ejfine · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026
diff --git a/.claude/hooks/bash-chain-guard.js b/.claude/hooks/bash-chain-guard.js
@@ -1,7 +1,19 @@
 #!/usr/bin/env node
 // PreToolUse hook: blocks command chaining in Bash tool calls
-// Detects &&/|| which violate AGENTS.md: "execute exactly one command per tool call"
+// Enforces AGENTS.md: "execute exactly one command per tool call"
+// Quoted spans and backslash-escapes are replaced with a space before scanning, so a `;` inside a
+// string literal (or the trailing `\;` of `find -exec`) is not mistaken for a chain. Replacing with
+// a space rather than deleting keeps tokens separate, so `printf hi >\x&` cannot collapse to
+// `printf hi >&` and hide the backgrounding `&` behind the redirection lookbehind.
 // Once https://github.com/anthropics/claude-code/issues/16561 is resolved, this should no longer be necessary
+// Improvements based on https://github.com/iandunn/dotfiles/blob/main/claude/hooks/block-chained-commands.js
+
+const CHAIN_OPERATORS = /&&|\|\||;/; // a single `|` is a pipe, which is allowed
+const BACKGROUND_AMPERSAND = /(?<![<>])&(?!>)/; // a lone `&` backgrounds the command, but `2>&1` and `&>file` are redirections
+
+function stripQuotedAndEscaped(command) {
+  return command.replace(/\\.|'[^']*'|"(?:\\.|[^"\\])*"/g, " ");
+}
 
 let input = "";
 process.stdin.on("data", (chunk) => {
@@ -11,15 +23,24 @@ process.stdin.on("end", () => {
   try {
     const data = JSON.parse(input);
     const command = (data.tool_input?.command || "").trim();
+    const scannable = stripQuotedAndEscaped(command);
 
-    if (/\s(&&|\|\||;)\s|\s&(\s|$)/.test(command)) {
+    if (CHAIN_OPERATORS.test(scannable)) {
       process.stderr.write(
-        "AGENTS.md violation: never chain commands with &&, ||, ;, or &. " +
+        "AGENTS.md violation: never chain commands with &&, ||, or ;. " +
           "Run one command per tool call. " +
           "Use cd as a separate prior tool call instead of cd && ...",
       );
       process.exit(2);
     }
+
+    if (BACKGROUND_AMPERSAND.test(scannable)) {
+      process.stderr.write(
+        "AGENTS.md violation: never background a command with &. " +
+          "Use the Bash tool's run_in_background option instead.",
+      );
+      process.exit(2);
+    }
   } catch (e) {
     // Silent fail — never block on hook errors
   }

diff --git a/.claude/settings/models.jsonc b/.claude/settings/models.jsonc
@@ -0,0 +1,20 @@
+/*
+ * ============== WARNING ==============================================================================
+ * File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+ * See .config/.copier-managed-files.json for details.
+ *
+ * You are welcome to make changes to this file in your repo if they are custom to your project,
+ * but if the change should be shared with other projects, please backport it to the template repo.
+ * =====================================================================================================
+ */
+{
+    "availableModels": [
+        "sonnet",
+        "opus",
+        "haiku",
+        "claude-opus-5",
+        "claude-opus-4-8",
+        "claude-sonnet-5",
+        "claude-sonnet-4-6"
+    ]
+}
diff --git a/.claude/settings/permissions/bash.jsonc b/.claude/settings/permissions/bash.jsonc
@@ -110,6 +110,7 @@
       "Bash(just *)",
       "Bash(lsof *)",
       "Bash(test *)",
+      "Bash(xxd)", // this invocation can be used to read, but not to write (so no " *" after it)
       "Bash(zk *)",
       // Node.js
       "Bash(pnpm list *)",

