npm - docks-kit - Versions diffs - 0.17.3 → 0.18.0 - Mend

docks-kit 0.17.3 → 0.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/AGENTS.md +6 -5
package/cli/docs/models.md +14 -14
package/cli/docs/modifiers.md +4 -4
package/cli/docs/omp-models.md +262 -152
package/cli/src/efforts.ts +3 -2
package/cli/src/engine-native/claudeSettingsModifiers.ts +4 -4
package/cli/src/generated/sotPayload.ts +8 -8
package/package.json +1 -1

package/AGENTS.md CHANGED Viewed

@@ -55,7 +55,7 @@ launcher can fall back to Bun source.
 Codex SoT notes:
 - `SoT/.codex/AGENTS.md` deploys to `~/.codex/AGENTS.md` as global Codex instructions.
-- `SoT/.codex/config.toml` pins Codex to `model = "gpt-5.6-sol"`, sets normal and plan reasoning to `high` with concise summaries, and sets `model_verbosity = "low"`, `personality`, live top-level `web_search`, workspace-write sandboxing with sandboxed command network access, cross-session `memories` (+ dedicated note tools), `[agents]` subagent limits (`max_threads = 12`, `max_depth = 2` — intentionally above Codex defaults for broad parallel kit work; deeper recursion increases cost and predictability risk), a 128 KiB `project_doc_max_bytes` budget for the repo-side AGENTS.md chain (the global `~/.codex/AGENTS.md` is uncapped and not counted), and enables the two Docks plugins `docks@docks` and `plan-lifecycle@docks` (the shared plan lifecycle).
+- `SoT/.codex/config.toml` pins Codex to `model = "gpt-6-sol"`, sets normal and plan reasoning to `high` with concise summaries, and sets `model_verbosity = "low"`, `personality`, live top-level `web_search`, workspace-write sandboxing with sandboxed command network access, cross-session `memories` (+ dedicated note tools), `[agents]` subagent limits (`max_threads = 12`, `max_depth = 2` — intentionally above Codex defaults for broad parallel kit work; deeper recursion increases cost and predictability risk), a 128 KiB `project_doc_max_bytes` budget for the repo-side AGENTS.md chain (the global `~/.codex/AGENTS.md` is uncapped and not counted), and enables the two Docks plugins `docks@docks` and `plan-lifecycle@docks` (the shared plan lifecycle).
 - `SoT/.codex/rules/*.rules` deploys to `~/.codex/rules/` as kit-managed Codex command policy. This is Codex's equivalent of permission allow/prompt/block rules; user-learned approvals in `~/.codex/rules/default.rules` are preserved.
 - `SoT/.codex/plugins/marketplace.json` deploys to Codex's personal marketplace path at `~/.agents/plugins/marketplace.json`; when the `codex` CLI is available, sync reruns `codex plugin add <plugin@marketplace>` for enabled SoT plugins so stale cached installs are refreshed.
 - Codex `/import` can copy Claude hooks into `~/.codex/hooks.json`. `codexSync.ts removeRetiredImportedHooks, legacy SessionStart cleanup` removes only recognized hooks from retired docks-kit Claude settings, backs up a changed file, and preserves user-authored hooks. The current Claude SessionStart program emits the structured JSON shape shared by both tools.
@@ -64,7 +64,7 @@ Codex SoT notes:
 - The `codex` CLI binary is upstream-owned, not kit-owned. The official standalone installer keeps package metadata under `$CODEX_HOME/packages/standalone` and places the `codex` symlink in `~/.local/bin` by default; sync only warns with a download-then-run installer command when the CLI is missing. Existing installs can self-update with `codex update`; npm and Homebrew remain upstream alternatives.
 - Claude runtime settings are an authoring template with sentinels. `claudeRuntime.ts` materializes absolute Bun/script paths only after the shared `bun.ts` bootstrap is ready; `claudeSync.ts` writes all runtime assets before atomically committing settings, then prunes the legacy shell scripts and Stop hook. Native `rate_limits` is the sole quota source, so jq/curl/OAuth caches are not runtime dependencies. A missing Bun defers only this cutover and preserves legacy pointers/files.
