claude-dev-env 8.7.0 → 8.9.0

package/scripts/dev_env_scripts_constants/private_term_constants.py

@@ -0,0 +1,60 @@
+"""Digests of the private organization names this public repository never names.
+
+The names stay out of the tree. Each entry holds the SHA-256 digest of one
+name after normalization, which keeps only ASCII letters and digits in lower
+case::
+
+    "Acme-Widgets, Inc."          -> "acmewidgetsinc"
+    "pat@acmewidgets.example.com" -> "patacmewidgetsexamplecom"
+
+A scan hashes every window of the normalized text whose length matches an
+entry, so any case, spacing, or punctuation of a name matches. To add a name,
+append the digest of its normalized form and its length.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class PrivateTermDigest:
+    """The length and SHA-256 hex digest of one normalized private name."""
+
+    length: int
+    sha256: str
+
+
+ALL_PRIVATE_TERM_DIGESTS: frozenset[PrivateTermDigest] = frozenset(
+    {
+        PrivateTermDigest(
+            length=10,
+            sha256="c2a70b3186691a74dece4ca824bec178bfaec83be119be28faedd14aa392233f",
+        ),
+    }
+)
+PRIVATE_TERM_TEXT_ENCODING = "utf-8"
+PRIVATE_TERM_FINDING_CODE = "private-term"
+PRIVATE_TERM_MESSAGE_TEMPLATE = (
+    "Line {line_number} names a private organization. "
+    "Describe it in general terms and drop any link to it."
+)
+ALL_EVENT_TEXT_FIELDS: tuple[tuple[str, str, str], ...] = (
+    ("pull_request", "title", "pull request title"),
+    ("pull_request", "body", "pull request body"),
+    ("issue", "title", "issue title"),
+    ("issue", "body", "issue body"),
+    ("comment", "body", "comment body"),
+    ("review", "body", "review body"),
+    ("release", "name", "release name"),
+    ("release", "body", "release body"),
+)
+FINDING_LINE_TEMPLATE = "{label}: {message}"
+COMMIT_LABEL_TEMPLATE = "commit {short_sha} {part}"
+COMMIT_IDENTITY_PART = "identity"
+COMMIT_MESSAGE_PART = "message"
+SHORT_SHA_LENGTH = 12
+COMMIT_FIELD_SEPARATOR = "\x1f"
+COMMIT_RECORD_SEPARATOR = "\x1e"
+COMMIT_FIELD_SPLIT_LIMIT = 2
+COMMIT_LOG_FORMAT = "--format=%H%x1f%an <%ae> %cn <%ce>%x1f%B%x1e"

package/scripts/dev_env_scripts_constants/test_claude_account_constants.py

@@ -0,0 +1,46 @@
+"""The second-account thresholds keep the main account the protected one."""
+
+from __future__ import annotations
+
+from dev_env_scripts_constants.claude_account_constants import (
+    JSON_ACCOUNT_KEY,
+    JSON_CONFIG_DIRECTORY_KEY,
+    JSON_METERS_KEY,
+    JSON_REASON_KEY,
+    JSON_SESSION_RESETS_AT_KEY,
+    JSON_SESSION_USED_PERCENT_KEY,
+    JSON_WEEKLY_RESETS_AT_KEY,
+    JSON_WEEKLY_USED_PERCENT_KEY,
+    LAUNCHER_TEXT_TEMPLATE,
+    MAIN_SESSION_USED_CEILING_PERCENT,
+    MAIN_WEEKLY_USED_CEILING_PERCENT,
+    SECOND_SESSION_USED_CEILING_PERCENT,
+    SECOND_WEEKLY_USED_CEILING_PERCENT,
+)
+
+
+def test_main_ceilings_sit_below_the_second_account_ceilings() -> None:
+    assert MAIN_WEEKLY_USED_CEILING_PERCENT < SECOND_WEEKLY_USED_CEILING_PERCENT
+    assert MAIN_SESSION_USED_CEILING_PERCENT < SECOND_SESSION_USED_CEILING_PERCENT
+
+
+def test_launcher_names_the_profile_and_passes_every_argument() -> None:
+    assert "{profile_home}" in LAUNCHER_TEXT_TEMPLATE
+    assert "claude %*" in LAUNCHER_TEXT_TEMPLATE
+
+
+def test_picker_report_keys_never_collide() -> None:
+    all_report_keys = [
+        JSON_ACCOUNT_KEY,
+        JSON_CONFIG_DIRECTORY_KEY,
+        JSON_REASON_KEY,
+        JSON_METERS_KEY,
+    ]
+    all_meter_keys = [
+        JSON_SESSION_USED_PERCENT_KEY,
+        JSON_SESSION_RESETS_AT_KEY,
+        JSON_WEEKLY_USED_PERCENT_KEY,
+        JSON_WEEKLY_RESETS_AT_KEY,
+    ]
+    assert len(set(all_report_keys)) == len(all_report_keys)
+    assert len(set(all_meter_keys)) == len(all_meter_keys)

