claude-dev-env 8.25.0 → 8.25.1

package/docs/CODE_RULES.md

@@ -31,7 +31,7 @@ A keep marker is the one comment that may be added and kept: a comment that open
 
 The staged policy lint reports each of these through `code_rules_enforcer.py` and names the specific breach; exact patterns and exemption lists live in that module:
 
-no new comments · imports at top · logging format args (`log_*("...", arg)`) · no `%s`/`%d` printf tokens in a `str.format`-logger message (`log_*` imported from `automation_logging`; `str.format` drops the args — use `{}`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · must-check returns (`find_and_click`, `write_outcome`) assigned and checked · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks are ruff's job (F401, isort I001), not this hook's · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
+no new comments · imports at top · logging format args (`log_*("...", arg)`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks belong to ruff (F401, isort I001) · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
 
 Test files follow the comment policy above; other test-specific exemptions are listed here. The one annotation the test-file exemption does NOT cover is a known pytest builtin fixture parameter: `tmp_path`, `monkeypatch`, `capsys`, `capfd`, `caplog`, `request`, and `tmp_path_factory` each have a single documented injected type, so the gate requires that annotation (`tmp_path: Path`) even inside a test file. The same set of fixtures is also subject to a use check: a pytest-collected test function that declares one of these parameters and never references it in its body fails the gate, because pytest materializes the fixture's setup (the temp directory, the monkeypatch context, the output capture) on every run whether or not the body reads the value — drop the unused parameter. A parameter counts as referenced when its name is read, augmented-assigned, or deleted anywhere in the body, including inside a nested function or comprehension. Only pytest-collectable functions are inspected — those at module top level or defined directly in a class body; a function nested inside another function's body is a local helper pytest never collects, so its fixture-named parameter is exempt. A `@pytest.fixture`-decorated function is exempt from the use check, since injecting one fixture into another purely to order its setup is intentional. Ordinary test parameters stay exempt from both checks.
 

package/hooks/blocking/code_rules_boolean_mustcheck.py

@@ -1,4 +1,4 @@
-"""Boolean naming-prefix and ignored must-check-return checks."""
+"""Boolean naming-prefix checks."""
 
 import ast
 import sys
@@ -21,12 +21,8 @@ from code_rules_shared import (  # noqa: E402
     is_workflow_registry_file,
 )
 
-from hooks_constants.blocking_check_limits import (  # noqa: E402
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-)
 from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     ALL_BOOLEAN_NAME_PREFIXES,
-    ALL_MUST_CHECK_RETURN_FUNCTION_NAMES,
     ALL_SELF_AND_CLS_PARAMETER_NAMES,
     UPPER_SNAKE_CONSTANT_PATTERN,
 )
@@ -271,80 +267,3 @@ def _called_terminal_name(call_node: ast.Call) -> str | None:
     if isinstance(callee, ast.Attribute):
         return callee.attr
     return None
-
-
-def check_ignored_must_check_return(
-    content: str,
-    file_path: str,
-    all_changed_lines: set[int] | None = None,
-    defer_scope_to_caller: bool = False,
-) -> list[str]:
-    """Flag bare-expression calls whose discarded return is the only failure signal.
-
-    Functions in ``ALL_MUST_CHECK_RETURN_FUNCTION_NAMES`` report success or failure
-    solely through their return value. A bare-statement call discards that value,
-    so the caller silently proceeds on failure. Bare ``ast.Expr`` calls are flagged,
-    including a bare ``await``-wrapped call (``await find_and_click(...)`` as a
-    statement); an assigned or branched-on call is exempt.
-
-    The caller passes the reconstructed full file as *content* so ``ast.parse``
-    sees a complete module rather than an Edit's ``new_string`` fragment, which is
-    rarely valid standalone Python (a bare ``await find_and_click(...)`` line is a
-    SyntaxError on its own). Findings are then scoped to *all_changed_lines* so an
-    Edit blocks on the discarded return it just introduced while a pre-existing
-    violation on an untouched line does not block the edit.
-
-    Args:
-        content: The source text to inspect — the reconstructed full file on an
-            Edit so the parse succeeds.
-        file_path: The path the source will be written to, used for exemptions.
-        all_changed_lines: Post-edit line numbers the current edit touched, or
-            None to treat the whole file as in scope. When provided, a violation
-            blocks only when the bare call's line intersects the changed lines.
-        defer_scope_to_caller: When True, return every violation so the
-            commit/push gate's ``split_violations_by_scope`` can scope by added
-            line.
-
-    Returns:
-        One issue per discarded must-check return, scoped to the changed lines
-        unless *defer_scope_to_caller* is True or *all_changed_lines* is None. When
-        *defer_scope_to_caller* is True every violation is returned uncapped so the
-        gate can scope by added line and apply its own ceiling; otherwise the
-        terminal result is capped at the module limit.
-    """
-    if is_test_file(file_path):
-        return []
-    try:
-        tree = ast.parse(content)
-    except SyntaxError:
-        return []
-    all_violations_in_walk_order: list[tuple[range, str]] = []
-    for each_node in ast.walk(tree):
-        if not isinstance(each_node, ast.Expr):
-            continue
-        expression_value = each_node.value
-        call_node = (
-            expression_value.value
-            if isinstance(expression_value, ast.Await)
-            else expression_value
-        )
-        if not isinstance(call_node, ast.Call):
-            continue
-        called_name = _called_terminal_name(call_node)
-        if called_name is None or called_name not in ALL_MUST_CHECK_RETURN_FUNCTION_NAMES:
-            continue
-        end_line_number = each_node.end_lineno or each_node.lineno
-        line_span = range(each_node.lineno, end_line_number + 1)
-        message = (
-            f"Line {each_node.lineno}: return value of {called_name}() is discarded - "
-            "assign and check it (the boolean/outcome is the only failure signal)"
-        )
-        all_violations_in_walk_order.append((line_span, message))
-    scoped_issues = _scope_violations_to_changed_lines(
-        all_violations_in_walk_order,
-        all_changed_lines,
-        defer_scope_to_caller,
-    )
-    if defer_scope_to_caller:
-        return scoped_issues
-    return scoped_issues[:MAX_IGNORED_MUST_CHECK_RETURN_ISSUES]

