claude-dev-env 8.24.0 → 8.25.1

package/hooks/hooks_constants/reply_length_gate_constants.py

@@ -15,6 +15,10 @@ FENCED_BLOCK_PATTERN = re.compile(r"```.*?(?:```|\Z)", re.DOTALL)
 INLINE_CODE_PATTERN = re.compile(r"`[^`\n]*`")
 LINK_TARGET_PATTERN = re.compile(r"\]\([^)\s]*\)")
 URL_PATTERN = re.compile(r"(?:https?://|www\.)\S+")
+MARKDOWN_LINK_PATTERN = re.compile(r"\[[^\]\n]*\]\([^)\s]*\)")
+UNLINKED_PULL_REQUEST_PATTERN = re.compile(
+    r"\b(?:PRs?|pull requests?)\s*#?\d+|(?<![\w/&])#\d+", re.IGNORECASE
+)
 LINE_BREAK_PATTERN = re.compile(r"\n+")
 SENTENCE_END_PATTERN = re.compile(r"(?<=[.!?])\s+")
 WORD_PATTERN = re.compile(r"[A-Za-z0-9]+(?:['.,-][A-Za-z0-9]+)*")
@@ -23,6 +27,7 @@ WORD_SEPARATOR = " "
 SENTENCE_PREVIEW_SUFFIX = "..."
 RETRY_INSTRUCTION = " Cut the text and resend the call."
 TOO_MANY_SENTENCES_MESSAGE = "Reply too long: {sentence_count} sentences, limit {sentence_limit}."
+UNLINKED_PULL_REQUEST_MESSAGE = 'Pull request "{reference}" has no link. Write it as [PR N](https://github.com/<owner>/<repo>/pull/N).'
 LONG_SENTENCE_MESSAGE = (
     'Sentence too long: {word_count} words, limit {word_limit}: "{sentence_preview}".'
 )

package/hooks/hooks_constants/test_local_identity.py

@@ -1,4 +1,4 @@
-"""Tests for the NAS local-identity loader used by the ssh enforcer hook."""
+"""Tests for the local-identity loader used by the PII hooks."""
 
 from __future__ import annotations
 
@@ -14,7 +14,7 @@ except ImportError:
     sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
     from hooks_constants import local_identity
 
-ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST", "CLAUDE_NAS_SSH_USER", "CLAUDE_NAS_SSH_PORT")
+ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST",)
 
 
 def _clear_nas_env() -> None:
@@ -23,30 +23,20 @@ def _clear_nas_env() -> None:
 
 
 class TestNasValuesFromEnvironment:
-    def should_read_host_user_and_port_from_the_environment(self) -> None:
-        with patch.dict(
-            os.environ,
-            {
-                "CLAUDE_NAS_HOST": "10.0.0.5",
-                "CLAUDE_NAS_SSH_USER": "tester",
-                "CLAUDE_NAS_SSH_PORT": "2200",
-            },
-            clear=False,
-        ):
+    def should_read_host_from_the_environment(self) -> None:
+        with patch.dict(os.environ, {"CLAUDE_NAS_HOST": "10.0.0.5"}, clear=False):
             assert local_identity.nas_host() == "10.0.0.5"
-            assert local_identity.nas_ssh_user() == "tester"
-            assert local_identity.nas_ssh_port() == 2200
 
 
 class TestNasValuesFromLocalFile:
-    def should_read_host_user_and_port_from_the_local_identity_file(
+    def should_read_host_from_the_local_identity_file(
         self, tmp_path: Path
     ) -> None:
         claude_home = tmp_path / ".claude"
         claude_home.mkdir()
         (claude_home / "local-identity.json").write_text(
             json.dumps(
-                {"nas": {"host": "10.1.1.9", "ssh_user": "fileuser", "ssh_port": 2222}}
+                {"nas": {"host": "10.1.1.9"}}
             ),
             encoding="utf-8",
         )
@@ -54,18 +44,14 @@ class TestNasValuesFromLocalFile:
             _clear_nas_env()
             with patch.object(Path, "home", return_value=tmp_path):
                 assert local_identity.nas_host() == "10.1.1.9"
-                assert local_identity.nas_ssh_user() == "fileuser"
-                assert local_identity.nas_ssh_port() == 2222
 
