fix(toolkit): address dojo-code-reviewer feedback on PR #44 (DOJ-4872)

Bot review at 3/5 confidence flagged 2 P2 + 2 P3. All four addressed:

P2 — commands/verify.md ref normalization
  - The behavior section assumed every <ref> arg was a bare branch name
    and unconditionally prefixed `origin/`, breaking `origin/develop`
    (→ `origin/origin/develop`), tags (`v1.31.0` → `origin/v1.31.0`),
    and SHAs. Added a normalization step at the top of the pipeline:
      * `refs/tags/<tag>` for tag inputs (fetched via `git fetch origin
        tag <tag> --quiet`)
      * bare SHA for already-local commits (skips fetch entirely;
        commits are immutable)
      * `origin/<branch>` left as-is when user passes `origin/...`
      * `origin/<branch>` only synthesized for bare branch input
  - Dropped the `-C "$REPO"` indirection — the slash command's cwd is
    the repo root, no need for the hardcoded variable that would fail
    when unset.
  - Updated the verdict-line shape to `<resolved-ref> @ <sha7>` so the
    citation reflects whatever normalization produced (tag refs, SHAs,
    branch refs all render correctly). Added tag + SHA examples.
  - Expanded the Edge cases section: `origin/<branch>` input, tag input,
    commit SHA input, ref not found.

P2 — hooks/pre-tool-use-claim-verification.sh line 116
  - The bare-FS detector regex `(ls|find|cat|head)[[:space:]]` failed
    to match the command-as-last-token cases like a bare `ls` invocation
    or `cd src && ls` (no trailing whitespace). Switched the trailing
    class to `([[:space:]]|$)` so end-of-string also matches.

P3 — hooks/pre-tool-use-claim-verification.sh line 162
  - Same fix in the suggester branch for `ls`: `ls[[:space:]]` →
    `ls([[:space:]]|$)` so the ls-specific replacement text is emitted
    even when the command ends in `ls`.

P3 — hooks/pre-tool-use-claim-verification.sh line 181
  - Same fix in the suggester branch for `find`: `find[[:space:]]` →
    `find([[:space:]]|$)`.

Verification:
  - shellcheck hooks/pre-tool-use-claim-verification.sh → 0 issues
  - bash hooks/pre-tool-use-claim-verification.sh "ls"           → warn (new)
  - bash hooks/pre-tool-use-claim-verification.sh "cd src && ls" → warn (new)
  - bash hooks/pre-tool-use-claim-verification.sh "ls src/foo"   → warn (regression)
  - bash hooks/pre-tool-use-claim-verification.sh "echo hello"   → silent (regression)
  - bash hooks/pre-tool-use-claim-verification.sh "find"         → warn (new)

Created by Claude Code on behalf of @lapc506.

Author: lapc506

commands/verify.md

@@ -35,78 +35,127 @@ branch name is passed.
 
 ## Behavior
 
-1. **Anchor.** Print the current local checkout state so the reader knows
+The command executes in the current workspace (the directory the slash
+command was invoked from). No `-C "$REPO"` indirection — the cwd is the
+repo. The `<ref>` argument is normalized once at the top so the rest of the
+pipeline handles bare branch names, `origin/<branch>`, tags, and SHAs
+uniformly.
+
+1. **Normalize the ref.** Decide which fully-qualified ref to query, and
+   whether a remote fetch makes sense for that ref:
+
+   ```bash
+   RAW_REF="$1"
+   FETCH_TARGET=""   # what to pass to `git fetch origin <…> --quiet`; empty = skip
+   RESOLVED_REF=""   # what to pass to git show / ls-tree / grep
+
+   if   git rev-parse --verify --quiet "refs/tags/$RAW_REF" >/dev/null; then
+     # Annotated/lightweight tag, e.g. v1.31.0
+     RESOLVED_REF="refs/tags/$RAW_REF"
+     FETCH_TARGET="tag $RAW_REF"
+   elif [[ "$RAW_REF" =~ ^[0-9a-f]{7,40}$ ]] \
+        && git cat-file -e "$RAW_REF" 2>/dev/null; then
+     # Commit SHA (short or long) that already exists locally — no fetch.
+     RESOLVED_REF="$RAW_REF"
+   elif [[ "$RAW_REF" == origin/* ]]; then
+     # User explicitly wrote origin/<branch> — fetch the branch part,
+     # query the full origin/<branch> name.
+     RESOLVED_REF="$RAW_REF"
+     FETCH_TARGET="${RAW_REF#origin/}"
+   else
+     # Bare branch name (the common case) — fetch + query origin/<branch>.
+     RESOLVED_REF="origin/$RAW_REF"
+     FETCH_TARGET="$RAW_REF"
+   fi
+   ```
+
+2. **Anchor.** Print the current local checkout state so the reader knows
    where the agent was when the verdict was rendered:
 