package/hooks/blocking/code_rules_enforcer.py

@@ -46,7 +46,6 @@ from code_rules_blast_radius import (  # noqa: E402
 )
 from code_rules_boolean_mustcheck import (  # noqa: E402
     check_boolean_naming,
-    check_ignored_must_check_return,
 )
 from code_rules_command_dispatch import (  # noqa: E402
     check_unanchored_command_dispatch,
@@ -86,7 +85,6 @@ from code_rules_imports_logging import (  # noqa: E402
     check_library_print,
     check_logging_adjacent_string_literals,
     check_logging_fstrings,
-    check_logging_printf_tokens,
     check_naive_datetime_construction,
     check_windows_api_none,
 )
@@ -329,7 +327,6 @@ def _python_comment_and_logging_issues(context: _ValidationContext) -> list[str]
         all_issues.extend(check_comment_changes(old_content, content, file_path))
     all_issues.extend(check_imports_at_top(content))
     all_issues.extend(check_logging_fstrings(content))
-    all_issues.extend(check_logging_printf_tokens(content, file_path))
     all_issues.extend(check_logging_adjacent_string_literals(content, file_path))
     all_issues.extend(check_windows_api_none(content))
     all_issues.extend(check_naive_datetime_construction(content, file_path))
@@ -450,9 +447,6 @@ def _python_boolean_and_test_assertion_issues(context: _ValidationContext) -> li
     )
     changed, defer = context.all_changed_lines, context.defer_scope_to_caller
     all_issues = check_boolean_naming(effective_content, file_path, changed, defer)
-    all_issues.extend(
-        check_ignored_must_check_return(effective_content, file_path, changed, defer)
-    )
     all_issues.extend(check_skip_decorators_in_tests(content, file_path))
     all_issues.extend(
         check_tests_use_isolated_filesystem_paths(

package/hooks/blocking/code_rules_imports_logging.py

@@ -1,4 +1,4 @@
-"""Import and logging convention checks: check_imports_at_top, check_logging_fstrings, check_logging_printf_tokens, check_logging_adjacent_string_literals, check_windows_api_none, check_naive_datetime_construction, check_e2e_test_naming, check_js_resume_task_enumeration_coverage, check_js_returns_object_schemaless_branch, check_js_sibling_return_object_key_drift, check_js_bare_flag_return_directive, and check_library_print."""
+"""Import and logging convention checks: check_imports_at_top, check_logging_fstrings, check_logging_adjacent_string_literals, check_windows_api_none, check_naive_datetime_construction, check_e2e_test_naming, check_js_resume_task_enumeration_coverage, check_js_returns_object_schemaless_branch, check_js_sibling_return_object_key_drift, check_js_bare_flag_return_directive, and check_library_print."""
 
 import ast
 import re
@@ -25,7 +25,6 @@ from code_rules_shared import (  # noqa: E402
 
 from hooks_constants.blocking_check_limits import (  # noqa: E402
     ALL_ALWAYS_NAIVE_DATETIME_CONSTRUCTORS,
-    ALL_FORMAT_LOGGER_FUNCTION_NAMES,
     DATETIME_CLASS_ATTRIBUTE_NAME,
     FROMTIMESTAMP_POSITIONAL_TIMEZONE_ARGUMENT_COUNT,
     MAX_E2E_TEST_NAMING_ISSUES,
@@ -35,7 +34,6 @@ from hooks_constants.blocking_check_limits import (  # noqa: E402
     MAX_JS_SIBLING_RETURN_OBJECT_KEY_DRIFT_ISSUES,
     MAX_LOGGING_ADJACENT_LITERAL_ISSUES,
     MAX_LOGGING_FSTRING_ISSUES,
-    MAX_LOGGING_PRINTF_TOKEN_ISSUES,
     MAX_NAIVE_DATETIME_ISSUES,
     MAX_WINDOWS_API_NONE_ISSUES,
     MINIMUM_RESUME_TASK_ENUMERATION_ITEMS,
@@ -87,9 +85,7 @@ from hooks_constants.code_rules_enforcer_constants import (  # noqa: E402
     JSDOC_RETURNS_STRUCTURED_OBJECT_PROMISE_PATTERN,
     LOGGING_FSTRING_PATTERN,
     LOGGING_HELPER_FUNCTION_NAME_PATTERN,
-    LOGGING_PRINTF_TOKEN_PATTERN,
     LOGGING_RECEIVER_NAME_PATTERN,
-    MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT,
     NOT_INSIDE_TYPE_CHECKING_BLOCK,
     RESUME_TASK_ENUMERATION_PATTERN,
     RETURN_CALL_OPENING_PARENTHESIS_PATTERN,
@@ -280,121 +276,6 @@ def check_logging_fstrings(content: str) -> list[str]:
     return issues
 
 
-def _format_logger_names_imported(tree: ast.Module) -> set[str]:
-    """Return the local names bound to automation_logging log helpers.
-
-    Scans every ``from ... import ...`` statement for an import whose module
-    path contains ``automation_logging`` and collects the local binding of each
-    imported ``log_*`` helper (the alias when ``as`` is present, otherwise the
-    imported name). Only these names identify a str.format-logger call; a
-    ``log_*`` helper from any other module is not collected, because a
-    ``%``-style logger formats its tokens correctly.
-
-    Args:
-        tree: The parsed module to scan for logger imports.
-
-    Returns:
-        The set of local names bound to automation_logging log helpers.
-    """
-    bound_names: set[str] = set()
-    for each_node in ast.walk(tree):
-        if not isinstance(each_node, ast.ImportFrom):
-            continue
-        if each_node.module is None or "automation_logging" not in each_node.module:
-            continue
-        for each_alias in each_node.names:
-            if each_alias.name in ALL_FORMAT_LOGGER_FUNCTION_NAMES:
-                bound_names.add(each_alias.asname or each_alias.name)
-    return bound_names
-
-
-def _printf_token_log_call_line(
-    node: ast.AST, all_format_logger_names: set[str]
-) -> int | None:
-    """Return the line of a format-logger call carrying a printf token, else None.
-
-    Args:
-        node: The AST node to inspect.
-        all_format_logger_names: Local names bound to automation_logging log
-            helpers.
-
-    Returns:
-        The 1-based line number when ``node`` is a bare-name call to a format
-        logger that has at least one format argument after the message and
-        whose first string-literal argument carries a printf token; otherwise
-        None. A call with only the message and no format arguments never runs
-        ``.format(*args)``, so its token prints intact and is not flagged.
-    """
-    if not isinstance(node, ast.Call):
-        return None
-    function_reference = node.func
-    if (
-        not isinstance(function_reference, ast.Name)
-        or function_reference.id not in all_format_logger_names
-    ):
-        return None
-    if len(node.args) < MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT:
-        return None
-    message_argument = node.args[0]
-    if not isinstance(message_argument, ast.Constant) or not isinstance(
-        message_argument.value, str
-    ):
-        return None
-    if not LOGGING_PRINTF_TOKEN_PATTERN.search(message_argument.value):
-        return None
-    return node.lineno
-
-
-def check_logging_printf_tokens(content: str, file_path: str) -> list[str]:
-    """Flag printf tokens in a str.format-logger (automation_logging) message.
-
-    The ``shared_utils.automation_logging`` helpers (``log_info``, ``log_error``,
-    ...) format with ``str.format`` (``{}`` placeholders) only when format
-    arguments follow the message (``message.format(*args) if args else
-    message``), so a printf-style token such as ``%s`` in the message literal is
-    never substituted: the format arguments are dropped and the literal token
-    prints. The check fires only in a file that imports one of those helpers
-    from an ``automation_logging`` module, and only for a bare-name call to such
-    a helper that passes at least one format argument after the message and
-    whose first argument is a string literal carrying a token. A call with only
-    the message and no format arguments never runs ``.format``, so its token
-    prints intact and is left alone. An attribute call (``logger.info``) or a
-    ``log_*`` helper from any other module formats ``%``-tokens correctly and is
-    left alone. Test files are exempt so a test may exercise the malformed shape.
-
-    Args:
-        content: The Python source under validation.
-        file_path: The destination path, used to skip test files and non-Python.
-
-    Returns:
-        One issue line per offending call, capped at the configured maximum.
-    """
-    if is_test_file(file_path):
-        return []
-    if get_file_extension(file_path) not in ALL_PYTHON_EXTENSIONS:
-        return []
-    try:
-        tree = ast.parse(content)
-    except SyntaxError:
-        return []
-    all_format_logger_names = _format_logger_names_imported(tree)
-    if not all_format_logger_names:
-        return []
-    issues: list[str] = []
-    for each_node in ast.walk(tree):
-        offending_line = _printf_token_log_call_line(each_node, all_format_logger_names)
-        if offending_line is None:
-            continue
-        issues.append(
-            f"Line {offending_line}: printf token in a str.format logger "
-            "message - the automation_logging helpers format with str.format; "
-            "use {} placeholders (the %-arguments are silently dropped)"
-        )
-        if len(issues) >= MAX_LOGGING_PRINTF_TOKEN_ISSUES:
-            break
-    return issues
-
-
 def _logging_call_receiver_name(receiver_node: ast.expr) -> str | None:
     """Return the trailing identifier of a logging-call receiver expression, else None.
 