-- Claude's deployed SoT defaults are `model: opus` and `effortLevel: high`; `advisorModel` is deliberately absent/off. `--claude-advisor=on` is the per-machine opt-in and writes `advisorModel: fable` after the settings merge. `opus` is the alias, not a pinned id: the `minimumVersion` floor of 2.1.219 ensures Claude Code can resolve it to the newest Opus its provider offers — Opus 5 on the Anthropic API or Opus 4.6 on Microsoft Foundry — instead of silently capping Anthropic API users at Opus 4.8 under the former 2.1.170 floor. Keeping the alias provides provider portability and tracks future Opus releases; the literal `claude-opus-5` is unavailable on Foundry. The floor also subsumes Fable 5's older 2.1.170 requirement.
+- Claude's deployed SoT defaults are `model: opus` and `effortLevel: high`; `advisorModel` is deliberately absent/off. `--claude-advisor=on` is the per-machine opt-in and writes `advisorModel: opus` after the settings merge. `opus` is the alias, not a pinned id: the `minimumVersion` floor of 2.1.280 makes Claude Code resolve it to Opus 5.5, the default Opus from that release, instead of capping at Opus 5 under the former 2.1.219 floor. Keeping the alias tracks the next Opus release without a kit change and stays portable across providers. The floor also subsumes Fable 5.1's 2.1.257 requirement.
 - Claude permission rules are pruned, not host-scoped. The kit deploys its `PowerShell(...)` deny and ask rules on every host, because Claude Code leaves the PowerShell tool opt-in off Windows rather than unavailable, and a host that enables it must already carry the guards. `claudeRetired.ts RETIRED_PERMISSION_RULES, exact retired-rule inventory` lists the rules the kit no longer ships. `claudeSync.ts syncRemovals, retired-permission pass` force-prunes those exact strings from the kit-managed `~/.claude/settings.json` on every sync, because `settings.ts mergeSettings, permission-array union` would otherwise keep a dropped rule forever. A different user-authored rule survives. To restore an exact retired rule for one checkout, put it in that checkout's `.claude/settings.local.json`. Claude Code resolves that file against the working directory and merges it over user settings. Sync never reads or writes the checkout-local file. Claude Code has no user-scope local settings file. For a machine-wide restoration, add the rule to `SoT/.claude/settings.json`. At the same time, remove the exact string from `claudeRetired.ts RETIRED_PERMISSION_RULES, exact retired-rule inventory`. `permissions.allow` holds four read-only entries (`Read`, `Glob`, `Grep`, and `WebSearch`) plus the working-directory edit rule `Edit(./)`. Broad shell allow rules are not restored, because an allow rule resolves before Claude Code's read-only command analyzer and the auto-mode classifier. `autoMemoryEnabled` and `autoDreamEnabled` are both `false`.
 omp SoT notes:
@@ -73,9 +73,10 @@ omp SoT notes:
 - `ompSync.ts syncMergedYaml` deep-merges `config.yml` through `ompYaml.ts mergeOmpConfig` and `models.yml` through `mergeOmpModels`. Both wrap one generic mapping merge; only the config wrapper prunes stale `retry.fallbackChains` wildcards.
 - `ompSync.ts` runs `ompRemovals.ts syncOmpRemovals, retired-key inventory` right after the config merge, and that pass force-prunes retired kit-owned keys from `~/.omp/agent/config.yml` on every sync, without `--reconcile`. The pass is required because `mergeOmpConfig` is additive, so removing a key from the SoT alone never removes it from a deployed file. A key retired with a recorded value is pruned only while the deployed value still matches that value, so a user edit survives; a key retired outright, such as `providers.webSearchOrder`, is pruned at any value.
 - `cycleOrder` ends with `astra` as its fifth stop. `modelRoles.astra` is `openai-codex/gpt-6-astra:xhigh`, and `modelTags.astra` is visible. Astra and Fable fall back to each other through concrete selectors. `modelRoles.fable` remains `anthropic/claude-fable-5-1:medium`, with visible `modelTags.fable`. The hidden `switch_fable` role uses the same Fable selector and keeps an empty fallback chain.
