Align AGENTS.md with current review conventions

- invalid module options: fail() and return False from options(), no exit() (#1346)
- concise code, no stub variables and fail() over warning() apply to all code
- one-line call rule also covers raise and log calls
- e2e lines use the file's placeholders, never real targets or credentials
- name sanitize_path_component() and allow lazy imports of heavy deps (#1475)
- drop the duplicate ruff bullet
- take the AGENTS.md lines from #1383

AGENTS.md

@@ -7,10 +7,18 @@
 
 # Coding style
 
+- Never add a comment or docstring at the top of a Python file unless that file already has a top-of-file comment or docstring.
+- In parenthesized Python import blocks, group multiple imported names on each line instead of placing every name on its own line.
+- Keep function and method call arguments on one line when practical, including `raise` and log calls; format object literals for readability.
+- Keep comments short and precise. Use block form for docstrings and other long text.
 - Assume ordinary LDAP searches and LDAP response parsing do not raise exceptions; do not wrap them in `try`/`except`.
 - Always bind caught exceptions as `e`, not `error` or another name.
 - Do not prefix function or method names with underscores; preserve required Python special methods such as `__init__`.
 - Do not assume the host runs Linux; keep code and paths cross-platform unless the task explicitly targets one operating system.
+- Keep implementations as short and concise as practical. Prefer direct control flow and shared error handling over wrappers, redundant branches, or defensive boilerplate.
+- Avoid stub variables that merely hold a value for one immediate use. Pass data directly unless a local name improves clarity, prevents repeated work, or represents meaningful state.
+- Do not use `.warning()` logging. Use `.fail()` when logic or an operation fails.
+- If unsure about anything, ask for clarification before proceeding.
 
 # NetExec protocol structure
 
@@ -23,26 +31,21 @@
 - In files under `nxc/modules/`, do not define variables, constants, or helper functions at module scope.
 - Keep all module-specific state, constants, and helper methods inside the `NXCModule` class.
 - Module scope should contain only imports and the `NXCModule` class definition.
-- When a module must terminate for invalid options, import `exit` with `from sys import exit` and call `exit(...)`; do not use `import sys` with `sys.exit(...)`.
+- When module options are invalid, log the reason with `context.log.fail()` and `return False` from `options()`; do not call `exit()`.
 - Do not over-validate module options. Check only that required arguments are present, mutually exclusive arguments are not combined, or a value would otherwise cause the module to fail before performing its normal lookup or operation.
 - Do not validate whether user-supplied object names, identifiers, or similar values are semantically correct when the underlying protocol lookup can handle them; let a misspecified value produce the normal "not found" result.
-- Avoid stub variables that merely hold a value for one immediate use. Pass data directly unless a local name improves clarity, prevents repeated work, or represents meaningful state.
-- Keep module implementations as short and concise as practical. Prefer direct control flow and shared error handling over wrappers, redundant branches, or defensive boilerplate.
-- Do not optimize module code for line length; long lines are acceptable when they keep straightforward logic together.
-- Do not use `.warning()` logging in NetExec modules. Use `.fail()` when logic or an operation fails.
-- Run `ruff check .` after every coding session.
 
 # Development and validation
 
 - To verify that a module works, run the module's actual NetExec command instead of pytest or compilation checks.
-- Record every module-verification command in `tests/e2e_commands.txt`.
+- Record every module-verification command in `tests/e2e_commands.txt` using the file's placeholders (`TARGET_HOST`, `LOGIN_USERNAME`, `LOGIN_PASSWORD`, `KERBEROS`), never real targets or credentials.
 - Do not run compilation checks.
 - Run Ruff after completing a coding session.
 
 # Filesystem and source conventions
 
 - Assume that the underlying operating system and its storage are fully secure. Files and other data produced by NetExec may intentionally contain readable plaintext credentials; do not add encryption, redaction, restrictive permission handling, or permission warnings unless explicitly requested.
-- Before opening, creating, writing, renaming, moving, or deleting a file or directory, sanitize every path component derived from untrusted data and verify that the resulting path cannot traverse outside its intended base directory.
+- Before opening, creating, writing, renaming, moving, or deleting a file or directory, sanitize every path component derived from untrusted data with `sanitize_path_component()` from `nxc/helpers/path.py` and verify that the resulting path cannot traverse outside its intended base directory.
 - Place every file and directory produced by NetExec under `NXC_PATH` by default, using `TMP_PATH` for temporary artifacts. An explicit user-provided output path or task requirement may override this default.
 - `NXC_PATH` defaults to `~/.nxc` but may be overridden by the environment. Import and use `NXC_PATH` or its derived path constants instead of hardcoding `~/.nxc`.
-- Place imports at the top of files unless explicitly instructed otherwise.
+- Place imports at the top of files unless explicitly instructed otherwise; only a heavy, rarely used dependency on a hot path, such as protocol loading, may be imported where it is used.