claude-code-arcane 2.10.0 → 2.11.0

package/skills/blender-modeling/SKILL.md

@@ -157,4 +157,4 @@ Reportar por objeto: verts, tris, n-gons, materiales, escala, y tris contra el p
 ---
 
 > → Topologia, presupuestos, ejes y las reglas de scripts destructivos estan en
-> `.claude/rules/blender-pipeline.md`.
+> `.claude/rules/blender-files.md`.

package/skills/check/SKILL.md

@@ -17,6 +17,6 @@ Run a comprehensive code quality and security check on the current project:
    - Hardcoded secrets, API keys, tokens in source code
    - Known vulnerable dependencies (npm audit, pip audit, etc.)
    - SQL injection, XSS, or command injection patterns
-6. **Report** — Summarize findings with severity levels and suggested fixes
+6. **Report** — Summarize findings with severity levels and suggested fixes, then close with a verdict: **FAIL** if tests or type checks fail, or a secret or critical vulnerability turned up; **CONCERNS** if only lint issues or lower-severity findings remain; **PASS** if nothing actionable came up
 
 Focus on actionable issues, not style nitpicks.

package/skills/chief-of-staff/SKILL.md

@@ -59,7 +59,7 @@ Before delivering ANY output to the founder:
 - Company context loaded (not generic advice)
 - Actions have owners and deadlines
 - Conflicts named, not smoothed
-- Max 5 bullets per section
+- About 5 bullets per section, ranked by impact; a critical finding is never dropped to fit
 
 ## Ecosystem Awareness
 

package/skills/cloud-security/SKILL.md

@@ -73,6 +73,10 @@ Full escalation combos, severity guide, and least privilege recommendations: `re
 
 Catch misconfigurations at definition time in Terraform, CloudFormation, Kubernetes manifests, and Helm charts. Integrate into CI/CD as a pre-apply gate.
 
+### Step 6: Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up. Apply the severity modifier first: an internet-facing or regulated-data resource raises the finding's severity before the verdict is taken.
+
 ---
 
 ## Cloud Provider Coverage

package/skills/isms-audit-expert/SKILL.md

@@ -54,6 +54,8 @@ For detailed control testing procedures by Annex A control, see [references/secu
 | Minor Nonconformity | Isolated deviation with limited impact | 90 days |
 | Observation | Improvement opportunity | Next audit cycle |
 
+**Audit conclusion:** **CONFORMING** (observations at most), **MINOR NONCONFORMITIES** (minor only), or **MAJOR NONCONFORMITY** (at least one major, which blocks a certification recommendation until it is corrected).
+
 ### Corrective Action Workflow
 
 1. Auditee acknowledges finding

package/skills/meshy-derive/SKILL.md

@@ -116,4 +116,4 @@ Reportar: targets generados, creditos gastados reales (delta de `check_balance`)
 
 ---
 
-> Presupuestos, estructura de `targets/`, formato del ledger y la tabla de creditos completa: `.claude/rules/meshy-assets.md`.
+> Presupuestos, estructura de `targets/` y formato del ledger: `.claude/rules/meshy-files.md`. Tabla de creditos completa: `.claude/rules/meshy-assets.md`.

package/skills/meshy-generate/SKILL.md

@@ -115,4 +115,4 @@ Reportar:
 
 ---
 
-> Tabla de creditos completa, reglas de gasto, formato del ledger y convenciones de ejes/escala: `.claude/rules/meshy-assets.md`. Leerla antes de la Phase 3.
+> Tabla de creditos completa, reglas de gasto, formato del ledger y convenciones de ejes/escala: `.claude/rules/meshy-assets.md` y `.claude/rules/meshy-files.md`. Leerlas antes de la Phase 3.

package/skills/meshy-setup/SKILL.md

@@ -113,4 +113,4 @@ Reportar:
 
 ---
 
-> Las reglas de gasto, estructura de `assets/3d/`, ledger `meshy.json` y tabla de derivados estan en `.claude/rules/meshy-assets.md`. Leerlas antes de cualquier operacion que gaste creditos.
+> Las reglas de gasto, estructura de `assets/3d/`, ledger `meshy.json` y tabla de derivados estan en `.claude/rules/meshy-assets.md` y `.claude/rules/meshy-files.md`. Leerlas antes de cualquier operacion que gaste creditos.