package/scripts/dev_env_scripts_constants/test_private_term_constants.py

@@ -0,0 +1,29 @@
+"""Tests for the private-term digest table."""
+
+from __future__ import annotations
+
+import re
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_EVENT_TEXT_FIELDS,
+    ALL_PRIVATE_TERM_DIGESTS,
+)
+
+_SHA256_HEX_PATTERN = re.compile(r"[0-9a-f]{64}")
+
+
+def test_should_ship_only_digests_of_named_lengths() -> None:
+    assert ALL_PRIVATE_TERM_DIGESTS
+    for each_digest in ALL_PRIVATE_TERM_DIGESTS:
+        assert _SHA256_HEX_PATTERN.fullmatch(each_digest.sha256)
+        assert each_digest.length > 0
+
+
+def test_should_read_every_text_a_pull_request_issue_comment_review_or_release_carries() -> None:
+    assert {each_object for each_object, _field, _label in ALL_EVENT_TEXT_FIELDS} == {
+        "pull_request",
+        "issue",
+        "comment",
+        "review",
+        "release",
+    }

package/scripts/durable_post_lint.py

@@ -12,6 +12,11 @@ from contrast_framing import describe_contrast_framing, find_contrast_framing
 from dev_env_scripts_constants.contrast_framing_constants import (
     CONTRAST_FRAMING_FINDING_CODE,
 )
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_FINDING_CODE,
+    PRIVATE_TERM_MESSAGE_TEMPLATE,
+)
 from durable_post_lint_config.config.constants import (
     ACTION_PR_CREATE,
     ACTION_PR_EDIT,
@@ -41,6 +46,7 @@ from durable_post_lint_config.config.constants import (
     PATH_ANCHOR_CHARACTER,
     PATH_SEGMENT_START_CHARACTERS,
     RELEASE_BRANCH_PREFIX,
+    REPOSITORY_OWNER_SEPARATOR,
     REWRITTEN_RELEASE_BODY_CODE,
     REWRITTEN_RELEASE_BODY_MESSAGE,
     TITLE_NOT_ALLOWED_MESSAGE,
@@ -48,6 +54,7 @@ from durable_post_lint_config.config.constants import (
     VOLATILE_PATH_CODE,
     VOLATILE_PATH_MESSAGE,
 )
+from private_terms import private_term_line_numbers
 
 
 class DurablePostUsageError(ValueError):
@@ -153,6 +160,26 @@ def _contrast_framing_findings(text: str) -> list[DurablePostFinding]:
     ]
 
