diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 95a52f3f..3a0244fc 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -41,21 +41,35 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: "20"
+          cache: "npm"
+
       - name: Install quality tools
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
           pip install .[dev]
 
-      - name: Run canonical quality gate
+      - name: Install JS dependencies for changed-file gate and audit
+        run: npm ci --ignore-scripts
+
+      - name: Run changed-file quality gate on pull requests
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          set -o pipefail
+          python scripts/run_changed_quality_gate.py 2>&1 | tee quality-gate.log
+
+      - name: Run canonical quality gate on pushes
+        if: github.event_name == 'push'
         shell: bash
         run: |
           set -o pipefail
           python scripts/run_quality_gate.py --python-only --skip-tests 2>&1 | tee quality-gate.log
 
-      - name: Install JS dependencies for audit
-        run: npm ci --ignore-scripts
-
       - name: Audit JS dependencies
         run: npm audit --audit-level=high
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 141acb22..d7156085 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,3 +1,5 @@
+default_install_hook_types: [pre-commit, pre-push]
+
 minimum_pre_commit_version: "3.6.0"
 
 repos:
@@ -20,21 +22,34 @@ repos:
         language: system
         pass_filenames: false
 
-      - id: ruff
-        name: Ruff
-        entry: python -m ruff check
+      - id: ruff-fix
+        name: Ruff autofix
+        entry: python -m ruff check --fix --exit-non-zero-on-fix
         language: system
+        types: [python]
+
+      - id: eslint-fix
+        name: ESLint autofix
+        entry: npm exec eslint --fix
+        language: system
+        files: ^js/.*\.(js|mjs|vue)$
+
+      - id: prettier-write
+        name: Prettier write
+        entry: npm exec prettier --write
+        language: system
+        files: ^js/.*\.(js|mjs|vue)$
 
       - id: mypy
-        name: Mypy (manual / pre-push)
+        name: Mypy (pre-push / manual)
         entry: python -m mypy --config-file mypy.ini
         language: system
         pass_filenames: false
-        stages: [commit, pre-push, manual]
+        stages: [pre-push, manual]
 
       - id: quality-gate
-        name: Quality gate (manual / pre-push)
-        entry: python scripts/run_quality_gate.py --python-only --skip-tests
+        name: Changed-file quality gate (pre-push / manual)
+        entry: python scripts/run_changed_quality_gate.py
         language: system
         pass_filenames: false
         stages: [pre-push, manual]
diff --git a/README.md b/README.md
index c23173c6..2f9746a0 100644
--- a/README.md
+++ b/README.md
@@ -835,15 +835,21 @@ Test reports: `tests/__reports__/index.html`
 
 ### Code Quality
 ```bash
+# Install local git hooks once
+python scripts/install_local_hooks.py
+
 # Canonical repo quality gate
 python scripts/run_quality_gate.py
 
 # Fast Python-only gate
 python scripts/run_quality_gate.py --python-only --skip-tests
 
+# Fast local pre-push equivalent on changed files
+python scripts/run_changed_quality_gate.py
+
 # Individual checks
 mypy --config-file mypy.ini
-python -m ruff check mjr_am_backend mjr_am_shared tests scripts __init__.py
+python -m ruff check --fix mjr_am_backend mjr_am_shared tests scripts __init__.py
 bandit -r mjr_am_backend -ll -ii -x tests
 pip-audit -r requirements.txt
 python scripts/check_cc_changed.py
@@ -853,9 +859,10 @@ python scripts/check_cc_changed.py
 1. Fork the repository
 2. Create a feature branch
 3. Install contributor dependencies: `pip install -r requirements-dev.txt`
-4. Make your changes
-5. Run tests: `run_tests.bat`
-6. Submit a pull request
+4. Install local hooks: `python scripts/install_local_hooks.py`
+5. Make your changes
+6. Run tests: `run_tests.bat`
+7. Submit a pull request
 
 See [`docs/TESTING.md`](docs/TESTING.md), [`tests/README.md`](tests/README.md), and [`docs/DEPENDENCY_POLICY.md`](docs/DEPENDENCY_POLICY.md) for detailed contributor guidance.
 
diff --git a/docs/TESTING.md b/docs/TESTING.md
index b2c5898a..1d893352 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -1,6 +1,6 @@
 # Testing
 
-**Version**: 2.4.4  
+**Version**: 2.4.4
 **Last Updated**: April 5, 2026
 
 This project uses **pytest** (backend) and **Vitest** (frontend) for comprehensive test coverage. On Windows, batch runners are provided for convenience and generate both:
@@ -11,6 +11,7 @@ Before running the quality gate or local tests, install contributor tooling:
 