package/skills/owasp-top10-check/SKILL.md

@@ -86,7 +86,7 @@ Auditoría contra OWASP Top 10 2021. Go backend + TS/React frontend. Datos de me
 
 ## Reporte Output
 
-Formato: Resumen ejecutivo (hallazgos por severidad) → Hallazgos por categoría (archivo:línea, descripción, PoC, remediación, ticket Jira) → Plan priorizado → Herramientas ejecutadas.
+Formato: Resumen ejecutivo (hallazgos por severidad y veredicto: **FAIL** si hay algún hallazgo Critical o High, **CONCERNS** si quedan solo Medium o Low, **PASS** si no hay nada accionable) → Hallazgos por categoría (archivo:línea, descripción, PoC, remediación, ticket Jira) → Plan priorizado → Herramientas ejecutadas.
 
 ## Educabot Specifics
 

package/skills/qms-audit-expert/SKILL.md

@@ -63,6 +63,8 @@ Gap: [How evidence fails to meet requirement]
 | Minor | Isolated lapse or partial implementation | Recommended | 60 days |
 | Observation | Improvement opportunity | Optional | As appropriate |
 
+**Audit conclusion:** **CONFORMING** (observations at most), **MINOR NONCONFORMITIES** (minor only), or **MAJOR NONCONFORMITY** (at least one major, which blocks a certification recommendation until it is corrected).
+
 ### Corrective Action Integration
 