 
+def _private_term_findings(
+    text: str | None, repository: str | None
+) -> list[DurablePostFinding]:
+    if text is None:
+        return []
+    if repository is not None and private_term_line_numbers(
+        repository.split(REPOSITORY_OWNER_SEPARATOR)[0], ALL_PRIVATE_TERM_DIGESTS
+    ):
+        return []
+    return [
+        DurablePostFinding(
+            code=PRIVATE_TERM_FINDING_CODE,
+            message=PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
+        )
+        for each_line_number in private_term_line_numbers(
+            text, ALL_PRIVATE_TERM_DIGESTS
+        )
+    ]
+
+
 def _title_findings(title: str | None) -> list[DurablePostFinding]:
     if title is None:
         return []
@@ -215,12 +242,29 @@ def lint_durable_post(
     title: str | None,
     body_text: str | None,
     head_branch: str | None = None,
+    repository: str | None = None,
 ) -> tuple[DurablePostFinding, ...]:
-    """Return content findings for one locally valid GitHub post request."""
+    """Return content findings for one locally valid GitHub post request.
+
+    A post to a repository whose owner is a private organization may name that
+    organization. Every other post, and a post with no repository given, may not.
+
+    Args:
+        action: The post action, such as ``pr-create`` or ``issue-comment``.
+        title: The post title, when the action carries one.
+        body_text: The post body, when the action carries one.
+        head_branch: The pull request head branch, when known.
+        repository: The ``owner/name`` the post targets, when known.
+
+    Returns:
+        Every finding, title findings first.
+    """
     _validate_request_shape(action, title, body_text)
     return (
         *_title_findings(title),
+        *_private_term_findings(title, repository),
         *_body_findings(action, body_text, head_branch),
+        *_private_term_findings(body_text, repository),
     )
 
 
@@ -230,6 +274,7 @@ def _parse_arguments(all_arguments: Sequence[str]) -> argparse.Namespace:
     parser.add_argument("--title")
     parser.add_argument("--body-file", type=Path)
     parser.add_argument("--head-branch")
+    parser.add_argument("--repository")
     return parser.parse_args(list(all_arguments))
 
 
@@ -247,6 +292,7 @@ def main(all_arguments: Sequence[str]) -> int:
             title=arguments.title,
             body_text=body_text,
             head_branch=arguments.head_branch,
+            repository=arguments.repository,
         )
     except (DurablePostInputError, DurablePostUsageError) as error:
         sys.stderr.write(f"{error}\n")

package/scripts/durable_post_lint_config/config/constants.py

@@ -101,3 +101,4 @@ REWRITTEN_RELEASE_BODY_MESSAGE = (
     "release automation reads this body back to recognize its own merge; "
     "keep the generated text whole"
 )
+REPOSITORY_OWNER_SEPARATOR = "/"

package/scripts/gh_artifact_upload.py

@@ -5,8 +5,8 @@ A durable GitHub post (issue, PR, comment, review) must not link a file under a
 job scratch directory or worktree, because that scratch is cleaned soon after
 the run while the post lives forever. Binary artifacts belong in a permanent
 place instead. This tool ensures the repo has a prerelease tagged ``artifacts``,
-uploads the given file under a timestamped asset name, and prints the permanent
-download URL a post can safely link. The timestamped name keeps each upload a
+shrinks a PNG losslessly with oxipng, uploads the file under a timestamped asset
+name, and prints the permanent download URL a post can safely link. The timestamped name keeps each upload a
 distinct asset. An upload never overwrites an earlier one. A same-name collision
 fails loudly instead of replacing the bytes an existing URL already serves.
 