 ```bash
 pip install -r requirements-dev.txt
+python scripts/install_local_hooks.py
 ```
 
 Runtime dependencies stay in `requirements.txt`; optional AI/vector dependencies stay in `requirements-vector.txt`. See `docs/DEPENDENCY_POLICY.md` for the canonical dependency policy.
@@ -94,7 +95,27 @@ The canonical gate runs encoding/BOM checks, `ruff`, `mypy`, `bandit`, `pip-audi
 
 The Python coverage gate currently enforces a minimum combined backend/shared coverage threshold of `60%`, which gives the CI pipeline a regression floor without making legacy cleanup block unrelated work.
 
-During the migration to stricter quality thresholds, `ruff` is enforced on changed Python files while repository-wide hygiene, security, and complexity checks continue to run across the repo. This keeps the gate hard for new work without turning legacy cleanup into a single big-bang change.
+During the migration to stricter quality thresholds, `ruff` is enforced with autofix on commit for changed Python files, while `mypy` and the changed-file complexity gate run on pre-push. The changed-file complexity threshold is aligned locally with the CI limit of `25`, and repository-wide hygiene, security, and complexity checks continue to run across the repo.
+
+## Local Hooks
+
+This repository ships local Git hooks via `pre-commit`:
+
+```bash
+python scripts/install_local_hooks.py
+```
+
+Installed behavior:
+- `pre-commit`: BOM/encoding hygiene, `ruff --fix`, `eslint --fix`, `prettier --write`
+- `pre-push`: mandatory `mypy` plus `scripts/run_changed_quality_gate.py`
+
+The changed-file quality gate is also runnable manually:
+
+```bash
+python scripts/run_changed_quality_gate.py
+```
+
+For frontend tests in the Node Vitest environment, prefer the shared helpers in `js/tests/helpers/vitestEnvironment.mjs`. Team rule: use partial Vue mocks by default, based on the real `vue` module, instead of full replacement mocks.
 
 ## Batch runners (Windows)
 
@@ -136,4 +157,3 @@ If you don't want to commit large samples, you can point the test to an external
 $env:MJR_TEST_PARSER_DIR = "C:\path\to\parser"
 python -m pytest tests/metadata/test_parser_folder_scan.py -q
 ```
-
diff --git a/js/tests/grid_loader_adaptive_paging.vitest.mjs b/js/tests/grid_loader_adaptive_paging.vitest.mjs
index 7a6c9e31..4bb6b8fd 100644
--- a/js/tests/grid_loader_adaptive_paging.vitest.mjs
+++ b/js/tests/grid_loader_adaptive_paging.vitest.mjs
@@ -1,5 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+import { ensureWindowStub, mockPartialVue } from "./helpers/vitestEnvironment.mjs";
+
 const fetchGridPageMock = vi.hoisted(() => vi.fn());
 const appendAssetsMock = vi.hoisted(() => vi.fn());
 
@@ -13,13 +15,9 @@ function makeStorage() {
     };
 }
 
-vi.mock("vue", async () => {
-    const actual = await vi.importActual("vue");
-    return {
-        ...actual,
-        nextTick: async () => {},
-        reactive: (obj) => obj,
-    };
+mockPartialVue({
+    nextTick: async () => {},
+    reactive: (obj) => obj,
 });
 
 vi.mock("../api/client.js", () => ({
@@ -81,10 +79,7 @@ describe("useGridLoader adaptive paging", () => {
         vi.resetModules();
         vi.clearAllMocks();
         globalThis.sessionStorage = makeStorage();
-        globalThis.window = {
-            addEventListener: vi.fn(),
-            removeEventListener: vi.fn(),
-        };
+        ensureWindowStub();
     });
 
     it("increases page size when successive pages add no visible cards", async () => {
diff --git a/js/tests/helpers/vitestEnvironment.mjs b/js/tests/helpers/vitestEnvironment.mjs
new file mode 100644
index 00000000..8678b11e
--- /dev/null
+++ b/js/tests/helpers/vitestEnvironment.mjs
@@ -0,0 +1,60 @@
+import { vi } from "vitest";
+
+const vueMockState = vi.hoisted(() => ({
+    overrides: {},
+}));
+
+export function createWindowStub(overrides = {}) {
+    const listeners = new Map();
+    return {
+        addEventListener: vi.fn((type, listener) => {
+            const key = String(type || "");
+            const existing = listeners.get(key) || [];
+            existing.push(listener);
+            listeners.set(key, existing);
+        }),
+        removeEventListener: vi.fn((type, listener) => {
+            const key = String(type || "");
+            const existing = listeners.get(key) || [];
+            listeners.set(
+                key,
+                existing.filter((entry) => entry !== listener),
+            );
+        }),
+        dispatchEvent: vi.fn((event) => {
+            const key = String(event?.type || "");
+            for (const listener of listeners.get(key) || []) {
+                listener(event);
+            }
+            return true;
+        }),
+        ...overrides,
+    };
+}
+
+export function ensureWindowStub(overrides = {}) {
+    const current = globalThis.window;
+    if (
+        !current
+        || typeof current.addEventListener !== "function"
+        || typeof current.removeEventListener !== "function"
+    ) {
+        globalThis.window = createWindowStub(overrides);
+        return globalThis.window;
+    }
+    Object.assign(current, overrides);
+    return current;
+}
+
+vi.mock("vue", async () => {
+    const actual = await vi.importActual("vue");
+    return {
+        ...actual,
+        ...vueMockState.overrides,
+    };
+});
+
+
+export function mockPartialVue(overrides = {}) {
+    vueMockState.overrides = { ...overrides };
+}
diff --git a/js/tests/vitest.setup.mjs b/js/tests/vitest.setup.mjs
new file mode 100644
index 00000000..0e651eab
--- /dev/null
+++ b/js/tests/vitest.setup.mjs
@@ -0,0 +1,5 @@
+import { ensureWindowStub } from "./helpers/vitestEnvironment.mjs";
+
+if (typeof globalThis.window === "undefined") {
+    ensureWindowStub();
+}
diff --git a/mjr_am_backend/features/assets/rename_service.py b/mjr_am_backend/features/assets/rename_service.py
index 6d30e802..9c2c2925 100644
--- a/mjr_am_backend/features/assets/rename_service.py
+++ b/mjr_am_backend/features/assets/rename_service.py
@@ -11,6 +11,10 @@ from ...shared import Result
 from .models import AssetRenameTarget
 