 | Severity | CAPA Depth | Verification |

package/skills/security-pen-testing/SKILL.md

@@ -74,7 +74,7 @@ Key tests: XSS (reflected, stored, DOM-based), CSRF (token replay, SameSite), SQ
 python scripts/pentest_report_generator.py --findings findings.json --format md --output report.md
 ```
 
-Report structure: executive summary, scope, methodology, findings table (by severity/CVSS), detailed findings with evidence and remediation, priority matrix.
+Report structure: executive summary with a verdict (**FAIL** if any finding is Critical or High, **CONCERNS** if only Medium or Low remain, **PASS** if nothing actionable turned up), scope, methodology, findings table (by severity/CVSS), detailed findings with evidence and remediation, priority matrix.
 
 Responsible disclosure timeline and templates: `references/responsible_disclosure.md`
 

package/skills/seo-audit/SKILL.md

@@ -43,7 +43,7 @@ Before auditing, understand:
 ### Audit Report Structure
 
 **Executive Summary**
-- Overall health assessment
+- Overall health: **HEALTHY** (no critical or high-impact issues), **NEEDS WORK** (high-impact issues, nothing blocking), or **CRITICAL** (something blocks indexation or ranking)
 - Top 3-5 priority issues
 - Quick wins identified
 

package/skills/skill-auditor/SKILL.md

@@ -68,7 +68,6 @@ Scan the body for required elements:
 
 - **Sections**: At least 2 phase headings (`## Phase`, `## Step`, `## Workflow`, or `###` subsections)
 - **Verdict keywords**: For review/analysis skills: APPROVED, PASS, FAIL, NEEDS REVISION (or equivalent)
-- **Collaborative protocol**: For file-modifying skills (Write/Edit in allowed-tools): must contain "May I write" or equivalent approval gate
 - **Next-step handoff**: Last section should guide what to do after the skill completes
 
 ### 1.4 Detect hallucinations

package/skills/skill-improve/SKILL.md

@@ -17,7 +17,7 @@ Read skill name from first arg. Verify `skills/[name]/SKILL.md` exists. If missi
 
 ## Phase 2: Baseline Test
 
-Run `/skill-test static [name]`. Record FAILs, WARNs, which checks failed (1-7).
+Run `/skill-test static [name]`. Record FAILs, WARNs, which checks failed (1-6).
 
 ### Phase 2b: Category Baseline
 
@@ -30,12 +30,11 @@ Read full skill file. For each failing/warning check, identify exact gap:
 | Check | Gap if failing |
 |-------|---------------|
 | 1 | Missing frontmatter field |
-| 2 | Fewer phases than minimum |
-| 3 | No verdict keywords in body |
-| 4 | Write/Edit in tools but no ask-before-write language |
-| 5 (warn) | No follow-up/next-step section |
-| 6 (warn) | `context: fork` with <5 phases |
-| 7 (warn) | argument-hint empty or mismatched with modes |
+| 2 | Over 40 lines with fewer than two `##` sections |
+| 3 | A value from the catalog's `verdict:` list missing from the skill |
+| 4 (warn) | No follow-up/next-step section |
+| 5 (warn) | `context: fork` with <5 phases |
+| 6 (warn) | argument-hint mismatched with modes |
 
 For category checks: identify text gaps (e.g., G2: missing director prompts, A2: no per-section May-I-write, T3: BLOCKED not surfaced). Show full diagnosis before proposing changes.
 

package/skills/skill-test/SKILL.md

@@ -15,18 +15,18 @@ Validates `skills/*/SKILL.md` for structural compliance and behavioral correctne
 
 | Mode | Command | Purpose | Cost |
 |------|---------|---------|------|
-| `static` | `/skill-test static [name\|all]` | 7 structural checks per skill | Low (~1k/skill) |
+| `static` | `/skill-test static [name\|all]` | 6 structural checks per skill | Low (~1k/skill) |
 | `spec` | `/skill-test spec [name]` | Behavioral assertions from test spec | Medium (~5k/skill) |
 | `category` | `/skill-test category [name\|all]` | Category-specific rubric metrics | Low (~2k/skill) |
 | `audit` | `/skill-test audit` | Coverage report — skills, agents, test dates | Low (~3k total) |
 
 ## Phase 1: Parse Arguments
 
-`static [name]` → 7 checks on one skill. `static all` → all skills (Glob `skills/*/SKILL.md`). `spec [name]` → read skill + test spec, evaluate assertions. `category [name|all]` → category rubric from `CCGS Skill Testing Framework/quality-rubric.md`. `audit` (or no arg) → read catalog, list all, show coverage. Missing/unrecognized → output usage and stop.
+`static [name]` → 6 checks on one skill. `static all` → all skills (Glob `skills/*/SKILL.md`). `spec [name]` → read skill + test spec, evaluate assertions. `category [name|all]` → category rubric from `skills-selftest/quality-rubric.md`. `audit` (or no arg) → read catalog, list all, show coverage. Missing/unrecognized → output usage and stop.
 
 ## Phase 2A: Static Mode
 
-> → Read references/static-checks.md for the 7 structural validation checks and verdict criteria
+> → Read references/static-checks.md for the 6 structural validation checks and verdict criteria
 
 ## Phase 2B: Spec Mode
 

package/skills/skill-test/references/static-checks.md

@@ -1,13 +1,18 @@
-# Static Checks — 7 Structural Validations
+# Static Checks — 6 Structural Validations
+
+Checks 1-3 are also enforced in CI by `src/__tests__/skill-static.test.ts`, so in this repo a skill that fails them never merges. Apply them here anyway: the skill may be running in a project with its own skills, where no test covers them.
 
 | Check | What | Verdict |
 |-------|------|---------|
-| 1 — Frontmatter | `name`, `description`, `argument-hint`, `user-invocable`, `allowed-tools` present | FAIL if any absent |
-| 2 — Phases | >=2 numbered phase headings (`## Phase N`, `## N.`, or >=2 `##` headings) | FAIL if <2 |
-| 3 — Verdict Keywords | Contains >=1 of: PASS, FAIL, CONCERNS, APPROVED, BLOCKED, COMPLETE, READY, COMPLIANT, NON-COMPLIANT | FAIL if none |
-| 4 — Collaborative Protocol | "May I write" / "before writing" / "approval" near file-write instructions | WARN if absent; FAIL if `allowed-tools` includes Write/Edit but no ask-before-write |
-| 5 — Next-Step Handoff | Final section mentions another skill, "next step", or follow-up | WARN if absent |
-| 6 — Fork Complexity | If `context: fork`, must have >=5 phase headings | WARN if <5 |
-| 7 — Argument Hint | Non-empty; documented modes should match hint | WARN if empty or mismatch |
+| 1 — Frontmatter | `name` (matching the directory), `description`, `argument-hint`, `user-invocable`, `allowed-tools` present; an empty `argument-hint` still counts as present | FAIL if any absent |
+| 2 — Sections | A skill longer than 40 lines has at least two `##` sections. Shorter skills are exempt | FAIL if longer than 40 lines with fewer than two |
+| 3 — Verdict | Only for skills that judge something: those with `verdict:` in `skills-selftest/catalog.yaml`. Every value listed there appears in the skill (SKILL.md or `references/`), in the skill's own vocabulary. Skills that build, write or advise do not need a verdict | FAIL if a listed value is missing |
+| 4 — Next-Step Handoff | Final section mentions another skill, "next step", or follow-up | WARN if absent |
+| 5 — Fork Complexity | If `context: fork`, must have >=5 phase headings | WARN if <5 |
+| 6 — Argument Hint | Documented modes should match the hint | WARN if mismatch |
+
+A new skill that judges something gets a `verdict:` list in the catalog when it is added; that is what makes check 3 apply to it.
+
+There is no check for ask-before-write language. Whether Claude may write without asking is set by the permission mode of each session, not by the skill, so a skill with `Write` or `Edit` is not non-compliant for leaving the decision there.
 
 **Output:** per-skill table of check results + verdict (COMPLIANT / WARNINGS / NON-COMPLIANT). For `static all`: summary table + aggregate counts.

package/skills/standup-report/SKILL.md

@@ -48,4 +48,4 @@ Flujo: detectar team/proyecto → pull data en paralelo (git, ClickUp, Jira, Git
 - NO incluir contenido sensible (PII, passwords, secrets)
 - Grouping lógico: mergear commits del mismo ticket
 - Sugerencias "hoy" basadas en tickets In Progress + priorities
-- Max 5 bullets per section, collapsar el resto
+- Unos 5 bullets por sección, ordenados por impacto, y el resto colapsado. Un blocker nunca se colapsa para respetar el número

package/skills/vn-gdd/SKILL.md

@@ -7,6 +7,8 @@ user-invocable: true
 allowed-tools: Read, Glob, Grep, Write, Edit, WebSearch, AskUserQuestion
 ---
 
+## Process
+
 When this skill is invoked:
 
 1. **Check for existing work**:

package/skills/web-security/SKILL.md

@@ -82,6 +82,10 @@ HSTS rollout: start with short `max-age` (300s), escalate to 2 years, then submi
 - **Threat modeling**: complex trust boundaries need STRIDE before implementation
 - **CSP breaks prod**: revert to report-only immediately; analyze before re-enforcing
 
+## Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up.
+
 ## Checklist
 
 - [ ] All required security headers present and returning correct values (target A+ on securityheaders.com)

package/skills/worktree-isolation/README.md

@@ -8,22 +8,22 @@ This README explains **how worktree isolation works under the hood**. For usage,
 
 ## Install
 
+Ships with the `infra` and backend profiles. Elsewhere:
+
 ```bash
-npx skills add https://github.com/educabot/team-ai-skills --skill worktree-isolation
+npx claude-code-arcane add worktree-isolation
 ```
 
-> The host repo is private — `npx skills add` clones via Git, so the machine needs GitHub credentials with read access (e.g. `gh auth login` or an SSH key on the account).
-
-After install, invoke with phrases like:
+Then invoke with phrases like:
 
 - `isolate worktree`
 - `regenerate worktree ports`
 - `which ports is this worktree using?`
 
-If you also want a SessionStart hook that runs this automatically on every Claude Code session start, install the companion skill:
+If you also want it to run automatically on every Claude Code session start, install the SessionStart hook once per machine:
 