package/hooks/blocking/test_code_rules_enforcer_narrow_edit.py

@@ -49,7 +49,6 @@ ALL_SCOPE_AWARE_RULE_NAMES = frozenset(
         "check_docstring_runon_sentence",
         "check_docstring_prose_wall_without_illustration",
         "check_boolean_naming",
-        "check_ignored_must_check_return",
         "check_tests_use_isolated_filesystem_paths",
         "check_return_annotations",
         "check_function_length",
@@ -70,7 +69,6 @@ NARROW_EDIT_ACCEPTED_RULE_NAMES = frozenset(
         "check_join_separator_string_magic",
         "check_banned_noun_word_boundary",
         "check_boolean_naming",
-        "check_ignored_must_check_return",
     }
 )
 
@@ -80,7 +78,6 @@ EXPECTED_RULE_TEXT_BY_NAME = {
     "check_join_separator_string_magic": "string separator",
     "check_banned_noun_word_boundary": "Identifier",
     "check_boolean_naming": "Boolean",
-    "check_ignored_must_check_return": "return value",
 }
 
 
@@ -139,19 +136,6 @@ ALL_REQUIRED_RULE_FIXTURES = (
         expected_marker="ready",
         rule_name="check_boolean_naming",
     ),
-    NarrowEditFixture(
-        old_fragment=(
-            "def submit_form() -> None:\n"
-            "    if find_and_click('#submit'):\n"
-            "        return\n"
-        ),
-        new_fragment=(
-            "def submit_form() -> None:\n"
-            "    find_and_click('#submit')\n"
-        ),
-        expected_marker="find_and_click",
-        rule_name="check_ignored_must_check_return",
-    ),
 )
 
 

package/hooks/hooks_constants/blocking_check_limits.py

@@ -22,12 +22,10 @@ MAX_DOCSTRING_FORMAT_ISSUES: int = 5
 MAX_DOCSTRING_ARGS_SIGNATURE_ISSUES: int = 5
 MAX_CLASS_DOCSTRING_PUBLIC_METHOD_ISSUES: int = 5
 MINIMUM_PUBLIC_METHODS_FOR_CLASS_DOCSTRING_BREADTH: int = 2
-MAX_IGNORED_MUST_CHECK_RETURN_ISSUES: int = 5
 MAX_TYPE_ESCAPE_HATCH_ISSUES: int = 5
 MAX_THIN_WRAPPER_ISSUES: int = 1
 MAX_ZERO_PAYLOAD_ALIAS_ISSUES: int = 3
 MAX_LOGGING_FSTRING_ISSUES: int = 3
-MAX_LOGGING_PRINTF_TOKEN_ISSUES: int = 3
 MAX_LOGGING_ADJACENT_LITERAL_ISSUES: int = 3
 MAX_CONFIG_DUPLICATE_PATH_ANCHOR_ISSUES: int = 3
 MAX_WINDOWS_API_NONE_ISSUES: int = 3
@@ -204,17 +202,6 @@ DOCSTRING_REFERENCE_MARKER_WINDOW: int = 2
 ALL_GENERIC_CHECK_NAME_TOKENS: frozenset[str] = frozenset(
     {"check", "checks", "test", "tests", "in", "for", "and", "the"}
 )
-ALL_FORMAT_LOGGER_FUNCTION_NAMES: frozenset[str] = frozenset(
-    {
-        "log_debug",
-        "log_info",
-        "log_ok",
-        "log_error",
-        "log_warning",
-        "log_batch",
-        "log_background",
-    }
-)
 DOCSTRING_RUNON_SENTENCE_WORD_LIMIT: int = 30
 MAX_DOCSTRING_RUNON_SENTENCE_ISSUES: int = 5
 ALL_DOCSTRING_RUNON_JOINER_MARKERS: tuple[str, ...] = ("—", " -- ", ";")

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -72,8 +72,6 @@ ALL_POLARITY_ANTONYM_TOKEN_PAIRS: tuple[tuple[str, str], ...] = (
 )
 POLARITY_TOKEN_BOUNDARY_PATTERN: str = r"(?:^|_)%s(?:_|$)"
 
-ALL_MUST_CHECK_RETURN_FUNCTION_NAMES: frozenset[str] = frozenset({"find_and_click", "write_outcome"})
-
 DOCSTRING_ARG_ENTRY_PATTERN: re.Pattern[str] = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)\s*[:(]")
 DOCSTRING_PLURAL_FAMILY_STOP_PATTERN: re.Pattern[str] = re.compile(
     r"\bthe\s+([a-z][a-z]+)\s+stops\b"
@@ -211,14 +209,10 @@ LOGGING_FSTRING_PATTERN = re.compile(
     r'|(?:logger|logging|log)\.(?:debug|info|warning|error|critical|exception))'
     r'\s*\(\s*(?:[rR][fF]|[fF][rR]?)["\']'
 )
-LOGGING_PRINTF_TOKEN_PATTERN: re.Pattern[str] = re.compile(
-    r"(?<!%)%[#0\- +]?[0-9.*]*[sdrixfgeEcoX](?![a-zA-Z])"
-)
 ADJACENT_STRING_LITERAL_PATTERN: re.Pattern[str] = re.compile(
     r'(?<!["\'])[rRbBfFuU]{0,2}(?:"(?:[^"\\\n]|\\.)*"|\'(?:[^\'\\\n]|\\.)*\')'
     r'\s*[rRbBfFuU]{0,2}(?:"(?:[^"\\\n]|\\.)*"|\'(?:[^\'\\\n]|\\.)*\')(?!["\'])'
 )
-MINIMUM_FORMAT_LOGGER_ARGUMENT_COUNT = 2
 ALL_LOGGING_CALL_METHOD_NAMES: frozenset[str] = frozenset(
     {"debug", "info", "warning", "error", "critical", "exception"}
 )

package/hooks/hooks_constants/local_identity.py

@@ -1,19 +1,17 @@
-"""Resolve local identity values for NAS ssh and PII exempt-repo hooks.
+"""Resolve local identity values for the PII hooks.
 
