claude-dev-env 8.25.0 → 8.26.0

package/docs/nas-ssh-invocation.md

@@ -1,107 +0,0 @@
-# Running Commands on the NAS
-
-Full detail behind the always-on `rules/nas-ssh-invocation.md` kernel.
-
-This file covers how to run a command there at all. What the NAS runs, where the automations are
-deployed, and how to verify a change against them belong with the project that owns those
-automations, not here.
-
-## The call
-
-```
-python <runner-path> <command-script.sh> <private-key-path>
-```
-
-Two arguments, both paths. The first is a file holding a bash script; the second is the private key.
-
-The runner is `nas_ssh_key.py`. It ships with the automation project it serves, so read its path from
-that project's own reference rather than assuming a location.
-
-The host, ssh port and ssh user are constants inside the runner, so no command you write names them.
-The same three values are recorded under the `nas` key in `~/.claude/local-identity.json`. Read them
-from there when something needs them, and keep them out of anything committed or posted.
-
-Write the script file with the Write tool. Keeping the commands in a file has a second benefit: a
-destructive word such as `rm -rf` inside the file never appears in a Bash tool command string, so the
-harness permission prompt never fires on it and an unattended run keeps going.
-
-The script runs through `bash -s` in a single shell. Variables, `cd`, and `source` all carry from one
-line to the next. Standard output, standard error and the exit code all come back.
-
-## Why not ssh, scp or sftp
-
-The runner loads the key with paramiko and signs inside the Python process. The command-line clients
-check the key file's permissions first and refuse to load a key whose permissions they do not like.
-Git Bash's `ssh` then falls back to an interactive password prompt, which hangs a run with nobody to
-answer it.
-
-To move a file onto the NAS, write it from inside the script:
-
-```bash
-cat > /tmp/thing.conf <<'EOF'
-contents here
-EOF
-```
-
-The quoted `'EOF'` stops the shell expanding anything in the body.
-
-## The key
-
-Use the ops key under `~/.claude/keys`. It is readable as-is and the NAS accepts it.
-
-Keys under `~/.ssh` are for other jobs and none of them works here. The default one carries a
-passphrase, so paramiko cannot load it unattended; the rest are for other hosts.
-
-## Writing a script that touches the automations
-
-Do not reach for the system interpreter. It carries neither pytest nor the libraries the automations
-import, so anything checked against it proves nothing.
-
-Each automation project records its own runtime — the interpreter, the virtual environment, the
-import root, and the deploy path. Read that project's reference and activate what it names before
-running anything.
-
-## Verifying a change before it ships
-
-The NAS is a Linux box and this machine is Windows, so two classes of difference show up only there:
-syntax newer than the NAS interpreter accepts, and tests that assert Windows paths.
-
-**Always separate a break in the code from a platform-only one.** Run the same test file at the branch head
-and at the commit the work started from. Identical failures at both mean the environment, not the
-change. Report both numbers rather than the head alone.
-
-## The /tmp limit
-
-`/tmp` is a small tmpfs. A full clone of a repository that carries binary assets fills it, the clone
-dies partway through, and the disk stays full for whatever runs next.
-
-Fetch shallow and sparse instead:
-
-```bash
-d=$(mktemp -d /tmp/work.XXXXXX)
-cd "$d"
-git init --quiet
-git remote add origin <repository-url>
-git sparse-checkout init --cone
-git sparse-checkout set <subdirectory>
-git fetch --quiet --depth 1 origin <sha>
-git checkout --quiet FETCH_HEAD
-```
-
-One subdirectory at one commit lands tens of megabytes rather than the whole history. Clean up at the
-end and print `df -h /tmp` so the next run knows the state:
-
-```bash
-find /tmp -maxdepth 1 -name 'work.*' -prune -exec rm -rf {} +
-```
-
-## When something fails
-
-| What you see | What it means |
-|---|---|
-| `PermissionError: [Errno 13]` on the key | The key file is not readable by this account. |
-| `PasswordRequiredException: Private key file is encrypted` | That key has a passphrase and cannot be used unattended. |
-| `Authentication (publickey) failed` | The transport works and the NAS does not accept that key. |
-| `Load key ...: Permission denied` from `ssh.exe` | A command-line client is being used. Use the runner. |
-| `No space left on device` | `/tmp` is full. Clean it, then fetch shallow and sparse. |
-| `No module named pytest` | The system interpreter is being used. Activate the project's environment first. |

