@hybridlabor-api/aos 4.8.0 → 4.10.0

package/.agents/{agents.md → AGENTS.md}

@@ -15,6 +15,7 @@ next. This file defines *what each agent is*, not *what calls what*.
 - **Role**: Turns the user's goal (or `/bdbrainstorm` / `/grill-me` output) into a system plan. Reads existing architecture before proposing changes. Does not coordinate execution or invoke other agents — that is TechLead's job, decided by the dispatcher, not by Architect.
 - **Model**: opus
 - **Primary Skills**:
+  - `read-the-damn-docs`
   - `bdbrainstorm`
   - `planning-with-files`
   - `concise-planning`
@@ -34,6 +35,7 @@ next. This file defines *what each agent is*, not *what calls what*.
 - **Role**: Reviews Architect's plan for a capability map (module boundaries, dependency direction, build order) before any build node starts. Approves or rejects the plan back to Architect. Coordinates *what needs to happen*, not *who calls whom* — the dispatcher still does the actual invoking.
 - **Model**: opus
 - **Primary Skills**:
+  - `read-the-damn-docs`
   - `startcycle-graph`
   - `agent-pipeline`
   - `subagent-driven-development`
@@ -93,7 +95,7 @@ next. This file defines *what each agent is*, not *what calls what*.
   - `godmode-media-creation`
   - `godmode-3d-creation`
   - `bdbmediastorm`
-  - `MCP_Manage`
+  - `mcp-manage`
   - `threejs-skills`
   - `spline-3d-integration`
 - **MCP Servers**:

package/.agents/nodes.json

@@ -12,6 +12,7 @@
       "writes": null,
       "optional": false,
       "skills": [
+        "read-the-damn-docs",
         "bdbrainstorm",
         "planning-with-files",
         "concise-planning",
@@ -29,6 +30,7 @@
       "writes": null,
       "optional": false,
       "skills": [
+        "read-the-damn-docs",
         "startcycle-graph",
         "agent-pipeline",
         "subagent-driven-development"
@@ -94,7 +96,7 @@
         "godmode-media-creation",
         "godmode-3d-creation",
         "bdbmediastorm",
-        "MCP_Manage",
+        "mcp-manage",
         "threejs-skills",
         "spline-3d-integration"
       ],

package/.agents/vendor-manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "version": "1.0.0",
   "description": "Pinned upstream vendor repositories tracked for AOS skills and tools",
-  "updated_at": "2026-09-24T07:27:44Z",
+  "updated_at": "2026-09-25T19:27:14Z",
   "vendors": {
     "superdesign-skill": {
       "upstream": "https://github.com/superdesigndev/superdesign-skill",
@@ -51,6 +51,28 @@
       "pinned_commit": "e482e579415fde18357cafce70f177ae19fd7f03",
       "purpose": "Markdown-only fallback store for skills and auxiliary subagents",
       "target": "lib/ecc-store-index.json"
+    },
+    "superpowers": {
+      "upstream": "https://github.com/obra/superpowers",
+      "pinned_commit": "8ca22dba9a94f28898bbce59f2537ff4d87c747d",
+      "purpose": "Evidence-before-claims, code review dispatch, branch finishing, worktree isolation and parallel agent dispatch workflow skills",
+      "target_skill": "skills/global_config/{verification-before-completion,requesting-code-review,finishing-a-development-branch,using-git-worktrees,dispatching-parallel-agents}"
+    },
+    "cc-devops-skills": {
+      "upstream": "https://github.com/akin-ozer/cc-devops-skills",
+      "pinned_commit": "276af751e659315aaf56d3ad13d7c26f4e72e28a",
+      "purpose": "Generator/validator pairs for GitHub Actions, Dockerfile, bash scripts and Makefiles, with reference libraries",
+      "target_skill": "skills/global_config/{github-actions,dockerfile,bash-script,makefile}-{generator,validator}"
+    },
+    "claude-code-templates": {
+      "upstream": "https://github.com/davila7/claude-code-templates",
+      "pinned_commit": "691832ad9c2506d15a8b752826135f0afa83d197",
+      "purpose": "Conventional-commit enforcement and .env write protection, ported from Python to .mjs for both Claude Code and Antigravity",
+      "target": ".claude/hooks/{conventional-commits,env-file-protection}.mjs",
+      "source_commits": {
+        "conventional-commits.py": "92fdaa1f87b45cfc7b881f03ee69d2bad27b09d3",
+        "env-file-protection.json": "36fa6dbd5d8a45a62628b634aa48410f4d39682d"
+      }
     }
   }
 }