 
 class TestNasValuesPlaceholderDefault:
-    def should_return_placeholders_when_no_env_and_no_file(self, tmp_path: Path) -> None:
+    def should_return_placeholder_when_no_env_and_no_file(self, tmp_path: Path) -> None:
         with patch.dict(os.environ, {}, clear=False):
             _clear_nas_env()
             with patch.object(Path, "home", return_value=tmp_path):
                 assert local_identity.nas_host() == "nas.example.local"
-                assert local_identity.nas_ssh_user() == "operator"
-                assert local_identity.nas_ssh_port() == 22
 
 
 class TestPiiExemptRepositorySlugs:
@@ -234,25 +220,3 @@ class TestLocalIdentityPathOverride:
         ), patch.object(Path, "home", return_value=tmp_path):
             _clear_nas_env()
             assert local_identity.nas_host() == "10.9.9.9"
-
-
-class TestDenyMessagesQuoteTheResolvedHost:
-    def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
-        self,
-    ) -> None:
-        with patch.dict(
-            os.environ,
-            {"CLAUDE_NAS_HOST": "10.0.0.5", "CLAUDE_NAS_SSH_PORT": "2200"},
-            clear=False,
-        ):
-            os.environ.pop("CLAUDE_NAS_SSH_USER", None)
-            message = local_identity.bare_ssh_binary_deny_message()
-            assert "10.0.0.5" in message
-            assert "-p 2200" in message
-            assert "BatchMode=yes" in message
-
-    def should_include_the_resolved_host_in_the_missing_batch_mode_message(self) -> None:
-        with patch.dict(os.environ, {"CLAUDE_NAS_HOST": "10.0.0.5"}, clear=False):
-            message = local_identity.missing_batch_mode_deny_message()
-            assert "10.0.0.5" in message
-            assert "BatchMode=yes" in message

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.24.0",
+    "version": "8.25.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/shell-invocation.md

@@ -6,7 +6,7 @@ Two constraints govern every shell command an agent issues: which shell runs it,
 
 Every Bash-tool shell command on Windows uses `pwsh`: `pwsh -NoProfile -File '<script>.ps1' <args>` for scripts, `pwsh -NoProfile -Command "..."` (or a literal `@'...'@` here-string) for inline work, or the built-in `PowerShell` tool for pure-PowerShell workflows (it supports `run_in_background`). Never wrap a script path in `-Command "& '...'"` — `-File` keeps `permissions.allow` matching. The `&` call operator is fine for invoking an executable at a path (`& '<venv>\Scripts\python.exe' script.py`).
 
-The mandate covers the shell a command runs through, not every executable a command names. A direct interpreter invocation another rule documents — the paramiko NAS helper in [`nas-ssh-invocation.md`](nas-ssh-invocation.md), a `python` call on a repo script — conforms as written.
+The mandate covers the shell a command runs through. A direct interpreter invocation, such as a `python` call on a repo script, conforms as written.
 
 Keep `powershell`, `powershell.exe`, `cmd /c`, and `bash -c` out of the `settings.json` permission rules. `Audit-ShellPolicy.ps1` reports those forms and `Migrate-ShellPolicy.ps1` rewrites them to `pwsh`. Both ship in the claude-dev-env repo at `packages/claude-dev-env/scripts/` and run on demand, not as a live gate.
 

