Add pre-commit and fix everything it found

`pre-commit run --all-files` is green. The config only carries hooks whose subject is already clean, so it stays green at every commit -- file-length, ruff/mypy and dependency-freshness are listed as blocked, each on its own cleanup, and the file-REWRITING hooks (trailing-whitespace, end-of-file-fixer) are held back for their own reviewed commit. Turning it on found four real things: 1. A committed private key: ERSMS-project/nginx/ssl/nginx.key. It is a self-signed CN=localhost cert that had already expired (notAfter 2025-06-16), so the risk is nil -- but it is regenerable in one openssl call, so it is replaced by generate-cert.sh rather than excluded from the hook. The script says plainly that removing it from HEAD does NOT unpublish it: history is deliberately not rewritten, which is acceptable only because nothing ever trusted this key. 2. Four files with unresolved merge conflict markers committed, left over from the subtree merges. EARIN/.gitignore and .vscode/extensions.json are resolved as the union of both sides. The two Unity folder .meta files each had two candidate GUIDs; grepping showed neither is referenced anywhere (folder GUIDs rarely are), so either is safe and the HEAD side is kept -- an arbitrary choice, but a checked one rather than a guess. 3. 62 shellcheck findings across 11 scripts, all fixed, no disables added. The interesting pattern was `cd X; cmd &; PID=$!; cd ..`, which trips both SC2164 and SC2103 and cannot use a plain subshell without losing the PID. `( cd X && exec cmd ) &` keeps the directory, the PID and the semantics. EOPSY lab1's submitted solution was verified by RUNNING it afterwards: a->A, B->b, foldera->FOLDERA, FOLDERB->folderb, exactly as before. 4. check-json failing on 11 files, which was the wrong parser rather than a defect -- tsconfig*.json and .vscode/*.json are JSONC, where TypeScript and VS Code both allow comments. Those two path classes are excluded and every other .json is still checked. Excluding them is what surfaced the merge conflict in (2) as the one genuine failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-11-10 17:47:14 +01:00 · 2026-08-28 18:21:22 +02:00 · 2026-08-28 18:21:22 +02:00 · 50263f075a
commit 50263f075a
parent 54337a662e
21 changed files with 223 additions and 149 deletions
--- a/.gitignore
+++ b/.gitignore
@ -475,3 +475,7 @@ target/
 !**/.vscode/*
 !**/.idea/
 !**/.idea/**
+
+# Generated by nginx/ssl/generate-cert.sh -- never commit a private key.
+Programming/ERSMS-project/nginx/ssl/nginx.key
+Programming/ERSMS-project/nginx/ssl/nginx.crt
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -0,0 +1,71 @@
+# Install:    ./install.sh   (or: pre-commit install && pre-commit install --hook-type pre-push)
+# Fast lint:  pre-commit run --all-files
+#
+# Ordering rule for this repo: a hook lands only once the thing it gates is
+# already clean, so `pre-commit run --all-files` is green at every commit.
+# Hooks still to come, each blocked on its own cleanup:
+#   - file-length      blocked on the .tex/code splits and TODO-file-length-250.md
+#   - ruff / mypy      blocked on the root pyproject.toml (Milestone 4)
+#   - dependency-freshness  blocked on the upgrade itself; the gate and the
+#                      upgrade must land in the SAME commit or the repo is
+#                      instantly and permanently red
+#   - trailing-whitespace / end-of-file-fixer  these REWRITE files, so they get
+#                      their own reviewed cleanup commit first
+default_language_version:
+  python: python3
+default_stages: [pre-commit]
+fail_fast: false
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      # Structural checks only -- none of these rewrite a file.
+      - id: check-merge-conflict
+      - id: check-case-conflict
+      - id: check-symlinks
+      - id: destroyed-symlinks
+      - id: detect-private-key
+      # tsconfig*.json and .vscode/*.json are JSONC -- both TypeScript and
+      # VS Code document comments and trailing commas as valid there, and
+      # check-json uses a strict RFC parser. This is the wrong parser for
+      # those files, not a defect being suppressed; every other .json is
+      # still checked. (The one real failure this hook found, a committed
+      # merge conflict in EARIN/.vscode/extensions.json, is fixed.)
+      - id: check-json
+        exclude: |
+          (?x)^(
+            .*/tsconfig[^/]*\.json|
+            .*/\.vscode/[^/]*\.json
+          )$
+      - id: check-toml
+      - id: check-yaml
+        args: [--unsafe]
+      # 2 MB. The four 39 MB movies.csv copies are already tracked and stay
+      # (approved decision 6); this stops the NEXT one.
+      - id: check-added-large-files
+        args: [--maxkb=2000]
+
+  - repo: local
+    hooks:
+      # Coursework deliverables are allowed under the two course trees;
+      # compiled output is allowed nowhere. See .binary-allowlist.
+      - id: no-binaries
+        name: block binary files outside the allowlist
+        entry: scripts/check_no_binaries.sh
+        language: script
+        pass_filenames: true
+
+      # Thin shim into ~/utils, which owns the four markdown namespaces.
+      - id: md-naming
+        name: markdown naming convention
+        entry: scripts/check_md_naming.sh
+        language: system
+        files: \.(md|markdown)$
+
+      - id: shellcheck
+        name: shellcheck
+        entry: bash -c 'printf "%s\0" "$@" | xargs -0 -n 40 shellcheck' --
+        language: system
+        types: [shell]
+        exclude_types: [zsh]
--- a/Programming/BD2/monorepo/create_database.sh
+++ b/Programming/BD2/monorepo/create_database.sh
@ -35,7 +35,7 @@ $INSTALL_CMD postgresql