 ```bash
-npx skills add https://github.com/educabot/team-ai-skills --skill worktree-isolation-setup
+npx claude-code-arcane global
 ```
 
 ---

package/skills/worktree-isolation/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: worktree-isolation
-description: On-demand worktree isolation for the current directory. Regenerates per-worktree docker-compose overrides + .env.worktree so multiple Claude Code worktrees can run their stacks in parallel without port or container-name collisions, and inspects the current allocation. Use when (1) the SessionStart hook didn't fire (new project, hook not installed, fresh clone), (2) docker-compose.yml changed mid-session and overrides need regenerating, (3) the user wants to inspect which host ports this worktree is mapped to. Trigger phrases include "isolate worktree", "regenerate worktree ports", "show worktree ports", "what ports is this worktree using", "worktree didn't isolate", "fix port collision", "aislar worktree".
+description: "Regenerate or show this worktree's Docker ports (.env.worktree + compose overrides) so parallel worktrees don't collide. Leaves repo files alone; to prepare a repo once, use worktree-isolation-setup."
+argument-hint: "[apply | status]"
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash
 ---
 
 # Worktree Isolation — On-Demand
@@ -81,7 +84,7 @@ This skill does not auto-rewrite `CLAUDE.md` or scripts (zero-touch on project f
 
 ## Out of scope
 
-- Does not install the SessionStart hook globally. Use [`worktree-isolation-setup`](../worktree-isolation-setup/) for that.
+- Does not install the SessionStart hook. `npx claude-code-arcane global` does that, once per machine.
 - Does not modify the repo's compose files / `CLAUDE.md` / `.gitignore`. Use [`worktree-isolation-setup`](../worktree-isolation-setup/) for that.
 - Does not clean up orphan stacks from deleted worktrees. For now, `docker compose ls` and `docker compose -p <project-name> down -v` manually.
 - Does not handle non-docker dev servers (Next.js, uvicorn directly on host).

package/skills/worktree-isolation-setup/README.md

@@ -8,13 +8,13 @@ This README explains **what setup does and why**. For step-by-step instructions,
 
 ## Install
 
+Ships with the `infra` and backend profiles, next to `worktree-isolation`. Elsewhere:
+
 ```bash
-npx skills add https://github.com/educabot/team-ai-skills --skill worktree-isolation-setup
+npx claude-code-arcane add worktree-isolation-setup
 ```
 
-> The host repo is private — `npx skills add` clones via Git, so the machine needs GitHub credentials with read access (e.g. `gh auth login` or an SSH key on the account).
-
-After install, run the skill once per repo:
+Then run the skill once per repo:
 