@@ -28,6 +28,7 @@ import tempfile
 from pathlib import Path
 
 from dev_env_scripts_constants.gh_artifact_upload_constants import (
+    ALL_OXIPNG_LOSSLESS_ARGUMENTS,
     ARTIFACTS_RELEASE_NOTES,
     ARTIFACTS_RELEASE_TAG,
     ARTIFACTS_RELEASE_TITLE,
@@ -37,7 +38,11 @@ from dev_env_scripts_constants.gh_artifact_upload_constants import (
     ASSET_URL_JSON_KEY,
     GH_BINARY_NAME,
     NOTES_FILE_SUFFIX,
+    OXIPNG_BINARY_NAME,
+    OXIPNG_MISSING_MESSAGE,
+    PNG_SUFFIX,
     RELEASE_ASSETS_JSON_KEY,
+    SIZE_REPORT_TEMPLATE,
     UTF8_ENCODING,
 )
 
@@ -132,6 +137,49 @@ def timestamped_asset_name(file_path: str) -> str:
     )
 
 
+def _run_oxipng(oxipng_path: str, staged_path: Path) -> None:
+    completion = subprocess.run(
+        [oxipng_path, *ALL_OXIPNG_LOSSLESS_ARGUMENTS, str(staged_path)],
+        capture_output=True,
+        text=True,
+        encoding=UTF8_ENCODING,
+        check=False,
+        creationflags=hidden_window_creation_flags(),
+    )
+    if completion.returncode != 0:
+        raise ArtifactUploadError(completion.stderr.strip())
+
+
+def optimize_png_losslessly(staged_path: Path) -> None:
+    """Shrink a staged PNG in place with oxipng and report both sizes.
+
+    ::
+
+        contact_sheet.png: 361105 -> 308782 bytes
+
+    Oxipng keeps every pixel and every chunk. Other suffixes stay as they are.
+
+    Args:
+        staged_path: The staged copy that the upload sends.
+
+    Raises:
+        ArtifactUploadError: When oxipng is missing or fails.
+    """
+    if staged_path.suffix.lower() != PNG_SUFFIX:
+        return
+    oxipng_path = shutil.which(OXIPNG_BINARY_NAME)
+    if oxipng_path is None:
+        raise ArtifactUploadError(OXIPNG_MISSING_MESSAGE)
+    original_size = staged_path.stat().st_size
+    _run_oxipng(oxipng_path, staged_path)
+    size_report = SIZE_REPORT_TEMPLATE.format(
+        name=staged_path.name,
+        original_size=original_size,
+        optimized_size=staged_path.stat().st_size,
+    )
+    print(size_report, file=sys.stderr)
+
+
 def _uploaded_asset_download_url(repository: str) -> str:
     """Read the just-uploaded asset's real download URL back from GitHub.
 
@@ -197,6 +245,9 @@ def _uploaded_asset_download_url(repository: str) -> str:
 def upload_artifact(file_path: str, repository: str) -> str:
     """Upload a file to the artifacts release and return its permanent URL.
 
+    A PNG passes through oxipng on a staged copy first, so the source file
+    stays unchanged.
+
     Args:
         file_path: The source file to upload.
         repository: The ``owner/repo`` slug.
@@ -205,7 +256,8 @@ def upload_artifact(file_path: str, repository: str) -> str:
         The permanent download URL for the uploaded asset.
 
     Raises:
-        ArtifactUploadError: When the file is missing or the upload fails.
+        ArtifactUploadError: When the file is missing, oxipng cannot shrink
+            a PNG, or the upload fails.
     """
     source_path = Path(file_path)
     if not source_path.is_file():
@@ -215,6 +267,7 @@ def upload_artifact(file_path: str, repository: str) -> str:
     with tempfile.TemporaryDirectory() as staging_directory:
         staged_asset_path = Path(staging_directory) / asset_name
         shutil.copyfile(source_path, staged_asset_path)
+        optimize_png_losslessly(staged_asset_path)
         completion = _run_gh(
             [
                 "release",

