Update CLAUDE.md and package.json with new check scripts

Co-authored-by: Claude <claude@anthropic.com>

Author: titouanmathis

CLAUDE.md

@@ -4,9 +4,10 @@ Instructions for AI agents contributing to this codebase.
 
 ## Git & Commits
 
-- Commit messages: English, simple verb-first sentences (e.g., "Add...", "Fix...", "Update...")
-- Always add `Co-authored-by: Claude <claude@anthropic.com>` trailer
-- **Tags**: Do NOT use `v` prefix (use `0.4.0` not `v0.4.0`)
+<!-- Commit format, Co-authored-by trailer, and tag prefix rules are enforced by git hooks:
+     .husky/commit-msg → scripts/check-commit-msg.sh
+     .husky/pre-push   → rejects v-prefixed tags -->
+
 - **Releases**: Do NOT create GitHub releases manually — they are created automatically by GitHub Actions when a tag is pushed
 
 ## Changelog
@@ -230,12 +231,10 @@ These rules are **mandatory** for all code in this monorepo:
 
 3. **File system operations must be mocked.** Never read/write real user files in tests.
 
-4. **Test file conventions:** Tests are colocated with source files: `foo.ts` → `foo.test.ts` in the same directory. CLI command tests live in their respective `src/commands/<resource>/` directory.
+4. **Test file conventions:** Tests are colocated with source files: `foo.ts` → `foo.test.ts` in the same directory. CLI command tests live in their respective `src/commands/<resource>/` directory. Run `npm run check:tests` to find missing test files.
 
 5. **No real API calls in tests.** All HTTP requests must be mocked via DI (injected `fetch`) or mock API objects.
 
-6. **Vitest configuration:** Root `vitest.config.ts` uses `projects: ['packages/*']` for single-process test runs across all packages. Each package has its own `vitest.config.ts`.
-
 After changing `productive-core` source, rebuild before running CLI/MCP tests:
 
 ```bash
@@ -263,12 +262,20 @@ npm run lint               # oxlint
 npm run lint:fix           # oxlint --fix
 npm run format             # oxfmt --write
 npm run typecheck          # TypeScript check (all workspaces)
+npm run check              # All static checks: lint + format + typecheck + test colocation
+npm run check:tests        # Report source files missing colocated .test.ts
 npm run semgrep            # Security/quality scan
 npm run version:patch      # Bump patch version across all packages
 npm run version:minor      # Bump minor version
 npm run version:major      # Bump major version
 ```
 
+### Git Hooks (via Husky)
+
+- **pre-commit**: lint-staged (oxlint + oxfmt) + semgrep secrets scan
+- **commit-msg**: validates commit format (capitalized verb, no conventional commits, Co-authored-by trailer)
+- **pre-push**: rejects v-prefixed tags, then build + test
+
 ## Adding a New Resource (step-by-step)
 
 When adding a new Productive.io resource (e.g., `invoices`):

package.json

@@ -40,6 +40,9 @@
     "typecheck": "npm run typecheck --workspaces",
     "semgrep": "semgrep scan --config p/typescript --config p/nodejs --config p/secrets --config p/owasp-top-ten --error --exclude='node_modules' --exclude='dist' --exclude='coverage' .",
     "semgrep:secrets": "semgrep scan --config p/secrets --error --quiet --exclude='node_modules' --exclude='dist' --exclude='coverage' .",
+    "check:tests": "sh scripts/check-test-colocation.sh",
+    "check:commit-msg": "sh scripts/check-commit-msg.sh",
+    "check": "npm run lint && npm run format:check && npm run typecheck && npm run check:tests",
     "clean": "rm -rf packages/*/dist packages/*/node_modules node_modules",
     "version:patch": "npm version --include-workspace-root --workspaces --no-git-tag-version patch",
     "version:minor": "npm version --include-workspace-root --workspaces --no-git-tag-version minor",