-The enforcer hooks ship into ``~/.claude/`` and cannot read a repository file,
-so they read real machine values from the environment or a git-ignored file in
-the Claude home directory. This module supplies NAS host/user/port, the two
-NAS deny messages that quote those values, and the owner/repo slug set used by
-``pii_exempt_repository_slugs`` (``CLAUDE_PII_EXEMPT_REPOS`` /
-``pii_exempt_repositories``). The committed NAS defaults are placeholders.
+The hooks ship into ``~/.claude/`` and cannot read a repository file, so they
+read machine values from the environment or a git-ignored file in the Claude
+home directory. This module supplies the NAS host the PII scanner allowlists
+and the owner/repo slug set used by ``pii_exempt_repository_slugs``
+(``CLAUDE_PII_EXEMPT_REPOS`` / ``pii_exempt_repositories``). The committed NAS
+host default is a placeholder.
 
 ::
 
     CLAUDE_NAS_HOST set to a host              ->  nas_host() returns that host
-    CLAUDE_NAS_SSH_PORT set to 2200            ->  nas_ssh_port() returns 2200
     CLAUDE_PII_EXEMPT_REPOS="Owner/repo"       ->  {"owner/repo"}
     (env unset, no file)                       ->  nas_host() == "nas.example.local"
-                                                   nas_ssh_port() == 22
                                                    pii_exempt_repository_slugs() == frozenset()
 
 Each value comes from its environment variable, then
@@ -32,19 +30,11 @@ PII_EXEMPT_REPOS_ENV_VAR = "CLAUDE_PII_EXEMPT_REPOS"
 PII_EXEMPT_REPOS_JSON_KEY = "pii_exempt_repositories"
 PII_EXEMPT_REPOS_SEPARATOR = ","
 PII_ALLOWLISTED_VALUES_JSON_KEY = "pii_allowlisted_values"
-NAS_SSH_USER_ENV_VAR = "CLAUDE_NAS_SSH_USER"
-NAS_SSH_PORT_ENV_VAR = "CLAUDE_NAS_SSH_PORT"
 NAS_JSON_KEY = "nas"
 NAS_HOST_JSON_KEY = "host"
-NAS_SSH_USER_JSON_KEY = "ssh_user"
-NAS_SSH_PORT_JSON_KEY = "ssh_port"
 CLAUDE_HOME_DIRECTORY_NAME = ".claude"
 LOCAL_IDENTITY_FILE_NAME = "local-identity.json"
 PLACEHOLDER_NAS_HOST = "nas.example.local"
-PLACEHOLDER_NAS_SSH_USER = "operator"
-PLACEHOLDER_NAS_SSH_PORT = 22
-OPENSSH_INVOCATION_EXAMPLE_BINARY = '"/c/Windows/System32/OpenSSH/ssh.exe"'
-NAS_SSH_RULE_REFERENCE = "~/.claude/rules/nas-ssh-invocation.md"
 
 
 def _local_identity_file_path() -> Path:
@@ -178,106 +168,3 @@ def nas_host() -> str:
     if isinstance(stored_host, str) and stored_host:
         return stored_host
     return PLACEHOLDER_NAS_HOST
-
-
-def nas_ssh_user() -> str:
-    """Return the ssh user the enforcer expects for the NAS.
-
-    ::
-
-        CLAUDE_NAS_SSH_USER set to a user  ->  that user
-        (env unset, no file)               ->  "operator"
-
-    The environment variable wins, then the git-ignored file, then the
-    placeholder default.
-
-    Returns:
-        The ssh login name for the NAS.
-    """
-    user_from_environment = os.environ.get(NAS_SSH_USER_ENV_VAR)
-    if user_from_environment:
-        return user_from_environment
-    stored_user = _nas_section_from_local_file().get(NAS_SSH_USER_JSON_KEY)
-    if isinstance(stored_user, str) and stored_user:
-        return stored_user
-    return PLACEHOLDER_NAS_SSH_USER
-
-
-def nas_ssh_port() -> int:
-    """Return the ssh port the enforcer expects for the NAS.
-
-    ::
-
-        CLAUDE_NAS_SSH_PORT set to 2200  ->  2200
-        (env unset, no file)             ->  22
-
-    The environment variable wins, then the git-ignored file, then the
-    placeholder default.
-
-    Returns:
-        The ssh port number for the NAS.
-    """
-    port_from_environment = os.environ.get(NAS_SSH_PORT_ENV_VAR)
-    if port_from_environment and port_from_environment.isdigit():
-        return int(port_from_environment)
-    stored_port = _nas_section_from_local_file().get(NAS_SSH_PORT_JSON_KEY)
-    if isinstance(stored_port, int):
-        return stored_port
-    return PLACEHOLDER_NAS_SSH_PORT
-
-
-def _openssh_invocation_example() -> str:
-    return (
-        f"{OPENSSH_INVOCATION_EXAMPLE_BINARY} -o BatchMode=yes -o ConnectTimeout=10 "
-        f'-p {nas_ssh_port()} {nas_ssh_user()}@{nas_host()} "<cmd>"'
-    )
-
-
-def bare_ssh_binary_deny_message() -> str:
-    """Return the deny message for a bare ssh-family word aimed at the NAS.
-
-    ::
-
-        ssh -p 22 operator@nas.example.local "ls"  ->  this message text
-        (the text quotes the resolved host, user, and port)
-
-    Names the Git Bash MSYS-ssh hang and points at the Windows OpenSSH binary
-    with batch mode on.
-
-    Returns:
-        The full deny-message text for the bare ssh-family case.
-    """
-    return (
-        f"BLOCKED [nas-ssh-binary]: Git Bash's MSYS ssh reads ~/.ssh/id_ed25519 as "
-        f"world-readable through its ACL mapping, rejects the key as bad permissions, "
-        f"and falls back to an interactive password prompt that hangs unattended "
-        f"sessions against the NAS at {nas_host()}.\n\n"
-        f"Use the Windows OpenSSH binary, which authenticates the key without prompting:\n"
-        f"  {_openssh_invocation_example()}\n\n"
-        f"See {NAS_SSH_RULE_REFERENCE} for full guidance."
-    )
-
-
-def missing_batch_mode_deny_message() -> str:
-    """Return the deny message for the OpenSSH binary without batch mode.
-
-    ::
-
-        "..ssh.exe" -p 22 operator@nas.example.local "ls"  ->  this message text
-        (the text quotes the resolved host, user, and port)
-
-    Names the interactive-prompt hang and asks for ``-o BatchMode=yes`` so a key
-    failure exits loudly.
-
-    Returns:
-        The full deny-message text for the missing-batch-mode case.
-    """
-    return (
-        f"BLOCKED [nas-ssh-binary]: this NAS ssh command uses the Windows OpenSSH binary "
-        f"but omits -o BatchMode=yes, so an authentication regression falls back to an "
-        f"interactive password prompt that hangs unattended sessions against the NAS at "
-        f"{nas_host()}.\n\n"
-        f"Add -o BatchMode=yes so a key failure exits loudly rather than prompting:\n"
-        f"  {_openssh_invocation_example()}\n\n"
-        f"See {NAS_SSH_RULE_REFERENCE} for full guidance."
-    )

