docks-kit 0.16.0 → 0.16.1

package/AGENTS.md

@@ -51,11 +51,14 @@ Codex SoT notes:
 - `SoT/.codex/config.toml` pins Codex to `model = "gpt-5.6-sol"`, sets normal and plan reasoning to `high` with concise summaries, and sets `model_verbosity = "low"`, `personality`, live top-level `web_search`, workspace-write sandboxing with sandboxed command network access, cross-session `memories` (+ dedicated note tools), `[agents]` subagent limits (`max_threads = 12`, `max_depth = 2` — intentionally above Codex defaults for broad parallel kit work; deeper recursion increases cost and predictability risk), a 128 KiB `project_doc_max_bytes` budget for the repo-side AGENTS.md chain (the global `~/.codex/AGENTS.md` is uncapped and not counted), and enables the two Docks plugins `docks@docks` and `plan-lifecycle@docks` (the shared plan lifecycle).
 - `SoT/.codex/rules/*.rules` deploys to `~/.codex/rules/` as kit-managed Codex command policy. This is Codex's equivalent of permission allow/prompt/block rules; user-learned approvals in `~/.codex/rules/default.rules` are preserved.
 - `SoT/.codex/plugins/marketplace.json` deploys to Codex's personal marketplace path at `~/.agents/plugins/marketplace.json`; when the `codex` CLI is available, sync reruns `codex plugin add <plugin@marketplace>` for enabled SoT plugins so stale cached installs are refreshed.
+- Codex `/import` can copy Claude hooks into `~/.codex/hooks.json`. `codexSync.ts removeRetiredImportedHooks, legacy SessionStart cleanup` removes only recognized hooks from retired docks-kit Claude settings, backs up a changed file, and preserves user-authored hooks. The current Claude SessionStart program emits the structured JSON shape shared by both tools.
+- Codex limits the initial skill list to 2% of the model context and shortens descriptions first; it still reads a selected skill's full `SKILL.md`. Additive sync preserves user-added plugins, so their skill count and malformed cached `SKILL.md` files remain plugin-owned. Sync never patches a plugin cache in place.
 - The global prompt SoTs carry the owner's standing authorization for Docks cross-company plan review, which never overrides host or platform denial.
 - The `codex` CLI binary is upstream-owned, not kit-owned. The official standalone installer keeps package metadata under `$CODEX_HOME/packages/standalone` and places the `codex` symlink in `~/.local/bin` by default; sync only warns with a download-then-run installer command when the CLI is missing. Existing installs can self-update with `codex update`; npm and Homebrew remain upstream alternatives.
 
 - Claude runtime settings are an authoring template with sentinels. `claudeRuntime.ts` materializes absolute Bun/script paths only after the shared `bun.ts` bootstrap is ready; `claudeSync.ts` writes all runtime assets before atomically committing settings, then prunes the legacy shell scripts and Stop hook. Native `rate_limits` is the sole quota source, so jq/curl/OAuth caches are not runtime dependencies. A missing Bun defers only this cutover and preserves legacy pointers/files.
 - Claude's deployed SoT defaults are `model: opus` and `effortLevel: high`; `advisorModel` is deliberately absent/off. `--claude-advisor=on` is the per-machine opt-in and writes `advisorModel: fable` after the settings merge. `opus` is the alias, not a pinned id: the `minimumVersion` floor of 2.1.219 ensures Claude Code can resolve it to the newest Opus its provider offers — Opus 5 on the Anthropic API or Opus 4.6 on Microsoft Foundry — instead of silently capping Anthropic API users at Opus 4.8 under the former 2.1.170 floor. Keeping the alias provides provider portability and tracks future Opus releases; the literal `claude-opus-5` is unavailable on Foundry. The floor also subsumes Fable 5's older 2.1.170 requirement.
+- Claude permission rules are pruned, not host-scoped. The kit deploys its `PowerShell(...)` deny and ask rules on every host, because Claude Code leaves the PowerShell tool opt-in off Windows rather than unavailable, and a host that enables it must already carry the guards. `claudeRetired.ts RETIRED_PERMISSION_RULES, exact retired-rule inventory` lists the rules the kit no longer ships. `claudeSync.ts syncRemovals, retired-permission pass` force-prunes those exact strings from the kit-managed `~/.claude/settings.json` on every sync, because `settings.ts mergeSettings, permission-array union` would otherwise keep a dropped rule forever. A different user-authored rule survives. To restore an exact retired rule for one checkout, put it in that checkout's `.claude/settings.local.json`. Claude Code resolves that file against the working directory and merges it over user settings. Sync never reads or writes the checkout-local file. Claude Code has no user-scope local settings file. For a machine-wide restoration, add the rule to `SoT/.claude/settings.json`. At the same time, remove the exact string from `claudeRetired.ts RETIRED_PERMISSION_RULES, exact retired-rule inventory`. `permissions.allow` holds four read-only entries (`Read`, `Glob`, `Grep`, and `WebSearch`) plus the working-directory edit rule `Edit(./)`. Broad shell allow rules are not restored, because an allow rule resolves before Claude Code's read-only command analyzer and the auto-mode classifier. `autoMemoryEnabled` and `autoDreamEnabled` are both `false`.
 
 omp SoT notes:
 - `SoT/.omp/AGENTS.md`, `config.yml`, and `mcp.json` deploy to `~/.omp/agent/`.

package/README.md

@@ -143,7 +143,7 @@ Tagging `cli-v*` builds six standalone binaries for Linux, macOS, and Windows
 on x64 and arm64. The workflow attaches them plus `SHA256SUMS` to the GitHub
 release. npm publishes the exact package tarball through trusted publishing
 with OIDC provenance.
-Package `docks-kit` 0.16.0 bundles the CLI + generated payload, so npm releases
+Package `docks-kit` 0.16.1 bundles the CLI + generated payload, so npm releases
 are versioned config snapshots without shipping the authoring `SoT/` tree.
 
 ## Deeper docs

package/cli/src/engine-native/claudeRetired.ts

@@ -0,0 +1,165 @@
+/** Kit-owned permission rules the SoT no longer ships.
+ *
+ * `mergeSettings` unions the deployed arrays with the SoT arrays, so dropping a
+ * rule from `SoT/.claude/settings.json` never removes it from a file an earlier
+ * sync already wrote. `claudeSync.ts syncRemovals` force-prunes this exact-string
+ * inventory on every host so the retirement reaches existing installations
+ * without `--reconcile`.
+ *
+ * `allow` holds the shell pre-approvals retired in favour of Claude Code's own
+ * read-only command analysis and the auto-mode classifier, plus `WebFetch`.
+ * `deny` holds the malformed single-backslash spellings superseded by their
+ * escaped `\\)` forms; Claude Code refuses to parse the old text.
+ *
+ * Exact strings only. A user-authored rule outside this list survives the prune.
+ */
+export const RETIRED_PERMISSION_RULES = {
+  allow: [
+    "Bash(git *)",
+    "Bash(git add *)",
+    "Bash(git commit *)",
+    "Bash(git status *)",
+    "Bash(git diff *)",
+    "Bash(git log *)",
+    "Bash(git branch *)",
+    "Bash(git checkout *)",
+    "Bash(git switch *)",
+    "Bash(git stash *)",
+    "Bash(git fetch *)",
+    "Bash(git pull *)",
+    "Bash(git tag *)",
+    "Bash(git show *)",
+    "Bash(git blame *)",
+    "Bash(git worktree *)",
+    "Bash(gh *)",
+    "Bash(pnpm *)",
+    "Bash(npm *)",
+    "Bash(npx *)",
+    "Bash(node *)",
+    "Bash(docker *)",
+    "Bash(docker-compose *)",
+    "Bash(ls *)",
+    "Bash(cat *)",
+    "Bash(find *)",
+    "Bash(grep *)",
+    "Bash(head *)",
+    "Bash(tail *)",
+    "Bash(wc *)",
+    "Bash(sort *)",
+    "Bash(uniq *)",
+    "Bash(diff *)",
+    "Bash(which *)",
+    "Bash(pwd *)",
+    "Bash(date *)",
+    "Bash(mkdir *)",
+    "Bash(basename *)",
+    "Bash(dirname *)",
+    "Bash(realpath *)",
+    "Bash(jq *)",
+    "Bash(curl *)",
+    "Bash(tree *)",
+    "Bash(sed *)",
+    "Bash(awk *)",
+    "Bash(cut *)",
+    "Bash(tr *)",
+    "Bash(tee *)",
+    "Bash(echo *)",
+    "Bash(printf *)",
+    "Bash(env *)",
+    "Bash(printenv *)",
+    "Bash(uname *)",
+    "Bash(file *)",
+    "Bash(stat *)",
+    "Bash(du *)",
+    "Bash(id *)",
+    "Bash(whoami *)",
+    "Bash(php *)",
+    "Bash(composer *)",
+    "Bash(python3 *)",
+    "Bash(python *)",
+    "Bash(pip *)",
+    "Bash(pip3 *)",
+    "PowerShell(git *)",
+    "PowerShell(git add *)",
+    "PowerShell(git commit *)",
+    "PowerShell(git status *)",
+    "PowerShell(git diff *)",
+    "PowerShell(git log *)",
+    "PowerShell(git branch *)",
+    "PowerShell(git checkout *)",
+    "PowerShell(git switch *)",
+    "PowerShell(git stash *)",
+    "PowerShell(git fetch *)",
+    "PowerShell(git pull *)",
+    "PowerShell(git tag *)",
+    "PowerShell(git show *)",
+    "PowerShell(git blame *)",
+    "PowerShell(git worktree *)",
+    "PowerShell(gh *)",
+    "PowerShell(pnpm *)",
+    "PowerShell(npm *)",
+    "PowerShell(npx *)",
+    "PowerShell(node *)",
+    "PowerShell(docker *)",
+    "PowerShell(docker-compose *)",
+    "PowerShell(ls *)",
+    "PowerShell(cat *)",
+    "PowerShell(find *)",
+    "PowerShell(grep *)",
+    "PowerShell(head *)",
+    "PowerShell(tail *)",
+    "PowerShell(wc *)",
+    "PowerShell(sort *)",
+    "PowerShell(uniq *)",
+    "PowerShell(diff *)",
+    "PowerShell(which *)",
+    "PowerShell(pwd *)",
+    "PowerShell(date *)",
+    "PowerShell(mkdir *)",
+    "PowerShell(basename *)",
+    "PowerShell(dirname *)",
+    "PowerShell(realpath *)",
+    "PowerShell(jq *)",
+    "PowerShell(curl *)",
+    "PowerShell(tree *)",
+    "PowerShell(sed *)",
+    "PowerShell(awk *)",
+    "PowerShell(cut *)",
+    "PowerShell(tr *)",
+    "PowerShell(tee *)",
+    "PowerShell(echo *)",
+    "PowerShell(printf *)",
+    "PowerShell(env *)",
+    "PowerShell(printenv *)",
+    "PowerShell(uname *)",
+    "PowerShell(file *)",
+    "PowerShell(stat *)",
+    "PowerShell(du *)",
+    "PowerShell(id *)",
+    "PowerShell(whoami *)",
+    "PowerShell(php *)",
+    "PowerShell(composer *)",
+    "PowerShell(python3 *)",
+    "PowerShell(python *)",
+    "PowerShell(pip *)",
+    "PowerShell(pip3 *)",
+    "WebFetch"
+  ],
+  deny: [
+    "PowerShell(Remove-Item *-Recurse* \\)",
+    "PowerShell(Remove-Item *-Recurse* *:\\)",
+    "PowerShell(del *-Recurse* \\)",
+    "PowerShell(del *-Recurse* *:\\)",
+    "PowerShell(erase *-Recurse* \\)",
+    "PowerShell(erase *-Recurse* *:\\)",
+    "PowerShell(rd *-Recurse* \\)",
+    "PowerShell(rd *-Recurse* *:\\)",
+    "PowerShell(ri *-Recurse* \\)",
+    "PowerShell(ri *-Recurse* *:\\)",
+    "PowerShell(rm *-Recurse* \\)",
+    "PowerShell(rm *-Recurse* *:\\)",
+    "PowerShell(rmdir *-Recurse* \\)",
+    "PowerShell(rmdir *-Recurse* *:\\)"
+  ],
+  ask: []
+} as const satisfies Readonly<Record<"allow" | "deny" | "ask", ReadonlyArray<string>>>