package/scripts/repository_checks/config/constants.py

@@ -147,10 +147,5 @@ ALL_TRACKED_SECRET_EXACT_EXEMPTIONS: frozenset[tuple[str, str, str]] = frozenset
             "home-path",
             "5d956228802fbd4a65af8fa7fb4183f5a9f8793dbe218877aefe887b905f726d",
         ),
-        (
-            "shared_utils/theme_assets/contracts/evidence/theme_editor_asset_resolution_master.oneui9.v1.json",
-            "home-path",
-            "ec69fe88e2f9d3f1ed3504532c7484120591cbec7ae6fda017b0f9ca57a3fc25",
-        ),
     )
 )

package/docs/nas-ssh-invocation.md

@@ -1,107 +0,0 @@
-# Running Commands on the NAS
-
-Full detail behind the always-on `rules/nas-ssh-invocation.md` kernel.
-
-This file covers how to run a command there at all. What the NAS runs, where the automations are
-deployed, and how to verify a change against them belong with the project that owns those
-automations, not here.
-
-## The call
-
-```
-python <runner-path> <command-script.sh> <private-key-path>
-```
-
-Two arguments, both paths. The first is a file holding a bash script; the second is the private key.
-
-The runner is `nas_ssh_key.py`. It ships with the automation project it serves, so read its path from
-that project's own reference rather than assuming a location.
-
-The host, ssh port and ssh user are constants inside the runner, so no command you write names them.
-The same three values are recorded under the `nas` key in `~/.claude/local-identity.json`. Read them
-from there when something needs them, and keep them out of anything committed or posted.
-
-Write the script file with the Write tool. Keeping the commands in a file has a second benefit: a
-destructive word such as `rm -rf` inside the file never appears in a Bash tool command string, so the
-harness permission prompt never fires on it and an unattended run keeps going.
-
-The script runs through `bash -s` in a single shell. Variables, `cd`, and `source` all carry from one
-line to the next. Standard output, standard error and the exit code all come back.
-
-## Why not ssh, scp or sftp
-
-The runner loads the key with paramiko and signs inside the Python process. The command-line clients
-check the key file's permissions first and refuse to load a key whose permissions they do not like.
-Git Bash's `ssh` then falls back to an interactive password prompt, which hangs a run with nobody to
-answer it.
-
-To move a file onto the NAS, write it from inside the script:
-
-```bash
-cat > /tmp/thing.conf <<'EOF'
-contents here
-EOF
-```
-
-The quoted `'EOF'` stops the shell expanding anything in the body.
-
-## The key
-
-Use the ops key under `~/.claude/keys`. It is readable as-is and the NAS accepts it.
-
-Keys under `~/.ssh` are for other jobs and none of them works here. The default one carries a
-passphrase, so paramiko cannot load it unattended; the rest are for other hosts.
-
-## Writing a script that touches the automations
-
-Do not reach for the system interpreter. It carries neither pytest nor the libraries the automations
-import, so anything checked against it proves nothing.
-
-Each automation project records its own runtime — the interpreter, the virtual environment, the
-import root, and the deploy path. Read that project's reference and activate what it names before
-running anything.
-
-## Verifying a change before it ships
-
-The NAS is a Linux box and this machine is Windows, so two classes of difference show up only there:
-syntax newer than the NAS interpreter accepts, and tests that assert Windows paths.
-
-**Always separate a break in the code from a platform-only one.** Run the same test file at the branch head
-and at the commit the work started from. Identical failures at both mean the environment, not the
-change. Report both numbers rather than the head alone.
-
-## The /tmp limit
-
-`/tmp` is a small tmpfs. A full clone of a repository that carries binary assets fills it, the clone
-dies partway through, and the disk stays full for whatever runs next.
-
-Fetch shallow and sparse instead:
-
-```bash
-d=$(mktemp -d /tmp/work.XXXXXX)
-cd "$d"
-git init --quiet
-git remote add origin <repository-url>
-git sparse-checkout init --cone
-git sparse-checkout set <subdirectory>
-git fetch --quiet --depth 1 origin <sha>
-git checkout --quiet FETCH_HEAD
-```
-
-One subdirectory at one commit lands tens of megabytes rather than the whole history. Clean up at the
-end and print `df -h /tmp` so the next run knows the state:
-
-```bash
-find /tmp -maxdepth 1 -name 'work.*' -prune -exec rm -rf {} +
-```
-
-## When something fails
-
-| What you see | What it means |
-|---|---|
-| `PermissionError: [Errno 13]` on the key | The key file is not readable by this account. |
-| `PasswordRequiredException: Private key file is encrypted` | That key has a passphrase and cannot be used unattended. |
-| `Authentication (publickey) failed` | The transport works and the NAS does not accept that key. |
-| `Load key ...: Permission denied` from `ssh.exe` | A command-line client is being used. Use the runner. |
-| `No space left on device` | `/tmp` is full. Clean it, then fetch shallow and sparse. |
-| `No module named pytest` | The system interpreter is being used. Activate the project's environment first. |