package/hooks/hooks_constants/test_local_identity.py

@@ -1,4 +1,4 @@
-"""Tests for the NAS local-identity loader used by the ssh enforcer hook."""
+"""Tests for the local-identity loader used by the PII hooks."""
 
 from __future__ import annotations
 
@@ -14,7 +14,7 @@ except ImportError:
     sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
     from hooks_constants import local_identity
 
-ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST", "CLAUDE_NAS_SSH_USER", "CLAUDE_NAS_SSH_PORT")
+ALL_NAS_ENV_VARS = ("CLAUDE_NAS_HOST",)
 
 
 def _clear_nas_env() -> None:
@@ -23,30 +23,20 @@ def _clear_nas_env() -> None:
 
 
 class TestNasValuesFromEnvironment:
-    def should_read_host_user_and_port_from_the_environment(self) -> None:
-        with patch.dict(
-            os.environ,
-            {
-                "CLAUDE_NAS_HOST": "10.0.0.5",
-                "CLAUDE_NAS_SSH_USER": "tester",
-                "CLAUDE_NAS_SSH_PORT": "2200",
-            },
-            clear=False,
-        ):
+    def should_read_host_from_the_environment(self) -> None:
+        with patch.dict(os.environ, {"CLAUDE_NAS_HOST": "10.0.0.5"}, clear=False):
             assert local_identity.nas_host() == "10.0.0.5"
-            assert local_identity.nas_ssh_user() == "tester"
-            assert local_identity.nas_ssh_port() == 2200
 
 
 class TestNasValuesFromLocalFile:
-    def should_read_host_user_and_port_from_the_local_identity_file(
+    def should_read_host_from_the_local_identity_file(
         self, tmp_path: Path
     ) -> None:
         claude_home = tmp_path / ".claude"
         claude_home.mkdir()
         (claude_home / "local-identity.json").write_text(
             json.dumps(
-                {"nas": {"host": "10.1.1.9", "ssh_user": "fileuser", "ssh_port": 2222}}
+                {"nas": {"host": "10.1.1.9"}}
             ),
             encoding="utf-8",
         )
@@ -54,18 +44,14 @@ class TestNasValuesFromLocalFile:
             _clear_nas_env()
             with patch.object(Path, "home", return_value=tmp_path):
                 assert local_identity.nas_host() == "10.1.1.9"
-                assert local_identity.nas_ssh_user() == "fileuser"
-                assert local_identity.nas_ssh_port() == 2222
 
 
 class TestNasValuesPlaceholderDefault:
-    def should_return_placeholders_when_no_env_and_no_file(self, tmp_path: Path) -> None:
+    def should_return_placeholder_when_no_env_and_no_file(self, tmp_path: Path) -> None:
         with patch.dict(os.environ, {}, clear=False):
             _clear_nas_env()
             with patch.object(Path, "home", return_value=tmp_path):
                 assert local_identity.nas_host() == "nas.example.local"
-                assert local_identity.nas_ssh_user() == "operator"
-                assert local_identity.nas_ssh_port() == 22
 
 
 class TestPiiExemptRepositorySlugs:
@@ -234,25 +220,3 @@ class TestLocalIdentityPathOverride:
         ), patch.object(Path, "home", return_value=tmp_path):
             _clear_nas_env()
             assert local_identity.nas_host() == "10.9.9.9"
-
-
-class TestDenyMessagesQuoteTheResolvedHost:
-    def should_include_the_resolved_host_and_port_in_the_bare_binary_message(
-        self,
-    ) -> None:
-        with patch.dict(
-            os.environ,
-            {"CLAUDE_NAS_HOST": "10.0.0.5", "CLAUDE_NAS_SSH_PORT": "2200"},
-            clear=False,
-        ):
-            os.environ.pop("CLAUDE_NAS_SSH_USER", None)
-            message = local_identity.bare_ssh_binary_deny_message()
-            assert "10.0.0.5" in message
-            assert "-p 2200" in message
-            assert "BatchMode=yes" in message
-
-    def should_include_the_resolved_host_in_the_missing_batch_mode_message(self) -> None:
-        with patch.dict(os.environ, {"CLAUDE_NAS_HOST": "10.0.0.5"}, clear=False):
-            message = local_identity.missing_batch_mode_deny_message()
-            assert "10.0.0.5" in message
-            assert "BatchMode=yes" in message

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.25.0",
+    "version": "8.25.1",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/shell-invocation.md

@@ -6,7 +6,7 @@ Two constraints govern every shell command an agent issues: which shell runs it,
 
 Every Bash-tool shell command on Windows uses `pwsh`: `pwsh -NoProfile -File '<script>.ps1' <args>` for scripts, `pwsh -NoProfile -Command "..."` (or a literal `@'...'@` here-string) for inline work, or the built-in `PowerShell` tool for pure-PowerShell workflows (it supports `run_in_background`). Never wrap a script path in `-Command "& '...'"` — `-File` keeps `permissions.allow` matching. The `&` call operator is fine for invoking an executable at a path (`& '<venv>\Scripts\python.exe' script.py`).
 
-The mandate covers the shell a command runs through, not every executable a command names. A direct interpreter invocation another rule documents — the paramiko NAS helper in [`nas-ssh-invocation.md`](nas-ssh-invocation.md), a `python` call on a repo script — conforms as written.
+The mandate covers the shell a command runs through. A direct interpreter invocation, such as a `python` call on a repo script, conforms as written.
 