diff --git a/.claude/skills/address-pr-comments/fetch-pr-comments.py b/.claude/skills/address-pr-comments/fetch-pr-comments.py
@@ -70,6 +70,7 @@ def gh_rest(*args: str) -> Any:  # noqa: ANN401 — return type is genuinely unk
         ["gh", *call_args],  # noqa: S607 — gh is expected on PATH
         capture_output=True,
         text=True,
+        encoding="utf-8",
         check=True,
         timeout=GH_TIMEOUT_SECONDS,
     )
@@ -91,6 +92,7 @@ def gh_graphql(query: str, variables: dict[str, str | int]) -> Any:  # noqa: ANN
         args,
         capture_output=True,
         text=True,
+        encoding="utf-8",
         check=True,
         timeout=GH_TIMEOUT_SECONDS,
     )
@@ -105,6 +107,7 @@ def fetch_current_user_login() -> str:
         ["gh", "api", "user", "--jq", ".login"],  # noqa: S607 — gh is expected on PATH
         capture_output=True,
         text=True,
+        encoding="utf-8",
         check=True,
         timeout=GH_TIMEOUT_SECONDS,
     )

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
@@ -13,7 +13,7 @@ reviews:
     - path: "**/vendor_files/**"
       instructions: "These files came from a vendor and we're not allowed to change them. Refer to it if you need to understand how the main code interacts with it, but do not make comments about it."
     - path: "**/*.py"
-      instructions: "Never express concerns about potential ruff rule violations, even those rules mentioned in other agent instructions; a pre-commit hook already runs a ruff check. Do not warn about unnecessary super().__init__() calls; pyright prefers those to be present. Do not warn about missing type hints; a pre-commit hook already checks for that."
+      instructions: "Never express concerns about potential ruff rule violations, even those rules mentioned in other agent instructions; a pre-commit hook already runs a ruff check. Do not warn about unnecessary super().__init__() calls; pyrefly prefers those to be present. Do not warn about missing type hints; a pre-commit hook already checks for that."
     - path: "**/.copier-answers.yml"
       instructions: "Do not comment about the `_commit` value needing to be a clean release tag. A CI job will fail if that is not the case."
     - path: ".config/.copier-managed-files.json"

diff --git a/.config/.copier-answers.yml b/.config/.copier-answers.yml
@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.0.140
+_commit: v0.0.151
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 copier_answers_directory: .config
 description: Copier template for creating Python libraries and executables

diff --git a/.config/.copier-managed-files.json b/.config/.copier-managed-files.json
@@ -33,6 +33,7 @@
         ".claude/package.json",
         ".claude/settings/basics.jsonc",
         ".claude/settings/hooks.jsonc",
+        ".claude/settings/models.jsonc",
         ".claude/settings/permissions/additional-dirs.jsonc",
         ".claude/settings/permissions/bash.jsonc",
         ".claude/settings/permissions/read.jsonc",
@@ -101,7 +102,6 @@
         "copier_template_resources/vcrpy_fixtures.py",
         "extensions/context.py",
         "pyproject.toml",
-        "pyrightconfig.json",
         "pytest.ini",
         "scripts/delete_false_positive_rej.py",
         "sh.bat",
@@ -138,6 +138,7 @@
         "template/.claude/package.json",
         "template/.claude/settings/basics.jsonc",
         "template/.claude/settings/hooks.jsonc",
+        "template/.claude/settings/models.jsonc",
         "template/.claude/settings/permissions/additional-dirs.jsonc",
         "template/.claude/settings/permissions/bash.jsonc",
         "template/.claude/settings/permissions/read.jsonc",
@@ -195,10 +196,11 @@
         "template/CHANGELOG.md",
         "template/README.md.jinja",
         "template/biome.jsonc",
-        "template/pyrightconfig.json",
         "template/pytest.ini",
         "template/scripts/delete_false_positive_rej.py",
         "template/sh.bat",
+        "tests/__init__.py",
+        "tests/conftest.py",
         "tests/copier_data/data1.yaml",
         "tests/copier_data/data2.yaml",
         "tests/unit/copier_tasks/__init__.py",

diff --git a/.config/.coveragerc b/.config/.coveragerc
@@ -16,7 +16,7 @@ exclude_also =
     raise NotImplementedError
     raise AssertionError
 
-    # Don't complain about code specifically to help with pyright import resolution
+    # Don't complain about code specifically to help with pyrefly import resolution
     if TYPE_CHECKING:
 