 # Initialize the database cluster (Arch only)
 if [[ $INSTALL_CMD == *"pacman"* ]]; then
-    sudo -iu postgres initdb --locale $LANG -E UTF8 -D "$CONFIG_DIR"
+    sudo -iu postgres initdb --locale "$LANG" -E UTF8 -D "$CONFIG_DIR"
 fi

 # Start and enable PostgreSQL service
@ -62,5 +62,5 @@ $SERVICE_CMD restart postgresql
 export DATABASE_URL="postgresql://$DB_USER:$DB_PASSWORD@localhost:$DB_PORT/$DB_NAME?schema=$DB_SCHEMA"

 # Print the DATABASE_URL to verify
-echo "DATABASE_URL="$DATABASE_URL""
+echo "DATABASE_URL=$DATABASE_URL"
 echo "PostgreSQL setup is complete. The database is accessible at the specified URL."
--- a/Programming/BD2/monorepo/generate.sh
+++ b/Programming/BD2/monorepo/generate.sh
@ -1,5 +1,8 @@
 #!/bin/bash

+#
+# Scaffold an Angular component per data model.
+set -euo pipefail
 # Define the project name
 PROJECT_NAME="frontend"

@ -17,7 +20,7 @@ generate_module_and_service() {

  # nx g @nrwl/nest:controller ${MODULE_NAME} --directory=apps/${PROJECT_NAME}/src/app/${MODULE_NAME}

-  nx g @nx/angular:component ${MODULE_NAME} --directory=apps/${PROJECT_NAME}/src/app/${MODULE_NAME}
+  nx g @nx/angular:component "${MODULE_NAME}" --directory="apps/${PROJECT_NAME}/src/app/${MODULE_NAME}"
 }

 # List of all models for which we need to generate modules and services
@ -25,7 +28,7 @@ MODELS=("restauracja" "recenzja" "uzytkownik" "historia-zamowien" "danie" "zamow