 ```
 setup worktree isolation in this project
@@ -80,7 +80,7 @@ After setup, both work in parallel.
 │                                                                     │
 │    user → "setup worktree isolation in this project"                │
 │      → this skill runs                                              │
-│        ├─ install_hook.py        (one-time per machine; idempotent) │
+│        ├─ arcane global          (one-time per machine; idempotent) │
 │        ├─ rewrites compose files (port + container_name params)     │
 │        ├─ updates .gitignore                                        │
 │        └─ amends CLAUDE.md                                          │
@@ -127,11 +127,7 @@ For deep-dive details on how the runtime script works (port allocation, override
 ```
 skills/worktree-isolation-setup/
 ├── SKILL.md             # entry point — step-by-step setup procedure
-├── README.md            # this file
-└── scripts/
-    ├── install_hook.py  # idempotent installer for the hook + scripts
-    ├── apply.py         # copied into ~/.claude/scripts/ by install_hook.py
-    └── lib.py           # ditto
+└── README.md            # this file
 ```
 
-`apply.py` and `lib.py` are duplicated from the [`worktree-isolation`](../worktree-isolation/) skill so this skill is self-contained. The runtime skill bundles its own copies for direct invocation.
+This skill has no scripts of its own. The runtime scripts live in [`worktree-isolation`](../worktree-isolation/scripts/), and `npx claude-code-arcane global` copies them from there into `~/.claude/scripts/`.