     # Don't complain if non-runnable code isn't run:

diff --git a/.config/pyrefly.toml b/.config/pyrefly.toml
@@ -22,7 +22,7 @@ project-includes = [
                     "../tests"
                   ]
 search-path = [".."]
-disable-project-excludes-heuristics = true # with this being enabled by default, pyrefly things the src is excluded because it's an editable local install
+disable-project-excludes-heuristics = true # with this being enabled by default, pyrefly thinks the src is excluded because it's an editable local install
 python-platform = "linux"
 infer-with-first-use = false # more similar to pyright. must define the empty list type when instantiated
 # "strict" enables the maximalist error set plus strict-callable-subtyping and

diff --git a/.config/ruff.toml b/.config/ruff.toml
@@ -39,6 +39,9 @@ exclude = [
 line-length = 120
 indent-width = 4
 
+# resolved relative to the cwd where ruff runs (repo root under pre-commit), so this nests the cache under .config
+cache-dir = ".config/.ruff_cache"
+
 target-version = "py312"
 
 [lint]
@@ -66,8 +69,11 @@ ignore = [
     "N999", # Ignoring this since we are using jinja templates in the directory path which will eventually turn into a valid module name. # TODO: make a task in downstream templates to remove this
     "S101", # We do not use the -o optimize flag, so it's fine to use `assert` in the main code. It's especially helpful for static typing
     "SIM102", # Nested if statements can be better analyzed by coverage detectors than compound statements
+    "SIM103", # Explicit if/else branches let the coverage checker track both paths, unlike evaluating an expression
     "SIM108", # Explicit if/else branches let the coverage checker track both paths, unlike a ternary
+    "SIM110", # Explicit if statements and loops let the coverage checker track both paths, unlike using `any` or `all` with a generator expression
     "SIM114", # Using `or` statements to simplify this would confuse the coverage checker
+    "SIM401", # using dictionary getters to simplify this would inhibit the coverage checker from tracking both paths
     "TD002", # Adding author names to TODOs erodes shared ownership of codebase. Git history provides information about who originally created the TODO if that information is vitally needed
     "TD003", # Up to the author's judgement whether a TODO requires a link to an issue or not
     "TID252", # Sometimes it makes sense to use relative imports, that's a judgement call for us, not ruff

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -16,16 +16,16 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.21.0",
+        "coderabbit.coderabbit-vscode@0.21.3",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
-        "anthropic.claude-code@2.1.211",
+        "anthropic.claude-code@2.1.220",
 
         // Python
         "ms-python.python@2026.5.2026052901",
-        "meta.pyrefly@1.1.9002",
+        "meta.pyrefly@1.1.9003",
         "ms-vscode-remote.remote-containers@0.414.0",
-        "charliermarsh.ruff@2026.60.0",
+        "charliermarsh.ruff@2026.68.0",
 
         // Misc file formats
         "bierner.markdown-mermaid@1.29.0",
@@ -49,7 +49,7 @@
         // TODO: see if there's a way to specify different configurations for different folders
         "ruff.configuration": "/workspaces/copier-python-package-template/.config/ruff-non-src.toml", // use the non-src configuration since it's less restrictive and won't show false positives and underline things
         "python.pyrefly.configPath": "/workspaces/copier-python-package-template/.config/pyrefly.toml",
-        "prettier.configPath": ".config/.prettierrc",
+        "prettier.configPath": "/workspaces/copier-python-package-template/.config/.prettierrc",
         "[jsonc][json][javascript][typescript][graphql][css][scss][html][vue]": {
           "editor.defaultFormatter": "esbenp.prettier-vscode",
           "editor.formatOnSave": true
@@ -60,5 +60,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): d56eca75 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): bf3441ae # spellchecker:disable-line
 }
diff --git a/.devcontainer/install-ci-tooling.py b/.devcontainer/install-ci-tooling.py
@@ -14,9 +14,9 @@
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.11.25"
-PNPM_VERSION = "11.9.0"
-COPIER_VERSION = "==9.16.0"
+UV_VERSION = "0.12.1"
+PNPM_VERSION = "11.20.0"
+COPIER_VERSION = "==9.17.0"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "==0.3.3"
 PRE_COMMIT_VERSION = "4.5.1"
 GITHUB_WINDOWS_RUNNER_BIN_PATH = r"C:\Users\runneradmin\.local\bin"