package/scripts/private_term_scan.py

@@ -0,0 +1,135 @@
+"""Fail a GitHub event whose text or commits name a private organization.
+
+The workflow ``private-terms.yml`` runs this on pull request, issue, comment,
+review, and release events. Each finding names where the text sits and its
+line number, never the name itself, so the public log stays clean::
+
+    pull request body: Line 4 names a private organization. ...
+    commit 3f2a9c1b77de identity: Line 1 names a private organization. ...
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+from collections.abc import Sequence
+from pathlib import Path
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_EVENT_TEXT_FIELDS,
+    ALL_PRIVATE_TERM_DIGESTS,
+    COMMIT_FIELD_SEPARATOR,
+    COMMIT_FIELD_SPLIT_LIMIT,
+    COMMIT_IDENTITY_PART,
+    COMMIT_LABEL_TEMPLATE,
+    COMMIT_LOG_FORMAT,
+    COMMIT_MESSAGE_PART,
+    COMMIT_RECORD_SEPARATOR,
+    FINDING_LINE_TEMPLATE,
+    PRIVATE_TERM_MESSAGE_TEMPLATE,
+    PRIVATE_TERM_TEXT_ENCODING,
+    SHORT_SHA_LENGTH,
+)
+from private_terms import private_term_line_numbers
+
+
+def _findings_for(label: str, text: str) -> list[str]:
+    return [
+        FINDING_LINE_TEMPLATE.format(
+            label=label,
+            message=PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
+        )
+        for each_line_number in private_term_line_numbers(
+            text, ALL_PRIVATE_TERM_DIGESTS
+        )
+    ]
+
+
+def scan_event(event_path: Path) -> list[str]:
+    """Return findings for the texts a GitHub event payload carries.
+
+    Args:
+        event_path: Path of the event JSON the runner writes.
+
+    Returns:
+        One finding per line that names a private organization.
+    """
+    event = json.loads(event_path.read_text(encoding=PRIVATE_TERM_TEXT_ENCODING))
+    all_findings: list[str] = []
+    for each_object_key, each_field, each_label in ALL_EVENT_TEXT_FIELDS:
+        event_object = event.get(each_object_key)
+        if not isinstance(event_object, dict):
+            continue
+        text = event_object.get(each_field)
+        if isinstance(text, str):
+            all_findings.extend(_findings_for(each_label, text))
+    return all_findings
+
+
+def _commit_findings(record: str) -> list[str]:
+    full_sha, identity, message = record.split(
+        COMMIT_FIELD_SEPARATOR, COMMIT_FIELD_SPLIT_LIMIT
+    )
+    short_sha = full_sha[:SHORT_SHA_LENGTH]
+    return [
+        *_findings_for(
+            COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_IDENTITY_PART),
+            identity,
+        ),
+        *_findings_for(
+            COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_MESSAGE_PART),
+            message,
+        ),
+    ]
+
+
+def scan_commits(repository_root: Path, commit_range: str) -> list[str]:
+    """Return findings for commit messages and identities in a range, oldest first.
+
+    Args:
+        repository_root: Git checkout holding the range.
+        commit_range: A ``base..head`` revision range.
+
+    Returns:
+        One finding per commit identity or message line that names a private
+        organization.
+    """
+    log_text = subprocess.run(
+        ["git", "-C", str(repository_root), "log", "--reverse", COMMIT_LOG_FORMAT, commit_range],
+        check=True,
+        capture_output=True,
+        encoding=PRIVATE_TERM_TEXT_ENCODING,
+    ).stdout
+    return [
+        each_finding
+        for each_record in log_text.split(COMMIT_RECORD_SEPARATOR)
+        if each_record.strip()
+        for each_finding in _commit_findings(each_record.strip())
+    ]
+
+
+def main(all_arguments: Sequence[str]) -> int:
+    """Print every finding and return 1 when any text names a private organization.
+
+    Args:
+        all_arguments: Command-line arguments after the script name.
+
+    Returns:
+        0 for a clean event, 1 when any finding printed.
+    """
+    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
+    parser.add_argument("--event-path", type=Path, required=True)
+    parser.add_argument("--commit-range")
+    arguments = parser.parse_args(list(all_arguments))
+    all_findings = scan_event(arguments.event_path)
+    if arguments.commit_range:
+        all_findings.extend(scan_commits(Path.cwd(), arguments.commit_range))
+    for each_finding in all_findings:
+        print(each_finding)
+    return 1 if all_findings else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/scripts/private_terms.py