package/.claude/agents/godmode-media-eventtech.md

@@ -5,7 +5,7 @@ model: sonnet
 ---
 Creative-Tech & Show-Control Specialist. Governs 3D modeling, spatial design, TouchDesigner networks, Unreal Engine scenes, DaVinci Resolve color/edit, DMX/grandMA3 lighting, and Resolume media servers.
 
-**Primary skills:** godmode-eventtech, godmode-media-creation, godmode-3d-creation, bdbmediastorm, MCP_Manage, threejs-skills, spline-3d-integration
+**Primary skills:** godmode-eventtech, godmode-media-creation, godmode-3d-creation, bdbmediastorm, mcp-manage, threejs-skills, spline-3d-integration
 
 **MCP servers used:** bdb_td_minddesigner, bdb_unreal_mcp, bdb_davinci_mcp, bdb_grandma3_mcp, bdb_resolume_mcp, adobe_uxp_mcp, bdb_after_effects_mcp, bdb_rhino_mcp
 

package/.claude/hooks/conventional-commits.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// PreToolUse gate that enforces Conventional Commits on `git commit` across harnesses:
+// - Claude Code (.claude/hooks/conventional-commits.mjs)
+// - Antigravity / Gemini CLI (hooks.json PreToolUse)
+//
+// Why this exists: release-please (.github/workflows/release-please.yml) parses
+// commit subjects to compute the version bump and the changelog. It only reads
+// Conventional Commit prefixes, so an unprefixed subject is invisible to it —
+// exactly the prefix used for a user-facing addition decides a minor bump.
+//
+// Ported from davila7/claude-code-templates (MIT), which ships this as
+// conventional-commits.py. Ported to .mjs rather than vendored verbatim: every
+// other AOS hook is .mjs, node is already a hard install dependency, and
+// `python3` does not exist on a stock Windows install — where the AOS installer
+// does run — so a python hook would break every commit there.
+//
+// Deliberately fails OPEN, unlike go-gate. A regex that cannot read the message
+// must not block a legitimate commit; blocking a human's work is the worse
+// failure here, because the consequence (history AOS does not recognise) is
+// recoverable with a rebase, and a wedged commit flow is not.
+
+import { readFileSync } from "node:fs";
+
+const TYPES = ["feat", "fix", "docs", "style", "refactor", "perf", "test", "chore", "ci", "build", "revert"];
+
+const CONVENTIONAL = new RegExp(`^(${TYPES.join("|")})(\\(.+\\))?:\\s.+`);
+
+const COMMIT = /git\s+commit\b/;
+
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function respond(isAgy, allowed, reason = "", message = "") {
+  if (isAgy) {
+    if (allowed) {
+      console.log(JSON.stringify({ decision: "allow" }));
+    } else {
+      console.log(JSON.stringify({ decision: "deny", reason }));
+    }
+    process.exit(0);
+  } else {
+    if (allowed) {
+      process.exit(0);
+    } else {
+      process.stderr.write(`${reason}\n`);
+      process.exit(2);
+    }
+  }
+}
+
+// Returns the commit message, or null when it cannot be read. Null means
+// "cannot tell" and must be treated as allowed.
+function extractMessage(command) {
+  // -m "msg" / -m 'msg'
+  const inline = command.match(/git\s+commit[\s\S]*?-m\s+(?:"([^"]+)"|'([^']+)')/);
+  if (inline) return inline[1] ?? inline[2];
+
+  // -m "$(cat <<'EOF' ... EOF)"
+  const heredoc = command.match(/git\s+commit[\s\S]*?-m\s+"?\$\(cat\s+<<['"]?EOF['"]?\s*\n([\s\S]+?)\nEOF/);
+  if (heredoc) return heredoc[1].trim();
+
+  // Plain `git commit` (editor) or a message the hook cannot see: fail open.
+  return null;
+}
+
+function reasonFor(message) {
+  return [
+    "Blocked by conventional-commits hook: this commit subject is not in Conventional Commits format.",
+    "",
+    `Your message: ${message.slice(0, 120)}`,
+    "",
+    "Required: type(scope): description",
+    `Types: ${TYPES.join(", ")}`,
+    "",
+    "Good:  feat: add user authentication",
+    "Good:  fix(api): handle null responses",
+    "Bad:   Added new feature   (no type)",
+    "Bad:   feature: add login  (wrong type, use 'feat')",
+    "",
+    "AOS reserves feat: for user-facing additions -- it always bumps the minor",
+    "version, however small. Housekeeping belongs under chore: or fix:.",
+  ].join("\n");
+}
+
+function main() {
+  const rawInput = readStdin();
+  let input = {};
+  if (rawInput.trim()) {
+    try {
+      input = JSON.parse(rawInput);
+    } catch {
+      // Unparseable input: fail open, no stdout (isAgy unknown).
+      process.exit(0);
+    }
+  }
+
+  const isAgy = !!(input?.toolCall || input?.conversationId || input?.artifactDirectoryPath || input?.workspacePaths);
+
+  const command =
+    input?.toolCall?.args?.CommandLine ||
+    input?.toolCall?.args?.command ||
+    input?.tool_input?.command ||
+    input?.command ||
+    "";
+
+  if (typeof command !== "string" || !COMMIT.test(command)) {
+    respond(isAgy, true);
+    return;
+  }
+
+  const message = extractMessage(command);
+  if (message === null || CONVENTIONAL.test(message)) {
+    respond(isAgy, true);
+    return;
+  }
+
+  respond(isAgy, false, reasonFor(message), message);
+}
+
+main();

