pre-commit-bigfix 2.0.1__py3-none-any.whl

pre_commit_bigfix/bes_actionscript_validate_prefetch.py

@@ -0,0 +1,1258 @@
+#!/usr/bin/env python3
+"""Pre-commit hook: validate BigFix prefetch lines in ActionScript.
+
+Finds every prefetch line in every <ActionScript> body of a BES file (and, for
+non-.bes/.ojo paths, in the whole file read as one raw ActionScript body) and
+hands it to `validate_prefetch()` from the
+[bigfix_prefetch](https://pypi.org/project/bigfix-prefetch/) package, which is
+the reference implementation of what a valid prefetch is. Both spellings are
+covered:
+
+    prefetch <name> sha1:<40> size:<n> <url> sha256:<64>
+    add prefetch item name=<name> sha1=<40> size=<n> url=<url> sha256=<64>
+
+SCOPE: this hook only answers "is this prefetch line internally valid" --
+size present and > 0, hash lengths right, sha256 present, sha1 present when the
+line is a prefetch statement without a sha256. It is deliberately offline:
+nothing here downloads the URL or checks that the hashes match the real file.
+The line's overall shape and its http-vs-https scheme are W206/W207 in
+bes-conventions-check, and its lexical validity is E300 in
+bes-actionscript-lint-schclass -- three altitudes on the same line, all
+intentional.
+
+Checks:
+    E400  a prefetch line is invalid; the reason is the message
+          `validate_prefetch()` reported (bad size, wrong hash length, an
+          unparsable line, ...)
+    E401  a prefetch line has no sha256. Upstream treats sha256 as optional
+          unless asked; this hook treats it as mandatory, because in 2026 it
+          is what enhanced security requires. It is its own code so a repo
+          that still wants it optional can `--disable E401`.
+    E402  a prefetch downloads the retired unzip-5.52.exe from the BigFix
+          redist folder; unzip-6.0.exe is the current one. Auto-fixable.
+    E403  a prefetch line holds text its syntax does not define: a statement
+          allows only `prefetch <name>`, the `sha1:`/`sha256:`/`size:` fields
+          and the URL; a block item only `name=`/`sha1=`/`sha256=`/`size=`/
+          `url=`. The reference parser silently ignores the rest, so e.g. a
+          template's `vs_SSMS.exe; filename*=UTF-8''vs_SSMS.exe` validates
+          while the file is saved as `vs_SSMS.exe;`. Two shapes are
+          auto-fixable offline, having one meaning each: `sha2:`/`sha2=` in
+          front of a 64-hex value becomes `sha256`, and tokens directly
+          after the URL (an unencoded space in it) are joined with `%20`;
+          stray text anywhere else is left for a human
+    E404  an auto-fix pass (E403, E402, E401 or W407) was not written,
+          because it would make a schema-valid file fail BES.xsd validation;
+          the other passes are still written (--disable E404 writes it
+          anyway)
+    W400  the file is not parseable BES XML; skipped (advisory --
+          bes-schema-validate is the authority on file validity)
+    W402  a prefetch block item has no sha1; technically valid, but unusual
+    W403  an `add nohash prefetch item` line: hashless by definition, so it is
+          reported rather than validated -- the download cannot be verified
+    W404  --auto-fix-network was asked to add a sha256 and could not: the URL
+          would not download, or what came back did not match the size and
+          sha1 already on the line. The E401 stands; this says why the fix did
+          not land.
+    W405  a prefetch statement has no sha1. Current BigFix clients accept a
+          statement with sha256 alone, so this is valid but unusual --
+          previously this hook (following upstream) treated it as mandatory
+          and failed the line as E400 with a misleading "could not be parsed"
+          message; it is now its own advisory code, same footing as W402's
+          block-item case.
+    W406  a prefetch's declared name and its URL's file end in different
+          extensions (`<sha1>.msi` fetched from `ccsetup531.exe`). The
+          extension decides how the file is run or unpacked, so a mismatch
+          is usually a copy-paste slip. An extension is a trailing `.` + 1-4
+          characters with a letter in them; a name or URL without one, and
+          a server-side script URL (`download.php`), are not compared
+    W407  --auto-fix-network tried to switch an http prefetch URL to https
+          (W207 in bes-conventions-check) and did not: the https URL was
+          unreachable, redirected off https, reported a Content-Length other
+          than the line's size (so nothing was downloaded), or served a file
+          whose size/sha1/sha256 differ. The line stays on http.
+
+E-codes are real issues and fail the hook. W-codes are advisory and do NOT
+fail the hook unless --strict is given.
+
+AUTO-FIXES. They sit behind two separate flags, because some touch the
+network:
+
+--auto-fix (E402, E403), on by default. An E403 `sha2:` for `sha256:`, or a
+space in the URL, is rewritten as described under E403 above. The retired unzip-5.52.exe prefetch is
+rewritten in place to the current unzip-6.0.exe one, in whichever spelling the
+line already used -- the replacement is built by `prefetch_from_dictionary()`
+from bigfix_prefetch, so its shape is the reference implementation's, not this
+hook's idea of it. Purely offline: the current file's size and hashes are
+constants here. The original download's *name* is kept (the rest of the
+ActionScript refers to the file by that name, so renaming it here would break
+the script); everything else -- url, size, sha1, sha256 -- becomes the current
+file's.
+
+--auto-fix-network (E401), OFF by default. A prefetch with no sha256 gets one,
+which means downloading the file to hash it: there is no other way to learn a
+sha256. The download is handed to `add_sha256_prefetch()` from bigfix_prefetch,
+which streams the file, checks it against the size and sha1 already on the
+line, and re-emits the prefetch with sha256 added; a download that does not
+match, or does not happen, is W404 and the line is left alone. Because this
+reaches out to whatever URLs the content names, it is opt-in, never the
+default, and each URL is fetched at most once per run.
+
+The same flag also switches an `http://` prefetch URL to `https://` (the fix
+for bes-conventions-check's W207), but only once the https copy is proven to
+be the same file: a HEAD request must report a Content-Length equal to the
+line's size -- checked BEFORE anything is downloaded, so a mismatch costs no
+download -- and must not redirect off https; then the file is downloaded
+(capped one byte past that size) and its size and every hash on the line
+(sha1 and/or sha256) must match. Only the URL's scheme changes. Anything else
+is W407 and the line stays on http. A line with no literal size, no hash, a
+`{...}` in it, or `add nohash prefetch item` is not attempted. `--disable
+W407` turns this part off.