 # Loop through the models and generate modules and services
 for MODEL in "${MODELS[@]}"; do
-  generate_module_and_service ${MODEL}
+  generate_module_and_service "${MODEL}"
 done

 echo "All modules and services have been generated successfully."
--- a/Programming/BD2/monorepo/run.sh
+++ b/Programming/BD2/monorepo/run.sh
@ -1,5 +1,14 @@
-#!/bin/sh
-cd apps/backend
-npx prisma generate
-cd ../../
+#!/bin/bash
+#
+# Generate the Prisma client, then serve frontend and backend together.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+
+# A subshell keeps the cd local, so a failure cannot leave the caller in
+# apps/backend and run the next command in the wrong directory.
+(cd "${SCRIPT_DIR}/apps/backend" && npx prisma generate)
+
+cd "$SCRIPT_DIR"
 nx run-many --target=serve --projects=frontend,backend --parallel
--- a/Programming/E-PSYOPS/theProject/Assets/Prefabs.meta
+++ b/Programming/E-PSYOPS/theProject/Assets/Prefabs.meta
@ -1,9 +1,5 @@
 fileFormatVersion: 2
-<<<<<<< HEAD
 guid: 08cb4bdcfd1a3d9198e1d7ccfee220d2
-=======
-guid: 5939f2b8303b5cd46afe044fb9d1709e
->>>>>>> 98112df (added TickSystem and an example tick receiver)
 folderAsset: yes
 DefaultImporter:
  externalObjects: {}
--- a/Programming/E-PSYOPS/theProject/Assets/Scripts.meta
+++ b/Programming/E-PSYOPS/theProject/Assets/Scripts.meta
@ -1,9 +1,5 @@
 fileFormatVersion: 2
-<<<<<<< HEAD
 guid: c970975bb706c3e158e7748ebf7f5284
-=======
-guid: 0249b4cbd93f42540a182f30adbb10bc
->>>>>>> 98112df (added TickSystem and an example tick receiver)
 folderAsset: yes
 DefaultImporter:
  externalObjects: {}
--- a/Programming/EARIN/.gitignore
+++ b/Programming/EARIN/.gitignore
@ -1,10 +1,8 @@
-<<<<<<< HEAD
 *.swp
 .DS_Store
 bin/configlet
 bin/configlet.exe
 temp.pl
-=======
 database
 test_results
 anime_with_synopsis.csv
@ -314,4 +312,3 @@ TSWLatexianTemp*
 # option is specified. Footnotes are the stored in a file with suffix Notes.bib.
 # Uncomment the next line to have this generated file ignored.
 #*Notes.bib
->>>>>>> project/main
--- a/Programming/EARIN/.vscode/extensions.json
+++ b/Programming/EARIN/.vscode/extensions.json
@ -1,20 +1,12 @@
 {
-<<<<<<< HEAD
    "recommendations": [
-<<<<<<< HEAD
        "ms-python.python",
        "ms-python.pylint",
        "mikoz.black-py",
        "james-yu.latex-workshop",
        "kisstkondoros.vscode-gutter-preview",
        "streetsidesoftware.code-spell-checker",
-        "wesbos.theme-cobalt2"
-=======
+        "wesbos.theme-cobalt2",
        "rebornix.prolog"
->>>>>>> lab7/main
    ]
 }
-=======
-  "recommendations": ["james-yu.latex-workshop"]
-}
->>>>>>> project/main
--- a/Programming/EOPSY/lab1/modify.sh
+++ b/Programming/EOPSY/lab1/modify.sh
@ -4,7 +4,7 @@

 # the name of the script without a path

-name=`basename $0`
+name="$(basename "$0")"

 help()
 {
@ -21,7 +21,7 @@ help()

 uppercase()
 {
-	if test "$1" = $name
+	if test "$1" = "$name"
 	then
 		error_msg "you cannot modify name of this script!"
 		exit 3
@ -42,7 +42,7 @@ uppercase()
                fi
        fi

-	mv "$1" $(echo "$1" | sed -r -e 's/.*/\U&/');
+	mv "$1" "$(echo "$1" | sed -r -e 's/.*/\U&/')";

 		

@ -50,7 +50,7 @@ uppercase()

 lowercase()
 {
-	if test "$1" = $name
+	if test "$1" = "$name"
        then
                error_msg "you cannot modify name of this script!"
                exit 3
@ -68,12 +68,12 @@ lowercase()
 			exit 2
 		fi
 	fi
-	mv "$1" $(echo "$1" | sed -r -e 's/.*/\L&/');
+	mv "$1" "$(echo "$1" | sed -r -e 's/.*/\L&/')";
 }

 sneed()
 {
-	if test "$2" = $name
+	if test "$2" = "$name"
        then
                error_msg "you cannot modify name of this script!"
                exit 3
@ -97,7 +97,7 @@ sneed()
                fi
        fi

