
     CLAUDE_PII_EXEMPT_REPOS="Owner/repo"       ->  {"owner/repo"}
     (env unset, no file)                       ->  nas_host() == "nas.example.local"
-                                                   nas_ssh_port() == 22
                                                    pii_exempt_repository_slugs() == frozenset()
 
 Each value comes from its environment variable, then
@@ -32,19 +30,11 @@ PII_EXEMPT_REPOS_ENV_VAR = "CLAUDE_PII_EXEMPT_REPOS"
 PII_EXEMPT_REPOS_JSON_KEY = "pii_exempt_repositories"
 PII_EXEMPT_REPOS_SEPARATOR = ","
 PII_ALLOWLISTED_VALUES_JSON_KEY = "pii_allowlisted_values"
-NAS_SSH_USER_ENV_VAR = "CLAUDE_NAS_SSH_USER"
-NAS_SSH_PORT_ENV_VAR = "CLAUDE_NAS_SSH_PORT"
 NAS_JSON_KEY = "nas"
 NAS_HOST_JSON_KEY = "host"
-NAS_SSH_USER_JSON_KEY = "ssh_user"
-NAS_SSH_PORT_JSON_KEY = "ssh_port"
 CLAUDE_HOME_DIRECTORY_NAME = ".claude"
 LOCAL_IDENTITY_FILE_NAME = "local-identity.json"
 PLACEHOLDER_NAS_HOST = "nas.example.local"
-PLACEHOLDER_NAS_SSH_USER = "operator"
-PLACEHOLDER_NAS_SSH_PORT = 22
-OPENSSH_INVOCATION_EXAMPLE_BINARY = '"/c/Windows/System32/OpenSSH/ssh.exe"'
-NAS_SSH_RULE_REFERENCE = "~/.claude/rules/nas-ssh-invocation.md"
 
 
 def _local_identity_file_path() -> Path:
@@ -178,106 +168,3 @@ def nas_host() -> str:
     if isinstance(stored_host, str) and stored_host:
         return stored_host
     return PLACEHOLDER_NAS_HOST
-
-
-def nas_ssh_user() -> str:
-    """Return the ssh user the enforcer expects for the NAS.
-
-    ::
-
-        CLAUDE_NAS_SSH_USER set to a user  ->  that user
-        (env unset, no file)               ->  "operator"
-
-    The environment variable wins, then the git-ignored file, then the
-    placeholder default.
-
-    Returns:
-        The ssh login name for the NAS.
-    """
-    user_from_environment = os.environ.get(NAS_SSH_USER_ENV_VAR)
-    if user_from_environment:
-        return user_from_environment
-    stored_user = _nas_section_from_local_file().get(NAS_SSH_USER_JSON_KEY)
-    if isinstance(stored_user, str) and stored_user:
-        return stored_user
-    return PLACEHOLDER_NAS_SSH_USER
-
-
-def nas_ssh_port() -> int:
-    """Return the ssh port the enforcer expects for the NAS.
-
-    ::
-
-        CLAUDE_NAS_SSH_PORT set to 2200  ->  2200
-        (env unset, no file)             ->  22
-
-    The environment variable wins, then the git-ignored file, then the
-    placeholder default.
-
-    Returns:
-        The ssh port number for the NAS.
-    """
-    port_from_environment = os.environ.get(NAS_SSH_PORT_ENV_VAR)
-    if port_from_environment and port_from_environment.isdigit():
-        return int(port_from_environment)
-    stored_port = _nas_section_from_local_file().get(NAS_SSH_PORT_JSON_KEY)
-    if isinstance(stored_port, int):
-        return stored_port
-    return PLACEHOLDER_NAS_SSH_PORT
-
-
-def _openssh_invocation_example() -> str:
-    return (
-        f"{OPENSSH_INVOCATION_EXAMPLE_BINARY} -o BatchMode=yes -o ConnectTimeout=10 "
-        f'-p {nas_ssh_port()} {nas_ssh_user()}@{nas_host()} "<cmd>"'
-    )
-
-
-def bare_ssh_binary_deny_message() -> str:
-    """Return the deny message for a bare ssh-family word aimed at the NAS.
-
-    ::
-
-        ssh -p 22 operator@nas.example.local "ls"  ->  this message text
-        (the text quotes the resolved host, user, and port)
-
-    Names the Git Bash MSYS-ssh hang and points at the Windows OpenSSH binary
-    with batch mode on.
-
-    Returns:
-        The full deny-message text for the bare ssh-family case.
-    """
-    return (
-        f"BLOCKED [nas-ssh-binary]: Git Bash's MSYS ssh reads ~/.ssh/id_ed25519 as "
-        f"world-readable through its ACL mapping, rejects the key as bad permissions, "
-        f"and falls back to an interactive password prompt that hangs unattended "
-        f"sessions against the NAS at {nas_host()}.\n\n"
-        f"Use the Windows OpenSSH binary, which authenticates the key without prompting:\n"
-        f"  {_openssh_invocation_example()}\n\n"
-        f"See {NAS_SSH_RULE_REFERENCE} for full guidance."
-    )
-
-
-def missing_batch_mode_deny_message() -> str:
-    """Return the deny message for the OpenSSH binary without batch mode.
-
-    ::
-
-        "..ssh.exe" -p 22 operator@nas.example.local "ls"  ->  this message text
-        (the text quotes the resolved host, user, and port)
-
-    Names the interactive-prompt hang and asks for ``-o BatchMode=yes`` so a key
-    failure exits loudly.
-
-    Returns:
-        The full deny-message text for the missing-batch-mode case.
-    """
-    return (
-        f"BLOCKED [nas-ssh-binary]: this NAS ssh command uses the Windows OpenSSH binary "
-        f"but omits -o BatchMode=yes, so an authentication regression falls back to an "
-        f"interactive password prompt that hangs unattended sessions against the NAS at "
-        f"{nas_host()}.\n\n"
-        f"Add -o BatchMode=yes so a key failure exits loudly rather than prompting:\n"
-        f"  {_openssh_invocation_example()}\n\n"
-        f"See {NAS_SSH_RULE_REFERENCE} for full guidance."
-    )