-- `modelRoles.task` is `openai-codex/gpt-5.6-sol:high`. The four reviewer entries in `task.agentModelOverrides` inherit it through `@task`. Only bundled `reviewer` and `security-reviewer` are discoverable OMP agents; `code-reviewer` and `plan-reviewer` stay dormant.
-- `modelRoles.web` is `web/firecrawl` and `retry.fallbackChains.web` carries the explicit 27-entry provider order. The kit declares both keys because the legacy `providers.webSearchOrder` key is retired: omp expands it in memory into these two keys and then drops it, and never writes that expansion back to disk. An explicit chain replaces omp's built-in web order wholesale, so the list must stay complete.
-- `SoT/.omp/models.yml` declares Astra's full `low, medium, high, xhigh, max` ladder with `defaultLevel: xhigh` as the worked provider ladder-override example. `ompYaml.ts mergeOmpModels` preserves deployed-only keys in `~/.omp/agent/models.yml`, because a user file may carry provider credentials. Whole-file replacement is wrong.
+- `modelRoles.task` is `openai-codex/gpt-6-sol:high`, and `advisor` is `openai-codex/gpt-6-sol:medium`. `smol`, `commit`, and `tiny` use `openai-codex/gpt-6-luna`. The four reviewer entries in `task.agentModelOverrides` inherit `task` through `@task`. Only bundled `reviewer` and `security-reviewer` are discoverable OMP agents; `code-reviewer` and `plan-reviewer` stay dormant. omp 18.2.9 does not list `gpt-6-sol` or `gpt-6-luna` in its `openai-codex` catalog, so it fuzzy-matches both selectors to the GPT-5.6 models without a warning until the catalog lists them. The owner deployed them anyway. `cli/docs/omp-models.md` records the checks.
+- The five Anthropic roles (`default`, `slow`, `plan`, `designer`, `vision`) and the five Anthropic retry chains use `anthropic/claude-opus-5-5` at the levels the role map records. `cli/docs/omp-models.md` carries the Artificial Analysis capture behind the role map, read 2026-09-22 at Intelligence Index v4.3.2 and Coding Agent Index v1.5 from the AA comparison-page metric tables. Opus 5.5 max has the highest index in that topic. AA has not measured speed or latency for Opus 5.5 max, GPT-6 Sol, or GPT-6 Luna.
+- `modelRoles.web` is `web/firecrawl` and `retry.fallbackChains.web` carries the explicit 20-entry provider order. The kit declares both keys because the legacy `providers.webSearchOrder` key is retired: omp expands it in memory into these two keys and then drops it, and never writes that expansion back to disk. An explicit chain replaces omp's built-in web order wholesale, so every entry left out is a provider omp never tries. The owner removed the seven entries that named older models (Gemini 2.5 Flash, Claude Haiku 4.5, GPT-5.6, GPT-5.5, and Grok 4.5); keep every other provider.
+- `SoT/.omp/models.yml` declares Astra's full `low, medium, high, xhigh, max` ladder with `defaultLevel: xhigh` as the worked provider ladder-override example. It also carries a temporary `anthropic.modelOverrides.claude-opus-5-5` block with that model's limits, ladder, and prices, because the shared catalog still serves the id as a stub with null limits and zero cost; remove the block once the catalog publishes the row. `ompYaml.ts mergeOmpModels` preserves deployed-only keys in `~/.omp/agent/models.yml`, because a user file may carry provider credentials. Whole-file replacement is wrong.
 - `SoT/.omp/AGENTS.md` carries the rule `Please remove all mannered prose.` Anthropic's Fable 5.1 prompting guide documents mannered prose as a Fable 5.1 behavior and gives that sentence as its short-version fix: https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/prompting-claude-fable-5-1
 - `cli/docs/omp-models.md` (topic `omp-models`) records the role map rationale and the Artificial Analysis snapshot behind it. Model choices change with published benchmarks, so update that topic in the same commit as a role change.