package/cli/src/engine-native/claudeSync.ts

@@ -22,6 +22,7 @@ import {
   syncClaudeModel
 } from "./claudeSettingsModifiers"
 import { claudeRuntimePaths, materializeClaudeSettings, type ClaudeRuntimePaths } from "./claudeRuntime"
+import { RETIRED_PERMISSION_RULES } from "./claudeRetired"
 import { p, spawnProcess, writeBytesIfChanged, writeTextIfChanged } from "./exec"
 import type { Ctx } from "./index"
 import { compareCodepoints, deepMerge, isObject, jqStringify, parseJson, type Json } from "./jq"
@@ -398,8 +399,14 @@ const REMOVED_MANIFEST = {
     "hooks.PreToolUse"
   ],
   permissionRules: {
-    allow: ["Write(./)", "Bash(rtk *)"],
-    deny: ["Write(**/.env)", "Write(**/.env.local)", "Write(**/secrets/**)"]
+    allow: ["Write(./)", "Bash(rtk *)", ...RETIRED_PERMISSION_RULES.allow],
+    deny: [
+      "Write(**/.env)",
+      "Write(**/.env.local)",
+      "Write(**/secrets/**)",
+      ...RETIRED_PERMISSION_RULES.deny
+    ],
+    ask: [...RETIRED_PERMISSION_RULES.ask]
   },
   claudeJsonKeys: [] as Array<string>,
   /** Home-relative artifacts the kit installed outside ~/.claude. */
@@ -447,14 +454,14 @@ function pruneJsonKeys(ctx: Ctx, file: string, keys: Array<string>): number {
 function prunePermissionRules(
   ctx: Ctx,
   file: string,
-  rules: Readonly<Record<"allow" | "deny", ReadonlyArray<string>>>
+  rules: Readonly<Record<"allow" | "deny" | "ask", ReadonlyArray<string>>>
 ): number {
   if (!existsSync(file)) return 0
   const doc = parseJson(readFileSync(file, "utf8"))
   if (doc === undefined || !isObject(doc) || !isObject(doc["permissions"])) return 0
   const permissions = doc["permissions"]
   let present = 0
-  for (const key of ["allow", "deny"] as const) {
+  for (const key of ["allow", "deny", "ask"] as const) {
     const values = permissions[key]
     if (!Array.isArray(values)) continue
     const removed = new Set(rules[key])

package/cli/src/engine-native/codexSync.ts

@@ -20,6 +20,7 @@ export async function codexSync(ctx: Ctx): Promise<void> {
   await ensureBubblewrap(ctx)
   if (!ctx.dryRun) mkdirSync(codexDir, { recursive: true })
   syncConfig(ctx, sotConfig, userConfig)
+  removeRetiredImportedHooks(ctx, codexDir)
   syncCodexModel(ctx, ctx.codexModel)
   syncCodexEffort(ctx, ctx.codexEffort)
   syncRules(ctx, payloadPaths("SoT/.codex/rules/"), p(codexDir, "rules"))
@@ -29,6 +30,74 @@ export async function codexSync(ctx: Ctx): Promise<void> {
   await syncPlugins(ctx, sotConfig)
 }
 
+const RETIRED_CONTEXT_HOOK = `echo "[CONTEXT] Current date: $(date '+%A, %Y-%m-%d %H:%M:%S %Z')"`
+const RETIRED_SKILLS_HOOK = `SKILL_COUNT=$(find .claude/skills -name 'SKILL.md' -mindepth 2 -maxdepth 2 2>/dev/null | wc -l); [ "$SKILL_COUNT" -gt 0 ] && echo "[SKILLS] $SKILL_COUNT project skills available in .claude/skills/. Claude Code loads them on demand via Skill tool. After code changes affecting documented patterns, update the relevant skill and its metadata.updated field." || true`
+const RETIRED_CONFIG_HOOKS = new Set([
+  `echo "[CONFIG] Context: $([ \\\"\${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: \${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: \${CLAUDE_CODE_EFFORT_LEVEL:-high} | Thinking: adaptive | Subagent: \${CLAUDE_CODE_SUBAGENT_MODEL:-default}"`,
+  `echo "[CONFIG] Context: $([ \\\"\${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: \${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: \${CLAUDE_CODE_EFFORT_LEVEL:-high} | Thinking: adaptive | Model: \${ANTHROPIC_DEFAULT_OPUS_MODEL:-default} | Subagent: \${CLAUDE_CODE_SUBAGENT_MODEL:-default}"`,
+  `echo "[CONFIG] Context: $([ \\\"\${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: \${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: \${CLAUDE_CODE_EFFORT_LEVEL:-$(jq -r .effortLevel $HOME/.claude/settings.json 2>/dev/null || echo default)} | Thinking: adaptive | Subagent: \${CLAUDE_CODE_SUBAGENT_MODEL:-default}"`
+])
+
+function isRetiredImportedSessionStartHook(handler: Json, codexDir: string): boolean {
+  if (!isObject(handler) || handler["type"] !== "command" || typeof handler["command"] !== "string") return false
+  const command = handler["command"]
+  const connectorScript = p(codexDir, "hooks", "disable-claudeai-connectors.sh")
+  const retiredConnectorHook = `[ -x '${connectorScript}' ] && '${connectorScript}' || true`
+  return command === RETIRED_CONTEXT_HOOK || command === RETIRED_SKILLS_HOOK || RETIRED_CONFIG_HOOKS.has(command) || command === retiredConnectorHook
+}
+
+function withoutRetiredImportedHooks(doc: { [key: string]: Json }, codexDir: string): { readonly value: Json; readonly removed: number } {
+  const hooks = doc["hooks"]
+  if (!isObject(hooks) || !Array.isArray(hooks["SessionStart"])) return { value: doc, removed: 0 }
+
+  let removed = 0
+  const groups: Array<Json> = []
+  for (const group of hooks["SessionStart"]) {
+    if (!isObject(group) || !Array.isArray(group["hooks"])) {
+      groups.push(group)
+      continue
+    }
+    const kept = group["hooks"].filter((handler) => {
+      if (!isRetiredImportedSessionStartHook(handler, codexDir)) return true
+      removed++
+      return false
+    })
+    if (kept.length > 0) groups.push({ ...group, hooks: kept })
+  }
+  if (removed === 0) return { value: doc, removed: 0 }
+
+  const nextHooks = { ...hooks }
+  if (groups.length > 0) nextHooks["SessionStart"] = groups
+  else delete nextHooks["SessionStart"]
+  return { value: { ...doc, hooks: nextHooks }, removed }
+}
+
+/** Remove only Claude hooks that docks-kit retired before Codex could import them safely. */
+function removeRetiredImportedHooks(ctx: Ctx, codexDir: string): void {
+  const { change, echo, warn } = ctx.services.logger
+  const hooksFile = p(codexDir, "hooks.json")
+  if (!existsSync(hooksFile)) return
+  const before = readFileSync(hooksFile, "utf8")
+  const doc = parseJson(before)
+  if (doc === undefined || !isObject(doc)) {
+    warn(`Codex hooks file is not a valid JSON object; retired hook cleanup skipped: ${hooksFile}`)
+    return
+  }
+  const result = withoutRetiredImportedHooks(doc, codexDir)
+  if (result.removed === 0) return
+
+  if (ctx.dryRun) {
+    echo(`[dry-run] remove ${result.removed} retired imported docks-kit SessionStart hook(s) from ${hooksFile}`)
+    return
+  }
+
+  copyFileSync(hooksFile, `${hooksFile}.bak`)
+  writeFileSync(`${hooksFile}.tmp`, jqStringify(result.value))
+  renameSync(`${hooksFile}.tmp`, hooksFile)
+  change(`Codex: removed ${result.removed} retired imported docks-kit SessionStart hook(s) (backup at hooks.json.bak)`)
+  ctx.nextStepTriggers.codexRestart = true
+}
+
 // ---------------------------------------------------------- bubblewrap ----
 