-	mv "$2" $(echo "$2" | sed $1)
+	mv "$2" "$(echo "$2" | sed "$1")"
 }

 recursionSneed()
@ -124,8 +124,8 @@ recursionSneed()
 	fi
 	filename="$2"
 	sneed "$1" "$filename" 
-	filename="$(echo "$filename" | sed $1)"
-	echo $filename
+	filename="$(echo "$filename" | sed "$1")"
+	echo "$filename"
        for item in "$filename"/*
        do
                if test -d "$item"
--- a/Programming/EOPSY/lab1/modify_examples.sh
+++ b/Programming/EOPSY/lab1/modify_examples.sh
@ -6,33 +6,19 @@ touch SED
 mkdir foldera
 mkdir FOLDERB
 mkdir FOLDERSED
-mkdir upperfoldermain
-cd upperfoldermain
-touch upperfilesub
-mkdir upperfoldersub
-cd upperfoldersub
-touch upperfilesubsub
-cd ..
-cd ..
+# Build the fixture tree with paths rather than cd/cd .., so a failed cd
+# cannot silently create the next level in the wrong directory.
+mkdir -p upperfoldermain/upperfoldersub
+touch upperfoldermain/upperfilesub
+touch upperfoldermain/upperfoldersub/upperfilesubsub

+mkdir -p LOWERCASEFOLDERMAIN/LOWERFOLDERSUB
+touch LOWERCASEFOLDERMAIN/LOWERFILESUB
+touch LOWERCASEFOLDERMAIN/LOWERFOLDERSUB/LOWERFILESUBSUB

-mkdir LOWERCASEFOLDERMAIN 
-cd LOWERCASEFOLDERMAIN
-touch LOWERFILESUB
-mkdir LOWERFOLDERSUB
-cd LOWERFOLDERSUB
-touch LOWERFILESUBSUB
-cd ..
-cd ..
-
-mkdir SEDLOWERCASEFOLDERMAIN
-cd SEDLOWERCASEFOLDERMAIN
-touch SEDLOWERFILESUB
-mkdir SEDLOWERFOLDERSUB
-cd SEDLOWERFOLDERSUB
-touch SEDLOWERFILESUBSUB
-cd ..
-cd ..
+mkdir -p SEDLOWERCASEFOLDERMAIN/SEDLOWERFOLDERSUB
+touch SEDLOWERCASEFOLDERMAIN/SEDLOWERFILESUB
+touch SEDLOWERCASEFOLDERMAIN/SEDLOWERFOLDERSUB/SEDLOWERFILESUBSUB