package/skills/worktree-isolation-setup/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: worktree-isolation-setup
-description: One-time per-repo setup that makes a project natively friendly to the worktree-isolation runtime. Refactors docker-compose port mappings + container_name to use ${VAR-default} substitutions, updates .gitignore, amends CLAUDE.md test commands, and ensures the global SessionStart hook + scripts are installed on the user's machine. Run once per repo. Trigger phrases include "setup worktree isolation in this project", "prepare repo for worktree isolation", "make this repo isolation-aware", "preparar repo para worktrees paralelos". DO NOT use mid-session for routine port regeneration — that is the `worktree-isolation` skill.
+description: "Prepare a repo once for parallel worktrees: parameterize docker-compose ports and container names, update .gitignore and CLAUDE.md, install the SessionStart hook. Edits repo files; to regenerate or show ports, use worktree-isolation."
+argument-hint: ""
+user-invocable: true
+allowed-tools: Read, Glob, Grep, Bash, Edit
 ---
 
 # Worktree Isolation — Setup (one-time)
@@ -20,17 +23,23 @@ For an in-depth explanation of how isolation works (hook lifecycle, override gen
 
 ## Step 1 — Ensure the global hook is installed
 
-Run the bundled installer. It is idempotent — safe to re-run.
+The hook is per machine, so check first:
 
 ```bash
-python3 scripts/install_hook.py
+npx claude-code-arcane global --status
+```
+
+If the SessionStart hook is not active, install it. It is idempotent — safe to re-run:
+
+```bash
+npx claude-code-arcane global
 ```
 
 What it does:
-1. Copies `scripts/apply.py` + `scripts/lib.py` into `~/.claude/scripts/worktree-isolation/`
-2. Adds (or confirms) a `SessionStart` hook in `~/.claude/settings.json` that invokes `~/.claude/scripts/worktree-isolation/apply.py --quiet`
+1. Copies `apply.py` + `lib.py` into `~/.claude/scripts/worktree-isolation/`
+2. Adds a `SessionStart` hook in `~/.claude/settings.json` that invokes `~/.claude/scripts/worktree-isolation/apply.py --quiet`
 
-If the hook is already present, it reports "already present" and exits 0.
+It refuses to touch a malformed `settings.json`; if it stops there, tell the user and continue with Step 2 — the repo changes do not depend on the hook.
 