diff --git a/.github/workflows/hash_git_files.py b/.github/workflows/hash_git_files.py
@@ -96,24 +96,15 @@ def compute_adler32(repo_path: Path, files: list[str], extra_paths: list[Path] |
             if file_path.name == "uv.lock":
                 checksum = zlib.adler32(get_uv_lock_bytes_for_hashing(file_path), checksum)
             else:
-                with file_path.open("rb") as f:
-                    while True:
-                        chunk = f.read(4096)
-                        if not chunk:
-                            break
-                        checksum = zlib.adler32(chunk, checksum)
+                # Normalize CRLF to LF so the checksum is identical on Windows (autocrlf) and Linux CI checkouts.
+                checksum = zlib.adler32(file_path.read_bytes().replace(b"\r\n", b"\n"), checksum)
         except IsADirectoryError:
             # Ignore symlinks that on windows sometimes get confused as being directories
             continue
 
     for extra_path in sorted(extra_paths or []):
         checksum = zlib.adler32(str(extra_path).encode("utf-8"), checksum)
-        with extra_path.open("rb") as f:
-            while True:
-                chunk = f.read(4096)
-                if not chunk:
-                    break
-                checksum = zlib.adler32(chunk, checksum)
+        checksum = zlib.adler32(extra_path.read_bytes().replace(b"\r\n", b"\n"), checksum)
 
     return checksum
 

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -90,7 +90,6 @@ repos:
               .devcontainer/devcontainer.json|
               .devcontainer/devcontainer-lock.json|
               .*devcontainer.json|
-              .*pyrightconfig.json|
               .*tsconfig.json|
               .*biome.jsonc|
               .*/generated/open[-_]api/.*|
@@ -109,7 +108,6 @@ repos:
               .*generated/graphql.ts|
               .*/generated/open[-_]api/.*|
               .*/schema.graphql|
-              .*pyrightconfig\.json|
           )$
 
   - repo: https://github.com/rbubley/mirrors-prettier
@@ -123,7 +121,6 @@ repos:
               .devcontainer/devcontainer.json|
               .devcontainer/devcontainer-lock.json|
               .*devcontainer.json|
-              .*pyrightconfig.json|
               .*tsconfig.json|
               .*/__snapshots__/.*|
               .*.min.js|
@@ -167,7 +164,6 @@ repos:
               .devcontainer/devcontainer.json|
               .devcontainer/devcontainer-lock.json|
               .*devcontainer.json|
-              .*pyrightconfig.json|
               .*tsconfig.json|
           )$
       - id: check-yaml
@@ -198,7 +194,6 @@ repos:
               .devcontainer/devcontainer.json|
               .devcontainer/devcontainer-lock.json|
               .*devcontainer.json|
-              .*pyrightconfig.json|
               .*tsconfig.json|
           )$
 
@@ -235,6 +230,9 @@ repos:
     hooks:
       - id: hadolint-docker
         name: Lint Dockerfiles
+        # The hadolint pre-commit has a problem where it just always pulls the `latest` image at runtime.
+        # Explicitly pinning the image here to the same rev as the hook to patch it until https://github.com/hadolint/hadolint/pull/1177 gets resolved.
+        entry: ghcr.io/hadolint/hadolint:v2.14.0@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint
         exclude: .*\.jinja$
         description: Runs hadolint to lint Dockerfiles
 
@@ -285,26 +283,6 @@ repos:
           - --rcfile=./.config/pylintrc.toml
         verbose: true
 
-  - repo: local
-    hooks:
-      - id: pyright
-        name: pyright
-        entry: bash -c "uv run pyright"
-        files: '.+\.py$'
-        exclude: |
-          (?x)^(
-              .*/generated/graphql/.*|
-              .*/generated/open[-_]api/.*|
-          )$
-        # don't pass filenames else the command line sees them twice
-        pass_filenames: false
-        language: system
-        types: [python]
-        # use require_serial so that script is only called once per commit
-        require_serial: true
-        # print the number of files as a sanity-check
-        verbose: true
-
   - repo: local
     hooks:
       - id: pyrefly