    ```bash
-   git -C "$REPO" branch --show-current
-   git -C "$REPO" rev-parse HEAD
+   git branch --show-current
+   git rev-parse HEAD
    ```
 
-2. **Refresh the ref.** Always:
+3. **Refresh the ref** (skipped for already-local commit SHAs):
 
    ```bash
-   git -C "$REPO" fetch origin "$REF" --quiet
+   [ -n "$FETCH_TARGET" ] && git fetch origin $FETCH_TARGET --quiet
    ```
 
-3. **Resolve the ref's SHA** so the verdict can be re-checked later:
+4. **Resolve the ref's SHA** so the verdict can be re-checked later:
 
    ```bash
-   REF_SHA="$(git -C "$REPO" rev-parse --short "origin/$REF")"
+   REF_SHA="$(git rev-parse --short "$RESOLVED_REF")"
    ```
 
-4. **Route by argument shape.**
+5. **Route by argument shape.**
 
    - If `<path-or-pattern>` contains a `/` and has no shell-glob characters
      (no `*`, `?`, `[`, no leading quote), treat it as a path:
 
      ```bash
-     git -C "$REPO" ls-tree "origin/$REF" -- "$ARG"
+     git ls-tree "$RESOLVED_REF" -- "$ARG"
      # If the user wants file content:
-     git -C "$REPO" show "origin/$REF:$ARG" | head -50
+     git show "$RESOLVED_REF:$ARG" | head -50
      ```
 
    - Otherwise, treat it as a regex/pattern to grep across `src/`:
 
      ```bash
-     git -C "$REPO" grep -nF -- "$ARG" "origin/$REF" -- src/
+     git grep -nF -- "$ARG" "$RESOLVED_REF" -- src/
      # If the user passes a regex (contains regex metachars), drop -F:
-     git -C "$REPO" grep -nE -- "$ARG" "origin/$REF" -- src/
+     git grep -nE -- "$ARG" "$RESOLVED_REF" -- src/
      ```
 
-5. **Emit a single verdict line** in this exact shape so it can be pasted
+6. **Emit a single verdict line** in this exact shape so it can be pasted
    verbatim into Linear, GitHub, or Slack:
 
    ```text
-   origin/<ref> @ <sha7> — <path-or-pattern> <PRESENT|NOT PRESENT|N MATCHES>
+   <resolved-ref> @ <sha7> — <path-or-pattern> <PRESENT|NOT PRESENT|N MATCHES>
    ```
 
-   Examples:
+   `<resolved-ref>` is whatever the normalization step produced —
+   `origin/<branch>` for bare/branch input, `origin/origin-typo-guarded` for
+   `origin/…` input (never doubled), `refs/tags/v1.31.0` for tag input, the
+   bare SHA for SHA input. Examples:
 
    ```text
    origin/develop @ c513198 — src/pages/PathDetailPage.tsx PRESENT
    origin/develop @ c513198 — src/hooks/path/usePathwayViewModel.ts NOT PRESENT
    origin/main @ a3f9c21 — buildPathwayUrl 7 MATCHES (src/utils/url.ts, src/hooks/...)
+   refs/tags/v1.31.0 @ 0e2af72 — hooks/pre-tool-use-claim-verification.sh PRESENT
+   c513198 @ c513198 — README.md PRESENT
    ```
 
-6. **Never read the working tree** to answer this question. No `ls`, no
+7. **Never read the working tree** to answer this question. No `ls`, no
    `grep -rn src/`, no `find`. If `git cat-file -e` and a stray `ls`
    disagree, **the ref wins**.
 