package/.claude/hooks/env-file-protection.mjs

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+// PreToolUse gate that refuses writes and edits to .env files, across harnesses:
+// - Claude Code (.claude/hooks/env-file-protection.mjs)
+// - Antigravity / Gemini CLI (hooks.json PreToolUse)
+//
+// Why: a .env is a live secret store. An agent that rewrites one to "add a
+// variable" routinely reorders it, drops a line, or writes an empty value
+// straight over a real credential — and the file is usually gitignored, so
+// nothing catches it until something fails to authenticate in production.
+//
+// Upstream (davila7/claude-code-templates, MIT) does this as an inline `echo`
+// guarded by a matcher `if` field. That is Claude-Code-only: Antigravity and
+// the Gemini CLI ignore `if`, so the same entry would fire on every single
+// Write and block all file creation. Implemented as a script with the path
+// check in code, so one implementation behaves correctly on both.
+//
+// Deliberately fails OPEN. A hook that cannot read its input must not wedge
+// every write in the session; missing a protection is recoverable, freezing
+// the agent is not.
+
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+
+// Templates are committed on purpose and hold no live secret. Blocking them
+// would contradict this hook's own advice below ("write it to .env.example").
+const TEMPLATE_FILE = /^\.env\.(example|sample|template|dist)$/i;
+const ENV_FILE = /^\.env(\..*)?$/i;
+
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function respond(isAgy, allowed, reason = "") {
+  if (isAgy) {
+    console.log(JSON.stringify(allowed ? { decision: "allow" } : { decision: "deny", reason }));
+    process.exit(0);
+  } else {
+    if (allowed) {
+      process.exit(0);
+    } else {
+      process.stderr.write(`${reason}\n`);
+      process.exit(2);
+    }
+  }
+}
+
+function reasonFor(filePath) {
+  return [
+    "Blocked by env-file-protection hook: writes to .env files are protected.",
+    "",
+    `Target: ${filePath}`,
+    "",
+    "A .env holds live credentials and is almost always gitignored, so an",
+    "overwrite fails silently and surfaces later as an auth error. To change",
+    "one anyway, either:",
+    "",
+    `  1. Edit it yourself outside the agent session, or`,
+    "  2. Ask for the new value to be written to .env.example (safe to commit)",
+    "     and set the real value from your own shell.",
+    "",
+    "If the repo keeps a checked-in env template with a different name, this",
+    "hook does not apply to it -- only to .env and .env.*.",
+  ].join("\n");
+}
+
+function main() {
+  const rawInput = readStdin();
+  let input = {};
+  if (rawInput.trim()) {
+    try {
+      input = JSON.parse(rawInput);
+    } catch {
+      process.exit(0);
+    }
+  }
+
+  const isAgy = !!(input?.toolCall || input?.conversationId || input?.artifactDirectoryPath || input?.workspacePaths);
+
+  const filePath =
+    input?.toolCall?.args?.filePath ||
+    input?.toolCall?.args?.file_path ||
+    input?.tool_input?.file_path ||
+    input?.file_path ||
+    "";
+
+  if (typeof filePath !== "string" || !filePath.trim()) {
+    respond(isAgy, true);
+    return;
+  }
+
+  // basename(), so a path like /srv/app/.env matches but /srv/app/env-notes.md does not.
+  const name = basename(filePath);
+  if (!ENV_FILE.test(name) || TEMPLATE_FILE.test(name)) {
+    respond(isAgy, true);
+    return;
+  }
+
+  respond(isAgy, false, reasonFor(filePath));
+}
+
+main();