 - `SoT/.omp/config.yml` sets `compaction.thresholdTokens` to `-1`, omp's schema default sentinel selecting reserve-based behavior: the trigger becomes `contextWindow` minus `max(floor(contextWindow * 0.15), 16384)`, which is 231,200 on the 272,000-token Codex window and 850,000 on the 1,000,000-token Anthropic window. The key ships as `-1` rather than being deleted because `ompYaml.ts mergeOmpConfig` is additive, so removing a key from SoT never removes it from a deployed file. `cli/docs/omp-context.md` (topic `omp-context`) carries the derivation and the measured evidence, so update that topic in the same commit as any compaction-setting change.

package/cli/docs/models.md CHANGED Viewed

@@ -17,15 +17,16 @@ the entry and date when a model ships or retires.
 ## The `best` alias and `default` pseudo-value
-- `best` resolves to Fable 5 where the org has access, latest Opus otherwise.
-  It needs Claude Code >= 2.1.170. The kit SoT pins the `opus` alias directly
-  rather than `best` or a full id, so the deployed model is unambiguous. Its
-  `minimumVersion` of 2.1.219 ensures Claude Code can resolve that alias to the
-  newest Opus its provider offers: Opus 5 on the Anthropic API or Opus 4.6 on
-  Microsoft Foundry. The former 2.1.170 floor silently capped Anthropic API
-  users at Opus 4.8. Keeping the alias provides provider portability and tracks
-  future Opus releases; the literal `claude-opus-5` is unavailable on Foundry.
-  The floor also subsumes `best`/Fable 5's older 2.1.170 requirement.
+- `best` resolves to Fable 5.1 where the org has access, latest Opus
+  otherwise. It needs Claude Code >= 2.1.257. Claude apps gateway sessions
+  still resolve `best` and `fable` to Fable 5. The kit SoT pins the `opus`
+  alias directly rather than `best` or a full id, so the deployed model is
+  unambiguous. Its `minimumVersion` of 2.1.280 ensures Claude Code can resolve
+  that alias to Opus 5.5, the default Opus from that release. The former
+  2.1.219 floor capped the alias at Opus 5. The kit keeps the alias because it
+  tracks the next Opus release without a kit change and stays portable across
+  every provider that carries a different newest Opus. The floor also subsumes
+  the older `best`/Fable 5.1 requirement of 2.1.257.
 - `default` is an engine pseudo-value: it DELETES the deployed `model` key so
   the account default applies. It never reaches the settings file as a value.
@@ -35,14 +36,13 @@ the entry and date when a model ships or retires.
 docks-kit models                  # both catalogs
 docks-kit models claude --json    # machine-readable
 docks-kit model claude            # current deployed + SoT + picker (TTY)
-docks-kit model claude opus       # per-machine override from the Fable SoT
+docks-kit model claude opus       # per-machine override from the Opus SoT
 docks-kit sync claude --claude-model=opus   # same, as part of a sync
 ```
 ## Advisor pairing note (Claude)
-The SoT ships `model: fable` with advisor off (`advisorModel` unset).
+The SoT ships `model: opus` with advisor off (`advisorModel` unset).
 Advisor is a per-machine opt-in: `docks-kit sync claude --claude-advisor=on`
-writes `advisorModel: fable`; `off` and `default` delete the key. Fable-main +
-Fable-advisor is an accepted pairing. The advisor needs Fable org access and
-Claude Code >= 2.1.170.
+writes `advisorModel: opus`; `off` and `default` delete the key. The advisor
+then runs the same Opus 5.5 the main session uses.

package/cli/docs/modifiers.md CHANGED Viewed

@@ -9,15 +9,15 @@ the SoT is never touched. They all share one contract:
 > profiles can instead use `~/.claude/settings.local.json`, which sync never
 > touches.
-Claude's embedded SoT is `model: fable`, `effortLevel: high`, with advisor
+Claude's embedded SoT is `model: opus`, `effortLevel: high`, with advisor
 off (`advisorModel` unset). Codex's embedded normal and plan reasoning effort is
 `high`.