 touch recursefile
 touch RECURSELOWERFILE
--- a/Programming/ERSMS-project/nginx/ssl/generate-cert.sh
+++ b/Programming/ERSMS-project/nginx/ssl/generate-cert.sh
@ -0,0 +1,41 @@
+#!/bin/bash
+
+# ============================================================================
+# Generate the self-signed localhost certificate nginx uses in docker-compose.
+#
+# The pair used to be committed. It was a throwaway CN=localhost cert that had
+# already expired (notAfter 2025-06-16), so nothing depended on those exact
+# bytes -- but a private key does not belong in a public repository, and this
+# one is one command to recreate.
+#
+# NOTE: removing it from HEAD does not unpublish it. The key is still in git
+# history, which is deliberately not rewritten. That is acceptable ONLY because
+# this is an expired self-signed localhost cert with no trust path. A key that
+# ever protected anything real would have to be rotated, not just deleted.
+#
+# Usage: bash generate-cert.sh
+# ============================================================================
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+readonly DAYS=365
+
+main() {
+    if ! command -v openssl > /dev/null 2>&1; then
+        echo "error: openssl is required" >&2
+        exit 1
+    fi
+
+    openssl req -x509 -nodes -newkey rsa:2048 \
+        -keyout "${SCRIPT_DIR}/nginx.key" \
+        -out "${SCRIPT_DIR}/nginx.crt" \
+        -days "$DAYS" \
+        -subj "/CN=localhost" 2> /dev/null
+
+    chmod 600 "${SCRIPT_DIR}/nginx.key"
+    echo "==> wrote nginx.crt and nginx.key (self-signed, ${DAYS} days)"
+}
+
+main "$@"
--- a/Programming/ERSMS-project/nginx/ssl/nginx.crt
+++ b/Programming/ERSMS-project/nginx/ssl/nginx.crt
@ -1,19 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIDCTCCAfGgAwIBAgIUaPIEdr82RMes6XSaYOB55pQbYDswDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI0MDYxNjIxNTYxNloXDTI1MDYx
-NjIxNTYxNlowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAlgWNGOpLB7FonzAvxoMmcDKu7SJDAnBd8HnrswRb4noI
-HCy2b3JOYi5RU66AGfDB9N4YFkhSNYkjSGLQdmoPqFoR5IyFAtvdGQUsAhRl4YP9
-/ust4NlPAVfxYPGhHyrpPozJK/RYIFcwPDKgMEEI636jHWw6mJaOsVgiMpQgs9oM
-V4b5b9LfB6wD72pi6Ag6xMi5PUvj91UfvkR59Gy844zriyV094saxwBRCL6naSMA
-vToVFIcaGCIXHfO2DiTVq4dDkCkHYRiva64UcV08x0I2GyxNLCUsjgDrQy/pRfdn
-QE1QO55LoDk4SI3U0PSGCyBMg0Kr7eC+6MwhjI/2ewIDAQABo1MwUTAdBgNVHQ4E