package/hooks/blocking/test_code_rules_enforcer_ignored_must_check_return.py

@@ -1,266 +0,0 @@
-"""Tests for check_ignored_must_check_return — discarded must-check outcomes.
-
-A bare-statement call to a function in ALL_MUST_CHECK_RETURN_FUNCTION_NAMES
-discards the only failure signal it produces. An assigned or branched-on
-call is exempt; only bare ``ast.Expr`` calls are flagged.
-"""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
-_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
-if _BLOCKING_DIRECTORY not in sys.path:
-    sys.path.insert(0, _BLOCKING_DIRECTORY)
-if _HOOKS_DIRECTORY not in sys.path:
-    sys.path.insert(0, _HOOKS_DIRECTORY)
-
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-)
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    check_ignored_must_check_return as _check_ignored_must_check_return,
-)
-from code_rules_enforcer import (  # noqa: E402
-    validate_content_for_full_gate as _validate_content,
-)
-
-code_rules_enforcer = SimpleNamespace(
-    MAX_IGNORED_MUST_CHECK_RETURN_ISSUES=MAX_IGNORED_MUST_CHECK_RETURN_ISSUES,
-    check_ignored_must_check_return=_check_ignored_must_check_return,
-    validate_content=_validate_content,
-)
-
-
-def check_ignored_must_check_return(content: str, file_path: str) -> list[str]:
-    return code_rules_enforcer.check_ignored_must_check_return(content, file_path)
-
-
-def validate_content(content: str, file_path: str, old_content: str) -> list[str]:
-    return code_rules_enforcer.validate_content(content, file_path, old_content)
-
-
-PRODUCTION_FILE_PATH = "/project/src/clicker.py"
-TEST_FILE_PATH = "/project/src/test_clicker.py"
-
-
-def test_should_flag_bare_find_and_click_call() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("find_and_click" in each for each in issues), (
-        f"Expected discarded-return flag for find_and_click, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_flag_bare_write_outcome_call() -> None:
-    source = "def step() -> None:\n    write_outcome('done')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("write_outcome" in each for each in issues), (
-        f"Expected discarded-return flag for write_outcome, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_flag_attribute_call_with_must_check_name() -> None:
-    source = "def step() -> None:\n    self.find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1, f"Attribute call terminal name must be resolved, got: {issues!r}"
-
-
-def test_should_not_flag_assigned_find_and_click() -> None:
-    source = "def step() -> None:\n    clicked = find_and_click('#submit')\n    print(clicked)\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Assigned call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_branched_find_and_click() -> None:
-    source = "def step() -> None:\n    if find_and_click('#submit'):\n        pass\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Branched-on call must not be flagged, got: {issues!r}"
-
-
-def test_should_flag_bare_awaited_find_and_click_call() -> None:
-    source = "async def step() -> None:\n    await find_and_click('#x')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert any("find_and_click" in each for each in issues), (
-        f"Expected discarded-return flag for awaited find_and_click, got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_should_not_flag_assigned_awaited_find_and_click() -> None:
-    source = (
-        "async def step() -> None:\n"
-        "    clicked = await find_and_click('#x')\n"
-        "    print(clicked)\n"
-    )
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Assigned awaited call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_branched_awaited_find_and_click() -> None:
-    source = "async def step() -> None:\n    if await find_and_click('#x'):\n        pass\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Branched-on awaited call must not be flagged, got: {issues!r}"
-
-
-def test_should_not_flag_unrelated_bare_call() -> None:
-    source = "def step() -> None:\n    print('hello')\n"
-    issues = check_ignored_must_check_return(source, PRODUCTION_FILE_PATH)
-    assert issues == [], f"Unrelated call must not be flagged, got: {issues!r}"
-
-
-def test_should_skip_test_file() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = check_ignored_must_check_return(source, TEST_FILE_PATH)
-    assert issues == [], f"Test files exempt, got: {issues!r}"
-
-
-def test_should_handle_syntax_error_gracefully() -> None:
-    issues = check_ignored_must_check_return("def step(\n", PRODUCTION_FILE_PATH)
-    assert issues == [], f"Syntax error must yield no issues, got: {issues!r}"