@@ -0,0 +1,87 @@
+"""Find private organization names in text without holding the names.
+
+``private_term_line_numbers`` reports where a name appears and never the
+name, so a caller can print its result in a public log.
+"""
+
+from __future__ import annotations
+
+import bisect
+import hashlib
+from collections.abc import Collection
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_TEXT_ENCODING,
+    PrivateTermDigest,
+)
+
+
+def _normalized_text_and_line_starts(text: str) -> tuple[str, list[int]]:
+    all_normalized_lines: list[str] = []
+    all_line_starts: list[int] = []
+    offset = 0
+    for each_line in text.split("\n"):
+        normalized_line = "".join(
+            each_character
+            for each_character in each_line.lower()
+            if each_character.isascii() and each_character.isalnum()
+        )
+        all_line_starts.append(offset)
+        all_normalized_lines.append(normalized_line)
+        offset += len(normalized_line)
+    return "".join(all_normalized_lines), all_line_starts
+
+
+def _matching_window_starts(
+    normalized_text: str, length: int, all_wanted_digests: set[str]
+) -> list[int]:
+    return [
+        each_start
+        for each_start in range(len(normalized_text) - length + 1)
+        if hashlib.sha256(
+            normalized_text[each_start : each_start + length].encode(
+                PRIVATE_TERM_TEXT_ENCODING
+            )
+        ).hexdigest()
+        in all_wanted_digests
+    ]
+
+
+def private_term_line_numbers(
+    text: str,
+    all_term_digests: Collection[PrivateTermDigest] = ALL_PRIVATE_TERM_DIGESTS,
+) -> tuple[int, ...]:
+    """Return the sorted one-based line numbers where a private name starts.
+
+    Args:
+        text: Text to scan.
+        all_term_digests: Digests of the normalized names to find.
+
+    Returns:
+        Each line number once. A name that wraps onto the next line reports
+        the line where it starts.
+    """
+    normalized_text, all_line_starts = _normalized_text_and_line_starts(text)
+    all_found_line_numbers: set[int] = set()
+    for each_length in {each_digest.length for each_digest in all_term_digests}:
+        all_wanted_digests = {
+            each_digest.sha256
+            for each_digest in all_term_digests
+            if each_digest.length == each_length
+        }
+        all_found_line_numbers.update(
+            bisect.bisect_right(all_line_starts, each_start)
+            for each_start in _matching_window_starts(
+                normalized_text, each_length, all_wanted_digests
+            )
+        )
+    return tuple(sorted(all_found_line_numbers))
+
+
+def names_private_term(
+    text: str,
+    all_term_digests: Collection[PrivateTermDigest] = ALL_PRIVATE_TERM_DIGESTS,
+) -> bool:
+    """Return whether the text names any private organization."""
+    return bool(private_term_line_numbers(text, all_term_digests))

package/scripts/repository_checks/config/constants.py

@@ -12,6 +12,7 @@ CHECK_ID_ENV_VAR_DOCUMENTATION = "env-var-documentation"
 CHECK_ID_PACKAGE_INVENTORY = "package-inventory"
 CHECK_ID_PYTEST_TESTPATHS = "pytest-testpaths"
 CHECK_ID_TRACKED_PERSONAL_DATA = "tracked-secrets"
+CHECK_ID_TRACKED_PRIVATE_TERMS = "tracked-private-terms"
 
 ALL_CHECK_IDS = (
     CHECK_ID_CLAUDE_MD_ORPHANS,
@@ -19,6 +20,7 @@ ALL_CHECK_IDS = (
     CHECK_ID_PACKAGE_INVENTORY,
     CHECK_ID_PYTEST_TESTPATHS,
     CHECK_ID_TRACKED_PERSONAL_DATA,
+    CHECK_ID_TRACKED_PRIVATE_TERMS,
 )
 