 
+def _propagate_rename_error(result: Result[Any], default_code: str, default_error: str) -> Result[dict[str, Any]]:
+    return Result.Err(result.code or default_code, str(result.error or default_error))
+
+
 def _compute_rename_path(current_resolved: Path, new_name: str) -> Path:
     return current_resolved.parent / new_name
 
@@ -214,11 +218,11 @@ async def rename_asset_and_sync(
     new_path = _compute_rename_path(current_resolved, new_name)
     conflict_res = _check_rename_conflict(current_resolved, new_path, new_name)
     if not conflict_res.ok:
-        return conflict_res
+        return _propagate_rename_error(conflict_res, "CONFLICT", "File rename conflict")
 
     rename_res = _rename_file(current_resolved, new_path, safe_error_message=safe_error_message)
     if not rename_res.ok:
-        return rename_res
+        return _propagate_rename_error(rename_res, "RENAME_FAILED", "Failed to rename file")
 
     stat_res = await _stat_renamed_file(
         current_resolved,
@@ -228,7 +232,7 @@ async def rename_asset_and_sync(
         logger=logger,
     )
     if not stat_res.ok:
-        return stat_res
+        return _propagate_rename_error(stat_res, "FS_ERROR", "Failed to stat renamed file")
     mtime = int(stat_res.data or 0)
 
     update_res = await _update_rename_records(
@@ -272,4 +276,4 @@ async def rename_asset_and_sync(
     )
 
 
-__all__ = ["rename_asset_and_sync"]
\ No newline at end of file
+__all__ = ["rename_asset_and_sync"]
diff --git a/mjr_am_backend/features/assets/request_context_service.py b/mjr_am_backend/features/assets/request_context_service.py
index 5201f78c..def1bd23 100644
--- a/mjr_am_backend/features/assets/request_context_service.py
+++ b/mjr_am_backend/features/assets/request_context_service.py
@@ -11,6 +11,8 @@ from aiohttp import web
 from ...shared import Result
 from .models import AssetIdsContext, AssetPathContext, AssetRenameContext, AssetRouteContext
 