+
+An auto-fixed file fails the hook so the change is reviewed and re-staged.
+Nothing else is fixable: E400's right size and hashes are properties of the
+real file, and a hook has no way to know which file was meant.
+
+Lines whose values are not knowable until the agent runs are skipped: a line
+containing a `{...}` relevance substitution (a dynamic prefetch) has no fixed
+size or hash to check, and `//` comment lines are not commands. The raw
+content of a `createfile until <MARKER>` block is file text, not ActionScript,
+so a prefetch-looking line inside one is skipped too.
+
+Only <ActionScript> elements with MIMEType application/x-Fixlet-Windows-Shell
+(or no MIMEType, which defaults to it) are BigFix ActionScript; other bodies
+are other languages and are skipped silently. Bodies are extracted with lxml,
+so entities are decoded and adjacent CDATA sections merged, with lxml's
+sourceline mapping issues back to file line numbers.
+
+Usage:
+    bes_actionscript_validate_prefetch.py [--strict] [--disable E401]
+                                          [--auto-fix=yes|no]
+                                          [--auto-fix-network=yes|no]
+                                          [file ...]
+
+With no file arguments, all *.bes files in the current folder and below are
+checked.
+
+A file whose prefetches knowingly do not meet these rules opts out of every
+check here with `prefetch-ok` anywhere in it, e.g.
+
+    <!-- prefetch-ok -->
+
+which is the same marker that opts out of the prefetch-shape warning (W206) in
+bes-conventions-check: one judgement, one marker. The longer
+
+    <!-- pre-commit-skip: bes-actionscript-validate-prefetch -->
+
+also skips the file, and matches the other hooks' spelling. To turn a check
+off across a whole repo instead of file by file, disable its code in the hook
+args -- `--disable E401` is the way back to sha256-optional.
+
+Files that look like mustache templates (containing `{{ ... }}`) are skipped
+silently: they are not real content until rendered.
+
+Exit codes:
+    0  no E-code issues and nothing auto-fixed (and, without --strict,
+       regardless of warnings)
+    1  an E-code issue was found, a file was auto-fixed, or a warning was found
+       while --strict is set
+"""
+
+import argparse
+import contextlib
+import hashlib
+import io
+import os
+import re
+import socket
+import sys
+import urllib.request
+import warnings
+from urllib.parse import urlsplit
+
+from bigfix_prefetch.prefetch import add_sha256_prefetch
+from bigfix_prefetch.prefetch_from_dictionary import prefetch_from_dictionary
+from bigfix_prefetch.prefetch_parse import parse_prefetch
+from bigfix_prefetch.prefetch_validate import validate_prefetch
+from lxml import etree
+
+if __package__ in (None, ""):  # run directly as a script, not as a module
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+# `_mask_heredocs` is shared with the sibling ActionScript hook on purpose:
+# both need to know that the lines inside a `createfile until` block are file
+# content rather than commands, and one implementation of that rule is enough.
+from pre_commit_bigfix import bes_common
+from pre_commit_bigfix.bes_actionscript_lint_schclass import _mask_heredocs
+from pre_commit_bigfix.bes_common import MUSTACHE_RE, encode, read_source
+
+SKIP_MARKER = "pre-commit-skip: bes-actionscript-validate-prefetch"
+
+# The one opt-out marker (matched anywhere in the file text): a file whose
+# prefetches are knowingly not up to standard opts out of the whole hook, not
+# one code at a time. A repo that wants a check off everywhere disables the
+# code instead, with --disable. NOTE: this is the same marker that opts out of
+# W206 in bes-conventions-check, so a file carrying it opts out of both -- the
+# two are the same judgement ("these prefetch lines are intentional"), and one
+# marker is what was asked for.
+PREFETCH_MARKER = "prefetch-ok"
+
+KNOWN_CODES = frozenset(
+    [
+        "E400",
+        "E401",
+        "E402",
+        "E403",
+        "E404",
+        "W400",
+        "W402",
+        "W403",
+        "W404",
+        "W405",
+        "W406",
+        "W407",
+    ]
+)
+
+# W406: a trailing `.` + 1-4 characters, at least one a letter, is taken as a
+# file extension -- `.7z` and `.gz` are, a version like `/1.2` is not
+EXTENSION_RE = re.compile(r"\.((?=[0-9]*[A-Za-z])[A-Za-z0-9]{1,4})$")
+# server-side script endpoints: the URL's extension says nothing about the
+# file served (`download.php?id=...`)
+SCRIPT_EXTENSIONS = frozenset(
+    ["php", "asp", "aspx", "ashx", "cgi", "jsp", "pl", "py", "do", "cfm"]
+)
+# spellings of the same file type
+EXTENSION_ALIASES = {
+    "tgz": "gz",
+    "jpeg": "jpg",
+    "tiff": "tif",
+    "htm": "html",
+    "yaml": "yml",
+}
+
+# Seconds any one --auto-fix-network download may stall for. bigfix_prefetch
+# calls urlopen() without a timeout, which can hang a commit indefinitely, so
+# the socket default is set around the call and put back afterwards.
+NETWORK_TIMEOUT = 60
+
+# The retired redist download (E402). Matched on either scheme: what is out of
+# date is the file, not the URL's scheme (the http-vs-https judgement is W207
+# in bes-conventions-check), and BigFix content has shipped it both ways.
+OUTDATED_UNZIP_RE = re.compile(
+    r"https?://software\.bigfix\.com/download/redist/unzip-5\.52\.exe",
+    re.IGNORECASE,
+)
+
+# The current unzip in the same folder, and the E402 auto-fix's replacement
+# values. `file_name` is only the fallback: the fix keeps whatever name the
+# original prefetch used, since the rest of the ActionScript refers to the
+# downloaded file by that name.
+CURRENT_UNZIP = {
+    "file_name": "unzip.exe",
+    "file_sha1": "84debf12767785cd9b43811022407de7413beb6f",
+    "file_size": "204800",
+    "download_url": "http://software.bigfix.com/download/redist/unzip-6.0.exe",
+    "file_sha256": ("2122557d350fd1c59fb0ef32125330bde673e9331eb9371b454c2ad2d82091ac"),
+}
+
+BES_EXTENSIONS = (".bes", ".ojo")
+
+# the one MIMEType that IS BigFix ActionScript; a missing MIMEType defaults to
+# it, every other value is some other language and holds no prefetch lines.