 Keep `powershell`, `powershell.exe`, `cmd /c`, and `bash -c` out of the `settings.json` permission rules. `Audit-ShellPolicy.ps1` reports those forms and `Migrate-ShellPolicy.ps1` rewrites them to `pwsh`. Both ship in the claude-dev-env repo at `packages/claude-dev-env/scripts/` and run on demand, not as a live gate.
 

package/scripts/repository_checks/config/constants.py

@@ -147,10 +147,5 @@ ALL_TRACKED_SECRET_EXACT_EXEMPTIONS: frozenset[tuple[str, str, str]] = frozenset
             "home-path",
             "5d956228802fbd4a65af8fa7fb4183f5a9f8793dbe218877aefe887b905f726d",
         ),
-        (
-            "shared_utils/theme_assets/contracts/evidence/theme_editor_asset_resolution_master.oneui9.v1.json",
-            "home-path",
-            "ec69fe88e2f9d3f1ed3504532c7484120591cbec7ae6fda017b0f9ca57a3fc25",
-        ),
     )
 )

package/docs/nas-ssh-invocation.md

@@ -1,107 +0,0 @@
-# Running Commands on the NAS
-
-Full detail behind the always-on `rules/nas-ssh-invocation.md` kernel.
-
-This file covers how to run a command there at all. What the NAS runs, where the automations are
-deployed, and how to verify a change against them belong with the project that owns those
-automations, not here.
-
-## The call
-
-```
-python <runner-path> <command-script.sh> <private-key-path>
-```
-
-Two arguments, both paths. The first is a file holding a bash script; the second is the private key.
-
-The runner is `nas_ssh_key.py`. It ships with the automation project it serves, so read its path from
-that project's own reference rather than assuming a location.
-
-The host, ssh port and ssh user are constants inside the runner, so no command you write names them.
-The same three values are recorded under the `nas` key in `~/.claude/local-identity.json`. Read them
-from there when something needs them, and keep them out of anything committed or posted.
-
-Write the script file with the Write tool. Keeping the commands in a file has a second benefit: a
-destructive word such as `rm -rf` inside the file never appears in a Bash tool command string, so the
-harness permission prompt never fires on it and an unattended run keeps going.
-
-The script runs through `bash -s` in a single shell. Variables, `cd`, and `source` all carry from one
-line to the next. Standard output, standard error and the exit code all come back.
-
-## Why not ssh, scp or sftp
-
-The runner loads the key with paramiko and signs inside the Python process. The command-line clients
-check the key file's permissions first and refuse to load a key whose permissions they do not like.
-Git Bash's `ssh` then falls back to an interactive password prompt, which hangs a run with nobody to
-answer it.
-
-To move a file onto the NAS, write it from inside the script:
-
-```bash
-cat > /tmp/thing.conf <<'EOF'
-contents here
-EOF
-```
-
-The quoted `'EOF'` stops the shell expanding anything in the body.
-
-## The key
-
-Use the ops key under `~/.claude/keys`. It is readable as-is and the NAS accepts it.
-
-Keys under `~/.ssh` are for other jobs and none of them works here. The default one carries a
-passphrase, so paramiko cannot load it unattended; the rest are for other hosts.
-
-## Writing a script that touches the automations
-
-Do not reach for the system interpreter. It carries neither pytest nor the libraries the automations
-import, so anything checked against it proves nothing.
-
-Each automation project records its own runtime — the interpreter, the virtual environment, the
-import root, and the deploy path. Read that project's reference and activate what it names before
-running anything.
-
-## Verifying a change before it ships
-
-The NAS is a Linux box and this machine is Windows, so two classes of difference show up only there:
-syntax newer than the NAS interpreter accepts, and tests that assert Windows paths.
-
-**Always separate a break in the code from a platform-only one.** Run the same test file at the branch head
-and at the commit the work started from. Identical failures at both mean the environment, not the
-change. Report both numbers rather than the head alone.
-
-## The /tmp limit
-
-`/tmp` is a small tmpfs. A full clone of a repository that carries binary assets fills it, the clone
-dies partway through, and the disk stays full for whatever runs next.
-
-Fetch shallow and sparse instead:
-
-```bash
-d=$(mktemp -d /tmp/work.XXXXXX)
-cd "$d"
-git init --quiet
-git remote add origin <repository-url>
-git sparse-checkout init --cone
-git sparse-checkout set <subdirectory>
-git fetch --quiet --depth 1 origin <sha>
-git checkout --quiet FETCH_HEAD
-```
-
-One subdirectory at one commit lands tens of megabytes rather than the whole history. Clean up at the
-end and print `df -h /tmp` so the next run knows the state:
-
-```bash
-find /tmp -maxdepth 1 -name 'work.*' -prune -exec rm -rf {} +
-```
-
-## When something fails
-
-| What you see | What it means |
-|---|---|
-| `PermissionError: [Errno 13]` on the key | The key file is not readable by this account. |
-| `PasswordRequiredException: Private key file is encrypted` | That key has a passphrase and cannot be used unattended. |
-| `Authentication (publickey) failed` | The transport works and the NAS does not accept that key. |
-| `Load key ...: Permission denied` from `ssh.exe` | A command-line client is being used. Use the runner. |
-| `No space left on device` | `/tmp` is full. Clean it, then fetch shallow and sparse. |
-| `No module named pytest` | The system interpreter is being used. Activate the project's environment first. |