+ResolveSecurityPrefs = Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]]
+
 
 class PrepareAssetPathContext(Protocol):
     async def __call__(
@@ -22,7 +24,7 @@ class PrepareAssetPathContext(Protocol):
         max_requests: int,
         window_seconds: int,
         require_services: Callable[[], Awaitable[tuple[dict[str, Any] | None, Result[Any] | None]]],
-        resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+        resolve_security_prefs: ResolveSecurityPrefs,
         require_operation_enabled: Callable[..., Result[Any]],
         require_write_access: Callable[[web.Request], Result[Any]],
         check_rate_limit: Callable[[web.Request, str, int, int], tuple[bool, int | None]],
@@ -42,7 +44,7 @@ class PrepareAssetRenameContext(Protocol):
         max_name_length: int,
         validate_filename: Callable[[str], tuple[bool, str]],
         require_services: Callable[[], Awaitable[tuple[dict[str, Any] | None, Result[Any] | None]]],
-        resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+        resolve_security_prefs: ResolveSecurityPrefs,
         require_operation_enabled: Callable[..., Result[Any]],
         require_write_access: Callable[[web.Request], Result[Any]],
         check_rate_limit: Callable[[web.Request, str, int, int], tuple[bool, int | None]],
@@ -61,7 +63,7 @@ class PrepareAssetIdsContext(Protocol):
         max_requests: int,
         window_seconds: int,
         require_services: Callable[[], Awaitable[tuple[dict[str, Any] | None, Result[Any] | None]]],
-        resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+        resolve_security_prefs: ResolveSecurityPrefs,
         require_operation_enabled: Callable[..., Result[Any]],
         require_write_access: Callable[[web.Request], Result[Any]],
         check_rate_limit: Callable[[web.Request, str, int, int], tuple[bool, int | None]],
@@ -103,7 +105,7 @@ async def _check_operation_auth(
     *,
     operation: str,
     services: dict[str, Any],
-    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+    resolve_security_prefs: ResolveSecurityPrefs,
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
 ) -> Result[None]:
@@ -218,7 +220,7 @@ async def prepare_asset_path_context(
     max_requests: int,
     window_seconds: int,
     require_services: Callable[[], Awaitable[tuple[dict[str, Any] | None, Result[Any] | None]]],
-    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+    resolve_security_prefs: ResolveSecurityPrefs,
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[[web.Request, str, int, int], tuple[bool, int | None]],
@@ -306,7 +308,7 @@ async def prepare_asset_rename_context(
     max_name_length: int,
     validate_filename: Callable[[str], tuple[bool, str]],
     require_services: Callable[[], Awaitable[tuple[dict[str, Any] | None, Result[Any] | None]]],
-    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+    resolve_security_prefs: ResolveSecurityPrefs,
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[[web.Request, str, int, int], tuple[bool, int | None]],
@@ -360,7 +362,7 @@ async def prepare_asset_ids_context(
     max_requests: int,
     window_seconds: int,
     require_services: Callable[[], Awaitable[tuple[dict[str, Any] | None, Result[Any] | None]]],
-    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
+    resolve_security_prefs: ResolveSecurityPrefs,
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[[web.Request, str, int, int], tuple[bool, int | None]],
@@ -407,4 +409,4 @@ __all__ = [
     "prepare_asset_path_context",
     "prepare_asset_rename_context",
     "prepare_asset_route_context",
-]
\ No newline at end of file
+]
diff --git a/mjr_am_backend/routes/assets/route_actions_basic.py b/mjr_am_backend/routes/assets/route_actions_basic.py
index 69b4bcaf..51cc25d4 100644
--- a/mjr_am_backend/routes/assets/route_actions_basic.py
+++ b/mjr_am_backend/routes/assets/route_actions_basic.py
@@ -6,7 +6,7 @@ import os
 import shutil
 import subprocess
 import sys
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Mapping
 from pathlib import Path
 from typing import Any
 
@@ -135,7 +135,7 @@ async def handle_open_in_folder(
     normalize_path: Callable[[str], Path | None],
     read_json: Callable[[web.Request], Awaitable[Any]],
     require_services: Callable[[], Awaitable[tuple[dict[str, Any], Result[Any] | None]]],
-    resolve_security_prefs: Callable[[dict[str, Any]], Awaitable[dict[str, Any]]],
+    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[..., tuple[bool, int | None]],
@@ -207,7 +207,7 @@ async def handle_open_in_folder(
     for cmd in commands:
         try:
             _execute_command(cmd)
-            payload = {"opened": True, "selected": selected}
+            payload: dict[str, Any] = {"opened": True, "selected": selected}
             if cmd[0] == "xdg-open":
                 payload["fallback"] = "xdg-open"
             return json_response(Result.Ok(payload))
diff --git a/mjr_am_backend/routes/assets/route_actions_batch_delete.py b/mjr_am_backend/routes/assets/route_actions_batch_delete.py
index 3c735e19..48138fc2 100644
--- a/mjr_am_backend/routes/assets/route_actions_batch_delete.py
+++ b/mjr_am_backend/routes/assets/route_actions_batch_delete.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Mapping
 from pathlib import Path
 from typing import Any
 
@@ -16,6 +16,17 @@ def _delete_audit_target(asset_ids: list[int]) -> str:
     return f"assets:{','.join(str(value) for value in asset_ids[:25])}"
 
 
+def _result_err(result: Result[Any], default_code: str, default_error: str) -> Result[Any]:
+    return Result.Err(result.code or default_code, str(result.error or default_error))
+
+
+def _coerce_asset_id(value: Any) -> int | None:
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
 async def _load_found_assets(
     services: dict[str, Any],
     asset_ids: list[int],
@@ -93,7 +104,7 @@ def _validate_assets_for_deletion(
             is_resolved_path_allowed=is_resolved_path_allowed,
         )
         if not asset_res.ok:
-            return asset_res
+            return _result_err(asset_res, "INVALID_INPUT", "Failed to validate asset for deletion")
         validated_assets.append(asset_res.data or {})
     validated_assets.sort(key=lambda item: item["id"])
     return Result.Ok(validated_assets)
@@ -221,14 +232,18 @@ def _partial_delete_result(
     attempted: int,
 ) -> Result[dict[str, Any]]:
     failed_ids = [
-        int(item.get("asset_id"))
+        asset_id
         for item in file_deletion_errors
-        if isinstance(item, dict) and item.get("asset_id") is not None
+        if isinstance(item, dict)
+        for asset_id in [_coerce_asset_id(item.get("asset_id"))]
+        if asset_id is not None
     ]
     failed_ids += [
-        int(item.get("asset_id"))
+        asset_id
         for item in db_errors
-        if isinstance(item, dict) and item.get("asset_id") is not None
+        if isinstance(item, dict)
+        for asset_id in [_coerce_asset_id(item.get("asset_id"))]
+        if asset_id is not None
     ]
     unique_failed_ids = sorted(set(failed_ids))
     return Result.Ok(
@@ -283,7 +298,7 @@ async def handle_delete_assets(
     audit_asset_write: Callable[..., Awaitable[None]],
     json_response: Callable[[Any], web.Response],
     require_services: Callable[[], Awaitable[tuple[dict[str, Any], Result[Any] | None]]],
-    resolve_security_prefs: Callable[[dict[str, Any]], Awaitable[dict[str, Any]]],
+    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[..., tuple[bool, int | None]],
diff --git a/mjr_am_backend/routes/assets/route_actions_delete.py b/mjr_am_backend/routes/assets/route_actions_delete.py
index 53dfc306..876321a3 100644
--- a/mjr_am_backend/routes/assets/route_actions_delete.py
+++ b/mjr_am_backend/routes/assets/route_actions_delete.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Mapping
 from pathlib import Path
 from typing import Any
 