+ACTIONSCRIPT_MIMETYPE = "application/x-Fixlet-Windows-Shell"
+
+# `add nohash prefetch item` is the documented hashless form; it is matched
+# before the hashed form so it is reported (W403), not validated.
+NOHASH_PREFETCH = "add nohash prefetch item"
+BLOCK_PREFETCH = "add prefetch item"
+STATEMENT_PREFETCH = "prefetch "
+
+
+def find_prefetch_lines(body):
+    """Yield (lineno, line, is_nohash) for each prefetch line in `body`.
+
+    Line numbers are local to the body, 1-based. Comment lines, lines holding
+    a `{...}` relevance substitution, and the raw content of a
+    `createfile until` block are not yielded -- see the module docstring.
+    """
+    body = body.replace("\r\n", "\n").replace("\r", "\n")
+    masked, _issues = _mask_heredocs(body.split("\n"))
+    for lineno, line in enumerate(masked, start=1):
+        stripped = line.strip()
+        lowered = stripped.lower()
+        if not stripped or lowered.startswith("//"):
+            continue
+        is_nohash = lowered.startswith(NOHASH_PREFETCH)
+        if not is_nohash and not lowered.startswith(
+            (BLOCK_PREFETCH, STATEMENT_PREFETCH)
+        ):
+            continue
+        if "{" in stripped:
+            continue  # a dynamic prefetch: no fixed size or hash to check
+        yield lineno, stripped, is_nohash
+
+
+def is_outdated_unzip(line):
+    """Say whether `line` downloads the retired redist unzip-5.52.exe."""
+    return bool(OUTDATED_UNZIP_RE.search(line))
+
+
+def current_unzip_prefetch(line):
+    """Return the current unzip prefetch, spelled the way `line` is spelled.
+
+    The replacement string itself comes from `prefetch_from_dictionary()` in
+    bigfix_prefetch, so a block item gets the block spelling (`name=`/`sha1=`)
+    and a statement gets the statement one (`sha1:`/`size:`) exactly as the
+    reference implementation writes them. The original download's name is
+    carried over -- the surrounding ActionScript refers to the file by name, so
+    renaming it here would break the script -- and the fallback if the line is
+    too broken to parse a name out of is the canonical `unzip.exe`.
+    """
+    lowered = line.strip().lower()
+    prefetch_type = "block" if lowered.startswith(BLOCK_PREFETCH) else "statement"
+    values = dict(CURRENT_UNZIP)
+    with warnings.catch_warnings():
+        # parse_prefetch warns about the very things E400/E401/W402 report;
+        # they are reported from validate_prefetch_line(), not from here.
+        warnings.simplefilter("ignore")
+        try:
+            parsed = parse_prefetch(line)
+        except (AttributeError, TypeError, ValueError):
+            parsed = {}
+    if parsed.get("file_name"):
+        values["file_name"] = parsed["file_name"]
+    return prefetch_from_dictionary(values, prefetch_type)
+
+
+def has_sha256(line):
+    """Say whether `line` already carries a sha256 (of any length: E400 owns that)."""
+    return "sha256" in line.lower()
+
+
+# Fed to validate_prefetch() only, to check the rest of a sha1-less statement
+# through the reference implementation; never parsed for its value and never
+# written to a file. See statement_missing_sha1()/_with_placeholder_sha1().
+PLACEHOLDER_SHA1 = "0" * 40
+
+
+def statement_missing_sha1(line):
+    """Say whether `line` is a prefetch *statement* with no sha1.
+
+    A prefetch block item with no sha1 is W402's business (upstream parses it
+    fine, sha1 just being optional there); a statement is different -- upstream
+    `parse_prefetch()` has no `try` around its `sha1:` regex for a statement,
+    so a sha1-less one raises `AttributeError` instead of reporting anything
+    useful. This is the pre-check that catches that case before it reaches
+    `validate_prefetch()`.
+    """
+    lowered = line.strip().lower()
+    return lowered.startswith(STATEMENT_PREFETCH) and " sha1:" not in lowered
+
+
+def _with_placeholder_sha1(line):
+    """Return `line` with a placeholder sha1 spliced in after the size field.
+
+    Lets a sha1-less statement be checked for every *other* defect (bad size,
+    wrong sha256 length, ...) through the real `validate_prefetch()` rather
+    than re-implementing its statement regexes here. The placeholder is never
+    parsed for its value, never reported in a message (messages are trimmed
+    to their first line by `_first_line()`, which drops the raw prefetch
+    upstream appends), and never written back to the file.
+    """
+    return re.sub(r" size:", f" sha1:{PLACEHOLDER_SHA1} size:", line, count=1)
+
+
+def sha256_added_prefetch(line):
+    """Download the prefetch's file and return the same line with sha256 added.
+
+    A thin wrapper over `add_sha256_prefetch()` from bigfix_prefetch (the
+    upstream examples/add_sha256_prefetch_string.py is exactly this call): it
+    streams the download, checks it against the size and sha1 the line already
+    claims, and re-emits the prefetch -- in the same spelling -- with sha256
+    added. Anything that goes wrong (no network, a 404, a download that does
+    not match the line) raises; the caller turns that into W404.
+
+    Three things are handled here that upstream does not:
+      * a socket timeout, so a hanging URL cannot hang a commit;
+      * upstream's progress printing and warnings, which are swallowed so they
+        cannot land in the middle of this hook's own output;
+      * the download's *name*, which upstream takes from the URL's basename --
+        the name the line already used is put back, since the rest of the
+        ActionScript refers to the downloaded file by that name.
+    """
+    old_timeout = socket.getdefaulttimeout()
+    with warnings.catch_warnings(), contextlib.redirect_stdout(io.StringIO()):
+        warnings.simplefilter("ignore")  # upstream warns about what E401 reports
+        socket.setdefaulttimeout(NETWORK_TIMEOUT)
+        try:
+            updated = add_sha256_prefetch(line)
+        finally:
+            socket.setdefaulttimeout(old_timeout)
+        if not updated or not has_sha256(updated):
+            raise ValueError("the regenerated prefetch still has no sha256")
+        parsed_old = parse_prefetch(line)
+        parsed_new = parse_prefetch(updated)
+
+    parsed_new["prefetch_type"] = parsed_old.get("prefetch_type", "statement")
+    if parsed_old.get("file_name"):
+        parsed_new["file_name"] = parsed_old["file_name"]
+    return prefetch_from_dictionary(parsed_new)
+
+
+def _first_line(message):
+    """Return a warning message as one line (validate_prefetch appends the raw)."""
