testsAndMisc/docs
Krzysztof kuhy Rudnicki 17b20e5fae Gate the no-inline-Python rule instead of asking people to remember it
CLAUDE.md's longest and most emphatic code rule -- never embed Python program
logic in a shell script -- was enforced by nothing. A repo-wide scan found it
had already been violated: install_plagiarism_tools.sh ran a 6-line NLTK
download as an inline `python3 -c`, invisible to ruff, mypy, pylint, bandit
and pytest, exactly the failure mode the rule exists to prevent.

check_no_inline_python.sh flags heredocs and multi-line `python -c` while
permitting the single-line availability probes the rule explicitly allows, so
the ~250 shell files here produce zero false positives. Commented-out examples
are skipped; otherwise the rule's own documentation would fail the hook.

The extracted download_nltk_data.py also fixes a real defect: the inline block
ignored nltk.download()'s return value, so a partial corpus download reported
success. It now returns non-zero and the caller's `set -e` sees it.

nltk is imported via importlib inside main(), not at module scope: it belongs
to the plagiarism toolchain, not this repo, so it is absent from
requirements.txt and unresolvable to pylint as a static import.

No suppressions anywhere: T201 avoided with sys.stderr.write, INP001 with a
shebang (matching sibling fast_count.py), E0401 with the dynamic import.
pylint 10.00/10, ruff clean, mypy clean.

Verified the gate fires rather than passing vacuously -- a staged canary with
a real heredoc exits non-zero -- and that the extracted script runs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
2026-08-16 15:11:56 +02:00
..
cleanup-2026-05 chore: spring-clean repo root (move docs, relocate batch3 script, drop stale outputs) 2026-05-14 20:01:09 +02:00
explanations session_autopsy: badge counts only significant candidates; zero-token aliases 2026-07-25 18:05:49 +02:00
superpowers Gate the no-inline-Python rule instead of asking people to remember it 2026-08-16 15:11:56 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
syncyomi-restore-runbook.md syncyomi_guard: refuse a collapsed payload as the new good copy 2026-08-10 15:33:18 +02:00