@@ -26,7 +26,7 @@ async def handle_delete_asset(
     audit_asset_write: Callable[..., Awaitable[None]],
     json_response: Callable[[Any], web.Response],
     require_services: Callable[[], Awaitable[tuple[dict[str, Any], Result[Any] | None]]],
-    resolve_security_prefs: Callable[[dict[str, Any]], Awaitable[dict[str, Any]]],
+    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[..., tuple[bool, int | None]],
diff --git a/mjr_am_backend/routes/assets/route_actions_rename.py b/mjr_am_backend/routes/assets/route_actions_rename.py
index d017b10a..d53c2e82 100644
--- a/mjr_am_backend/routes/assets/route_actions_rename.py
+++ b/mjr_am_backend/routes/assets/route_actions_rename.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from collections.abc import Awaitable, Callable
+from collections.abc import Awaitable, Callable, Mapping
 from pathlib import Path
 from typing import Any
 
@@ -26,7 +26,7 @@ async def handle_rename_asset(
     audit_asset_write: Callable[..., Awaitable[None]],
     json_response: Callable[[Any], web.Response],
     require_services: Callable[[], Awaitable[tuple[dict[str, Any], Result[Any] | None]]],
-    resolve_security_prefs: Callable[[dict[str, Any]], Awaitable[dict[str, Any]]],
+    resolve_security_prefs: Callable[[Mapping[str, Any] | None], Awaitable[Mapping[str, Any] | None]],
     require_operation_enabled: Callable[..., Result[Any]],
     require_write_access: Callable[[web.Request], Result[Any]],
     check_rate_limit: Callable[..., tuple[bool, int | None]],
diff --git a/mjr_am_backend/routes/search/listing_all_scope.py b/mjr_am_backend/routes/search/listing_all_scope.py
index 97308566..20021a9e 100644
--- a/mjr_am_backend/routes/search/listing_all_scope.py
+++ b/mjr_am_backend/routes/search/listing_all_scope.py
@@ -10,6 +10,10 @@ from aiohttp import web
 from mjr_am_backend.shared import Result
 
 
+def _propagate_all_scope_error(result: Result[Any], default_code: str, default_error: str) -> Result[dict[str, Any]]:
+    return Result.Err(result.code or default_code, str(result.error or default_error))
+
+
 def _build_all_scope_payload(
     *,
     assets: list[dict[str, Any]],
@@ -310,7 +314,7 @@ async def _merge_all_scope_page(
 
     err = await _fill_output_buffer(state, svc=svc, query=query, sort_key=sort_key, filters=filters, output_root=output_root)
     if err:
-        return err
+        return _propagate_all_scope_error(err, "SEARCH_FAILED", "Failed to fill output buffer")
     err = await _fill_input_buffer(
         state,
         input_root=input_root,
@@ -320,7 +324,7 @@ async def _merge_all_scope_page(
         list_filesystem_assets=list_filesystem_assets,
     )
     if err:
-        return err
+        return _propagate_all_scope_error(err, "SEARCH_FAILED", "Failed to fill input buffer")
 
     total = int(state["out_total"] or 0) + int(state["in_total"] or 0)
     target = offset + limit
@@ -338,7 +342,7 @@ async def _merge_all_scope_page(
                 output_root=output_root,
             )
             if err:
-                return err
+                return _propagate_all_scope_error(err, "SEARCH_FAILED", "Failed to refill output buffer")
         if state["in_i"] >= len(state["in_buf"]) and (state["in_total"] is None or state["in_offset"] < state["in_total"]):
             err = await _fill_input_buffer(
                 state,
@@ -349,7 +353,7 @@ async def _merge_all_scope_page(
                 list_filesystem_assets=list_filesystem_assets,
             )
             if err:
-                return err
+                return _propagate_all_scope_error(err, "SEARCH_FAILED", "Failed to refill input buffer")
 