 SEVERITY_BREAKING = "breaking"
@@ -29,6 +31,7 @@ SEVERITY_BY_CHECK_ID: dict[str, str] = {
     CHECK_ID_PACKAGE_INVENTORY: SEVERITY_SMELL,
     CHECK_ID_PYTEST_TESTPATHS: SEVERITY_BREAKING,
     CHECK_ID_TRACKED_PERSONAL_DATA: SEVERITY_BREAKING,
+    CHECK_ID_TRACKED_PRIVATE_TERMS: SEVERITY_BREAKING,
 }
 
 SUCCESS_EXIT_CODE = 0

package/scripts/repository_checks/runner.py

@@ -14,6 +14,9 @@ from repository_checks.env_var_documentation import (
 from repository_checks.models import RepositoryCheckReport, RepositoryFinding
 from repository_checks.package_inventory import collect_package_inventory_findings
 from repository_checks.pytest_testpaths import collect_pytest_testpath_findings
+from repository_checks.tracked_private_terms import (
+    collect_tracked_private_term_findings,
+)
 from repository_checks.tracked_secrets import collect_tracked_secret_findings
 
 RepositoryCollector = Callable[[Path, Sequence[str]], list[RepositoryFinding]]
@@ -90,4 +93,8 @@ def _all_collectors() -> tuple[tuple[str, RepositoryCollector], ...]:
             repository_constants.CHECK_ID_TRACKED_PERSONAL_DATA,
             collect_tracked_secret_findings,
         ),
+        (
+            repository_constants.CHECK_ID_TRACKED_PRIVATE_TERMS,
+            collect_tracked_private_term_findings,
+        ),
     )

package/scripts/repository_checks/tracked_private_terms.py

@@ -0,0 +1,57 @@
+"""Tracked-file check for private organization names."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from pathlib import Path
+
+from dev_env_scripts_constants.private_term_constants import (
+    ALL_PRIVATE_TERM_DIGESTS,
+    PRIVATE_TERM_MESSAGE_TEMPLATE,
+)
+from policy_lint.config import constants as policy_constants
+from private_terms import private_term_line_numbers
+
+from repository_checks.config import constants as repository_constants
+from repository_checks.models import RepositoryFinding
+
+
+def _read_text_or_none(absolute_path: Path) -> str | None:
+    if not absolute_path.is_file():
+        return None
+    try:
+        return absolute_path.read_text(encoding=policy_constants.UTF8_ENCODING)
+    except UnicodeDecodeError:
+        return None
+
+
+def collect_tracked_private_term_findings(
+    repository_root: Path, all_tracked_paths: Sequence[str]
+) -> list[RepositoryFinding]:
+    """Return one finding for each tracked line that names a private organization.
+
+    Args:
+        repository_root: Git repository root.
+        all_tracked_paths: Repository-relative tracked paths.
+
+    Returns:
+        Findings that carry the path and line number, never the name.
+    """
+    all_findings: list[RepositoryFinding] = []
+    for each_relative_path in all_tracked_paths:
+        if (content := _read_text_or_none(repository_root / each_relative_path)) is None:
+            continue
+        posix_relative_path = each_relative_path.replace(
+            repository_constants.WINDOWS_PATH_SEPARATOR, policy_constants.PATH_SEPARATOR
+        )
+        all_findings.extend(
+            RepositoryFinding(
+                repository_constants.CHECK_ID_TRACKED_PRIVATE_TERMS,
+                posix_relative_path,
+                PRIVATE_TERM_MESSAGE_TEMPLATE.format(line_number=each_line_number),
+            )
+            for each_line_number in private_term_line_numbers(
+                content, ALL_PRIVATE_TERM_DIGESTS
+            )
+        )
+    return all_findings