package/hooks/blocking/test_code_rules_enforcer_ignored_must_check_return.py

@@ -1,266 +0,0 @@
-"""Tests for check_ignored_must_check_return — discarded must-check outcomes.
-
-A bare-statement call to a function in ALL_MUST_CHECK_RETURN_FUNCTION_NAMES
-discards the only failure signal it produces. An assigned or branched-on
-call is exempt; only bare ``ast.Expr`` calls are flagged.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
-_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
-if _BLOCKING_DIRECTORY not in sys.path:
-    sys.path.insert(0, _BLOCKING_DIRECTORY)
-if _HOOKS_DIRECTORY not in sys.path:
-    sys.path.insert(0, _HOOKS_DIRECTORY)
-
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-)
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    check_ignored_must_check_return as _check_ignored_must_check_return,
-)
-from code_rules_enforcer import (  # noqa: E402
-    validate_content_for_full_gate as _validate_content,
-)
-
-code_rules_enforcer = SimpleNamespace(
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES=MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-    check_ignored_must_check_return=_check_ignored_must_check_return,
-    validate_content=_validate_content,
-)
-
-
-def check_ignored_must_check_return(content: str, file_path: str) -> list[str]:
-    return code_rules_enforcer.check_ignored_must_check_return(content, file_path)
-
-
-def validate_content(content: str, file_path: str, old_content: str) -> list[str]:
-    return code_rules_enforcer.validate_content(content, file_path, old_content)
-
-
-PRODUCTION_FILE_PATH = "/project/src/clicker.py"
-TEST_FILE_PATH = "/project/src/test_clicker.py"
-
-
-def test_should_flag_bare_find_and_click_call() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("find_and_click" in each for each in issues), (
-        f"Expected discarded-return flag for find_and_click, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_flag_bare_write_outcome_call() -> None:
-    source = "def step() -> None:\n    write_outcome('done')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("write_outcome" in each for each in issues), (
-        f"Expected discarded-return flag for write_outcome, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_flag_attribute_call_with_must_check_name() -> None:
-    source = "def step() -> None:\n    self.find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1, f"Attribute call terminal name must be resolved, got: {issues!r}"
-
-
-def test_should_not_flag_assigned_find_and_click() -> None:
-    source = "def step() -> None:\n    clicked = find_and_click('#submit')\n    print(clicked)\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Assigned call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_branched_find_and_click() -> None:
-    source = "def step() -> None:\n    if find_and_click('#submit'):\n        pass\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Branched-on call must not be flagged, got: {issues!r}"
-
-
-def test_should_flag_bare_awaited_find_and_click_call() -> None:
-    source = "async def step() -> None:\n    await find_and_click('#x')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("find_and_click" in each for each in issues), (
-        f"Expected discarded-return flag for awaited find_and_click, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_not_flag_assigned_awaited_find_and_click() -> None:
-    source = (
-        "async def step() -> None:\n"
-        "    clicked = await find_and_click('#x')\n"
-        "    print(clicked)\n"
-    )
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Assigned awaited call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_branched_awaited_find_and_click() -> None:
-    source = "async def step() -> None:\n    if await find_and_click('#x'):\n        pass\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Branched-on awaited call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_unrelated_bare_call() -> None:
-    source = "def step() -> None:\n    print('hello')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Unrelated call must not be flagged, got: {issues!r}"
-
-
-def test_should_skip_test_file() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, TEST_FILE_PATH)
-    assert issues == [], f"Test files exempt, got: {issues!r}"
-
-
-def test_should_handle_syntax_error_gracefully() -> None:
-    issues = check_ignored_must_check_return("def step(\n", PRODUCTION_FILE_PATH)