package/hooks/blocking/test_code_rules_enforcer_ignored_must_check_return.py

@@ -1,266 +0,0 @@
-"""Tests for check_ignored_must_check_return — discarded must-check outcomes.
-
-A bare-statement call to a function in ALL_MUST_CHECK_RETURN_FUNCTION_NAMES
-discards the only failure signal it produces. An assigned or branched-on
-call is exempt; only bare ``ast.Expr`` calls are flagged.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
-_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
-if _BLOCKING_DIRECTORY not in sys.path:
-    sys.path.insert(0, _BLOCKING_DIRECTORY)
-if _HOOKS_DIRECTORY not in sys.path:
-    sys.path.insert(0, _HOOKS_DIRECTORY)
-
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-)
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    check_ignored_must_check_return as _check_ignored_must_check_return,
-)
-from code_rules_enforcer import (  # noqa: E402
-    validate_content_for_full_gate as _validate_content,
-)
-
-code_rules_enforcer = SimpleNamespace(
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES=MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-    check_ignored_must_check_return=_check_ignored_must_check_return,
-    validate_content=_validate_content,
-)
-
-
-def check_ignored_must_check_return(content: str, file_path: str) -> list[str]:
-    return code_rules_enforcer.check_ignored_must_check_return(content, file_path)
-
-
-def validate_content(content: str, file_path: str, old_content: str) -> list[str]:
-    return code_rules_enforcer.validate_content(content, file_path, old_content)
-
-
-PRODUCTION_FILE_PATH = "/project/src/clicker.py"
-TEST_FILE_PATH = "/project/src/test_clicker.py"
-
-
-def test_should_flag_bare_find_and_click_call() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("find_and_click" in each for each in issues), (
-        f"Expected discarded-return flag for find_and_click, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_flag_bare_write_outcome_call() -> None:
-    source = "def step() -> None:\n    write_outcome('done')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("write_outcome" in each for each in issues), (
-        f"Expected discarded-return flag for write_outcome, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_flag_attribute_call_with_must_check_name() -> None:
-    source = "def step() -> None:\n    self.find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1, f"Attribute call terminal name must be resolved, got: {issues!r}"
-
-
-def test_should_not_flag_assigned_find_and_click() -> None:
-    source = "def step() -> None:\n    clicked = find_and_click('#submit')\n    print(clicked)\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Assigned call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_branched_find_and_click() -> None:
-    source = "def step() -> None:\n    if find_and_click('#submit'):\n        pass\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Branched-on call must not be flagged, got: {issues!r}"
-
-
-def test_should_flag_bare_awaited_find_and_click_call() -> None:
-    source = "async def step() -> None:\n    await find_and_click('#x')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("find_and_click" in each for each in issues), (
-        f"Expected discarded-return flag for awaited find_and_click, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_not_flag_assigned_awaited_find_and_click() -> None:
-    source = (
-        "async def step() -> None:\n"
-        "    clicked = await find_and_click('#x')\n"
-        "    print(clicked)\n"
-    )
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Assigned awaited call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_branched_awaited_find_and_click() -> None:
-    source = "async def step() -> None:\n    if await find_and_click('#x'):\n        pass\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Branched-on awaited call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_unrelated_bare_call() -> None:
-    source = "def step() -> None:\n    print('hello')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Unrelated call must not be flagged, got: {issues!r}"
-
-
-def test_should_skip_test_file() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, TEST_FILE_PATH)
-    assert issues == [], f"Test files exempt, got: {issues!r}"
-
-
-def test_should_handle_syntax_error_gracefully() -> None:
-    issues = check_ignored_must_check_return("def step(\n", PRODUCTION_FILE_PATH)
-    assert issues == [], f"Syntax error must yield no issues, got: {issues!r}"
-
-
-def test_validate_content_surfaces_discarded_return() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = validate_content(source, PRODUCTION_FILE_PATH, old_content="")
-    matching_issues = [each for each in issues if "find_and_click" in each]
-    assert matching_issues, (
-        f"Expected validate_content to surface the discarded-return issue, got: {issues!r}"
-    )
-
-
-EDIT_FULL_MODULE_SOURCE = (
-    "async def step() -> None:\n"
-    "    await find_and_click('#x')\n"
-)
-AWAITED_CALL_LINE_NUMBER = 2
-UNCHANGED_LINE_NUMBER = 1
-
-
-def test_should_flag_when_changed_line_covers_the_bare_await() -> None:
-    all_changed_lines = {AWAITED_CALL_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        EDIT_FULL_MODULE_SOURCE,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        f"An Edit touching the bare await line must surface exactly one issue, got: {issues!r}"
-    )
-    assert "find_and_click" in issues[0]
-
-
-def test_should_not_flag_when_changed_line_excludes_the_bare_await() -> None:
-    all_changed_lines = {UNCHANGED_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        EDIT_FULL_MODULE_SOURCE,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert issues == [], (
-        f"A pre-existing violation on an unedited line must not block the edit, got: {issues!r}"
-    )
-
-
-PRE_EXISTING_BARE_CALL_COUNT = 5
-EDITED_BARE_CALL_LINE_NUMBER = PRE_EXISTING_BARE_CALL_COUNT + 2
-
-
-def _build_module_with_pre_existing_violations_before_the_edit() -> str:
-    all_signature_lines = ["async def step() -> None:"]
-    all_pre_existing_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(PRE_EXISTING_BARE_CALL_COUNT)
-    ]
-    edited_call_line = "    await find_and_click('#edited')"
-    all_lines = all_signature_lines + all_pre_existing_call_lines + [edited_call_line]
-    return "\n".join(all_lines) + "\n"
-
-
-def test_should_flag_edited_line_even_when_cap_worth_of_violations_precede_it() -> None:
-    source = _build_module_with_pre_existing_violations_before_the_edit()
-    all_changed_lines = {EDITED_BARE_CALL_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        "Collecting every violation before scoping must surface the edited-line "
-        f"violation even with a cap's worth of earlier out-of-scope calls, got: {issues!r}"
-    )
-    assert f"Line {EDITED_BARE_CALL_LINE_NUMBER}:" in issues[0], (
-        f"The single issue must name the edited line {EDITED_BARE_CALL_LINE_NUMBER}, got: {issues!r}"
-    )
-
-
-def _build_module_with_more_than_cap_bare_calls() -> tuple[str, int]:
-    bare_call_count = code_rules_enforcer.MAX_IGNORED_MUST_CHECK_RETURN_ISSUES + 3
-    all_signature_lines = ["async def step() -> None:"]
-    all_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(bare_call_count)
-    ]
-    source = "\n".join(all_signature_lines + all_call_lines) + "\n"
-    return source, bare_call_count
-
-
-def test_deferred_scope_returns_every_violation_uncapped() -> None:
-    source, bare_call_count = _build_module_with_more_than_cap_bare_calls()
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        None,
-        True,
-    )
-    assert len(issues) == bare_call_count, (
-        "With defer_scope_to_caller=True the gate must see every violation uncapped "
-        f"so it can scope by added line, got: {issues!r}"
-    )
-
-
-def test_terminal_scope_caps_violations_at_the_module_limit() -> None:
-    source, _ = _build_module_with_more_than_cap_bare_calls()
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        None,
-        False,
-    )
-    assert len(issues) == code_rules_enforcer.MAX_IGNORED_MUST_CHECK_RETURN_ISSUES, (
-        "The terminal hook path with all_changed_lines=None must cap at the module "
-        f"limit, got: {issues!r}"
-    )
-
-
-WRAPPED_CALL_OPEN_PAREN_LINE_NUMBER = 2
-WRAPPED_CALL_ARGUMENT_LINE_NUMBER = 3
-
-
-def test_should_flag_when_changed_line_covers_a_later_line_of_a_wrapped_call() -> None:
-    source = (
-        "def step() -> None:\n"
-        "    find_and_click(\n"
-        "        '#submit',\n"
-        "    )\n"
-    )
-    all_changed_lines = {WRAPPED_CALL_ARGUMENT_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        "Editing a later line of a multi-line bare must-check call must still flag it "
-        f"because the violation span covers the whole call, got: {issues!r}"
-    )
-    assert "find_and_click" in issues[0]