 | Modifier | Deployed change | Typical use |
 |----------|-----------------|-------------|
-| `--claude-model=<m>` | `.model` in ~/.claude/settings.json (`default` deletes the key) | Override one machine while the SoT retains `fable` |
+| `--claude-model=<m>` | `.model` in ~/.claude/settings.json (`default` deletes the key) | Override one machine while the SoT retains `opus` |
 | `--claude-effort=<level>` | `.effortLevel` in ~/.claude/settings.json (`default` writes `high`) | Tune persisted Claude effort per machine; valid `low`, `medium`, `high`, `xhigh` |
-| `--claude-advisor=<state>` | `on` sets `.advisorModel = "fable"`; `off`/`default` remove it | Enable Claude advisor only on machines that need it |
+| `--claude-advisor=<state>` | `on` sets `.advisorModel = "opus"`; `off`/`default` remove it | Enable Claude advisor only on machines that need it |
 | `--claude-compact-window=<n>` | `env.CLAUDE_CODE_AUTO_COMPACT_WINDOW` | Disposable containers running long autonomous work (e.g. `680k`) — not host machines |
 | `--claude-permissive` | `permissions.ask = []`, `permissions.deny = []` | Sandboxes/containers where prompts stall unattended work. Never on a host — the deny list is the safety floor |
 | `--codex-model=<m>` | top-level `model = "…"` in ~/.codex/config.toml | Same as claude-model, for Codex |
@@ -29,7 +29,7 @@ selecting that positional target warns and ignores it.
 A flag-less Claude sync also removes the formerly kit-owned `advisorModel`
 from machines synced before advisor became opt-in. Any explicit advisor state
-owns that key for the run: `on` writes `fable`; `off` and `default` delete it.
+owns that key for the run: `on` writes `opus`; `off` and `default` delete it.
 Codex has no advisor modifier because its documented config has no advisor
 setting; `review_model` applies only to `/review`.

package/cli/docs/omp-models.md CHANGED Viewed

@@ -6,27 +6,56 @@ against.
 ## Role map
-| Role | Model | Level | Index | Cost/task | TTFT | Coding Agent Index |
-|---|---|---|---:|---:|---:|---:|
-| `default` | `anthropic/claude-opus-5` | high | 48 | $3.61 | 16.96 s | 66 (Claude Code) |
-| `slow` | `anthropic/claude-opus-5` | xhigh | 50 | $4.88 | 28.65 s | 68 (Claude Code) |
-| `plan` | `anthropic/claude-opus-5` | xhigh | 50 | $4.88 | 28.65 s | 68 (Claude Code) |
-| `task` | `openai-codex/gpt-5.6-sol` | high | 42 | $0.81 | 11.26 s | 64 (Codex) |
-| `advisor` | `openai-codex/gpt-5.6-sol` | medium | 39 | $0.50 | 4.90 s | 62 (Codex) |
-| `designer` | `anthropic/claude-opus-5` | high | 48 | $3.61 | 16.96 s | 66 (Claude Code) |
-| `vision` | `anthropic/claude-opus-5` | medium | 45 | $2.19 | 3.79 s | 64 (Claude Code) |
-| `smol` / `commit` | `openai-codex/gpt-5.6-luna` | medium | 26 | n/a | 2.18 s | 42 (Codex) |
-| `tiny` | `openai-codex/gpt-5.6-luna` | low | 22 | n/a | 1.78 s | 25 (Codex) |
-| `fable` | `anthropic/claude-fable-5-1` | medium | 49 | $2.98 | 9.65 s | n/a |
-| `switch_fable` | `anthropic/claude-fable-5-1` | medium | 49 | $2.98 | 9.65 s | n/a |
-| `astra` | `openai-codex/gpt-6-astra` | xhigh | 53 | $2.31 | 161.65 s | n/a |
-| `web` | `web/firecrawl` | n/a | n/a | n/a | n/a | n/a |
+| Role | Model | Level | Index | Cost/task | TTFT |
+|---|---|---|---:|---:|---:|
+| `default` | `anthropic/claude-opus-5-5` | high | 54 | $1.82 | 12.49 s |
+| `slow` | `anthropic/claude-opus-5-5` | xhigh | 56 | $3.46 | 165.20 s |
+| `plan` | `anthropic/claude-opus-5-5` | xhigh | 56 | $3.46 | 165.20 s |
+| `task` | `openai-codex/gpt-6-sol` | high | 43 | $0.37 | n/a |
+| `advisor` | `openai-codex/gpt-6-sol` | medium | 40 | $0.25 | n/a |
+| `designer` | `anthropic/claude-opus-5-5` | high | 54 | $1.82 | 12.49 s |
+| `vision` | `anthropic/claude-opus-5-5` | medium | 51 | $1.34 | 22.17 s |
+| `smol` / `commit` | `openai-codex/gpt-6-luna` | medium | 29 | $0.02 | n/a |
+| `tiny` | `openai-codex/gpt-6-luna` | low | 21 | $0.0045 | n/a |
+| `fable` | `anthropic/claude-fable-5-1` | medium | 49 | $2.98 | 8.61 s |
+| `switch_fable` | `anthropic/claude-fable-5-1` | medium | 49 | $2.98 | 8.61 s |
+| `astra` | `openai-codex/gpt-6-astra` | xhigh | 52 | $2.31 | 188.20 s |
+| `web` | `web/firecrawl` | n/a | n/a | n/a | n/a |
 The table reports the measured Artificial Analysis figures for each assigned
 model and level. It states no motive that the config or omp's own
-documentation does not establish. AA lists no cost per task for Luna medium
-and low, and no Coding Agent Index for any Astra or Fable 5.1 level except
-max. AA measures no web search provider, so the `web` row carries no figures.