-
-
-def test_validate_content_surfaces_discarded_return() -> None:
-    source = "def step() -> None:\n    find_and_click('#submit')\n"
-    issues = validate_content(source, PRODUCTION_FILE_PATH, old_content="")
-    matching_issues = [each for each in issues if "find_and_click" in each]
-    assert matching_issues, (
-        f"Expected validate_content to surface the discarded-return issue, got: {issues!r}"
-    )
-
-
-EDIT_FULL_MODULE_SOURCE = (
-    "async def step() -> None:\n"
-    "    await find_and_click('#x')\n"
-)
-AWAITED_CALL_LINE_NUMBER = 2
-UNCHANGED_LINE_NUMBER = 1
-
-
-def test_should_flag_when_changed_line_covers_the_bare_await() -> None:
-    all_changed_lines = {AWAITED_CALL_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        EDIT_FULL_MODULE_SOURCE,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        f"An Edit touching the bare await line must surface exactly one issue, got: {issues!r}"
-    )
-    assert "find_and_click" in issues[0]
-
-
-def test_should_not_flag_when_changed_line_excludes_the_bare_await() -> None:
-    all_changed_lines = {UNCHANGED_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        EDIT_FULL_MODULE_SOURCE,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert issues == [], (
-        f"A pre-existing violation on an unedited line must not block the edit, got: {issues!r}"
-    )
-
-
-PRE_EXISTING_BARE_CALL_COUNT = 5
-EDITED_BARE_CALL_LINE_NUMBER = PRE_EXISTING_BARE_CALL_COUNT + 2
-
-
-def _build_module_with_pre_existing_violations_before_the_edit() -> str:
-    all_signature_lines = ["async def step() -> None:"]
-    all_pre_existing_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(PRE_EXISTING_BARE_CALL_COUNT)
-    ]
-    edited_call_line = "    await find_and_click('#edited')"
-    all_lines = all_signature_lines + all_pre_existing_call_lines + [edited_call_line]
-    return "\n".join(all_lines) + "\n"
-
-
-def test_should_flag_edited_line_even_when_cap_worth_of_violations_precede_it() -> None:
-    source = _build_module_with_pre_existing_violations_before_the_edit()
-    all_changed_lines = {EDITED_BARE_CALL_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        "Collecting every violation before scoping must surface the edited-line "
-        f"violation even with a cap's worth of earlier out-of-scope calls, got: {issues!r}"
-    )
-    assert f"Line {EDITED_BARE_CALL_LINE_NUMBER}:" in issues[0], (
-        f"The single issue must name the edited line {EDITED_BARE_CALL_LINE_NUMBER}, got: {issues!r}"
-    )
-
-
-def _build_module_with_more_than_cap_bare_calls() -> tuple[str, int]:
-    bare_call_count = code_rules_enforcer.MAX_IGNORED_MUST_CHECK_RETURN_ISSUES + 3
-    all_signature_lines = ["async def step() -> None:"]
-    all_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(bare_call_count)
-    ]
-    source = "\n".join(all_signature_lines + all_call_lines) + "\n"
-    return source, bare_call_count
-
-
-def test_deferred_scope_returns_every_violation_uncapped() -> None:
-    source, bare_call_count = _build_module_with_more_than_cap_bare_calls()
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        None,
-        True,
-    )
-    assert len(issues) == bare_call_count, (
-        "With defer_scope_to_caller=True the gate must see every violation uncapped "
-        f"so it can scope by added line, got: {issues!r}"
-    )
-
-
-def test_terminal_scope_caps_violations_at_the_module_limit() -> None:
-    source, _ = _build_module_with_more_than_cap_bare_calls()
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        None,
-        False,
-    )
-    assert len(issues) == code_rules_enforcer.MAX_IGNORED_MUST_CHECK_RETURN_ISSUES, (
-        "The terminal hook path with all_changed_lines=None must cap at the module "
-        f"limit, got: {issues!r}"
-    )
-
-
-WRAPPED_CALL_OPEN_PAREN_LINE_NUMBER = 2
-WRAPPED_CALL_ARGUMENT_LINE_NUMBER = 3
-
-
-def test_should_flag_when_changed_line_covers_a_later_line_of_a_wrapped_call() -> None:
-    source = (
-        "def step() -> None:\n"
-        "    find_and_click(\n"
-        "        '#submit',\n"
-        "    )\n"
-    )
-    all_changed_lines = {WRAPPED_CALL_ARGUMENT_LINE_NUMBER}
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        PRODUCTION_FILE_PATH,
-        all_changed_lines,
-        False,
-    )
-    assert len(issues) == 1, (
-        "Editing a later line of a multi-line bare must-check call must still flag it "
-        f"because the violation span covers the whole call, got: {issues!r}"
-    )
-    assert "find_and_click" in issues[0]