         out_has = state["out_i"] < len(state["out_buf"])
         in_has = state["in_i"] < len(state["in_buf"])
diff --git a/package.json b/package.json
index 8cb36ac6..8d983141 100644
--- a/package.json
+++ b/package.json
@@ -6,8 +6,12 @@
     "build": "vite build",
     "build:watch": "vite build --watch",
     "build:dev": "vite build --mode development",
+    "hooks:install": "python scripts/install_local_hooks.py",
     "quality": "python scripts/run_quality_gate.py",
+    "quality:changed": "python scripts/run_changed_quality_gate.py",
+    "quality:prepush": "python scripts/run_changed_quality_gate.py",
     "quality:py": "python scripts/run_quality_gate.py --python-only",
+    "lint:py:fix": "python -m ruff check --fix mjr_am_backend mjr_am_shared tests scripts __init__.py",
     "test:js": "vitest run",
     "test:js:watch": "vitest",
     "test:js:coverage": "vitest run --coverage",
@@ -18,18 +22,18 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@vitejs/plugin-vue": "^6.0.5",
+    "@vitejs/plugin-vue": "^5.2.1",
     "@vitest/coverage-v8": "^4.1.2",
     "@vue/test-utils": "^2.4.6",
     "eslint": "^10.1.0",
     "happy-dom": "^20.8.9",
     "prettier": "^3.8.1",
     "vite": "^6.4.2",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.2"
   },
   "dependencies": {
     "@tanstack/vue-virtual": "^3.13.23",
-    "pinia": "^3.0.4",
+    "pinia": "^2.3.1",
     "three": "0.183.2",
     "vue": "^3.5.13"
   }
diff --git a/pyproject.toml b/pyproject.toml
index 3ba21190..5b671147 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -56,6 +56,7 @@ dev = [
   "pytest-asyncio>=0.22.0,<2.0.0",
   "pytest-cov>=6.0.0,<8.0.0",
   "pytest-timeout>=2.3.0,<3.0.0",
+  "pre-commit>=4.3.0,<5.0.0",
   "radon>=6.0.1,<7.0.0",
   "xenon>=0.9.3,<1.0.0",
   "ruff>=0.12.0,<1.0.0",
@@ -80,7 +81,7 @@ exclude = ["js*", "vendor*", "plugins*", "ressources*"]
 PublisherId = "majoor-waldi"
 DisplayName = "ComfyUI-Majoor-AssetsManager"
 Icon = "https://raw.githubusercontent.com/MajoorWaldi/ComfyUI-Majoor-AssetsManager/main/ressources/icon.png"
-includes = [] 
+includes = []
 "requires-comfyui" = ">=0.13.0"
 
 [tool.black]
@@ -111,4 +112,3 @@ ignore = ["E501", "S101", "S105", "S110", "S112", "S311", "S603", "S607", "S608"
 [tool.ruff.lint.per-file-ignores]
 "scripts/junit_to_html.py" = ["S314"]
 "tests/**/*.py" = ["S108", "S605"]
-
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 5f8d4429..998b44bf 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -7,9 +7,10 @@ pytest>=8.0.0,<10.0.0
 pytest-asyncio>=0.22.0,<2.0.0
 pytest-cov>=6.0.0,<8.0.0
 pytest-timeout>=2.3.0,<3.0.0
+pre-commit>=4.3.0,<5.0.0
 radon>=6.0.1,<7.0.0
 xenon>=0.9.3,<1.0.0
 ruff>=0.12.0,<1.0.0
 mypy>=1.11.0,<2.0.0
 pip-audit>=2.9.0,<3.0.0
-bandit>=1.8.0,<2.0.0
\ No newline at end of file
+bandit>=1.8.0,<2.0.0
diff --git a/scripts/check_cc_changed.py b/scripts/check_cc_changed.py
index 48f4bfb1..cfdfddd2 100644
--- a/scripts/check_cc_changed.py
+++ b/scripts/check_cc_changed.py
@@ -5,9 +5,10 @@ from __future__ import annotations
 import json
 import os
 import subprocess
+import sys
 from pathlib import Path
 
-DEFAULT_MAX_CC = 10
+DEFAULT_MAX_CC = 25
 
 
 def _max_cc() -> int:
@@ -24,23 +25,41 @@ def _run(cmd: list[str]) -> str:
     return subprocess.check_output(cmd, text=True, stderr=subprocess.DEVNULL).strip()
 