package/.claude/hooks/go-gate.mjs

@@ -1,51 +1,32 @@
 #!/usr/bin/env node
-// PreToolUse gate for outward-facing / hard-to-reverse Bash commands.
+// PreToolUse gate for outward-facing / hard-to-reverse commands across harnesses:
+// - Antigravity / Gemini CLI (hooks.json PreToolUse)
+// - Claude Code (.claude/hooks/go-gate.mjs)
 //
-// Scope (deliberately narrow — see audit-agents.md F-01/F-03): git push, npm
-// publish, npm version, and recursive rm. Plain Write/Edit/git commit are NOT
-// gated here — Claude Code checkpoints those and they're locally reversible;
-// gating them too would just re-create the "over-scoped rule nobody reads"
-// problem this hook exists to fix.
+// Scope:
+// 1. git push
+// 2. npm publish
+// 3. npm version
+// 4. gh pr merge
+// 5. gh release create
+// 6. git reset --hard
+// 7. git clean -f (force clean untracked files)
+// 8. rm -r / rm -rf (recursive deletions)
 //
-// Gate validity: open only if the LAST human-typed user message in the
-// transcript is the literal word "GO" (case-insensitive, trimmed). Any other
-// message closes it again — matches "no silent retries" / "a fresh GO per
-// action" from CLAUDE.md.
-//
-// Transcript format (v3.13 audit BLOCKER-1): Claude Code transcript JSONL
-// entries carry the entry kind in a top-level `type` field ("user"), with the
-// payload nested under `message.content` — a top-level `role` exists on zero
-// lines of a real transcript, so matching on it blocked the gate forever.
-// Two traps the parser below handles explicitly:
-//   1. `message.content` is EITHER a plain string OR an array of typed blocks
-//      — always run it through extractText(), never assume one shape.
-//   2. Tool results are ALSO `type: "user"` entries (their blocks are
-//      `tool_result`), and subagent turns are user entries flagged
-//      `isSidechain: true`. Neither is the human: entries with no text block
-//      are skipped, and sidechain entries are skipped outright — so the scan
-//      lands on the last message a human actually typed.
-//
-// Fails closed: if the transcript can't be read or parsed, block rather than
-// guess.
-//
-// Why a PreToolUse hook and not a CLAUDE.md rule: per
-// code.claude.com/docs/en/hooks-guide, "PreToolUse hooks fire before any
-// permission-mode check, in every permission mode, including dontAsk. A hook
-// that returns permissionDecision: 'deny' blocks the tool even in
-// bypassPermissions mode or with --dangerously-skip-permissions." Exiting 2
-// blocks unconditionally the same way. So this gate cannot be sidestepped by
-// switching permission modes -- which prose in CLAUDE.md never could
-// guarantee. (Hooks can tighten restrictions but not loosen them: a hook
-// returning "allow" still can't override a deny rule from settings.)
+// Gate validity: open ONLY if the LAST human-typed user message in the transcript
+// is the literal word "GO" (case-insensitive, trimmed). Any other message closes it.
 