package/hooks/blocking/test_code_rules_enforcer_split_mustcheck.py

@@ -1,87 +0,0 @@
-"""Behavior tests for the code_rules_boolean_mustcheck code-rules check module."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-from types import SimpleNamespace
-
-_BLOCKING_DIRECTORY = str(Path(__file__).resolve().parent)
-_HOOKS_DIRECTORY = str(Path(__file__).resolve().parent.parent)
-if _BLOCKING_DIRECTORY not in sys.path:
-    sys.path.insert(0, _BLOCKING_DIRECTORY)
-if _HOOKS_DIRECTORY not in sys.path:
-    sys.path.insert(0, _HOOKS_DIRECTORY)
-
-from code_rules_boolean_mustcheck import (  # noqa: E402
-    check_ignored_must_check_return,
-)
-
-code_rules_enforcer = SimpleNamespace(
-    check_ignored_must_check_return=check_ignored_must_check_return,
-)
-
-
-def test_ignored_must_check_return_flags_bare_awaited_call() -> None:
-    """A bare ``await find_and_click(...)`` statement discards its only failure signal.
-
-    The curated must-check functions are async, so the common real call site is a
-    bare ``await``-wrapped call. Unwrapping ``ast.Await`` before the Call check is
-    required for this case to be flagged.
-    """
-    source = "async def step() -> None:\n    await find_and_click('#x')\n"
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source, "/project/src/clicker.py"
-    )
-    assert any("find_and_click" in each_issue for each_issue in issues), (
-        f"a bare awaited must-check call must be flagged; got: {issues!r}"
-    )
-    assert len(issues) == 1
-
-
-def test_ignored_must_check_return_exempts_consumed_awaited_call() -> None:
-    """An assigned or branched-on awaited must-check call consumes its outcome."""
-    assigned = "async def step() -> None:\n    clicked = await find_and_click('#x')\n    print(clicked)\n"
-    branched = "async def step() -> None:\n    if await find_and_click('#x'):\n        pass\n"
-    assert (
-        code_rules_enforcer.check_ignored_must_check_return(assigned, "/project/src/clicker.py")
-        == []
-    )
-    assert (
-        code_rules_enforcer.check_ignored_must_check_return(branched, "/project/src/clicker.py")
-        == []
-    )
-
-
-def test_ignored_must_check_return_flags_edited_line_past_a_cap_of_earlier_violations() -> None:
-    """The cap must apply after scoping so the edited-line violation is never dropped.
-
-    Collecting only a cap's worth of violations in ``ast.walk`` order, then scoping,
-    fills the cap with earlier out-of-scope calls and discards the edited-line one —
-    the very violation the scoped enforcer exists to block. Every violation must be
-    collected before scoping so the edited line survives the diff filter.
-    """
-    pre_existing_call_count = 5
-    edited_call_line_number = pre_existing_call_count + 2
-    all_pre_existing_call_lines = [
-        f"    await find_and_click('#x{each_index}')"
-        for each_index in range(pre_existing_call_count)
-    ]
-    all_lines = (
-        ["async def step() -> None:"]
-        + all_pre_existing_call_lines
-        + ["    await find_and_click('#edited')"]
-    )
-    source = "\n".join(all_lines) + "\n"
-    issues = code_rules_enforcer.check_ignored_must_check_return(
-        source,
-        "/project/src/clicker.py",
-        {edited_call_line_number},
-        False,
-    )
-    assert len(issues) == 1, (
-        f"the edited-line violation must survive a cap's worth of earlier calls; got: {issues!r}"
-    )
-    assert f"Line {edited_call_line_number}:" in issues[0], (
-        f"the single issue must name the edited line {edited_call_line_number}; got: {issues!r}"
-    )