-    assert issues == [], f"Syntax error must yield no issues, got: {issues!r}"
-
-
-def test_validate_content_surfaces_discarded_return() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = validate_content(source, PRODUCTION_FILE_PATH, old_content="")
-    matching_issues = [each for each in issues if "find_and_click" in each]
-    assert matching_issues, (
-        f"Expected validate_content to surface the discarded-return issue, got: {issues!r}"
-    )
-
-
-EDIT_FULL_MODULE_SOURCE = (
-    "async def step() -> None:\n"
-    "    await find_and_click('#x')\n"
-)
-AWAITED_CALL_LINE_NUMBER = 2
-UNCHANGED_LINE_NUMBER = 1
-
-
-def test_should_flag_when_changed_line_covers_the_bare_await() -> None:
-    all_changed_lines = {AWAITED_CALL_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        EDIT_FULL_MODULE_SOURCE,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        f"An Edit touching the bare await line must surface exactly one issue, got: {issues!r}"
-    )
-    assert "find_and_click" in issues[0]
-
-
-def test_should_not_flag_when_changed_line_excludes_the_bare_await() -> None:
-    all_changed_lines = {UNCHANGED_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        EDIT_FULL_MODULE_SOURCE,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert issues == [], (
-        f"A pre-existing violation on an unedited line must not block the edit, got: {issues!r}"
-    )
-
-
-PRE_EXISTING_BARE_CALL_COUNT = 5
-EDITED_BARE_CALL_LINE_NUMBER = PRE_EXISTING_BARE_CALL_COUNT + 2
-
-
-def _build_module_with_pre_existing_violations_before_the_edit() -> str:
-    all_signature_lines = ["async def step() -> None:"]
-    all_pre_existing_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(PRE_EXISTING_BARE_CALL_COUNT)
-    ]
-    edited_call_line = "    await find_and_click('#edited')"
-    all_lines = all_signature_lines + all_pre_existing_call_lines + [edited_call_line]
-    return "\n".join(all_lines) + "\n"
-
-
-def test_should_flag_edited_line_even_when_cap_worth_of_violations_precede_it() -> None:
-    source = _build_module_with_pre_existing_violations_before_the_edit()
-    all_changed_lines = {EDITED_BARE_CALL_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        "Collecting every violation before scoping must surface the edited-line "
-        f"violation even with a cap's worth of earlier out-of-scope calls, got: {issues!r}"
-    )
-    assert f"Line {EDITED_BARE_CALL_LINE_NUMBER}:" in issues[0], (
-        f"The single issue must name the edited line {EDITED_BARE_CALL_LINE_NUMBER}, got: {issues!r}"
-    )
-
-
-def _build_module_with_more_than_cap_bare_calls() -> tuple[str, int]:
-    bare_call_count = code_rules_enforcer.MAX_IGNORED_MUST_CHECK_RETURN_ISSUES + 3
-    all_signature_lines = ["async def step() -> None:"]
-    all_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(bare_call_count)
-    ]
-    source = "\n".join(all_signature_lines + all_call_lines) + "\n"
-    return source, bare_call_count
-
-
-def test_deferred_scope_returns_every_violation_uncapped() -> None:
-    source, bare_call_count = _build_module_with_more_than_cap_bare_calls()
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        None,
-        True,
-    )
-    assert len(issues) == bare_call_count, (
-        "With defer_scope_to_caller=True the gate must see every violation uncapped "
-        f"so it can scope by added line, got: {issues!r}"
-    )
-
-
-def test_terminal_scope_caps_violations_at_the_module_limit() -> None:
-    source, _ = _build_module_with_more_than_cap_bare_calls()
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        None,
-        False,
-    )
-    assert len(issues) == code_rules_enforcer.MAX_IGNORED_MUST_CHECK_RETURN_ISSUES, (
-        "The terminal hook path with all_changed_lines=None must cap at the module "
-        f"limit, got: {issues!r}"
-    )
-
-
-WRAPPED_CALL_OPEN_PAREN_LINE_NUMBER = 2
-WRAPPED_CALL_ARGUMENT_LINE_NUMBER = 3
-
-
-def test_should_flag_when_changed_line_covers_a_later_line_of_a_wrapped_call() -> None:
-    source = (
-        "def step() -> None:\n"
-        "    find_and_click(\n"
-        "        '#submit',\n"
-        "    )\n"
-    )
-    all_changed_lines = {WRAPPED_CALL_ARGUMENT_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        "Editing a later line of a multi-line bare must-check call must still flag it "
-        f"because the violation span covers the whole call, got: {issues!r}"
-    )
-    assert "find_and_click" in issues[0]