 async function ensureBubblewrap(ctx: Ctx): Promise<void> {

package/cli/src/generated/sotPayload.ts

@@ -1,7 +1,7 @@
 // Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.
 // Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts
 
-export const GENERATED_PACKAGE_VERSION = "0.16.0"
+export const GENERATED_PACKAGE_VERSION = "0.16.1"
 
 export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",
@@ -9,9 +9,9 @@ export const GENERATED_PAYLOAD_TEXT = {
   "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a package the kit installs through another tool, such as npx or `omp install`). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"note\": \"hosts the npm globals installed for the Claude LSP plugins\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.219\", \"note\": \"kit floor — lets the `opus` alias select the newest Opus its provider offers (Anthropic API: 5; Foundry: 4.6) and subsumes Fable 5's >=2.1.170 requirement (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"omp\":    { \"kind\": \"check\", \"floor\": \"18.0.8\", \"verified\": \"18.0.8\",\n                \"note\": \"Oh My Pi harness (https://github.com/can1357/oh-my-pi); upstream-owned and self-updating through `omp update`, so sync never installs or upgrades it. `sync omp` needs the CLI only for the marketplace and plugin passes; the file deploys proceed without it\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"5.3.0\", \"verified\": \"5.3.0\", \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\", \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.4.0\", \"verified\": \"1.4.0\", \"pinnable\": true,\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.22\",\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" },\n    \"pi-intercom\": { \"kind\": \"pin\", \"verified\": \"0.10.0\",\n                \"note\": \"the cross-session messaging plugin ompSync installs with `omp install pi-intercom@<verified>` - pinned, never floating. Its broker runs under Bun because omp's flat plugin store cannot resolve the default `npx --no-install tsx` launcher\" }\n  }\n}\n",
   "SoT/.claude/CLAUDE.md": "## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- Upgrading or migrating between versions.\n- Any task where relying on memory could cause stale syntax or behavior.\n\nDo not:\n- Assume API signatures, method names, or config options from memory.\n- Generate framework code without checking current docs first.\n- Skip research because the library seems familiar.\n\n<constraint>\nResearch the codebase before editing. Never change code you have not read.\n</constraint>\n\n## Agentic Harness Heuristics\n\n**1. Persistence.** Keep going until the user's query is completely resolved. Only yield when sure the problem is solved. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done (\"I'll…\"), do that work now.\n\n**2. Default to parallel.** Whenever you have multiple independent operations (reads, greps, web fetches, independent edits), invoke them in a single response with multiple tool-use blocks. Sequential calls only when output of one operation is required as input to the next.\n\n**3. Multi-pass search.** First-pass search often misses — vary the wording (colleague-questions over keywords) before concluding something doesn't exist.\n\n**4. Trace symbols.** Before modifying a symbol, trace it to its definitions and all usages. Don't assume a function's behavior or a type's shape from the call site alone.\n\n**5. Linter-loop 3-strike rule.** Don't loop more than 3 times fixing linter errors on the same file. On the third attempt, stop and ask the user — repeated failure usually means the diagnosis is wrong, not the code.\n\n**6. Read-before-Edit TTL.** If you haven't read a file with the Read tool in the last ~5 messages, re-read it before editing. Cached file content goes stale silently when the user edits between turns.\n\n**7. Big-file rule.** For files >1000 lines, prefer Grep + scoped Read (`offset` + `limit`) over reading the entire file. Whole-file reads bloat context; targeted reads keep the working set small.\n\n**8. Todo hygiene.** Use TaskCreate for items with meaningful outcome (≥5 min, distinct deliverable). Never include operational sub-actions (linting, testing, searching, examining the codebase) as their own todos — those are sub-steps in service of higher-level tasks. Mark complete immediately when done, never in batches.\n\n**9. Literal-instruction rule.** Current frontier models follow instructions literally — they do not silently generalize from intent. Phrase requirements as explicit checklists with success criteria, not narrative.\n\n**10. Context hygiene.** Prefer `/clear` at task boundaries and `/rewind` for wrong-path detours over carrying rot forward (corrections accumulate noise; rewinds preserve the prefix and discard the bad branch). On a continuing task, run `/compact` with steering before context quality degrades. Never stop, summarize, or suggest a new session on account of context limits.\n\n**11. Autonomy calibration.** For minor choices (naming, formatting, default values, which of two equivalent approaches), pick a reasonable option and note it — don't ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; don't apply fixes until asked. Don't close a finished task with \"Want me to also…?\" — run the obvious verification, then stop cleanly.\n\n**12. Capability triggering.** When the answer depends on current or version-specific information, search or fetch before answering — never answer from memory. When work fans out across independent items (many files to read, many tests to run, many candidates to check), delegate to parallel subagents; never spawn one for work you can complete directly. For verification, prefer a fresh-context subagent over self-critique. On tasks longer than a few turns, keep a running notes file and re-read it before each phase.\n\n<constraint>\nTreat the 12 heuristics above as protocol, not preference. If a turn ends without honoring an applicable one (e.g., lint-loop guard not respected, edit without re-read), self-correct in the next turn before continuing.\n</constraint>\n\nReuse before invention: inventory existing code, components, conventions, and dependencies; extend them instead of creating a parallel pattern. Load only the narrow skills supported by the task and repository evidence. If a request establishes a new React/Tailwind system and no convention exists, prefer current shadcn/ui `base-*` components backed by Base UI; otherwise preserve the existing stack. Treat probe, production access, publish, push, release, and deploy as literal current-request effects—never infer external authority from a plan, schedule, review, or old receipt.\n\nFor Docks plan reviews, cross-company review is standing-authorized; do not ask for export consent. This never overrides a host or platform security denial.\n\nUse a narrow-to-broad verification ladder: direct acceptance while iterating, focused regressions next, and one full CI at the pre-commit or release boundary. Reuse still-matching evidence; rerun full CI only after a relevant edit invalidates it.\n\n<constraint>\nNo secrets in committed config. Treat plugin marketplaces, installers, and downloaded artifacts as untrusted until verified.\n</constraint>\n",
   "SoT/.claude/mcp-servers.json": "{\n  \"mcpServers\": {}\n}\n",
-  "SoT/.claude/settings.json": "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"minimumVersion\": \"2.1.219\",\n  \"model\": \"opus\",\n  \"effortLevel\": \"high\",\n  \"autoMemoryEnabled\": true,\n  \"skillListingMaxDescChars\": 2048,\n  \"respectGitignore\": true,\n  \"cleanupPeriodDays\": 14,\n  \"skillListingBudgetFraction\": 0.05,\n  \"env\": {\n    \"CLAUDE_CODE_MAX_OUTPUT_TOKENS\": \"64000\",\n    \"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR\": \"1\",\n    \"CLAUDE_CODE_AUTO_COMPACT_WINDOW\": \"468000\",\n    \"CLAUDE_CODE_NO_FLICKER\": \"1\"\n  },\n  \"permissions\": {\n    \"defaultMode\": \"auto\",\n    \"allow\": [\n      \"Read\",\n      \"Glob\",\n      \"Grep\",\n      \"WebFetch\",\n      \"WebSearch\",\n      \"Edit(./)\",\n      \"Bash(git *)\",\n      \"Bash(git add *)\",\n      \"Bash(git commit *)\",\n      \"Bash(git status *)\",\n      \"Bash(git diff *)\",\n      \"Bash(git log *)\",\n      \"Bash(git branch *)\",\n      \"Bash(git checkout *)\",\n      \"Bash(git switch *)\",\n      \"Bash(git stash *)\",\n      \"Bash(git fetch *)\",\n      \"Bash(git pull *)\",\n      \"Bash(git tag *)\",\n      \"Bash(git show *)\",\n      \"Bash(git blame *)\",\n      \"Bash(git worktree *)\",\n      \"Bash(gh *)\",\n      \"Bash(pnpm *)\",\n      \"Bash(npm *)\",\n      \"Bash(npx *)\",\n      \"Bash(node *)\",\n      \"Bash(docker *)\",\n      \"Bash(docker-compose *)\",\n      \"Bash(ls *)\",\n      \"Bash(cat *)\",\n      \"Bash(find *)\",\n      \"Bash(grep *)\",\n      \"Bash(head *)\",\n      \"Bash(tail *)\",\n      \"Bash(wc *)\",\n      \"Bash(sort *)\",\n      \"Bash(uniq *)\",\n      \"Bash(diff *)\",\n      \"Bash(which *)\",\n      \"Bash(pwd *)\",\n      \"Bash(date *)\",\n      \"Bash(mkdir *)\",\n      \"Bash(basename *)\",\n      \"Bash(dirname *)\",\n      \"Bash(realpath *)\",\n      \"Bash(jq *)\",\n      \"Bash(curl *)\",\n      \"Bash(tree *)\",\n      \"Bash(sed *)\",\n      \"Bash(awk *)\",\n      \"Bash(cut *)\",\n      \"Bash(tr *)\",\n      \"Bash(tee *)\",\n      \"Bash(echo *)\",\n      \"Bash(printf *)\",\n      \"Bash(env *)\",\n      \"Bash(printenv *)\",\n      \"Bash(uname *)\",\n      \"Bash(file *)\",\n      \"Bash(stat *)\",\n      \"Bash(du *)\",\n      \"Bash(id *)\",\n      \"Bash(whoami *)\",\n      \"Bash(php *)\",\n      \"Bash(composer *)\",\n      \"Bash(python3 *)\",\n      \"Bash(python *)\",\n      \"Bash(pip *)\",\n      \"Bash(pip3 *)\",\n      \"PowerShell(git *)\",\n      \"PowerShell(git add *)\",\n      \"PowerShell(git commit *)\",\n      \"PowerShell(git status *)\",\n      \"PowerShell(git diff *)\",\n      \"PowerShell(git log *)\",\n      \"PowerShell(git branch *)\",\n      \"PowerShell(git checkout *)\",\n      \"PowerShell(git switch *)\",\n      \"PowerShell(git stash *)\",\n      \"PowerShell(git fetch *)\",\n      \"PowerShell(git pull *)\",\n      \"PowerShell(git tag *)\",\n      \"PowerShell(git show *)\",\n      \"PowerShell(git blame *)\",\n      \"PowerShell(git worktree *)\",\n      \"PowerShell(gh *)\",\n      \"PowerShell(pnpm *)\",\n      \"PowerShell(npm *)\",\n      \"PowerShell(npx *)\",\n      \"PowerShell(node *)\",\n      \"PowerShell(docker *)\",\n      \"PowerShell(docker-compose *)\",\n      \"PowerShell(ls *)\",\n      \"PowerShell(cat *)\",\n      \"PowerShell(find *)\",\n      \"PowerShell(grep *)\",\n      \"PowerShell(head *)\",\n      \"PowerShell(tail *)\",\n      \"PowerShell(wc *)\",\n      \"PowerShell(sort *)\",\n      \"PowerShell(uniq *)\",\n      \"PowerShell(diff *)\",\n      \"PowerShell(which *)\",\n      \"PowerShell(pwd *)\",\n      \"PowerShell(date *)\",\n      \"PowerShell(mkdir *)\",\n      \"PowerShell(basename *)\",\n      \"PowerShell(dirname *)\",\n      \"PowerShell(realpath *)\",\n      \"PowerShell(jq *)\",\n      \"PowerShell(curl *)\",\n      \"PowerShell(tree *)\",\n      \"PowerShell(sed *)\",\n      \"PowerShell(awk *)\",\n      \"PowerShell(cut *)\",\n      \"PowerShell(tr *)\",\n      \"PowerShell(tee *)\",\n      \"PowerShell(echo *)\",\n      \"PowerShell(printf *)\",\n      \"PowerShell(env *)\",\n      \"PowerShell(printenv *)\",\n      \"PowerShell(uname *)\",\n      \"PowerShell(file *)\",\n      \"PowerShell(stat *)\",\n      \"PowerShell(du *)\",\n      \"PowerShell(id *)\",\n      \"PowerShell(whoami *)\",\n      \"PowerShell(php *)\",\n      \"PowerShell(composer *)\",\n      \"PowerShell(python3 *)\",\n      \"PowerShell(python *)\",\n      \"PowerShell(pip *)\",\n      \"PowerShell(pip3 *)\"\n    ],\n    \"deny\": [\n      \"Read(**/.env)\",\n      \"Read(**/.env.local)\",\n      \"Read(**/secrets/**)\",\n      \"Read(**/*.key)\",\n      \"Read(**/*.pem)\",\n      \"Read(**/*.p12)\",\n      \"Read(**/.credentials*)\",\n      \"Edit(**/.env)\",\n      \"Edit(**/.env.local)\",\n      \"Edit(**/secrets/**)\",\n      \"Bash(sudo *)\",\n      \"Bash(rm -rf /)\",\n      \"Bash(rm -rf / *)\",\n      \"Bash(rm -rf ~)\",\n      \"Bash(rm -rf ~ *)\",\n      \"Bash(rm -rf $HOME)\",\n      \"Bash(rm -rf $HOME *)\",\n      \"Bash(> /dev *)\",\n      \"Bash(dd if= *)\",\n      \"Bash(mkfs *)\",\n      \"Bash(eval *)\",\n      \"Bash(chmod 777 *)\",\n      \"Bash(chmod -R 777 *)\",\n      \"Bash(git push --force origin main *)\",\n      \"Bash(git push --force origin master *)\",\n      \"Bash(git push -f origin main *)\",\n      \"Bash(git push -f origin master *)\",\n      \"PowerShell(sudo *)\",\n      \"PowerShell(rm -rf /)\",\n      \"PowerShell(rm -rf / *)\",\n      \"PowerShell(rm -rf ~)\",\n      \"PowerShell(rm -rf ~ *)\",\n      \"PowerShell(rm -rf $HOME)\",\n      \"PowerShell(rm -rf $HOME *)\",\n      \"PowerShell(> /dev *)\",\n      \"PowerShell(dd if= *)\",\n      \"PowerShell(mkfs *)\",\n      \"PowerShell(eval *)\",\n      \"PowerShell(chmod 777 *)\",\n      \"PowerShell(chmod -R 777 *)\",\n      \"PowerShell(git push --force origin main *)\",\n      \"PowerShell(git push --force origin master *)\",\n      \"PowerShell(git push -f origin main *)\",\n      \"PowerShell(git push -f origin master *)\",\n      \"PowerShell(Remove-Item *-Recurse* /)\",\n      \"PowerShell(Remove-Item *-Recurse* / *)\",\n      \"PowerShell(Remove-Item / *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path / *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath / *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* ~)\",\n      \"PowerShell(Remove-Item *-Recurse* ~ *)\",\n      \"PowerShell(Remove-Item ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME *)\",\n      \"PowerShell(Remove-Item $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(Remove-Item $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\ *)\",\n      \"PowerShell(Remove-Item \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\ *)\",\n      \"PowerShell(Remove-Item *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* /)\",\n      \"PowerShell(del *-Recurse* / *)\",\n      \"PowerShell(del / *-Recurse*)\",\n      \"PowerShell(del -Path / *-Recurse*)\",\n      \"PowerShell(del -LiteralPath / *-Recurse*)\",\n      \"PowerShell(del *-Recurse* ~)\",\n      \"PowerShell(del *-Recurse* ~ *)\",\n      \"PowerShell(del ~ *-Recurse*)\",\n      \"PowerShell(del -Path ~ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $HOME)\",\n      \"PowerShell(del *-Recurse* $HOME *)\",\n      \"PowerShell(del $HOME *-Recurse*)\",\n      \"PowerShell(del -Path $HOME *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(del $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del *-Recurse* \\\\)\",\n      \"PowerShell(del *-Recurse* \\\\ *)\",\n      \"PowerShell(del \\\\ *-Recurse*)\",\n      \"PowerShell(del -Path \\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* *:\\\\)\",\n      \"PowerShell(del *-Recurse* *:\\\\ *)\",\n      \"PowerShell(del *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* /)\",\n      \"PowerShell(erase *-Recurse* / *)\",\n      \"PowerShell(erase / *-Recurse*)\",\n      \"PowerShell(erase -Path / *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath / *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* ~)\",\n      \"PowerShell(erase *-Recurse* ~ *)\",\n      \"PowerShell(erase ~ *-Recurse*)\",\n      \"PowerShell(erase -Path ~ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $HOME)\",\n      \"PowerShell(erase *-Recurse* $HOME *)\",\n      \"PowerShell(erase $HOME *-Recurse*)\",\n      \"PowerShell(erase -Path $HOME *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(erase $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* \\\\)\",\n      \"PowerShell(erase *-Recurse* \\\\ *)\",\n      \"PowerShell(erase \\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path \\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* *:\\\\)\",\n      \"PowerShell(erase *-Recurse* *:\\\\ *)\",\n      \"PowerShell(erase *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* /)\",\n      \"PowerShell(rd *-Recurse* / *)\",\n      \"PowerShell(rd / *-Recurse*)\",\n      \"PowerShell(rd -Path / *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* ~)\",\n      \"PowerShell(rd *-Recurse* ~ *)\",\n      \"PowerShell(rd ~ *-Recurse*)\",\n      \"PowerShell(rd -Path ~ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $HOME)\",\n      \"PowerShell(rd *-Recurse* $HOME *)\",\n      \"PowerShell(rd $HOME *-Recurse*)\",\n      \"PowerShell(rd -Path $HOME *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rd $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* \\\\)\",\n      \"PowerShell(rd *-Recurse* \\\\ *)\",\n      \"PowerShell(rd \\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* *:\\\\)\",\n      \"PowerShell(rd *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rd *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* /)\",\n      \"PowerShell(ri *-Recurse* / *)\",\n      \"PowerShell(ri / *-Recurse*)\",\n      \"PowerShell(ri -Path / *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath / *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* ~)\",\n      \"PowerShell(ri *-Recurse* ~ *)\",\n      \"PowerShell(ri ~ *-Recurse*)\",\n      \"PowerShell(ri -Path ~ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $HOME)\",\n      \"PowerShell(ri *-Recurse* $HOME *)\",\n      \"PowerShell(ri $HOME *-Recurse*)\",\n      \"PowerShell(ri -Path $HOME *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(ri $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* \\\\)\",\n      \"PowerShell(ri *-Recurse* \\\\ *)\",\n      \"PowerShell(ri \\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path \\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* *:\\\\)\",\n      \"PowerShell(ri *-Recurse* *:\\\\ *)\",\n      \"PowerShell(ri *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* /)\",\n      \"PowerShell(rm *-Recurse* / *)\",\n      \"PowerShell(rm / *-Recurse*)\",\n      \"PowerShell(rm -Path / *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* ~)\",\n      \"PowerShell(rm *-Recurse* ~ *)\",\n      \"PowerShell(rm ~ *-Recurse*)\",\n      \"PowerShell(rm -Path ~ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $HOME)\",\n      \"PowerShell(rm *-Recurse* $HOME *)\",\n      \"PowerShell(rm $HOME *-Recurse*)\",\n      \"PowerShell(rm -Path $HOME *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rm $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* \\\\)\",\n      \"PowerShell(rm *-Recurse* \\\\ *)\",\n      \"PowerShell(rm \\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* *:\\\\)\",\n      \"PowerShell(rm *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rm *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* /)\",\n      \"PowerShell(rmdir *-Recurse* / *)\",\n      \"PowerShell(rmdir / *-Recurse*)\",\n      \"PowerShell(rmdir -Path / *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* ~)\",\n      \"PowerShell(rmdir *-Recurse* ~ *)\",\n      \"PowerShell(rmdir ~ *-Recurse*)\",\n      \"PowerShell(rmdir -Path ~ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $HOME)\",\n      \"PowerShell(rmdir *-Recurse* $HOME *)\",\n      \"PowerShell(rmdir $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -Path $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rmdir $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* \\\\)\",\n      \"PowerShell(rmdir *-Recurse* \\\\ *)\",\n      \"PowerShell(rmdir \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rmdir *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(Start-Process *-Verb RunAs*)\",\n      \"PowerShell(Invoke-Expression *)\",\n      \"PowerShell(iex *)\",\n      \"PowerShell(Format-Volume *)\",\n      \"PowerShell(icacls */grant*Everyone:F*)\",\n      \"PowerShell(icacls */grant*Everyone:(F)*)\"\n    ],\n    \"ask\": [\n      \"Bash(git clean *)\",\n      \"Bash(docker volume rm *)\",\n      \"Bash(docker system prune *)\",\n      \"PowerShell(git clean *)\",\n      \"PowerShell(docker volume rm *)\",\n      \"PowerShell(docker system prune *)\"\n    ]\n  },\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_SESSION_START__\"],\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"Notification\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_NOTIFY__\"],\n            \"timeout\": 10,\n            \"async\": true\n          }\n        ]\n      }\n    ],\n    \"PostToolUseFailure\": [\n      {\n        \"matcher\": \"Bash|PowerShell\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo '{\\\"hookSpecificOutput\\\":{\\\"hookEventName\\\":\\\"PostToolUseFailure\\\",\\\"additionalContext\\\":\\\"Last bash command failed. Repository / file state may have shifted \\u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\\\"}}'\",\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"SubagentStop\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"prompt\",\n            \"prompt\": \"You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\\n\\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\\n\\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \\\"Which mode do you prefer\\\", \\\"select an option\\\", \\\"no issues / problems / violations / blockers found\\\".\\n\\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \\u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\\n\\n3. BLOCK (return `{\\\"decision\\\":\\\"block\\\",\\\"reason\\\":\\\"<one-line explanation>\\\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \\\"the auth handler\\\" or \\\"near the database code\\\" are not acceptable as the only evidence.\\n\\nSubagent invocation JSON:\\n$ARGUMENTS\\n\\nReturn ONLY the JSON decision (no commentary, no markdown fences).\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  },\n  \"statusLine\": {\n    \"type\": \"command\",\n    \"command\": \"__DOCKS_KIT_STATUSLINE__\",\n    \"refreshInterval\": 5\n  },\n  \"enabledPlugins\": {\n    \"docks@docks\": true,\n    \"plan-lifecycle@docks\": true,\n    \"php-lsp@claude-plugins-official\": true,\n    \"typescript-lsp@claude-plugins-official\": true\n  },\n  \"extraKnownMarketplaces\": {\n    \"docks\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"DocksDocks/docks\"\n      }\n    }\n  },\n  \"alwaysThinkingEnabled\": true,\n  \"showThinkingSummaries\": true,\n  \"viewMode\": \"default\",\n  \"theme\": \"dark-daltonized\",\n  \"skipDangerousModePermissionPrompt\": true\n}\n",
+  "SoT/.claude/settings.json": "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"minimumVersion\": \"2.1.219\",\n  \"model\": \"opus\",\n  \"effortLevel\": \"high\",\n  \"autoMemoryEnabled\": false,\n  \"autoDreamEnabled\": false,\n  \"skillListingMaxDescChars\": 2048,\n  \"respectGitignore\": true,\n  \"cleanupPeriodDays\": 14,\n  \"skillListingBudgetFraction\": 0.05,\n  \"env\": {\n    \"CLAUDE_CODE_MAX_OUTPUT_TOKENS\": \"64000\",\n    \"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR\": \"1\",\n    \"CLAUDE_CODE_AUTO_COMPACT_WINDOW\": \"468000\",\n    \"CLAUDE_CODE_NO_FLICKER\": \"1\"\n  },\n  \"permissions\": {\n    \"defaultMode\": \"auto\",\n    \"allow\": [\n      \"Read\",\n      \"Glob\",\n      \"Grep\",\n      \"WebSearch\",\n      \"Edit(./)\"\n    ],\n    \"deny\": [\n      \"Read(**/.env)\",\n      \"Read(**/.env.local)\",\n      \"Read(**/secrets/**)\",\n      \"Read(**/*.key)\",\n      \"Read(**/*.pem)\",\n      \"Read(**/*.p12)\",\n      \"Read(**/.credentials*)\",\n      \"Edit(**/.env)\",\n      \"Edit(**/.env.local)\",\n      \"Edit(**/secrets/**)\",\n      \"Bash(sudo *)\",\n      \"Bash(rm -rf /)\",\n      \"Bash(rm -rf / *)\",\n      \"Bash(rm -rf ~)\",\n      \"Bash(rm -rf ~ *)\",\n      \"Bash(rm -rf $HOME)\",\n      \"Bash(rm -rf $HOME *)\",\n      \"Bash(> /dev *)\",\n      \"Bash(dd if= *)\",\n      \"Bash(mkfs *)\",\n      \"Bash(eval *)\",\n      \"Bash(chmod 777 *)\",\n      \"Bash(chmod -R 777 *)\",\n      \"Bash(git push --force origin main *)\",\n      \"Bash(git push --force origin master *)\",\n      \"Bash(git push -f origin main *)\",\n      \"Bash(git push -f origin master *)\",\n      \"PowerShell(sudo *)\",\n      \"PowerShell(rm -rf /)\",\n      \"PowerShell(rm -rf / *)\",\n      \"PowerShell(rm -rf ~)\",\n      \"PowerShell(rm -rf ~ *)\",\n      \"PowerShell(rm -rf $HOME)\",\n      \"PowerShell(rm -rf $HOME *)\",\n      \"PowerShell(> /dev *)\",\n      \"PowerShell(dd if= *)\",\n      \"PowerShell(mkfs *)\",\n      \"PowerShell(eval *)\",\n      \"PowerShell(chmod 777 *)\",\n      \"PowerShell(chmod -R 777 *)\",\n      \"PowerShell(git push --force origin main *)\",\n      \"PowerShell(git push --force origin master *)\",\n      \"PowerShell(git push -f origin main *)\",\n      \"PowerShell(git push -f origin master *)\",\n      \"PowerShell(Remove-Item *-Recurse* /)\",\n      \"PowerShell(Remove-Item *-Recurse* / *)\",\n      \"PowerShell(Remove-Item / *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path / *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath / *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* ~)\",\n      \"PowerShell(Remove-Item *-Recurse* ~ *)\",\n      \"PowerShell(Remove-Item ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME *)\",\n      \"PowerShell(Remove-Item $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(Remove-Item $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\ *)\",\n      \"PowerShell(Remove-Item \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\ *)\",\n      \"PowerShell(Remove-Item *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* /)\",\n      \"PowerShell(del *-Recurse* / *)\",\n      \"PowerShell(del / *-Recurse*)\",\n      \"PowerShell(del -Path / *-Recurse*)\",\n      \"PowerShell(del -LiteralPath / *-Recurse*)\",\n      \"PowerShell(del *-Recurse* ~)\",\n      \"PowerShell(del *-Recurse* ~ *)\",\n      \"PowerShell(del ~ *-Recurse*)\",\n      \"PowerShell(del -Path ~ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $HOME)\",\n      \"PowerShell(del *-Recurse* $HOME *)\",\n      \"PowerShell(del $HOME *-Recurse*)\",\n      \"PowerShell(del -Path $HOME *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(del $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del *-Recurse* \\\\\\\\)\",\n      \"PowerShell(del *-Recurse* \\\\ *)\",\n      \"PowerShell(del \\\\ *-Recurse*)\",\n      \"PowerShell(del -Path \\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(del *-Recurse* *:\\\\ *)\",\n      \"PowerShell(del *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* /)\",\n      \"PowerShell(erase *-Recurse* / *)\",\n      \"PowerShell(erase / *-Recurse*)\",\n      \"PowerShell(erase -Path / *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath / *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* ~)\",\n      \"PowerShell(erase *-Recurse* ~ *)\",\n      \"PowerShell(erase ~ *-Recurse*)\",\n      \"PowerShell(erase -Path ~ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $HOME)\",\n      \"PowerShell(erase *-Recurse* $HOME *)\",\n      \"PowerShell(erase $HOME *-Recurse*)\",\n      \"PowerShell(erase -Path $HOME *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(erase $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* \\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* \\\\ *)\",\n      \"PowerShell(erase \\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path \\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* *:\\\\ *)\",\n      \"PowerShell(erase *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* /)\",\n      \"PowerShell(rd *-Recurse* / *)\",\n      \"PowerShell(rd / *-Recurse*)\",\n      \"PowerShell(rd -Path / *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* ~)\",\n      \"PowerShell(rd *-Recurse* ~ *)\",\n      \"PowerShell(rd ~ *-Recurse*)\",\n      \"PowerShell(rd -Path ~ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $HOME)\",\n      \"PowerShell(rd *-Recurse* $HOME *)\",\n      \"PowerShell(rd $HOME *-Recurse*)\",\n      \"PowerShell(rd -Path $HOME *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rd $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* \\\\ *)\",\n      \"PowerShell(rd \\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rd *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* /)\",\n      \"PowerShell(ri *-Recurse* / *)\",\n      \"PowerShell(ri / *-Recurse*)\",\n      \"PowerShell(ri -Path / *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath / *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* ~)\",\n      \"PowerShell(ri *-Recurse* ~ *)\",\n      \"PowerShell(ri ~ *-Recurse*)\",\n      \"PowerShell(ri -Path ~ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $HOME)\",\n      \"PowerShell(ri *-Recurse* $HOME *)\",\n      \"PowerShell(ri $HOME *-Recurse*)\",\n      \"PowerShell(ri -Path $HOME *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(ri $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* \\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* \\\\ *)\",\n      \"PowerShell(ri \\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path \\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* *:\\\\ *)\",\n      \"PowerShell(ri *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* /)\",\n      \"PowerShell(rm *-Recurse* / *)\",\n      \"PowerShell(rm / *-Recurse*)\",\n      \"PowerShell(rm -Path / *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* ~)\",\n      \"PowerShell(rm *-Recurse* ~ *)\",\n      \"PowerShell(rm ~ *-Recurse*)\",\n      \"PowerShell(rm -Path ~ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $HOME)\",\n      \"PowerShell(rm *-Recurse* $HOME *)\",\n      \"PowerShell(rm $HOME *-Recurse*)\",\n      \"PowerShell(rm -Path $HOME *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rm $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* \\\\ *)\",\n      \"PowerShell(rm \\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rm *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* /)\",\n      \"PowerShell(rmdir *-Recurse* / *)\",\n      \"PowerShell(rmdir / *-Recurse*)\",\n      \"PowerShell(rmdir -Path / *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* ~)\",\n      \"PowerShell(rmdir *-Recurse* ~ *)\",\n      \"PowerShell(rmdir ~ *-Recurse*)\",\n      \"PowerShell(rmdir -Path ~ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $HOME)\",\n      \"PowerShell(rmdir *-Recurse* $HOME *)\",\n      \"PowerShell(rmdir $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -Path $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rmdir $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* \\\\ *)\",\n      \"PowerShell(rmdir \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rmdir *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(Start-Process *-Verb RunAs*)\",\n      \"PowerShell(Invoke-Expression *)\",\n      \"PowerShell(iex *)\",\n      \"PowerShell(Format-Volume *)\",\n      \"PowerShell(icacls */grant*Everyone:F*)\",\n      \"PowerShell(icacls */grant*Everyone:(F)*)\"\n    ],\n    \"ask\": [\n      \"Bash(git clean *)\",\n      \"Bash(docker volume rm *)\",\n      \"Bash(docker system prune *)\",\n      \"PowerShell(git clean *)\",\n      \"PowerShell(docker volume rm *)\",\n      \"PowerShell(docker system prune *)\"\n    ]\n  },\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_SESSION_START__\"],\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"Notification\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_NOTIFY__\"],\n            \"timeout\": 10,\n            \"async\": true\n          }\n        ]\n      }\n    ],\n    \"PostToolUseFailure\": [\n      {\n        \"matcher\": \"Bash|PowerShell\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo '{\\\"hookSpecificOutput\\\":{\\\"hookEventName\\\":\\\"PostToolUseFailure\\\",\\\"additionalContext\\\":\\\"Last bash command failed. Repository / file state may have shifted \\u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\\\"}}'\",\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"SubagentStop\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"prompt\",\n            \"prompt\": \"You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\\n\\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\\n\\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \\\"Which mode do you prefer\\\", \\\"select an option\\\", \\\"no issues / problems / violations / blockers found\\\".\\n\\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \\u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\\n\\n3. BLOCK (return `{\\\"decision\\\":\\\"block\\\",\\\"reason\\\":\\\"<one-line explanation>\\\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \\\"the auth handler\\\" or \\\"near the database code\\\" are not acceptable as the only evidence.\\n\\nSubagent invocation JSON:\\n$ARGUMENTS\\n\\nReturn ONLY the JSON decision (no commentary, no markdown fences).\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  },\n  \"statusLine\": {\n    \"type\": \"command\",\n    \"command\": \"__DOCKS_KIT_STATUSLINE__\",\n    \"refreshInterval\": 5\n  },\n  \"enabledPlugins\": {\n    \"docks@docks\": true,\n    \"plan-lifecycle@docks\": true,\n    \"php-lsp@claude-plugins-official\": true,\n    \"typescript-lsp@claude-plugins-official\": true\n  },\n  \"extraKnownMarketplaces\": {\n    \"docks\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"DocksDocks/docks\"\n      }\n    }\n  },\n  \"alwaysThinkingEnabled\": true,\n  \"showThinkingSummaries\": true,\n  \"viewMode\": \"default\",\n  \"theme\": \"dark-daltonized\",\n  \"skipDangerousModePermissionPrompt\": true\n}\n",