 
-def _new_python_files() -> list[Path]:
+def _diff_outputs() -> list[str]:
+    diffs: list[str] = []
     base_ref = os.environ.get("GITHUB_BASE_REF", "").strip()
-    if base_ref:
+    try:
+        if base_ref:
+            diffs.append(_run(["git", "diff", "--diff-filter=AM", "--name-only", f"origin/{base_ref}...HEAD"]))
+        else:
+            try:
+                diffs.append(_run(["git", "diff", "--diff-filter=AM", "--name-only", "@{upstream}...HEAD"]))
+            except Exception:
+                diffs.append(_run(["git", "diff", "--diff-filter=AM", "--name-only", "HEAD~1...HEAD"]))
+    except Exception:
+        pass
+
+    for cmd in (
+        ["git", "diff", "--diff-filter=AM", "--name-only"],
+        ["git", "diff", "--cached", "--diff-filter=AM", "--name-only"],
+        ["git", "ls-files", "--others", "--exclude-standard"],
+    ):
         try:
-            diff = _run(["git", "diff", "--diff-filter=AM", "--name-only", f"origin/{base_ref}...HEAD"])
+            diffs.append(_run(cmd))
         except Exception:
-            diff = ""
-    else:
-        try:
-            diff = _run(["git", "diff", "--diff-filter=AM", "--name-only", "HEAD~1...HEAD"])
-        except Exception:
-            diff = ""
+            continue
+    return diffs
+
+
+def _new_python_files() -> list[Path]:
     files = []
-    for raw in diff.splitlines():
-        p = Path(raw.strip())
-        if p.suffix == ".py" and p.exists():
-            files.append(p)
+    seen: set[Path] = set()
+    for diff in _diff_outputs():
+        for raw in diff.splitlines():
+            p = Path(raw.strip())
+            if p.suffix == ".py" and p.exists() and p not in seen:
+                seen.add(p)
+                files.append(p)
     return files
 
 
@@ -51,7 +70,7 @@ def main() -> int:
         print("No changed Python files; complexity gate skipped.")
         return 0
 
-    cmd = ["python", "-m", "radon", "cc", "--json", *[str(p) for p in files]]
+    cmd = [sys.executable, "-m", "radon", "cc", "--json", *[str(p) for p in files]]
     try:
         payload = _run(cmd)
         data = json.loads(payload) if payload else {}
@@ -85,4 +104,3 @@ def main() -> int:
 
 if __name__ == "__main__":
     raise SystemExit(main())
-
diff --git a/scripts/install_local_hooks.py b/scripts/install_local_hooks.py
new file mode 100644
index 00000000..d9a54b3c
--- /dev/null
+++ b/scripts/install_local_hooks.py
@@ -0,0 +1,24 @@
+"""Install the repository's local Git hooks via pre-commit."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _run(*args: str) -> None:
+    subprocess.run([sys.executable, "-m", "pre_commit", *args], cwd=ROOT, check=True)
+
+
+def main() -> int:
+    _run("install", "--hook-type", "pre-commit", "--hook-type", "pre-push")
+    _run("install-hooks")
+    print("Local Git hooks installed for pre-commit and pre-push.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/run_changed_quality_gate.py b/scripts/run_changed_quality_gate.py
new file mode 100644
index 00000000..a403ffd0
--- /dev/null
+++ b/scripts/run_changed_quality_gate.py
@@ -0,0 +1,122 @@
+"""Run the local changed-file quality gate used for pre-push and manual checks."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+MAX_CC = "25"
+XENON_TARGET_RANK = "D"
+
+
+def _git_output(cmd: list[str]) -> str:
+    return subprocess.check_output(cmd, cwd=ROOT, text=True, stderr=subprocess.DEVNULL).strip()
+
+
+def _changed_files(*, suffixes: tuple[str, ...]) -> list[str]:
+    diffs: list[str] = []
+    base_ref = os.environ.get("GITHUB_BASE_REF", "").strip()
+    try:
+        if base_ref:
+            diffs.append(_git_output(["git", "diff", "--diff-filter=AM", "--name-only", f"origin/{base_ref}...HEAD"]))
+        else:
+            try:
+                diffs.append(_git_output(["git", "diff", "--diff-filter=AM", "--name-only", "@{upstream}...HEAD"]))
+            except Exception:
+                diffs.append(_git_output(["git", "diff", "--diff-filter=AM", "--name-only", "HEAD~1...HEAD"]))
+    except Exception:
+        pass
+
+    for cmd in (
+        ["git", "diff", "--diff-filter=AM", "--name-only"],
+        ["git", "diff", "--cached", "--diff-filter=AM", "--name-only"],
+        ["git", "ls-files", "--others", "--exclude-standard"],
+    ):
+        try:
+            diffs.append(_git_output(cmd))
+        except Exception:
+            continue
+
+    changed: list[str] = []
+    for diff in diffs:
+        for raw in diff.splitlines():
+            candidate = raw.strip()
+            if not candidate or not candidate.endswith(suffixes):
+                continue
+            path = ROOT / candidate
+            if path.exists():
+                changed.append(candidate)
+    return sorted(dict.fromkeys(changed))
+
+
+def _run(cmd: list[str], *, label: str, env: dict[str, str] | None = None) -> None:
+    print(f"\n==> {label}")
+    print(" ".join(cmd))
+    subprocess.run(cmd, cwd=ROOT, check=True, env=env)
+
+
+def _python_cmd(module: str, *args: str) -> list[str]:
+    return [sys.executable, "-m", module, *args]
+
+
+def _npm_cmd(*args: str) -> list[str]:
+    candidates = ["npm.cmd", "npm"] if os.name == "nt" else ["npm"]
+    for candidate in candidates:
+        if shutil.which(candidate):
+            return [candidate, *args]
+    raise SystemExit("npm is required for Vitest checks but was not found in PATH.")
+
+
+def _npm_available() -> bool:
+    return any(shutil.which(candidate) for candidate in (("npm.cmd", "npm") if os.name == "nt" else ("npm",)))
+
+
+def main() -> int:
+    changed_python = _changed_files(suffixes=(".py",))
+    changed_vitest = _changed_files(suffixes=(".vitest.mjs", ".test.mjs"))
+
+    if changed_python:
+        _run(
+            _python_cmd("ruff", "check", *changed_python),
+            label="Ruff lint (changed Python files)",
+        )
+        _run(
+            _python_cmd("xenon", "-b", XENON_TARGET_RANK, "-m", XENON_TARGET_RANK, "-a", "B", *changed_python),
+            label="Xenon changed-file complexity gate",
+        )
+        _run(
+            [sys.executable, "scripts/check_cc_changed.py"],
+            label="Radon changed-file complexity gate",
+            env={**os.environ, "MJR_COMPLEXITY_MAX_CC": MAX_CC},
+        )
+    else:
+        print("\n==> Changed-file Python gate")
+        print("No changed Python files detected; skipping incremental Python checks.")
+
+    if changed_python:
+        _run(
+            _python_cmd("mypy", "--config-file", "mypy.ini", "--follow-imports=silent", *changed_python),
+            label="Mypy (changed Python files)",
+        )
+    else:
+        print("\n==> Mypy (changed Python files)")
+        print("No changed Python files detected; skipping incremental mypy checks.")
+
+    if changed_vitest:
+        if not _npm_available():
+            raise SystemExit("npm is required for Vitest checks but was not found in PATH.")
+        _run(_npm_cmd("exec", "vitest", "run", *changed_vitest), label="Vitest (changed test files)")
+    else:
+        print("\n==> Vitest (changed test files)")
+        print("No changed Vitest files detected; skipping incremental frontend tests.")
+
+    print("\nChanged-file quality gate passed.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/run_quality_gate.py b/scripts/run_quality_gate.py
index e7b3c1cc..20ae2a48 100644
--- a/scripts/run_quality_gate.py
+++ b/scripts/run_quality_gate.py
@@ -117,6 +117,14 @@ def _python_cmd(module: str, *args: str) -> list[str]:
     return [sys.executable, "-m", module, *args]
 