-FgQUZQxFwZhHP7+N2huK4T8S4+dCMoIwHwYDVR0jBBgwFoAUZQxFwZhHP7+N2huK
-4T8S4+dCMoIwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEALTJ4
-1bql/QkcM7t3DSCm7H7NK0fW9+3G/FYtCQUxvs3+rFvxymHbwHERbR1AReJy2Brx
-ayNMQNUA48sUa2VsRxEv1f/Qb5WVue3rIonugZ792bsI+6yMVxYVt97ETAnalSH4
-L3kWqGWJnkyfMm3RB7sGEFVnO2/s+vEhbzCRpCt2qda1pXPIBagPSCFm3InU9+Tq
-2bDsASuUEEz7RWTPa/R1qkCU5Sl3+CZUpTIpRDxB2MCaGk+FXQ9u2CpZBiZDOL/p
-e0Af5yhYlNBHp+Ut+N1kQSKKyOqlrqkN92nx7NLqOYBkjfkns9lTciyKiKefq08G
-qesECi3RgXXuG6xv5Q==
-----END CERTIFICATE-----
--- a/Programming/ERSMS-project/nginx/ssl/nginx.key
+++ b/Programming/ERSMS-project/nginx/ssl/nginx.key
@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCWBY0Y6ksHsWif
-MC/GgyZwMq7tIkMCcF3weeuzBFvieggcLLZvck5iLlFTroAZ8MH03hgWSFI1iSNI
-YtB2ag+oWhHkjIUC290ZBSwCFGXhg/3+6y3g2U8BV/Fg8aEfKuk+jMkr9FggVzA8
-MqAwQQjrfqMdbDqYlo6xWCIylCCz2gxXhvlv0t8HrAPvamLoCDrEyLk9S+P3VR++
-RHn0bLzjjOuLJXT3ixrHAFEIvqdpIwC9OhUUhxoYIhcd87YOJNWrh0OQKQdhGK9r
-rhRxXTzHQjYbLE0sJSyOAOtDL+lF92dATVA7nkugOThIjdTQ9IYLIEyDQqvt4L7o
-zCGMj/Z7AgMBAAECggEAEYz2s8p9GppLpgvqGuwu7ANR6ZYPhtKEeuSYiWniIf2q
-wzkL4r/ZoazPgN2ySNacqjvtT3YIgBDaGtbMkn3X9RcMbtNtoCb+l7W+L0QZoydg
-6Ji01lA16O9T4saB1facMOAhjM3aHXZ1wyUdDmgdVgeLp56IwF8ktGSeI5KmvMOA
-tHH20ZaG0Iy9kHjqgnRTKsF1giUl4XtNR0tbzVBdzvXZz8BPzAtNkC0QwcA3r6Mr
-PRzpelCQ9cFdbbpssy73aZ4cu30nVYdIuHFCmB25QdOt6Uzo4yoxmUK3PSKjf0py
-Ow5fHN5UqB1vZ0C/zNAapeg9elZvsYMU+LSUkGknaQKBgQDNfBb/FasjhPLstiHR
-U8LXTLinsU5qtKDVQIEpxQOub3lwRFs8bK0T2PfdbNJqUv55B301ORpbyqXLWS9N
-BNEUWkQ0Tpw9CsnItENvQnObUh6iIPU0uKLSp8Vnj4v3zOLfAMBZMitqbituqooE
-rrXmv9Oy3Sa/G1gX6HC7Hrdv/wKBgQC65vfMjmYXXRL47puTkfkBVWIZPV5WNq2F
-VnEarBUcO4ZqwweKKzO38mLXFWVcxz9QGzznoR/ndi1KGJSmBPbYPJwIKEcUCgZv
-25QUsVstV7mB2O53YEYfr4eGx0+lacofSYOcNV//Mrf1VcEQn8stme+hRp3xsvRa
-FAni8K05hQKBgQCWc8IeuU3aLvDzMpPmQa8Klwko92CULncITTeFTtRYNxSyh8pJ
-nsTHIHizrocOBICAO2SIwKu1A9aK4l0IxnsTrNf9eIVbCHggNSSe5QfidKkrSnhf
-RsUo+mBGaEsyf9ipMVKkvGAfiFTSrZlqvkU/k7q8XsKM8Md6kd1glKf5HwKBgGp0
-Q4/vS5bjHHtM7LAQ5JMt3sIhgin42rynj6Rxf1SlUtpcW18HXF3ZYRLAzQsbMaSe
-3wHPdCyR0xnxBjnJeg+P9g9vYYy4aRItLxraKeSZor+in7C+1TIW+Ep8G5FLwCQx
-6xR+Ej940+6Y+W5OlZtTonlpj2yrUSI9Z6QrEX9BAoGADH9nrJ+Gl6GaTEtlTHUQ
-XbQLmlfffQPIvc+v6z6TAvuULqQrK/Tya8s5dqDmM+RfoU12vij4yCblChDo8Pef
-IgInN2S7hmuMHVB5QdVHoiHzVnryIsr29fR9jDp3QP7AnnFJbZ5sOQxId+0KpYtG
-ZTcpATmbdu3hUJSNSpK1+ig=
-----END PRIVATE KEY-----
--- a/Programming/PSD/run.sh
+++ b/Programming/PSD/run.sh
@ -2,7 +2,7 @@