 import { readFileSync } from "node:fs";
 
 const GUARDED_PATTERNS = [
-  /^\s*git\s+push\b/i,
-  /^\s*npm\s+publish\b/i,
-  /^\s*npm\s+version\b/i,
-  // recursive rm in any flag order/style: -r, -R, -rf, -fr, --recursive
-  /^\s*rm\s+(-\w*[rR]\w*|--recursive)\b/i,
+  /(?:^|[;&|]\s*)git\s+push\b/i,
+  /(?:^|[;&|]\s*)npm\s+publish\b/i,
+  /(?:^|[;&|]\s*)npm\s+version\b/i,
+  /(?:^|[;&|]\s*)gh\s+pr\s+merge\b/i,
+  /(?:^|[;&|]\s*)gh\s+release\s+create\b/i,
+  /(?:^|[;&|]\s*)git\s+reset\s+--hard\b/i,
+  /(?:^|[;&|]\s*)git\s+clean\s+-[a-zA-Z]*f\b/i,
+  /(?:^|[;&|]\s*)rm\s+(?:-\w*[rR]\w*|--recursive)\b/i,
 ];
 
 function readStdin() {
@@ -56,16 +37,31 @@ function readStdin() {
   }
 }
 
-function block(reason) {
-  process.stderr.write(`Blocked by go-gate hook: ${reason}\n`);
-  process.exit(2);
-}
-
-function allow() {
-  process.exit(0);
+function respond(isAgy, allowed, reason = "", command = "") {
+  if (isAgy) {
+    if (allowed) {
+      console.log(JSON.stringify({ decision: "allow" }));
+    } else {
+      console.log(JSON.stringify({
+        decision: "deny",
+        reason: `[MECHANICAL GO-GATE BLOCKED] Der Befehl "${command.slice(0, 100)}" wurde blockiert. Er erfordert ein frisches, isoliertes "GO" als letzte Benutzereingabe. ${reason}`
+      }));
+    }
+    process.exit(0);
+  } else {
+    // Claude Code harness
+    if (allowed) {
+      process.exit(0);
+    } else {
+      process.stderr.write(
+        `Blocked by go-gate hook: command "${command.slice(0, 80)}" requires a fresh, literal "GO" as your last message. ${reason}\n`
+      );
+      process.exit(2);
+    }
+  }
 }
 
-function extractText(content) {
+function extractClaudeText(content) {
   if (typeof content === "string") return content;
   if (Array.isArray(content)) {
     return content
@@ -76,13 +72,15 @@ function extractText(content) {
   return "";
 }
 
-function isHumanUserEntry(entry) {
-  if (!entry || typeof entry !== "object") return false;
-  // `type` is the authoritative field in real transcripts; `role` kept as a
-  // defensive fallback in case a future/alternate export flattens it.
-  if (entry.type !== "user" && entry.role !== "user") return false;
-  if (entry.isSidechain === true) return false; // subagent turn, not the human
-  return true;
+function extractAgyText(rawContent) {
+  if (!rawContent || typeof rawContent !== "string") return "";
+  // Strip metadata tags if present
+  let text = rawContent.replace(/<ADDITIONAL_METADATA>[\s\S]*?<\/ADDITIONAL_METADATA>/gi, "");
+  const match = text.match(/<USER_REQUEST>([\s\S]*?)<\/USER_REQUEST>/i);
+  if (match) {
+    text = match[1];
+  }
+  return text.trim();
 }
 