package/hooks/blocking/test_code_rules_enforcer_split_mustcheck.py

@@ -1,87 +0,0 @@
-"""Behavior tests for the code_rules_boolean_mustcheck code-rules check module."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
-_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
-if _BLOCKING_DIRECTORY not in sys.path:
-    sys.path.insert(0, _BLOCKING_DIRECTORY)
-if _HOOKS_DIRECTORY not in sys.path:
-    sys.path.insert(0, _HOOKS_DIRECTORY)
-
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    check_ignored_must_check_return,
-)
-
-code_rules_enforcer = SimpleNamespace(
-    check_ignored_must_check_return=check_ignored_must_check_return,
-)
-
-
-def test_ignored_must_check_return_flags_bare_awaited_call() -> None:
-    """A bare ``await find_and_click(...)`` statement discards its only failure signal.
-
-    The curated must-check functions are async, so the common real call site is a
-    bare ``await``-wrapped call. Unwrapping ``ast.Await`` before the Call check is
-    required for this case to be flagged.
-    """
-    source = "async def step() -> None:\n    await find_and_click('#x')\n"
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source, "/project/src/clicker.py"
-    )
-    assert any("find_and_click" in each_issue for each_issue in issues), (
-        f"a bare awaited must-check call must be flagged; got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_ignored_must_check_return_exempts_consumed_awaited_call() -> None:
-    """An assigned or branched-on awaited must-check call consumes its outcome."""
-    assigned = "async def step() -> None:\n    clicked = await find_and_click('#x')\n    print(clicked)\n"
-    branched = "async def step() -> None:\n    if await find_and_click('#x'):\n        pass\n"
-    assert (
-        code_rules_enforcer.check_ignored_must_check_return(assigned, "/project/src/clicker.py")
-        == []
-    )
-    assert (
-        code_rules_enforcer.check_ignored_must_check_return(branched, "/project/src/clicker.py")
-        == []
-    )
-
-
-def test_ignored_must_check_return_flags_edited_line_past_a_cap_of_earlier_violations() -> None:
-    """The cap must apply after scoping so the edited-line violation is never dropped.
-
-    Collecting only a cap's worth of violations in ``ast.walk`` order, then scoping,
-    fills the cap with earlier out-of-scope calls and discards the edited-line one —
-    the very violation the scoped enforcer exists to block. Every violation must be
-    collected before scoping so the edited line survives the diff filter.
-    """
-    pre_existing_call_count = 5
-    edited_call_line_number = pre_existing_call_count + 2
-    all_pre_existing_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(pre_existing_call_count)
-    ]
-    all_lines = (
-        ["async def step() -> None:"]
-        + all_pre_existing_call_lines
-        + ["    await find_and_click('#edited')"]
-    )
-    source = "\n".join(all_lines) + "\n"
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        "/project/src/clicker.py",
-        {edited_call_line_number},
-        False,
-    )
-    assert len(issues) == 1, (
-        f"the edited-line violation must survive a cap's worth of earlier calls; got: {issues!r}"
-    )
-    assert f"Line {edited_call_line_number}:" in issues[0], (
-        f"the single issue must name the edited line {edited_call_line_number}; got: {issues!r}"
-    )

package/hooks/blocking/test_code_rules_logging_printf_tokens.py

@@ -1,134 +0,0 @@
-"""Tests for the printf-token check on str.format-logger (automation_logging) calls."""
-
-from __future__ import annotations
-
-import importlib.util
-from pathlib import Path
-from types import ModuleType
-
-ENFORCER_FILENAME = "code_rules_enforcer.py"
-ENFORCER_MODULE_NAME = "code_rules_enforcer_printf_under_test"
-PRODUCTION_FILE_PATH = "shared_utils/web_automation/sample.py"
-TEST_FILE_PATH = "shared_utils/web_automation/tests/test_sample.py"
-FORMAT_LOGGER_IMPORT = (
-    "from shared_utils.automation_logging import log_error, log_info, log_debug\n"
-)
-
-
-def load_enforcer_module() -> ModuleType:
-    enforcer_path = Path(__file__).parent / ENFORCER_FILENAME
-    module_spec = importlib.util.spec_from_file_location(ENFORCER_MODULE_NAME, enforcer_path)
-    assert module_spec is not None
-    assert module_spec.loader is not None
-    enforcer_module = importlib.util.module_from_spec(module_spec)
-    module_spec.loader.exec_module(enforcer_module)
-    return enforcer_module
-
-
-enforcer = load_enforcer_module()
-
-
-def test_should_flag_percent_s_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s after error: %s", name, err)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-    assert "printf token" in issues[0]
-
-
-def test_should_flag_percent_d_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_debug("attempt %d of %d", index, total)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_allow_brace_placeholders_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("Processing {} of {}", index, total)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_ignore_percent_token_without_format_logger_import() -> None:
-    source = 'log_error("Skipping %s", name)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_ignore_attribute_style_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'logger.info("delivered %s", message_id)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_inspect_message_literal_not_argument_value() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("status: {}", "100%s done")\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_exempt_test_files() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s", name)\n'
-    issues = enforcer.check_logging_printf_tokens(source, TEST_FILE_PATH)
-    assert issues == []
-
-
-def test_should_resolve_aliased_format_logger_import() -> None:
-    source = (
-        "from shared_utils.automation_logging import log_error as report_error\n"
-        + 'report_error("failed %s", name)\n'
-    )
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_allow_token_bearing_message_with_no_format_args() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("Use %s for string substitution")\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_documentation_style_token_message_with_no_args() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_warning("avoid %s-style tokens here")\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_percent_adjacent_to_word_in_format_message() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("memory 80%free now", host)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_doubled_percent_in_format_message() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("100%% done", host)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_trailing_percent_in_format_message() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("100% done", host)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_flag_width_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("item %5d", index)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_flag_precision_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("took %0.2f sec", elapsed)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_flag_float_general_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("ratio %g", ratio)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_flag_scientific_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("value %e", measurement)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1

package/rules/nas-ssh-invocation.md

@@ -1,29 +0,0 @@
-# Running Commands on the NAS
-
-Reach the NAS through the `nas_ssh_key.py` runner, never through `ssh`, `scp` or `sftp`:
-
-```
-python <runner-path> <command-script.sh> <private-key-path>
-```
-
-The first argument is a **path to a file** holding a bash script, not a command string. Write that
-file with the Write tool. The whole script runs in one shell, so variables, `cd` and `source` carry
-from line to line.
-
-The runner ships with the automation project it serves; read its path from that project's own
-reference. Use the ops key under `~/.claude/keys` — keys under `~/.ssh` either carry a passphrase,
-which cannot be answered unattended, or belong to other hosts.
-
-The runner loads the key with paramiko and signs in the same process. The command-line clients check
-the key file's permissions first and refuse it, and Git Bash's `ssh` then falls back to a password
-prompt that hangs an unattended run. No hook denies an ssh-family word aimed at the NAS, so keep to
-the runner yourself. When the `System32/OpenSSH` binary is unavoidable, pass `-o BatchMode=yes` so it
-fails fast on a refused key.
-
-Host, ssh port and ssh user are constants inside the runner and are also under the `nas` key in
-`~/.claude/local-identity.json`. Keep all three out of anything committed or posted.
-
-To copy a file, write it inside the script with a quoted heredoc rather than reaching for `scp`.
-
-The `/tmp` size limit, how to tell a break in the code from a platform-only one, and a failure-to-cause
-table: `@~/.claude/docs/nas-ssh-invocation.md`.