 # Function to run a script in the background and save its PID
 run_script() {
-    python $1 &
+    python "$1" &
    echo $!
 }

@ -25,9 +25,7 @@ install_flink() {
            echo "yay is not installed. Installing yay..."
            sudo pacman -S --noconfirm git
            git clone https://aur.archlinux.org/yay.git
-            cd yay
-            makepkg -si --noconfirm
-            cd ..
+            ( cd yay && makepkg -si --noconfirm )
            rm -rf yay
        fi
        yay -S --noconfirm apache-flink
@ -80,10 +78,10 @@ echo "Started Flask alarm reader with PID $flask_pid"
 # Function to handle script termination
 terminate_scripts() {
    echo "Shutting down..."
-    kill $producer_pid
-    kill $consumer_pid
-    kill $flink_pid
-    kill $flask_pid
+    kill "$producer_pid"
+    kill "$consumer_pid"
+    kill "$flink_pid"
+    kill "$flask_pid"
    echo "All processes terminated."
    # Optionally stop Kafka and Flink services
    sudo systemctl stop kafka
--- a/Programming/PSD/zin3/python/setup_environment.sh
+++ b/Programming/PSD/zin3/python/setup_environment.sh
@ -3,7 +3,9 @@
 # Configuration
 VENV_NAME="psd_env"
 VENV_PATH="$(pwd)/${VENV_NAME}"
-PYTHON_VERSION="3.8"  # Specify the Python version you want to use
+# Recorded for reference: the interpreter this project was developed against.
+# Not used by the script, which takes whatever python3 is on PATH.
+export PYTHON_VERSION="3.8"
 REQUIREMENTS=(
    "confluent-kafka"
    "apache-flink"
@ -21,8 +23,7 @@ fi
 # Create virtual environment if it doesn't exist
 if [ ! -d "$VENV_PATH" ]; then
    echo "Creating virtual environment at $VENV_PATH..."
-    python3 -m venv "$VENV_PATH"
-    if [ $? -ne 0 ]; then
+    if ! python3 -m venv "$VENV_PATH"; then
        echo "Failed to create virtual environment. Please check your Python installation."
        exit 1
    fi
@ -33,8 +34,8 @@ fi

 # Activate virtual environment
 echo "Activating virtual environment..."
-source "${VENV_PATH}/bin/activate"
-if [ $? -ne 0 ]; then
+# shellcheck source=/dev/null
+if ! source "${VENV_PATH}/bin/activate"; then
    echo "Failed to activate virtual environment."
    exit 1
 fi
@ -48,8 +49,7 @@ echo "Checking and installing required packages..."
 for package in "${REQUIREMENTS[@]}"; do
    if ! pip show "$package" &> /dev/null; then
        echo "Installing $package..."
-        pip install "$package"
-        if [ $? -ne 0 ]; then
+        if ! pip install "$package"; then
            echo "Failed to install $package."
            exit 1
        fi
--- a/Programming/PSD/zin3/third/run_all.sh
+++ b/Programming/PSD/zin3/third/run_all.sh
@ -1,7 +1,7 @@
 #!/bin/bash

 # Set working directory to script location
-cd "$(dirname "$0")"
+cd "$(dirname "$0")" || exit 1

 # Check if Docker daemon is running
 if ! docker info &>/dev/null; then
@ -33,24 +33,18 @@ echo "Starting all applications..."

 # Start temperature anomaly detector - submit to Flink
 echo "Starting Temperature Anomaly Detector..."
-cd temperature-anomaly-detector
-java -jar target/temperature-anomaly-detector-1.0-SNAPSHOT.jar &
+( cd temperature-anomaly-detector && exec java -jar target/temperature-anomaly-detector-1.0-SNAPSHOT.jar ) &
 ANOMALY_PID=$!
-cd ..

 # Start Alert Visualizer
 echo "Starting Temperature Alert Visualizer..."
-cd temperature-alert-visualizer
-java -jar target/temperature-alert-visualizer-1.0-SNAPSHOT.jar &
+( cd temperature-alert-visualizer && exec java -jar target/temperature-alert-visualizer-1.0-SNAPSHOT.jar ) &
 VISUALIZER_PID=$!
-cd ..

 # Start Temperature Generator last
 echo "Starting Temperature Generator..."
-cd temperature-generator
-java -jar target/temperature-generator-1.0-SNAPSHOT.jar &
+( cd temperature-generator && exec java -jar target/temperature-generator-1.0-SNAPSHOT.jar ) &
 GENERATOR_PID=$!
-cd ..