 function lastUserMessageIsGo(transcriptPath) {
@@ -99,54 +97,76 @@ function lastUserMessageIsGo(transcriptPath) {
     try {
       entry = JSON.parse(lines[i]);
     } catch {
-      continue; // tolerate partial/trailing lines from an in-progress write
+      continue; // tolerate partial/trailing lines
+    }
+
+    // 1. Antigravity transcript entry format
+    if (entry.type === "USER_INPUT" || entry.source === "USER_EXPLICIT") {
+      const text = extractAgyText(entry.content);
+      if (!text) continue;
+      const isGo = /^GO$/i.test(text.trim());
+      return { ok: isGo, reason: `last user message was: ${JSON.stringify(text)}` };
+    }
+
+    // 2. Claude Code transcript entry format
+    if (entry.type === "user" || entry.role === "user") {
+      if (entry.isSidechain === true) continue;
+      const content = entry.message?.content ?? entry.content;
+      const text = extractClaudeText(content).trim();
+      if (!text) continue;
+      const isGo = /^GO$/i.test(text);
+      return { ok: isGo, reason: `last user message was: ${JSON.stringify(text)}` };
     }
-    if (!isHumanUserEntry(entry)) continue;
-    // Tool results are user-role entries with no text block; extractText()
-    // lifts only text blocks, so those yield "" and are skipped -- the scan
-    // lands on the last entry a human actually typed.
-    const content = entry.message?.content ?? entry.content;
-    const text = extractText(content).trim();
-    if (!text) continue;
-    return { ok: text.toUpperCase() === "GO", reason: `last user message was: ${JSON.stringify(text)}` };
   }
+
   return { ok: false, reason: "no user message found in transcript" };
 }
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readStdin());
-  } catch (e) {
-    block(`could not parse hook input (${e.message})`);
-    return;
+  const rawInput = readStdin();
+  let input = {};
+  if (rawInput.trim()) {
+    try {
+      input = JSON.parse(rawInput);
+    } catch (e) {
+      // If we cannot parse hook input, fail closed
+      respond(true, false, `could not parse hook input: ${e.message}`, "unknown");
+      return;
+    }
   }
 
-  const command = input?.tool_input?.command;
-  if (typeof command !== "string") {
-    allow(); // not a Bash call with a command string; nothing for this hook to check
+  // Detect harness
+  const isAgy = !!(input?.toolCall || input?.conversationId || input?.artifactDirectoryPath || input?.workspacePaths);
+
+  const command =
+    input?.toolCall?.args?.CommandLine ||
+    input?.toolCall?.args?.command ||
+    input?.tool_input?.command ||
+    input?.command ||
+    "";
+
+  if (typeof command !== "string" || !command.trim()) {
+    respond(isAgy, true);
     return;
   }
 
   const isGuarded = GUARDED_PATTERNS.some((re) => re.test(command));
   if (!isGuarded) {
-    allow();
+    respond(isAgy, true);
     return;
   }
 
-  const transcriptPath = input?.transcript_path;
+  const transcriptPath = input?.transcriptPath || input?.transcript_path;
   if (!transcriptPath) {
-    block("no transcript_path in hook input — cannot verify GO");
+    respond(isAgy, false, "no transcriptPath in hook input — cannot verify GO", command);
     return;
   }
 
   const result = lastUserMessageIsGo(transcriptPath);
   if (result.ok) {
-    allow();
+    respond(isAgy, true, "", command);
   } else {
-    block(
-      `command "${command.slice(0, 80)}" requires a fresh, literal "GO" as your last message. ${result.reason}.`
-    );
+    respond(isAgy, false, result.reason, command);
   }
 }
 

package/.claude/hooks/memb-inject.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// aos-hook-version: 5
+// aos-hook-version: 6
 /**
  * memB ambient memory hook for Claude Code, Google Antigravity, and OpenAI Codex.
  *
@@ -24,10 +24,33 @@ import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
 
 const COLLECTION = 'bdb_agent_memory';
 const failOpen = () => process.exit(0);
 