+    return str(message).strip().splitlines()[0].strip()
+
+
+def _is_missing(message, hash_name):
+    """Say whether `message` is the "<hash_name> is missing" reason."""
+    lowered = message.lower()
+    return hash_name in lowered and "missing" in lowered
+
+
+def validate_prefetch_line(line):
+    """Validate one prefetch line; return [(code, message)].
+
+    Wraps `validate_prefetch()` from bigfix_prefetch: its verdict is the
+    return value and its reasons are `warnings`, so the warnings are captured
+    and turned into this hook's codes. A missing sha256 is pulled out of the
+    verdict into its own E401 -- upstream treats it as optional-unless-asked,
+    this hook treats it as mandatory, and giving it a code of its own is what
+    lets `--disable E401` put it back to optional for a repo that wants that.
+
+    A sha1-less prefetch *statement* is a separate pre-check (W405): upstream
+    cannot even parse such a line (see `statement_missing_sha1()`), so it is
+    validated with a placeholder sha1 spliced in instead, to catch every
+    *other* defect through the real `validate_prefetch()` rather than one
+    reimplemented here.
+    """
+    is_sha1_less_statement = statement_missing_sha1(line)
+    line_to_validate = _with_placeholder_sha1(line) if is_sha1_less_statement else line
+    with warnings.catch_warnings(record=True) as caught:
+        warnings.simplefilter("always")  # the same reason may repeat per line
+        try:
+            valid = validate_prefetch(line_to_validate)
+        except (AttributeError, TypeError, ValueError) as err:
+            # validate_prefetch handles the unparsable-line case itself (its
+            # regexes returning None); this is the belt-and-braces path for a
+            # shape it does not, so one odd line cannot abort a whole run.
+            return [("E400", f"prefetch line could not be validated ({err})")]
+    messages = [_first_line(entry.message) for entry in caught]
+
+    issues = []
+    # a missing sha1 escalates sha256 to mandatory upstream, so the "sha256 is
+    # missing" reason can arrive as either a warning or the failure reason.
+    if any(_is_missing(message, "sha256") for message in messages):
+        issues.append(
+            (
+                "E401",
+                (
+                    "prefetch has no sha256; it is technically optional, but "
+                    "treated as mandatory here -- add one, or "
+                    f"`{PREFETCH_MARKER}` if intentional"
+                ),
+            )
+        )
+    if is_sha1_less_statement:
+        issues.append(
+            (
+                "W405",
+                (
+                    "prefetch statement has no sha1; sha256 alone is accepted "
+                    "by current BigFix clients, so this is valid but unusual "
+                    f"-- add one, or `{PREFETCH_MARKER}` if intentional"
+                ),
+            )
+        )
+    elif any(_is_missing(message, "sha1") for message in messages):
+        issues.append(
+            (
+                "W402",
+                (
+                    "prefetch has no sha1, which is unusual though valid in a "
+                    f"prefetch block; add `{PREFETCH_MARKER}` if intentional"
+                ),
+            )
+        )
+
+    if not valid:
+        reasons = [m for m in messages if m.lower().startswith("error")] or messages
+        # the missing sha256 is already reported as E401 above; anything left
+        # is a separate defect and is what E400 is for.
+        reasons = [m for m in reasons if not _is_missing(m, "sha256")]
+        if reasons:
+            reported = "; ".join(dict.fromkeys(reasons))
+            issues.append(
+                (
+                    "E400",
+                    (
+                        f"invalid prefetch: {reported}; add `{PREFETCH_MARKER}` "
+                        "if intentional"
+                    ),
+                )
+            )
+        elif not issues:  # failed for a reason nothing reported; do not swallow it
+            issues.append(
+                (
+                    "E400",
+                    (
+                        "invalid prefetch: reason not reported; add "
+                        f"`{PREFETCH_MARKER}` if intentional"
+                    ),
+                )
+            )
+    return issues
+
+
+# E403: what a prefetch statement's fields after the name may be, and the
+# keys an `add prefetch item` may carry
+STATEMENT_FIELD_RE = re.compile(r"^(?:sha1|sha256|size):\S+$|://", re.IGNORECASE)
+ITEM_FIELD_RE = re.compile(r"^(?:name|sha1|sha256|size|url)=", re.IGNORECASE)
+# a trailing `// comment` after whitespace ends the line's syntax
+TRAILING_COMMENT_RE = re.compile(r"\s//.*$")
+ITEM_PREFIX_RE = re.compile(r"^\s*add\s+(?:nohash\s+)?prefetch\s+item\b", re.IGNORECASE)
+
+
+def stray_prefetch_tokens(line):
+    """E403: return the tokens of a prefetch line its syntax does not define.
+
+    A statement is `prefetch <name>` followed only by `sha1:`, `sha256:`,
+    `size:` fields and the URL; a block item only by `name=`, `sha1=`,
+    `sha256=`, `size=`, `url=`. The reference parser keeps what it
+    recognizes and silently ignores anything else -- so a template that
+    pastes extra text into the line (`vs_SSMS.exe; filename*=UTF-8''...`)
+    validates, and the file is saved under a name nothing else uses.
+    """
+    line = TRAILING_COMMENT_RE.sub("", line)  # a spaced `// comment` is valid
+    item = ITEM_PREFIX_RE.match(line)
+    if item:
+        return [
+            tok for tok in line[item.end() :].split() if not ITEM_FIELD_RE.match(tok)
+        ]
+    tokens = line.split()[2:]  # past `prefetch <name>`
+    return [tok for tok in tokens if not STATEMENT_FIELD_RE.search(tok)]
+
+
+# E403 fix: `sha2` written for `sha256`, carrying a real sha256 value
+FIELD_LIKE_RE = re.compile(r"^\w+[:=]")
+SHA2_TYPO_RE = re.compile(r"(?<!\S)sha2([:=])([0-9A-Fa-f]{64})(?!\S)", re.IGNORECASE)
+
+
+def _is_field(token, item):
+    """Say whether `token` is a field the prefetch syntax defines."""
+    if item:
+        return bool(ITEM_FIELD_RE.match(token))
+    return bool(STATEMENT_FIELD_RE.search(token))
+
+
+def stray_tokens_fixed(line):
+    """E403: return `line` with its certain stray-text fixes applied, or None.