package/hooks/blocking/test_code_rules_logging_printf_tokens.py

@@ -1,134 +0,0 @@
-"""Tests for the printf-token check on str.format-logger (automation_logging) calls."""
-
-from __future__ import annotations
-
-import importlib.util
-from pathlib import Path
-from types import ModuleType
-
-ENFORCER_FILENAME = "code_rules_enforcer.py"
-ENFORCER_MODULE_NAME = "code_rules_enforcer_printf_under_test"
-PRODUCTION_FILE_PATH = "shared_utils/web_automation/sample.py"
-TEST_FILE_PATH = "shared_utils/web_automation/tests/test_sample.py"
-FORMAT_LOGGER_IMPORT = (
-    "from shared_utils.automation_logging import log_error, log_info, log_debug\n"
-)
-
-
-def load_enforcer_module() -> ModuleType:
-    enforcer_path = Path(__file__).parent / ENFORCER_FILENAME
-    module_spec = importlib.util.spec_from_file_location(ENFORCER_MODULE_NAME, enforcer_path)
-    assert module_spec is not None
-    assert module_spec.loader is not None
-    enforcer_module = importlib.util.module_from_spec(module_spec)
-    module_spec.loader.exec_module(enforcer_module)
-    return enforcer_module
-
-
-enforcer = load_enforcer_module()
-
-
-def test_should_flag_percent_s_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s after error: %s", name, err)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-    assert "printf token" in issues[0]
-
-
-def test_should_flag_percent_d_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_debug("attempt %d of %d", index, total)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_allow_brace_placeholders_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("Processing {} of {}", index, total)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_ignore_percent_token_without_format_logger_import() -> None:
-    source = 'log_error("Skipping %s", name)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_ignore_attribute_style_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'logger.info("delivered %s", message_id)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_inspect_message_literal_not_argument_value() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("status: {}", "100%s done")\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_exempt_test_files() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("Skipping %s", name)\n'
-    issues = enforcer.check_logging_printf_tokens(source, TEST_FILE_PATH)
-    assert issues == []
-
-
-def test_should_resolve_aliased_format_logger_import() -> None:
-    source = (
-        "from shared_utils.automation_logging import log_error as report_error\n"
-        + 'report_error("failed %s", name)\n'
-    )
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_allow_token_bearing_message_with_no_format_args() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("Use %s for string substitution")\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_documentation_style_token_message_with_no_args() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_warning("avoid %s-style tokens here")\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_percent_adjacent_to_word_in_format_message() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("memory 80%free now", host)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_doubled_percent_in_format_message() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("100%% done", host)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_allow_trailing_percent_in_format_message() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_info("100% done", host)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert issues == []
-
-
-def test_should_flag_width_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("item %5d", index)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_flag_precision_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("took %0.2f sec", elapsed)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_flag_float_general_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("ratio %g", ratio)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1
-
-
-def test_should_flag_scientific_token_in_format_logger_call() -> None:
-    source = FORMAT_LOGGER_IMPORT + 'log_error("value %e", measurement)\n'
-    issues = enforcer.check_logging_printf_tokens(source, PRODUCTION_FILE_PATH)
-    assert len(issues) == 1

package/rules/nas-ssh-invocation.md

@@ -1,29 +0,0 @@
-# Running Commands on the NAS
-
-Reach the NAS through the `nas_ssh_key.py` runner, never through `ssh`, `scp` or `sftp`:
-
-```
-python <runner-path> <command-script.sh> <private-key-path>
-```
-
-The first argument is a **path to a file** holding a bash script, not a command string. Write that
-file with the Write tool. The whole script runs in one shell, so variables, `cd` and `source` carry
-from line to line.
-
-The runner ships with the automation project it serves; read its path from that project's own
-reference. Use the ops key under `~/.claude/keys` — keys under `~/.ssh` either carry a passphrase,
-which cannot be answered unattended, or belong to other hosts.
-
-The runner loads the key with paramiko and signs in the same process. The command-line clients check
-the key file's permissions first and refuse it, and Git Bash's `ssh` then falls back to a password
-prompt that hangs an unattended run. No hook denies an ssh-family word aimed at the NAS, so keep to
-the runner yourself. When the `System32/OpenSSH` binary is unavoidable, pass `-o BatchMode=yes` so it
-fails fast on a refused key.
-
-Host, ssh port and ssh user are constants inside the runner and are also under the `nas` key in
-`~/.claude/local-identity.json`. Keep all three out of anything committed or posted.
-
-To copy a file, write it inside the script with a quoted heredoc rather than reaching for `scp`.
-
-The `/tmp` size limit, how to tell a break in the code from a platform-only one, and a failure-to-cause
-table: `@~/.claude/docs/nas-ssh-invocation.md`.