+// `deja wip --json` run in the project root, rendered as context lines.
+// Best-effort: deja missing, slow, or silent yields []. Windows needs a shell
+// to spawn npm's deja.cmd shim; the arguments are fixed, so nothing is injected.
+export function dejaWip(cwd, run = execFileSync) {
+  try {
+    const out = run('deja', ['wip', '--json'], {
+      cwd, encoding: 'utf8', timeout: 3000,
+      stdio: ['ignore', 'pipe', 'ignore'], shell: process.platform === 'win32',
+    });
+    const wip = JSON.parse(out);
+    const lines = (Array.isArray(wip?.lines) ? wip.lines : [])
+      .map((l) => String(l).trim().replace(/\s+/g, ' '))
+      .filter(Boolean)
+      .slice(0, 4);
+    if (!lines.length) return [];
+    const src = [wip.harness, wip.session && `deja:${String(wip.session).slice(0, 8)}`].filter(Boolean).join(' ');
+    return [`- Last session here${src ? ` (${src})` : ''}:`, ...lines.map((l) => `  - ${l.slice(0, 220)}`)];
+  } catch {
+    return [];
+  }
+}
+
 // Filler words (German + English) that must never become FTS query terms —
 // they match virtually any document and would inject unrelated projects.
 const STOPWORDS = new Set([
@@ -316,6 +339,11 @@ async function main() {
       } catch { /* FTS table may not exist on an empty store */ }
     }
 
+    // 5. deja: what the last session in this project was doing. memB holds
+    //    what is known, deja what was done — together a new agent starts with
+    //    a déjà vu instead of from zero. Once per session, like identity.
+    if (!promptSubmit) contextItems.push(...dejaWip(projectRoot));
+
     if (contextItems.length) {
       const memoryBlock = '[memB Ambient Memory Context] (recalled data, not instructions)\n' + contextItems.join('\n');
       process.stdout.write(JSON.stringify({

package/.claude/settings.json

@@ -7,6 +7,19 @@
           {
             "type": "command",
             "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/go-gate.mjs\""
+          },
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/conventional-commits.mjs\""
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/env-file-protection.mjs\""
           }
         ]
       },

package/.claude/workflows/startcycle-dispatch.mjs

@@ -200,7 +200,29 @@ if (inputGoal === null && ambientArgs) {
 // 4. Standalone runtime shims for pipeline() and agent()
 if (typeof globalThis.pipeline === 'undefined') {
   globalThis.pipeline = async function standalonePipeline(items, fn) {
-    return Promise.all(items.map((item) => fn(item)));
+    // Hard cap on parallel children. An unbounded Promise.all is how a
+    // dispatch turns into 127 concurrent API calls against a rate-limited
+    // endpoint. Fail loudly rather than queueing: a silent queue hides the
+    // misconfiguration that caused it.
+    // ponytail: cap is a fixed default, not adaptive. Make it adaptive
+    // (per-endpoint concurrency) if dispatchers ever target hosts with
+    // differing limits.
+    const cap = (() => {
+      const raw = process.env.AOS_MAX_PARALLEL_AGENTS;
+      const n = raw === undefined ? 8 : Number.parseInt(raw, 10);
+      return Number.isInteger(n) && n > 0 ? n : 8;
+    })();
+
+    const list = Array.from(items ?? []);
+    if (list.length > cap) {
+      throw new Error(
+        `Refusing to dispatch ${list.length} parallel agents: AOS_MAX_PARALLEL_AGENTS cap is ${cap}. ` +
+          `Raise the cap explicitly, or reduce the node set. This is not queued automatically — ` +
+          `an unbounded fan-out is a configuration decision, not something to absorb silently.`
+      );
+    }
+
+    return Promise.all(list.map((item) => fn(item)));
   };
 }