+
+    Two E403 shapes have exactly one meaning, and only these are rewritten:
+    `sha2:`/`sha2=` in front of a 64-hex value (a truncated `sha256`), and
+    tokens directly after the URL, before the next field -- an unencoded
+    space in the URL, joined back with `%20`. Stray text anywhere else (next
+    to the name, say) is left for a human, and a trailing `// comment` is
+    kept as it is.
+    """
+    comment = TRAILING_COMMENT_RE.search(line)
+    core, tail = (
+        (line[: comment.start()], line[comment.start() :]) if comment else (line, "")
+    )
+    item = bool(ITEM_PREFIX_RE.match(core))
+    separator = "=" if item else ":"
+    core = SHA2_TYPO_RE.sub(
+        lambda m: (
+            f"sha256{separator}{m.group(2)}" if m.group(1) == separator else m.group(0)
+        ),
+        core,
+    )
+
+    tokens = list(re.finditer(r"\S+", core))
+    # past `add [nohash] prefetch item` / `prefetch <name>`
+    first_field = len(ITEM_PREFIX_RE.match(core).group(0).split()) if item else 2
+    url_index = next(
+        (
+            index
+            for index in range(first_field, len(tokens))
+            if (
+                tokens[index].group(0).lower().startswith("url=")
+                if item
+                else "://" in tokens[index].group(0)
+            )
+        ),
+        None,
+    )
+    if url_index is not None:
+        last = url_index
+        while last + 1 < len(tokens):
+            token = tokens[last + 1].group(0)
+            # a `key:value` / `key=value` token is a mistyped field, not URL text
+            if _is_field(token, item) or FIELD_LIKE_RE.match(token):
+                break
+            last += 1
+        if last > url_index:
+            start, end = tokens[url_index].start(), tokens[last].end()
+            span = core[start:end]
+            if "\t" not in span:
+                core = core[:start] + span.replace(" ", "%20") + core[end:]
+
+    new_line = core + tail
+    return new_line if new_line != line else None
+
+
+def find_stray_fix_targets(raw, src, is_bes):
+    """Return [(file_lineno, line, new_line)] for the E403 lines to rewrite.
+
+    `add nohash prefetch item` lines are included: joining a URL or fixing a
+    field name does not change what a hashless line does.
+    """
+    if is_bes:
+        try:
+            bodies = list(_iter_actionscript_bodies(raw))
+        except etree.XMLSyntaxError:
+            return []
+    else:
+        bodies = [(1, src)]
+    targets = []
+    for sourceline, body in bodies:
+        for lineno, line, _is_nohash in find_prefetch_lines(body):
+            if stray_prefetch_tokens(line):
+                new_line = stray_tokens_fixed(line)
+                if new_line is not None:
+                    targets.append((sourceline + lineno - 1, line, new_line))
+    return targets
+
+
+def fix_stray_tokens(src, targets):
+    """Apply `find_stray_fix_targets`' rewrites in place; return (src, fixed)."""
+    lines = src.split("\n")
+    fixed = []
+    for lineno, text, new_text in targets:
+        if _replace_on_line(lines, lineno, text, new_text):
+            fixed.append(
+                (
+                    lineno,
+                    "E403",
+                    (
+                        "rewrote stray prefetch text (`sha2` -> `sha256`, or a "
+                        "space in the URL -> `%20`)"
+                    ),
+                )
+            )
+    return "\n".join(lines), fixed
+
+
+# W207 network fix: the https copy of an http prefetch is checked before the
+# URL is switched. Content-Length first, so nothing is downloaded unless the
+# size already matches; then the download is capped at that size (plus one
+# byte, to notice a longer file) and hashed.
+DOWNLOAD_CHUNK = 65536
+
+
+def https_head(url):
+    """Return (final_url, content_length_or_None) for a HEAD of `url`.
+
+    Redirects are followed (urllib's default); the caller checks the final
+    URL is still https.
+    """
+    request = urllib.request.Request(url, method="HEAD")
+    with urllib.request.urlopen(request, timeout=NETWORK_TIMEOUT) as response:
+        length = response.headers.get("Content-Length", "")
+        return response.geturl(), (int(length) if length.strip().isdigit() else None)
+
+
+def https_hashes(url, limit):
+    """Download `url` and return (size, sha1, sha256) of at most `limit`+1 bytes.
+
+    Reading stops one byte past `limit`, so a file larger than the prefetch
+    says is noticed (its size is wrong) without being streamed to the end.
+    """
+    sha1, sha256, size = hashlib.sha1(), hashlib.sha256(), 0
+    with urllib.request.urlopen(url, timeout=NETWORK_TIMEOUT) as response:
+        if urlsplit(response.geturl()).scheme.lower() != "https":
+            raise ValueError(f"redirected to a non-https URL ({response.geturl()})")
+        while size <= limit:
+            chunk = response.read(min(DOWNLOAD_CHUNK, limit + 1 - size))
+            if not chunk:
+                break
+            size += len(chunk)
+            sha1.update(chunk)
+            sha256.update(chunk)
+    return size, sha1.hexdigest(), sha256.hexdigest()
+
+
+def http_prefetch_facts(line):
+    """Return (url, size, sha1, sha256) for an http prefetch W207 could fix.
+
+    None when the line is not a candidate: not http, no literal size, or no
+    hash at all to verify an https copy against.
+    """
+    sha1_less = statement_missing_sha1(line)
+    to_parse = _with_placeholder_sha1(line) if sha1_less else line
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore")
+        try:
+            parsed = parse_prefetch(to_parse)
+        except (AttributeError, TypeError, ValueError, KeyError):
+            return None
+    url = parsed.get("download_url") or ""
+    size = str(parsed.get("file_size") or "")
+    sha1 = None if sha1_less else parsed.get("file_sha1")
+    sha256 = parsed.get("file_sha256")
+    if not url.lower().startswith("http://") or url not in line:
+        return None
+    if not size.isdigit() or not (sha1 or sha256):
+        return None
+    return url, int(size), sha1, sha256
+
+
+def verified_https_url(url, size, sha1, sha256):
+    """Return the https URL for `url` once its copy is proven identical.
+
+    Raises ValueError (or a network error) saying why when it is not: a
+    Content-Length that does not equal `size` -- checked before anything is
+    downloaded -- a redirect off https, or a size/sha1/sha256 mismatch.
