Add is_autoclose_suspended() function that checks for a per-app
suspend file dated today. When suspended, launches the app directly
without the auto-close timer via exec.
- generate_blunder_tests.py: use 'or' instead of ternary (FURB110)
- music_generator.py: use 'or' instead of ternary (FURB110), fix type: ignore
- random_digits.py: use rsplit with maxsplit instead of split (PLC0207)
- Replace module-level globals with _mp_state dict (PLW0603)
- Use hashlib.sha256 instead of md5 (S324)
- Use secrets.randbelow instead of random.randrange (S311)
- Use tempfile.gettempdir() instead of hardcoded /tmp (S108)
- Replace assert statements with RuntimeError (S101)
- Add type annotations and docstrings to focus_mode_daemon.py, transcribe_fw.py, transcribe_helpers.py
- Use logging module instead of print
- Fix bare except clauses with specific exception types
- Replace print() with logging module throughout
- Add type annotations and Google docstrings to all functions
- Introduce DeckInput and LessonConfig dataclasses to reduce function parameters
- Use specific exception types instead of bare except (BLE001)
- Remove all noqa suppression comments
- Fix test fixtures: remove unused _capsys/_tmp_path parameters
- Replace print() with logging module
- Add type annotations to all functions
- Add Google-style docstrings to all public functions/classes
- Extract magic numbers into named constants
- Break complex functions into smaller helpers
- Use Path.open() instead of open()
- Use contextlib.suppress where appropriate
- Replace stored phone_config.txt with _get_wireless_serial() which
parses 'adb devices' and auto-picks the ip:port (wireless) entry
- Replace _scan_phone_port-based reconnect with _try_wireless_reconnect
that scans local /24 subnet on port 5555 via parallel probing
- Add _get_local_subnet_prefix() using UDP socket trick (8.8.8.8:80)
- Remove PHONE_CONFIG_FILE, _load_phone_config, _save_phone_config,
_save_connected_device_config, _scan_phone_port
- No config file needed; device is always discovered dynamically
- 112 tests passing
- ADB check runs in background thread (ThreadPoolExecutor) so the UI
remains responsive while checking StrongLifts on the phone
- Poll result every 500ms via root.after instead of blocking main thread
- Show success screen for 1.5s before auto-unlocking when verified
- Target specific ADB device via -s flag using saved phone_config.txt
to avoid errors when multiple devices (USB + wireless) are connected
- Demo mode uses local grab_set() instead of grab_set_global() so it
works alongside other fullscreen apps
- Stub _start_phone_check in create_locker to prevent background threads
leaking into unrelated tests (fixes flaky test_run_adb_success)
- 112 tests passing, 100% branch coverage
- Add enforce-resolved.sh: validates ReadEtcHosts=yes, prevents
DNSOverTLS bypass, removes drop-in overrides, locks drop-in dir
- Add resolved-guard.path/service: watches /etc/systemd/resolved.conf
and its drop-in directory for tampering
- Update pacman hooks to unlock/relock nsswitch.conf and resolved.conf
alongside /etc/hosts during package transactions
- Extend setup_hosts_guard.sh with --skip-resolved option, resolved
canonical snapshot, drop-in directory locking, and enforcement
- Add resolved.conf checks to check_and_enable_services.sh: validates
ReadEtcHosts, DNSOverTLS, drop-in overrides, immutable attribute,
and resolved-guard.path status with auto-fix capability
Fixed on live system: ReadEtcHosts was set to 'no' and nsswitch.conf
was missing 'files' in the hosts line, completely bypassing /etc/hosts.