 ---
 

package/skills/worktree-isolation-setup/scripts/apply.py

@@ -1,178 +0,0 @@
-#!/usr/bin/env -S uv run --script --quiet
-# /// script
-# requires-python = ">=3.11"
-# dependencies = ["pyyaml"]
-# ///
-"""Worktree isolation entry point.
-
-Two callers:
-  1. Claude Code SessionStart hook → `apply.py --quiet` (emits hook JSON).
-  2. worktree-isolation skill → `apply.py --verbose --force` or `--status`.
-
-Reads the project's docker-compose*.yml files, generates per-worktree override
-files (sibling .worktree.yml) with deterministic randomized host ports + suffixed
-container_names, writes .env.worktree, and registers the generated files in the
-per-worktree git exclude list.
-"""
-
-from __future__ import annotations
-
-import argparse
-import json
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).parent))
-
-import yaml  # noqa: E402
-
-from lib import (  # noqa: E402
-    PortMapping,
-    collect_container_names,
-    collect_port_mappings,
-    ensure_git_exclude,
-    find_compose_files,
-    overrides_up_to_date,
-    override_path_for,
-    render_env_worktree,
-    render_override_yaml,
-    worktree_id,
-)
-
-
-def _build_summary(
-    project_name: str,
-    worktree: str,
-    compose_chain: list[tuple[Path, Path | None]],
-    mappings: list[PortMapping],
-) -> str:
-    lines = [
-        f"Worktree isolation active: project='{project_name}' (id={worktree}).",
-        "",
-        "Port mappings (legacy → worktree host):",
-    ]
-    for m in sorted(mappings, key=lambda x: (x.service, x.container_port)):
-        lines.append(
-            f"  {m.service}  container :{m.container_port}  →  host {m.new_host_port}  "
-            f"(was {m.original_host_port})"
-        )
-    lines += [
-        "",
-        "To bring up the stack from this worktree:",
-        "  set -a; source .env.worktree; set +a",
-        "  docker compose up -d",
-        "(COMPOSE_FILE in .env.worktree auto-chains base + override files.)",
-        "",
-        "When running ad-hoc commands (e.g. test commands in CLAUDE.md) that hardcode",
-        "legacy host ports like " + ", ".join(sorted({str(m.original_host_port) for m in mappings}))
-        + ", substitute the matching new host port from the table above before executing.",
-    ]
-    return "\n".join(lines)
-
-
-def _run(args: argparse.Namespace) -> int:
-    cwd = args.cwd.resolve()
-
-    if args.status:
-        env_file = cwd / ".env.worktree"
-        if not env_file.exists():
-            print(f"No .env.worktree at {cwd}. Run with --force to generate.", file=sys.stderr)
-            return 1
-        print(env_file.read_text())
-        return 0
-
-    compose_files = find_compose_files(cwd)
-    if not compose_files:
-        if args.quiet:
-            print(json.dumps({"continue": True}))
-        elif args.verbose:
-            print(f"No docker-compose files in {cwd}. Nothing to isolate.")
-        return 0
-
-    wid = worktree_id(cwd)
-    project_name = f"{cwd.name}-{wid}"
-    env_file = cwd / ".env.worktree"
-
-    compose_chain: list[tuple[Path, Path | None]] = []
-    all_mappings: list[PortMapping] = []
-    regenerated_any = False
-
-    for base in compose_files:
-        mappings = collect_port_mappings(base, wid)
-        container_names = collect_container_names(base)
-
-        if not mappings and not container_names:
-            # Nothing to override for this file — still include in chain for completeness? No,
-            # if there's nothing to override, the base alone is fine. Skip.
-            continue
-
-        override_path = override_path_for(base)
-
-        if not args.force and overrides_up_to_date(base, override_path, env_file):
-            compose_chain.append((base, override_path))
-            all_mappings.extend(mappings)
-            continue
-
-        override_yaml_data = render_override_yaml(mappings, container_names, project_name, wid)
-        with open(override_path, "w") as f:
-            f.write("# Auto-generated by ~/.claude/scripts/worktree-isolation/apply.py\n")
-            f.write("# DO NOT COMMIT. Regenerate with the worktree-isolation skill.\n")
-            yaml.safe_dump(override_yaml_data, f, sort_keys=False, default_flow_style=False)
-        compose_chain.append((base, override_path))
-        all_mappings.extend(mappings)
-        regenerated_any = True
-
-    if not compose_chain:
-        if args.quiet:
-            print(json.dumps({"continue": True}))
-        elif args.verbose:
-            print(f"No services with ports or container_name in {cwd}. Nothing to isolate.")
-        return 0
-
-    # Always write env file when we have a chain — covers fresh dirs even if overrides exist.
-    env_content = render_env_worktree(project_name, wid, compose_chain, all_mappings)
-    if not env_file.exists() or env_file.read_text() != env_content:
-        env_file.write_text(env_content)
-        regenerated_any = True
-
-    ensure_git_exclude(cwd, [".env.worktree", "*.worktree.yml", "*.worktree.yaml"])
-
-    summary = _build_summary(project_name, wid, compose_chain, all_mappings)
-
-    if args.quiet:
-        out = {
-            "hookSpecificOutput": {
-                "hookEventName": "SessionStart",
-                "additionalContext": summary,
-            }
-        }
-        print(json.dumps(out))
-    else:
-        print(summary)
-        if not regenerated_any:
-            print("\n(no changes — overrides already up to date)")
-    return 0
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="Per-worktree docker-compose isolation.")
-    parser.add_argument("--cwd", type=Path, default=Path.cwd(), help="Working directory")
-    parser.add_argument("--quiet", action="store_true", help="Hook mode: emit JSON only")
-    parser.add_argument("--verbose", action="store_true", help="Skill mode: human output")
-    parser.add_argument("--force", action="store_true", help="Regenerate even if up-to-date")
-    parser.add_argument("--status", action="store_true", help="Print current .env.worktree only")
-    args = parser.parse_args()
-
-    try:
-        return _run(args)
-    except Exception as exc:  # noqa: BLE001 — fail loud; hook captures stderr
-        if args.quiet:
-            # Don't break the session — emit a minimal valid hook response and log to stderr.
-            print(json.dumps({"continue": True}))
-            print(f"worktree-isolation error: {exc}", file=sys.stderr)
-            return 0
-        raise
-
-
-if __name__ == "__main__":
-    sys.exit(main())