+    """
+    https_url = "https://" + url[len("http://") :]
+    final, length = https_head(https_url)
+    if urlsplit(final).scheme.lower() != "https":
+        raise ValueError(f"the https URL redirects to a non-https one ({final})")
+    if length != size:
+        raise ValueError(
+            f"the https copy's Content-Length ({length}) is not the prefetch's "
+            f"size ({size}); nothing was downloaded"
+        )
+    got_size, got_sha1, got_sha256 = https_hashes(https_url, size)
+    if got_size != size:
+        raise ValueError(f"the https copy is {got_size} bytes, not {size}")
+    if sha1 and got_sha1 != sha1.lower():
+        raise ValueError("the https copy's sha1 does not match the prefetch's")
+    if sha256 and got_sha256 != sha256.lower():
+        raise ValueError("the https copy's sha256 does not match the prefetch's")
+    return https_url
+
+
+def find_https_fix_targets(raw, src, is_bes):
+    """Return [(file_lineno, line, facts)] for the http prefetches W207 may fix."""
+    targets = []
+    for lineno, line in iter_prefetch_targets(raw, src, is_bes):
+        facts = http_prefetch_facts(line)
+        if facts:
+            targets.append((lineno, line, facts))
+    return targets
+
+
+def fix_http_urls(src, targets, cache=None):
+    """Switch each target's http URL to https once it is verified.
+
+    Returns (src, fixed, failed). `failed` is a list of W407s -- the line stayed http. `cache` maps a
+    prefetch's (url, size, sha1, sha256) to its verified https URL, or to the
+    reason it failed, so each URL is checked at most once per run.
+    """
+    if cache is None:
+        cache = {}
+    lines = src.split("\n")
+    fixed = []
+    failed = []
+    for lineno, text, facts in targets:
+        key = ("https",) + facts
+        if key not in cache:
+            try:
+                cache[key] = (verified_https_url(*facts), None)
+            except Exception as err:  # noqa: BLE001 -- same reasoning as E401's
+                cache[key] = (None, f"{type(err).__name__}: {err}")
+        https_url, reason = cache[key]
+        if https_url is None:
+            failed.append(
+                (
+                    lineno,
+                    "W407",
+                    (
+                        f"could not switch the prefetch URL to https ({reason}); "
+                        "the line was left on http"
+                    ),
+                )
+            )
+        elif _replace_on_line(
+            lines, lineno, text, text.replace(facts[0], https_url, 1)
+        ):
+            fixed.append(
+                (
+                    lineno,
+                    "W207",
+                    (
+                        "switched the prefetch URL to https after verifying the "
+                        "https copy's size and hashes"
+                    ),
+                )
+            )
+    return "\n".join(lines), fixed, failed
+
+
+def _extension(name):
+    """Return `name`'s lowercased, alias-normalized extension, or None."""
+    match = EXTENSION_RE.search(name)
+    if not match:
+        return None
+    extension = match.group(1).lower()
+    return EXTENSION_ALIASES.get(extension, extension)
+
+
+def extension_mismatch(line):
+    """W406: return (name, url_file) if their extensions disagree, else None.
+
+    The URL's file is the last segment of its *path* (query and fragment
+    dropped; a bare host has none). Both must carry an extension -- a
+    sha1-named prefetch, a URL with none, or a server-side script endpoint
+    (`download.php`) says nothing either way -- and the comparison ignores
+    case and treats spellings like `tgz`/`gz` alike. A URL file that is the
+    declared name plus one more extension (`7z.dll.txt`, a common way to get
+    a binary past web filtering) is the right file, not a slip.
+    """
+    to_parse = _with_placeholder_sha1(line) if statement_missing_sha1(line) else line
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore")
+        try:
+            parsed = parse_prefetch(to_parse)
+        except (AttributeError, TypeError, ValueError, KeyError):
+            return None
+    name, url = parsed.get("file_name"), parsed.get("download_url")
+    if not name or not url or "{" in name + url:
+        return None
+    url_file = urlsplit(url).path.rstrip("/").rsplit("/", 1)[-1]
+    name_ext, url_ext = _extension(name), _extension(url_file)
+    if not name_ext or not url_ext or url_ext in SCRIPT_EXTENSIONS:
+        return None
+    if url_file.lower().startswith(name.lower() + "."):
+        return None  # `x.exe.txt`: the real name plus an extension to pass filters
+    return None if name_ext == url_ext else (name, url_file)
+
+
+def validate_actionscript(body):
+    """Validate every prefetch line in one ActionScript body.
+
+    Returns sorted [(lineno, code, message)] with line numbers local to the
+    body, 1-based.
+    """
+    issues = []
+    for lineno, line, is_nohash in find_prefetch_lines(body):
+        if is_outdated_unzip(line):
+            fixable = "" if is_nohash else " (auto-fixable)"
+            issues.append(
+                (
+                    lineno,
+                    "E402",
+                    (
+                        "prefetch downloads the retired unzip-5.52.exe; "
+                        f"{CURRENT_UNZIP['download_url']} is the current one"
+                        f"{fixable}; add `{PREFETCH_MARKER}` if intentional"
+                    ),
+                )
+            )
+        stray = stray_prefetch_tokens(line)
+        if stray:
+            issues.append(
+                (
+                    lineno,
+                    "E403",
+                    (
+                        "prefetch line has text its syntax does not define ("
+                        + ", ".join(f"`{tok}`" for tok in stray)
+                        + "); it is silently ignored, and a stray token next "
+                        "to the name usually means the name itself is wrong; "
+                        f"add `{PREFETCH_MARKER}` if intentional"
+                    ),
+                )
+            )
+        mismatch = extension_mismatch(line)
+        if mismatch:
+            issues.append(
+                (
+                    lineno,
+                    "W406",
+                    (
+                        f'prefetch names the file "{mismatch[0]}" but the URL '
+                        f'serves "{mismatch[1]}"; the extension decides how the '
+                        "file is run or unpacked (msiexec vs a direct launch, "
+                        "which extractor), so this is usually a copy-paste "
+                        f"slip; add `{PREFETCH_MARKER}` if intentional"
+                    ),
+                )
+            )
+        if is_nohash:
+            issues.append(
+                (
+                    lineno,
+                    "W403",
+                    (
+                        "`add nohash prefetch item` downloads without a hash, so "
+                        "the file cannot be verified and is not validated here; "
+                        f"prefer a hashed prefetch, or add `{PREFETCH_MARKER}` if "
+                        "intentional"
+                    ),
+                )
+            )
+            continue
+        for code, message in validate_prefetch_line(line):
+            issues.append((lineno, code, message))
+    return sorted(issues)
+
+
+def _iter_actionscript_bodies(raw):
+    """Yield (sourceline, body) for every BigFix ActionScript in a BES document.