 
+def _npm_cmd(*args: str) -> list[str]:
+    candidates = ["npm.cmd", "npm"] if os.name == "nt" else ["npm"]
+    for candidate in candidates:
+        if shutil.which(candidate):
+            return [candidate, *args]
+    raise SystemExit("npm is required for JS checks but was not found in PATH.")
+
+
 def _existing_paths(values: list[str]) -> list[str]:
     existing: list[str] = []
     for value in values:
@@ -136,7 +144,7 @@ def _pip_audit_cmd() -> list[str]:
 
 
 def _npm_available() -> bool:
-    return shutil.which("npm") is not None
+    return any(shutil.which(candidate) for candidate in (("npm.cmd", "npm") if os.name == "nt" else ("npm",)))
 
 
 def _clear_mypy_cache() -> None:
@@ -196,7 +204,7 @@ def main() -> int:
         _run(
             [sys.executable, "scripts/check_cc_changed.py"],
             label="Changed-file complexity gate",
-            env={**os.environ, "MJR_COMPLEXITY_MAX_CC": "10"},
+            env={**os.environ, "MJR_COMPLEXITY_MAX_CC": "25"},
         )
 
     if not args.skip_tests:
@@ -206,18 +214,18 @@ def main() -> int:
     if not args.skip_js_lint:
         if not _npm_available():
             raise SystemExit("npm is required for JS lint but was not found in PATH.")
-        _run(["npm", "run", "lint:js"], label="ESLint")
-        _run(["npm", "run", "format:check"], label="Prettier")
+        _run(_npm_cmd("run", "lint:js"), label="ESLint")
+        _run(_npm_cmd("run", "format:check"), label="Prettier")
 
     if not args.skip_js_tests:
         if not _npm_available():
             raise SystemExit("npm is required for JS tests but was not found in PATH.")
-        _run(["npm", "run", "test:js"], label="Vitest")
+        _run(_npm_cmd("run", "test:js"), label="Vitest")
 
     if not args.skip_js_audit:
         if not _npm_available():
             raise SystemExit("npm is required for npm audit but was not found in PATH.")
-        _run(["npm", "audit", "--audit-level=high"], label="npm audit")
+        _run(_npm_cmd("audit", "--audit-level=high"), label="npm audit")
 
     print("\nQuality gate passed.")
     return 0
diff --git a/vitest.config.mjs b/vitest.config.mjs
index 146cce8a..64bd609f 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -5,6 +5,7 @@ export default defineConfig({
   plugins: [vue()],
   test: {
     environment: "node",
+    setupFiles: ["js/tests/vitest.setup.mjs"],
     transformMode: {
       web: [/\.vue$/],
     },