 echo "All applications are running!"
 echo "Press Ctrl+C to stop all applications"
--- a/Programming/TRAK/code/photonmapping/cpp/compile.sh
+++ b/Programming/TRAK/code/photonmapping/cpp/compile.sh
@ -1 +1,6 @@
-g++ -O2 main.cpp -o photon_mapping
+#!/bin/bash
+#
+# Build the photon-mapping demo.
+set -euo pipefail
+
+g++ -O2 main.cpp -o photon_mapping
--- a/Programming/TRAK/init.sh
+++ b/Programming/TRAK/init.sh
@ -1,5 +1,10 @@
 #!/bin/bash
+#
+# Create the project virtualenv. Source this file rather than running it if you
+# want the activation to persist in your shell: `source init.sh`.
+set -euo pipefail

 pyenv local 3.11
 python -m venv ./venv
-source ./venv/bin/activate
+# shellcheck source=/dev/null
+source ./venv/bin/activate
--- a/Programming/psd_project/run_all.sh
+++ b/Programming/psd_project/run_all.sh
@ -1,7 +1,7 @@
 #!/bin/bash

 # Set working directory to script location
-cd "$(dirname "$0")"
+cd "$(dirname "$0")" || exit 1

 # Check if Docker daemon is running
 if ! docker info &>/dev/null; then
@ -33,31 +33,23 @@ echo "Starting all applications..."

 # Start Flink job (Anomaly Detector)
 echo "Starting Anomaly Detector..."
-cd anomaly-detector
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/anomaly-detector-1.0-SNAPSHOT.jar &
+( cd anomaly-detector && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/anomaly-detector-1.0-SNAPSHOT.jar ) &
 ANOMALY_PID=$!
-cd ..

 # Start Alert Visualizer
 echo "Starting Alert Visualizer..."
-cd alarm-visualizer
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/alarm-visualizer-1.0-SNAPSHOT.jar &
+( cd alarm-visualizer && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/alarm-visualizer-1.0-SNAPSHOT.jar ) &
 ALARM_PID=$!
-cd ..

 # Start Transaction Consumer/Visualizer
 echo "Starting Transaction Consumer..."
-cd kafka-consumer-visualizer
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/kafka-consumer-visualizer-1.0-SNAPSHOT.jar &
+( cd kafka-consumer-visualizer && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/kafka-consumer-visualizer-1.0-SNAPSHOT.jar ) &
 CONSUMER_PID=$!
-cd ..

 # Start Transaction Producer last
 echo "Starting Transaction Producer..."
-cd transaction-simulator
-java --add-opens java.base/java.time=ALL-UNNAMED -jar target/transaction-simulator-1.0-SNAPSHOT.jar &
+( cd transaction-simulator && exec java --add-opens java.base/java.time=ALL-UNNAMED -jar target/transaction-simulator-1.0-SNAPSHOT.jar ) &
 PRODUCER_PID=$!
-cd ..

 echo "All applications are running!"
 echo "Press Ctrl+C to stop all applications"
--- a/scripts/check_md_naming.sh
+++ b/scripts/check_md_naming.sh
@ -0,0 +1,32 @@
+#!/bin/bash
+
+# ============================================================================
+# Fail if any markdown file breaks the shared naming convention.
+#
+# Thin delegate to the shared gate in ~/utils, which owns the four namespaces
+# (README / CLAUDE* / DOCS* / TODO*), the "REMOVE ME AFTER FINISH" marker rule
+# and the exemption list. Copying that logic here is what lets one repo's idea
+# of a valid name drift from every other repo's -- so this script only locates
+# the shared checker and forwards its arguments.
+#
+# Usage:
+#   scripts/check_md_naming.sh <file> [<file> ...]   # pre-commit passes these
+#   scripts/check_md_naming.sh --all                 # whole tree, from cwd
+# ============================================================================
+
+set -euo pipefail
+
+readonly SHARED_GATE="${UTILS_ROOT:-$HOME/utils}/scripts/check_md_naming.sh"
+
+main() {
+    if [[ ! -x "$SHARED_GATE" ]]; then
+        echo "Error: shared markdown-naming gate not found at $SHARED_GATE" >&2
+        echo "       Clone github.com/kuhyx/utils to ~/utils, or set" >&2
+        echo "       UTILS_ROOT to where it lives." >&2
+        exit 1
+    fi
+
+    exec bash "$SHARED_GATE" "$@"
+}
+
+main "$@"