+
+    Raises etree.XMLSyntaxError if the document does not parse; the callers
+    turn that into W400.
+    """
+    root = etree.fromstring(raw)
+    for element in root.iter("ActionScript"):
+        mimetype = element.get("MIMEType")
+        if mimetype is not None and mimetype != ACTIONSCRIPT_MIMETYPE:
+            continue
+        yield element.sourceline, element.text or ""
+
+
+def _validate_bes_xml(raw):
+    """Validate prefetches in every ActionScript of a BES document."""
+    try:
+        bodies = list(_iter_actionscript_bodies(raw))
+    except etree.XMLSyntaxError as err:
+        return [(1, "W400", f"not parseable BES XML ({err}); skipping")]
+    issues = []
+    for sourceline, body in bodies:
+        for lineno, code, message in validate_actionscript(body):
+            issues.append((sourceline + lineno - 1, code, message))
+    return issues
+
+
+def iter_prefetch_targets(raw, src, is_bes):
+    """Yield (file_lineno, line) for every fixable prefetch line in a file.
+
+    Line numbers are 1-based into `src`. An `add nohash prefetch item` is left
+    out of both fixes: it is hashless on purpose, and giving it hashes would
+    change what the line does, not just which file it fetches.
+    """
+    if is_bes:
+        try:
+            bodies = list(_iter_actionscript_bodies(raw))
+        except etree.XMLSyntaxError:
+            return  # already reported as W400; nothing safe to rewrite
+    else:
+        bodies = [(1, src)]
+
+    for sourceline, body in bodies:
+        for lineno, line, is_nohash in find_prefetch_lines(body):
+            if not is_nohash:
+                yield sourceline + lineno - 1, line
+
+
+def find_fix_targets(raw, src, is_bes):
+    """Return [(file_lineno, line)] for the E402 lines that can be rewritten."""
+    return [
+        (lineno, line)
+        for lineno, line in iter_prefetch_targets(raw, src, is_bes)
+        if is_outdated_unzip(line)
+    ]
+
+
+def find_network_fix_targets(raw, src, is_bes):
+    """Return [(file_lineno, line)] for the E401 lines a download could fix."""
+    return [
+        (lineno, line)
+        for lineno, line in iter_prefetch_targets(raw, src, is_bes)
+        if not has_sha256(line)
+    ]
+
+
+def _replace_on_line(lines, lineno, text, replacement):
+    """Substitute `text` on 1-based `lineno` of `lines`; say whether it landed.
+
+    The prefetch text is replaced inside the file line rather than the line
+    being rebuilt, so indentation and anything sharing the line (a `<![CDATA[`
+    opener, say) survive. A target whose text is not found on its line -- which
+    entity decoding could in principle cause -- is left alone rather than
+    guessed at, and its issue still stands.
+    """
+    if not 1 <= lineno <= len(lines):
+        return False
+    raw_line = lines[lineno - 1]
+    if text not in raw_line:
+        return False
+    lines[lineno - 1] = raw_line.replace(text, replacement, 1)
+    return True
+
+
+def fix_outdated_unzip(src, targets):
+    """Rewrite each target line to the current unzip prefetch; return (src, fixed)."""
+    lines = src.split("\n")
+    fixed = []
+    for lineno, text in targets:
+        if _replace_on_line(lines, lineno, text, current_unzip_prefetch(text)):
+            fixed.append(
+                (
+                    lineno,
+                    "E402",
+                    (
+                        "replaced the retired unzip-5.52.exe prefetch with "
+                        f"{CURRENT_UNZIP['download_url']}"
+                    ),
+                )
+            )
+    return "\n".join(lines), fixed
+
+
+def fix_missing_sha256(src, targets, cache=None):
+    """Add a sha256 to each target line by downloading it; return (src, fixed, failed).
+
+    `failed` is a list of W404s: the line stayed as it was and its E401 still
+    stands. `cache` maps a prefetch line to the rewritten one (or to None for a
+    line whose download already failed), so a URL repeated across a run is
+    fetched once -- pass the same dict to every call to share it.
+    """
+    if cache is None:
+        cache = {}
+    lines = src.split("\n")
+    fixed = []
+    failed = []
+    for lineno, text in targets:
+        if text not in cache:
+            try:
+                cache[text] = sha256_added_prefetch(text)
+            except Exception as err:  # noqa: BLE001 -- see below
+                # urlopen alone raises URLError, HTTPError, socket.timeout, ssl
+                # errors...; upstream adds AttributeError/TypeError/ValueError
+                # for a download that does not match the line. Every one of them
+                # means the same thing here -- no sha256 was learned -- and none
+                # of them may take the whole run down.
+                cache[text] = None
+                failed.append((lineno, "W404", f"{type(err).__name__}: {err}"))
+                continue
+        replacement = cache[text]
+        if replacement is None:
+            failed.append((lineno, "W404", "the download already failed above"))
+        elif _replace_on_line(lines, lineno, text, replacement):
+            fixed.append((lineno, "E401", "downloaded the file and added its sha256"))
+    failed = [
+        (
+            lineno,
+            code,
+            (
+                f"could not add a sha256 by download ({reason}); the line was "
+                "left as it is and its E401 stands"
+            ),
+        )
+        for lineno, code, reason in failed
+    ]
+    return "\n".join(lines), fixed, failed
+
+
+def check_file(  # pylint: disable=too-many-locals,too-many-arguments,too-many-positional-arguments
+    path,
+    disabled=frozenset(),
+    strict=False,
+    auto_fix=False,
+    auto_fix_network=False,
+    network_cache=None,
+):
+    """Check one file; return (issues, fixed), each a list of (lineno, code, msg).
+
+    With `auto_fix`, the certain E403 stray-text shapes are fixed and the
+    retired unzip-5.52.exe prefetches (E402) are rewritten in place to the
+    current unzip-6.0.exe one. With `auto_fix_network` -- which
+    downloads files, and so is never the default -- a prefetch with no sha256
+    (E401) gets one, or a W404 saying why it could not, and an http URL is
+    switched to https once verified (W207), or a W407 says why not;
+    `network_cache` is a
+    dict shared across files so a repeated URL is fetched once. Both report
+    under `fixed`, and the file's line endings are preserved (CRLF in, CRLF
+    out). `strict` is accepted for parity with the sibling hooks and does not
+    change what is reported (the caller decides whether warnings fail).