   "SoT/.claude/bin/statusline.mjs": "const ESC = \"\\x1b[\"\nconst PIPE = `${ESC}90m | ${ESC}0m`\nconst DOT = `${ESC}90m • ${ESC}0m`\nconst DIM = `${ESC}2m${ESC}38;2;156;162;175m`\n\nfunction isRecord(value) {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction finitePercentage(value) {\n  return typeof value === \"number\" && Number.isFinite(value) && value >= 0 && value <= 100\n    ? value\n    : undefined\n}\n\nfunction roundHalfEven(value) {\n  const lower = Math.floor(value)\n  const fraction = value - lower\n  if (fraction < 0.5) return lower\n  if (fraction > 0.5) return lower + 1\n  return lower % 2 === 0 ? lower : lower + 1\n}\n\nfunction pathBasename(path) {\n  const parts = path.split(/[\\\\/]+/).filter((part) => part !== \"\")\n  return parts.at(-1) ?? \"\"\n}\n\nfunction modelName(input) {\n  const model = isRecord(input.model) && typeof input.model.display_name === \"string\"\n    ? input.model.display_name\n    : \"\"\n  const suffix = model.indexOf(\" (\")\n  return suffix === -1 ? model : model.slice(0, suffix)\n}\n\nfunction workingDirectory(input, cwd) {\n  if (isRecord(input.workspace) && typeof input.workspace.current_dir === \"string\" && input.workspace.current_dir !== \"\") {\n    return input.workspace.current_dir\n  }\n  if (typeof input.cwd === \"string\" && input.cwd !== \"\") return input.cwd\n  return cwd\n}\n\nfunction compactWindow(env, total) {\n  const raw = env.CLAUDE_CODE_AUTO_COMPACT_WINDOW\n  if (typeof raw !== \"string\" || !/^[0-9]+$/.test(raw)) return total\n  const parsed = Number(raw)\n  return Number.isSafeInteger(parsed) && parsed >= 1000 && parsed < total ? parsed : total\n}\n\nfunction formatTokensK(value) {\n  if (value < 1000) return `${value}k`\n  if (value % 1000 === 0) return `${value / 1000}M`\n  return `${(roundHalfEven(value / 100) / 10).toFixed(1)}M`\n}\n\nfunction contextSegment(input, env) {\n  if (!isRecord(input.context_window)) return \"\"\n  const used = finitePercentage(input.context_window.used_percentage)\n  if (used === undefined) return \"\"\n\n  const total = input.context_window.context_window_size\n  if (typeof total !== \"number\" || !Number.isFinite(total) || total <= 0) {\n    return `${ESC}38;2;130;160;230mctx ${roundHalfEven(used)}%${ESC}0m`\n  }\n\n  const usedK = roundHalfEven((used / 100) * (total / 1000))\n  const effectiveK = Math.trunc(compactWindow(env, total) / 1000)\n  if (effectiveK <= 0) return `${ESC}38;2;130;160;230mctx ${roundHalfEven(used)}%${ESC}0m`\n  const effectivePercentage = roundHalfEven((usedK / effectiveK) * 100)\n  return `${ESC}38;2;130;160;230mctx ${effectivePercentage}%${ESC}0m ${DIM}(${formatTokensK(usedK)}/${formatTokensK(effectiveK)})${ESC}0m`\n}\n\nfunction resetDelta(value, nowMs) {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) return \"\"\n  const seconds = Math.trunc(value) - Math.floor(nowMs / 1000)\n  if (seconds <= 0) return \"now\"\n  const days = Math.trunc(seconds / 86_400)\n  if (days > 0) return `${days}d`\n  const hours = Math.trunc((seconds % 86_400) / 3_600)\n  if (hours > 0) return `${hours}h`\n  return `${Math.trunc((seconds % 3_600) / 60)}m`\n}\n\nfunction quotaWindow(value, label, color, nowMs) {\n  if (!isRecord(value)) return \"\"\n  const used = finitePercentage(value.used_percentage)\n  if (used === undefined) return \"\"\n  const delta = resetDelta(value.resets_at, nowMs)\n  const reset = delta === \"\" ? \"\" : ` ${DIM}(${delta})${ESC}0m`\n  return `${ESC}38;2;${color}m${label} ${roundHalfEven(used)}%${ESC}0m${reset}`\n}\n\nfunction decodeStdout(result) {\n  const stdout = result?.stdout\n  if (stdout === undefined || stdout === null) return \"\"\n  return typeof stdout === \"string\" ? stdout : stdout.toString()\n}\n\nfunction resolveBranch(directory, which, spawnSync) {\n  const git = which(\"git\")\n  if (typeof git !== \"string\" || git === \"\") return \"\"\n  const commands = [\n    [git, \"-C\", directory, \"symbolic-ref\", \"--short\", \"HEAD\"],\n    [git, \"-C\", directory, \"rev-parse\", \"--short\", \"HEAD\"]\n  ]\n  for (const command of commands) {\n    try {\n      const result = spawnSync(command, { stdin: \"ignore\", stdout: \"pipe\", stderr: \"ignore\" })\n      if (result?.success === true) return decodeStdout(result).trim()\n    } catch {\n      return \"\"\n    }\n  }\n  return \"\"\n}\n\nexport function formatStatusline(input, options = {}) {\n  if (!isRecord(input)) return \"\"\n  const env = isRecord(options.env) ? options.env : process.env\n  const nowMs = typeof options.nowMs === \"number\" ? options.nowMs : Date.now()\n  const cwd = typeof options.cwd === \"string\" ? options.cwd : process.cwd()\n  const branch = typeof options.branch === \"string\" ? options.branch : \"\"\n  const directory = workingDirectory(input, cwd)\n\n  const model = `${ESC}38;5;208m${ESC}1m${modelName(input)}${ESC}22m${ESC}0m`\n  const folder = `${ESC}1m${ESC}38;2;76;208;222m${pathBasename(directory)}${ESC}22m${ESC}0m`\n  const branchSegment = branch === \"\" ? \"\" : `${DOT}${ESC}1m${ESC}38;2;192;103;222m${branch}${ESC}22m${ESC}0m`\n  const context = contextSegment(input, env)\n\n  const rateLimits = isRecord(input.rate_limits) ? input.rate_limits : {}\n  const fiveHour = quotaWindow(rateLimits.five_hour, \"5h\", \"100;200;200\", nowMs)\n  const sevenDay = quotaWindow(rateLimits.seven_day, \"7d\", \"230;180;90\", nowMs)\n  const quota = fiveHour === \"\" && sevenDay === \"\"\n    ? \"\"\n    : `${PIPE}${fiveHour}${fiveHour !== \"\" && sevenDay !== \"\" ? DOT : \"\"}${sevenDay}`\n\n  return `${model}${PIPE}${folder}${branchSegment}${context === \"\" ? \"\" : `${PIPE}${context}`}${quota}`\n}\n\nexport async function main(options = {}) {\n  const readStdin = options.readStdin ?? (() => Bun.stdin.text())\n  const writeStdout = options.writeStdout ?? ((value) => process.stdout.write(value))\n  let raw\n  try {\n    raw = await readStdin()\n  } catch {\n    return 0\n  }\n\n  let input\n  try {\n    input = JSON.parse(raw)\n  } catch {\n    return 0\n  }\n  if (!isRecord(input)) return 0\n\n  const cwd = typeof options.cwd === \"string\" ? options.cwd : process.cwd()\n  const directory = workingDirectory(input, cwd)\n  const branch = resolveBranch(\n    directory,\n    options.which ?? ((name) => Bun.which(name)),\n    options.spawnSync ?? ((argv, spawnOptions) => Bun.spawnSync(argv, spawnOptions))\n  )\n  const output = formatStatusline(input, {\n    env: options.env ?? process.env,\n    nowMs: options.nowMs ?? Date.now(),\n    cwd,\n    branch\n  })\n  if (output !== \"\") writeStdout(`${output}\\n`)\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
-  "SoT/.claude/bin/session-start.mjs": "import { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\n\nfunction isRecord(value) {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction nonEmpty(value, fallback) {\n  return typeof value === \"string\" && value !== \"\" ? value : fallback\n}\n\nfunction pad(value) {\n  return String(value).padStart(2, \"0\")\n}\n\nfunction configuredEffort(home, readText) {\n  try {\n    const parsed = JSON.parse(readText(`${home}/.claude/settings.json`))\n    return isRecord(parsed) ? nonEmpty(parsed.effortLevel, \"default\") : \"default\"\n  } catch {\n    return \"default\"\n  }\n}\n\nfunction localZone(now) {\n  const part = new Intl.DateTimeFormat(\"en-US\", { timeZoneName: \"short\" })\n    .formatToParts(now)\n    .find((value) => value.type === \"timeZoneName\")\n  return part?.value ?? \"\"\n}\n\nexport function sessionStartLines(options = {}) {\n  const env = isRecord(options.env) ? options.env : process.env\n  const now = options.now instanceof Date ? options.now : new Date()\n  const home = typeof options.home === \"string\" ? options.home : homedir()\n  const readText = options.readText ?? ((path) => readFileSync(path, \"utf8\"))\n  const weekday = new Intl.DateTimeFormat(\"en-US\", { weekday: \"long\" }).format(now)\n  const date = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`\n  const time = `${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}`\n  const effort = nonEmpty(env.CLAUDE_CODE_EFFORT_LEVEL, configuredEffort(home, readText))\n  const context = env.CLAUDE_CODE_DISABLE_1M_CONTEXT === \"1\" ? \"200K\" : \"1M\"\n  const compactWindow = nonEmpty(env.CLAUDE_CODE_AUTO_COMPACT_WINDOW, \"full\")\n  const subagent = nonEmpty(env.CLAUDE_CODE_SUBAGENT_MODEL, \"default\")\n  return [\n    `[CONTEXT] Current date: ${weekday}, ${date} ${time} ${localZone(now)}`,\n    `[CONFIG] Context: ${context} | Compact-window: ${compactWindow} | Effort: ${effort} | Thinking: adaptive | Subagent: ${subagent}`\n  ]\n}\n\nexport async function main(options = {}) {\n  const writeStdout = options.writeStdout ?? ((value) => process.stdout.write(value))\n  writeStdout(`${sessionStartLines(options).join(\"\\n\")}\\n`)\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