package/hooks/blocking/test_code_rules_enforcer_split_mustcheck.py

@@ -1,87 +0,0 @@
-"""Behavior tests for the code_rules_boolean_mustcheck code-rules check module."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
-_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
-if _BLOCKING_DIRECTORY not in sys.path:
-    sys.path.insert(0, _BLOCKING_DIRECTORY)
-if _HOOKS_DIRECTORY not in sys.path:
-    sys.path.insert(0, _HOOKS_DIRECTORY)
-
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    check_ignored_must_check_return,
-)
-
-code_rules_enforcer = SimpleNamespace(
-    check_ignored_must_check_return=check_ignored_must_check_return,
-)
-
-
-def test_ignored_must_check_return_flags_bare_awaited_call() -> None:
-    """A bare ``await find_and_click(...)`` statement discards its only failure signal.
-
-    The curated must-check functions are async, so the common real call site is a
-    bare ``await``-wrapped call. Unwrapping ``ast.Await`` before the Call check is
-    required for this case to be flagged.
-    """
-    source = "async def step() -> None:\n    await find_and_click('#x')\n"
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source, "/project/src/clicker.py"
-    )
-    assert any("find_and_click" in each_issue for each_issue in issues), (
-        f"a bare awaited must-check call must be flagged; got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_ignored_must_check_return_exempts_consumed_awaited_call() -> None:
-    """An assigned or branched-on awaited must-check call consumes its outcome."""
-    assigned = "async def step() -> None:\n    clicked = await find_and_click('#x')\n    print(clicked)\n"
-    branched = "async def step() -> None:\n    if await find_and_click('#x'):\n        pass\n"
-    assert (
-        code_rules_enforcer.check_ignored_must_check_return(assigned, "/project/src/clicker.py")
-        == []
-    )
-    assert (
-        code_rules_enforcer.check_ignored_must_check_return(branched, "/project/src/clicker.py")
-        == []
-    )
-
-
-def test_ignored_must_check_return_flags_edited_line_past_a_cap_of_earlier_violations() -> None:
-    """The cap must apply after scoping so the edited-line violation is never dropped.
-
-    Collecting only a cap's worth of violations in ``ast.walk`` order, then scoping,
-    fills the cap with earlier out-of-scope calls and discards the edited-line one —
-    the very violation the scoped enforcer exists to block. Every violation must be
-    collected before scoping so the edited line survives the diff filter.
-    """
-    pre_existing_call_count = 5
-    edited_call_line_number = pre_existing_call_count + 2
-    all_pre_existing_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(pre_existing_call_count)
-    ]
-    all_lines = (
-        ["async def step() -> None:"]
-        + all_pre_existing_call_lines
-        + ["    await find_and_click('#edited')"]
-    )
-    source = "\n".join(all_lines) + "\n"
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        "/project/src/clicker.py",
-        {edited_call_line_number},
-        False,
-    )
-    assert len(issues) == 1, (
-        f"the edited-line violation must survive a cap's worth of earlier calls; got: {issues!r}"
-    )
-    assert f"Line {edited_call_line_number}:" in issues[0], (
-        f"the single issue must name the edited line {edited_call_line_number}; got: {issues!r}"
-    )