+    """
+    del strict  # reported issues are the same either way
+    if not os.path.isfile(path):
+        return [(1, "W400", "file not found; skipping")], []
+
+    original, src, was_crlf = read_source(path)
+
+    if SKIP_MARKER in src:
+        return [], []
+    if MUSTACHE_RE.search(src):
+        return [], []
+
+    is_bes = path.endswith(BES_EXTENSIONS)
+    opted_out = PREFETCH_MARKER in src
+
+    raw = original
+    # each fix pass is kept only if it leaves a schema-valid file valid (E404)
+    guard = bes_common.SchemaGuard(
+        src, "E404", path, validate=is_bes and "E404" not in disabled
+    )
+    failed = []
+    if not opted_out and auto_fix and "E403" not in disabled:
+        new_src, got = fix_stray_tokens(src, find_stray_fix_targets(raw, src, is_bes))
+        if guard.apply(new_src, got):
+            src, raw = new_src, encode(new_src, was_crlf)
+    if not opted_out and auto_fix and "E402" not in disabled:
+        new_src, got = fix_outdated_unzip(src, find_fix_targets(raw, src, is_bes))
+        if guard.apply(new_src, got):
+            src, raw = new_src, encode(new_src, was_crlf)
+    if not opted_out and auto_fix_network and "E401" not in disabled:
+        # re-found on the current text: an E402 fix above may already have
+        # brought a sha256 with it, leaving nothing here to download.
+        new_src, got, failed = fix_missing_sha256(
+            src, find_network_fix_targets(raw, src, is_bes), network_cache
+        )
+        if guard.apply(new_src, got):
+            src, raw = new_src, encode(new_src, was_crlf)
+    if not opted_out and auto_fix_network and "W407" not in disabled:
+        # after E401, so a sha256 just added is one more hash to verify against
+        new_src, got, https_failed = fix_http_urls(
+            src, find_https_fix_targets(raw, src, is_bes), network_cache
+        )
+        failed += https_failed
+        if guard.apply(new_src, got):
+            src, raw = new_src, encode(new_src, was_crlf)
+    fixed = guard.fixed
+    if raw != original:
+        with open(path, "wb") as handle:
+            handle.write(raw)
+
+    if is_bes:
+        issues = _validate_bes_xml(raw)
+    else:
+        issues = validate_actionscript(src)
+    issues += failed + guard.refused
+
+    issues = [
+        (lineno, code, message)
+        for lineno, code, message in issues
+        if code not in disabled and not opted_out
+    ]
+    return sorted(issues), fixed
+
+
+def check_files(
+    paths, disabled=frozenset(), strict=False, auto_fix=False, auto_fix_network=False
+):
+    """Check several files; return a list of (path, issues, fixed) tuples.
+
+    This is the programmatic entry point: it does no printing. The download
+    cache is made here, so a URL repeated across the files is fetched once.
+    """
+    network_cache = {}
+    return [
+        (
+            path,
+            *check_file(
+                path,
+                disabled=disabled,
+                strict=strict,
+                auto_fix=auto_fix,
+                auto_fix_network=auto_fix_network,
+                network_cache=network_cache,
+            ),
+        )
+        for path in paths
+    ]
+
+
+def discover_bes_files(root="."):
+    """Return all .bes files under `root`, pruning hidden and noise directories."""
+    return bes_common.discover_bes_files(root)
+
+
+def main(argv=None):
+    """Execution starts here.
+
+    argv defaults to None so this works both as a console_scripts entry point
+    (pre-commit calls it with no arguments; argparse then reads sys.argv) and
+    when called directly as `main(sys.argv[1:])`.
+    """
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--strict",
+        action="store_true",
+        help="treat warnings as failures (non-zero exit); default: advisory",
+    )
+    parser.add_argument(
+        "--auto-fix",
+        choices=["yes", "no"],
+        default=None,
+        help=(
+            "rewrite the retired unzip-5.52.exe prefetches (E402) and fix "
+            "`sha2:` / a space in the URL (E403) in place "
+            "(default: yes when files are given, no when auto-discovering)"
+        ),
+    )
+    parser.add_argument(
+        "--auto-fix-network",
+        choices=["yes", "no"],
+        default="no",
+        help=(
+            "add a sha256 to the prefetches that have none (E401) by "
+            "DOWNLOADING each file to hash it, and switch http prefetch URLs "
+            "to https once the https copy's size and hashes match (W207); off "
+            "by default, since it fetches whatever URLs the content names"
+        ),
+    )
+    parser.add_argument(
+        "--disable",
+        default="",
+        metavar="CODES",
+        help=(
+            "comma-separated check IDs to skip entirely, e.g. --disable E401 "
+            "for a repo that still treats sha256 as optional"
+        ),
+    )
+    parser.add_argument(
+        "files",
+        nargs="*",
+        help=(
+            "files to check (.bes/.ojo are read as BES XML, anything else as "
+            "raw ActionScript); if omitted, all *.bes files in the current "
+            "folder and below are checked"
+        ),
+    )
+    args = parser.parse_args(argv)
+
+    disabled = {
+        code.strip().upper() for code in args.disable.split(",") if code.strip()
+    }
+    unknown = disabled - KNOWN_CODES
+    if unknown:
+        print(
+            f"warning: ignoring unknown --disable code(s): {', '.join(sorted(unknown))}"
+        )
+
+    # auto-fix defaults to yes for explicit files, no when auto-discovering; an
+    # explicit --auto-fix always wins. This is the sibling hooks' rule, and
+    # pre-commit always passes files, so under pre-commit the default is yes.
+    if args.auto_fix is not None:
+        auto_fix = args.auto_fix == "yes"
+    else:
+        auto_fix = bool(args.files)
+    paths = args.files if args.files else discover_bes_files(".")
+
+    issue_count, warning_count, fix_count = bes_common.report(
+        check_files(
+            paths,
+            disabled=disabled,
+            strict=args.strict,
+            auto_fix=auto_fix,
+            auto_fix_network=args.auto_fix_network == "yes",
+        )
+    )
+
+    if fix_count:
+        print(f"\nauto-fixed {fix_count} issue(s); review and re-stage the changes.")
+    if warning_count:
+        print(f"{warning_count} prefetch warning(s).")
+    if issue_count:
+        print(f"{issue_count} prefetch issue(s).")
+    # E-codes and any fix always fail; warnings fail only under --strict
+    return 1 if (issue_count or fix_count or (warning_count and args.strict)) else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))