 ## Edge cases
 
-- **Ref not found / no upstream:** print `origin/<ref> NOT FOUND — did you
-  mean origin/main?` and exit with the suggestion. Don't fall back to the
-  working tree.
+- **`origin/<branch>` input (already qualified):** the normalization step
+  detects the `origin/` prefix and queries `origin/<branch>` as-is — no
+  doubling like `origin/origin/develop`.
+- **Tag input (`v1.31.0`, etc.):** normalized to `refs/tags/<tag>`. The
+  fetch uses `git fetch origin tag <tag> --quiet` to refresh the tag ref
+  specifically (without pulling other refs).
+- **Commit SHA input (7-40 hex chars):** normalized to the bare SHA. Skips
+  the fetch when the commit already exists locally; if the SHA is unknown
+  locally, falls through to the bare-branch branch and lets the fetch
+  surface the error.
+- **Ref not found / no upstream:** print `<resolved-ref> NOT FOUND — did
+  you mean origin/main?` and exit with the suggestion. Don't fall back to
+  the working tree.
 - **Path with shell metacharacters:** quote `$ARG`. Treat as path if it
   contains `/`, otherwise as a pattern.
 - **Multiple worktrees:** the command operates in the worktree it's invoked
-  from but always queries `origin/<ref>` — the working tree's branch is
+  from but always queries the resolved ref — the working tree's branch is
   irrelevant. If the user is in a worktree on a different branch, the
   result is still authoritative for the named ref.
 - **Squash-merged PRs:** `origin/<branch>` is rewritten on squash-merge; a
   pre-merge `git fetch` you ran 10 minutes ago is stale. The command always
-  re-fetches.
+  re-fetches (except for already-local commit SHAs, which are immutable).
 
 ## Why
 

hooks/pre-tool-use-claim-verification.sh

@@ -106,7 +106,7 @@ is_bare_fs_op() {
   # after a command separator (; | && ||). Use ERE so we can express the
   # leading-position constraint without shellcheck flagging redundant case
   # globs (SC2221/SC2222).
-  if printf '%s' "$cmd" | grep -qE '(^|[;&|][[:space:]]*)(ls|find|cat|head)[[:space:]]'; then
+  if printf '%s' "$cmd" | grep -qE '(^|[;&|][[:space:]]*)(ls|find|cat|head)([[:space:]]|$)'; then
     return 0
   fi
   if printf '%s' "$cmd" | grep -qE 'grep[[:space:]]+-[rRnliN]+'; then
@@ -153,7 +153,7 @@ fi
 
 # Best-effort suggested replacement, branched by detected op.
 SUGGESTED=""
-if printf '%s' "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)ls[[:space:]]'; then
+if printf '%s' "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)ls([[:space:]]|$)'; then
   # Extract the path argument (best-effort, first non-flag token after ls).
   path_arg="$(printf '%s' "$COMMAND" \
     | sed -E 's/^.*ls[[:space:]]+(-[A-Za-z]+[[:space:]]+)*//' \
@@ -178,7 +178,7 @@ elif printf '%s' "$COMMAND" | grep -qE 'grep[[:space:]]+-[rRnliN]+'; then
   else
     SUGGESTED="git fetch origin <branch> --quiet && git grep \"<pattern>\" origin/<branch> -- src/"
   fi
-elif printf '%s' "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)find[[:space:]]'; then
+elif printf '%s' "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)find([[:space:]]|$)'; then
   SUGGESTED="git fetch origin <branch> --quiet && git ls-tree -r origin/<branch> -- <path> | grep <pattern>"
 else
   SUGGESTED="git fetch origin <branch> --quiet && git show origin/<branch>:<path>"