+  "SoT/.claude/bin/session-start.mjs": "import { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\n\nfunction isRecord(value) {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction nonEmpty(value, fallback) {\n  return typeof value === \"string\" && value !== \"\" ? value : fallback\n}\n\nfunction pad(value) {\n  return String(value).padStart(2, \"0\")\n}\n\nfunction configuredEffort(home, readText) {\n  try {\n    const parsed = JSON.parse(readText(`${home}/.claude/settings.json`))\n    return isRecord(parsed) ? nonEmpty(parsed.effortLevel, \"default\") : \"default\"\n  } catch {\n    return \"default\"\n  }\n}\n\nfunction localZone(now) {\n  const part = new Intl.DateTimeFormat(\"en-US\", { timeZoneName: \"short\" })\n    .formatToParts(now)\n    .find((value) => value.type === \"timeZoneName\")\n  return part?.value ?? \"\"\n}\n\nexport function sessionStartLines(options = {}) {\n  const env = isRecord(options.env) ? options.env : process.env\n  const now = options.now instanceof Date ? options.now : new Date()\n  const home = typeof options.home === \"string\" ? options.home : homedir()\n  const readText = options.readText ?? ((path) => readFileSync(path, \"utf8\"))\n  const weekday = new Intl.DateTimeFormat(\"en-US\", { weekday: \"long\" }).format(now)\n  const date = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`\n  const time = `${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}`\n  const effort = nonEmpty(env.CLAUDE_CODE_EFFORT_LEVEL, configuredEffort(home, readText))\n  const context = env.CLAUDE_CODE_DISABLE_1M_CONTEXT === \"1\" ? \"200K\" : \"1M\"\n  const compactWindow = nonEmpty(env.CLAUDE_CODE_AUTO_COMPACT_WINDOW, \"full\")\n  const subagent = nonEmpty(env.CLAUDE_CODE_SUBAGENT_MODEL, \"default\")\n  return [\n    `[CONTEXT] Current date: ${weekday}, ${date} ${time} ${localZone(now)}`,\n    `[CONFIG] Context: ${context} | Compact-window: ${compactWindow} | Effort: ${effort} | Thinking: adaptive | Subagent: ${subagent}`\n  ]\n}\n\nexport async function main(options = {}) {\n  const writeStdout = options.writeStdout ?? ((value) => process.stdout.write(value))\n  const output = {\n    hookSpecificOutput: {\n      hookEventName: \"SessionStart\",\n      additionalContext: sessionStartLines(options).join(\"\\n\")\n    }\n  }\n  writeStdout(`${JSON.stringify(output)}\\n`)\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
   "SoT/.claude/bin/notify.mjs": "const DEFAULT_SOUND = `${import.meta.dir}/../notification.mp3`\n\nexport function selectPlayer(options = {}) {\n  const platform = options.platform ?? process.platform\n  const sound = options.sound ?? DEFAULT_SOUND\n  const which = options.which ?? ((name) => Bun.which(name))\n  if (platform === \"darwin\") {\n    const afplay = which(\"afplay\")\n    if (typeof afplay === \"string\" && afplay !== \"\") return [afplay, sound]\n  }\n  const ffplay = which(\"ffplay\")\n  if (typeof ffplay === \"string\" && ffplay !== \"\") {\n    return [ffplay, \"-nodisp\", \"-autoexit\", \"-loglevel\", \"quiet\", sound]\n  }\n  const paplay = which(\"paplay\")\n  if (typeof paplay === \"string\" && paplay !== \"\") return [paplay, sound]\n  const aplay = which(\"aplay\")\n  if (typeof aplay === \"string\" && aplay !== \"\") return [aplay, \"-q\", sound]\n  return undefined\n}\n\nexport async function main(options = {}) {\n  const sound = options.sound ?? DEFAULT_SOUND\n  const fileExists = options.fileExists ?? ((path) => Bun.file(path).exists())\n  if (!await fileExists(sound)) return 0\n  const command = selectPlayer({ ...options, sound })\n  if (command === undefined) return 0\n  const spawnSync = options.spawnSync ?? ((argv, spawnOptions) => Bun.spawnSync(argv, spawnOptions))\n  spawnSync(command, { stdin: \"ignore\", stdout: \"ignore\", stderr: \"ignore\" })\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
   "SoT/.codex/AGENTS.md": "# AGENTS.md\n\n## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- Upgrading or migrating between versions.\n- Any task where relying on memory could cause stale syntax or behavior.\n\nDo not:\n- Assume API signatures, method names, or config options from memory.\n- Generate framework code without checking current docs first.\n- Skip research because the library seems familiar.\n\n<constraint>\nResearch the codebase before editing. Never change code you have not read.\n</constraint>\n\n## Agentic Harness Heuristics\n\nModel-agnostic operating rules for coding-agent work.\n\n1. Persistence. Keep going until the user's request is actually handled. Only yield when the problem is solved or a concrete blocker is identified. Resolve in the fewest useful tool loops — once you can answer the core request with evidence, answer. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done, do that work now.\n2. Default to parallel. When multiple reads, searches, inspections, or independent checks can run without depending on each other, run them together.\n3. Multi-pass search. First-pass search often misses — vary the wording before concluding something does not exist.\n4. Trace symbols. Before modifying a symbol, trace its definition and usages. Do not infer behavior from one call site.\n5. Linter-loop 3-strike rule. Do not loop more than 3 times fixing the same lint/test failure without reassessing the diagnosis.\n6. Read-before-edit TTL. If you have not read a file recently, re-read it before editing. User edits can make cached context stale.\n7. Big-file rule. For files over 1000 lines, prefer targeted search plus scoped reads over whole-file reads.\n8. Task hygiene. Track meaningful deliverables, not operational sub-steps. Mark work complete as soon as it is done.\n9. Literal-instruction rule. Treat explicit user requirements as checklists with success criteria. Do not silently broaden scope.\n10. Context hygiene. Prefer a fresh session at task boundaries over carrying stale context; preserve useful state before quality decays. Never stop, summarize, or suggest a new session on account of context limits.\n11. Autonomy calibration. For minor choices (naming, formatting, defaults, equivalent approaches), pick a reasonable option and note it — do not ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; do not apply fixes until asked.\n12. Capability triggering. Search or fetch current documentation when the answer depends on current or version-specific information. When work fans out across independent items, parallelize or delegate; never delegate work you can complete directly. For verification, prefer a fresh-context check over self-critique. On long tasks, keep running notes and re-read them between phases.\n\n<constraint>\nTreat these heuristics as protocol. If a turn violates an applicable rule, self-correct before continuing.\n</constraint>\n\nReuse before invention: inventory existing code, components, conventions, and dependencies; extend them instead of creating a parallel pattern. Load only the narrow skills supported by the task and repository evidence. If a request establishes a new React/Tailwind system and no convention exists, prefer current shadcn/ui `base-*` components backed by Base UI; otherwise preserve the existing stack. Treat probe, production access, publish, push, release, and deploy as literal current-request effects—never infer external authority from a plan, schedule, review, or old receipt.\n\nFor Docks plan reviews, cross-company review is standing-authorized; do not ask for export consent. This never overrides a host or platform security denial.\n\nUse a narrow-to-broad verification ladder: direct acceptance while iterating, focused regressions next, and one full CI at the pre-commit or release boundary. Reuse still-matching evidence; rerun full CI only after a relevant edit invalidates it.\n\n<constraint>\nNo secrets in committed config. Treat plugin marketplaces, installers, and downloaded artifacts as untrusted until verified.\n</constraint>\n",
   "SoT/.codex/config.toml": "model = \"gpt-5.6-sol\"\nmodel_reasoning_effort = \"high\"\nplan_mode_reasoning_effort = \"high\"\nmodel_reasoning_summary = \"concise\"\nmodel_verbosity = \"low\"\npersonality = \"pragmatic\"\nweb_search = \"live\"\nproject_doc_max_bytes = 131072\napproval_policy = \"on-request\"\nsandbox_mode = \"workspace-write\"\napprovals_reviewer = \"auto_review\"\n\n[sandbox_workspace_write]\nnetwork_access = true\n\n[windows]\nsandbox = \"elevated\"\n\n[features]\nmemories = true\n\n[memories]\ndedicated_tools = true\nmax_rollout_age_days = 30\n\n[agents]\nmax_threads = 12\nmax_depth = 2\n\n[tui]\nstatus_line_use_colors = true\nstatus_line = [\n  \"model-with-reasoning\",\n  \"current-dir\",\n  \"git-branch\",\n  \"context-used\",\n  \"five-hour-limit\",\n  \"weekly-limit\",\n]\n\n[plugins.\"docks@docks\"]\nenabled = true\n\n[plugins.\"plan-lifecycle@docks\"]\nenabled = true\n",
@@ -48,4 +48,4 @@ export const GENERATED_PAYLOAD_PATHS = [
   "notification.mp3"
 ] as const
 
-export const GENERATED_PAYLOAD_HASH = "d9b0c1b28fe227fd618e3bb4415ab777dea6f1504fffe7d4ef087e4282b52471"
+export const GENERATED_PAYLOAD_HASH = "34c7bea1669d4aaedafd82c2a87eab12819d56d380f15ea71f608f291ee89661"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docks-kit",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills",
   "type": "module",
   "license": "MIT",