+documentation does not establish. AA has not measured output speed or latency
+for GPT-6 Sol or GPT-6 Luna at any level, so those rows carry `n/a` for TTFT.
+AA measures no web search provider, so the `web` row carries no figures.
+The role map carries no Coding Agent Index column. That index publishes one
+entry per harness and model, and the Codex entries for GPT-6 Sol and GPT-6
+Luna run at `max`, a level no role here uses. The snapshot section below
+lists the entries.
+### GPT-6 Sol and GPT-6 Luna availability
+The `openai-codex` selectors for GPT-6 Sol and GPT-6 Luna were deployed on
+2026-09-22, while the rollout of both models was still in progress. The owner
+chose to deploy them before the rollout completed. Checks on that date, with
+omp 18.2.9 and codex-cli 0.153.3:
+- At 19:02 UTC, `codex exec -m gpt-6-sol` returned HTTP 400, `The 'gpt-6-sol'
+  model is not supported when using Codex with a ChatGPT account.`
+  `gpt-6-luna` returned the same error. The Codex model cache fetched at that
+  time listed neither model.
+- At 19:14 UTC, the Codex model cache for the same account listed
+  `gpt-6-sol` and `gpt-6-luna`. A request on the new default could not be
+  tested, because the account had reached its Codex usage limit.
+- The omp `openai-codex` catalog listed `gpt-6-astra` and the three `gpt-5.6`
+  models, but not `gpt-6-sol` or `gpt-6-luna`, both before and after
+  `omp models refresh` at 19:14 UTC. omp resolves a selector that is not in
+  the catalog by provider-scoped fuzzy match. An `omp -p --mode json` run on
+  `openai-codex/gpt-6-sol:low` recorded `gpt-5.6-sol` as the serving model,
+  and the Luna selector recorded `gpt-5.6-luna`. omp printed no warning.
+Until the omp catalog lists both ids, the omp roles run GPT-5.6. To check, run
+`omp models openai-codex`: the `gpt-6-sol` and `gpt-6-luna` rows must appear.
 What omp's settings catalog establishes about these roles:
@@ -43,159 +72,235 @@ and `security-reviewer` exist as OMP agents (omp's task tool lists `scout`,
 `reviewer`, `security-reviewer`, `task`, and `sonic`), so those two inherit
 whatever `task` resolves to. The `code-reviewer` and `plan-reviewer` entries
 are dormant until an OMP agent with that name exists.
-`retry.fallbackChains.task` keeps `anthropic/claude-opus-5:high` as a
+`retry.fallbackChains.task` keeps `anthropic/claude-opus-5-5:high` as a
 cross-vendor fallback.
 `retry.fallbackChains.astra` holds `anthropic/claude-fable-5-1:medium`.
 `retry.fallbackChains.fable` holds `openai-codex/gpt-6-astra:xhigh`.
 Each deliberate cycle stop falls to the other vendor. Without these explicit
 chains, `retry.fallbackChains.default` would send either stop to
-`openai-codex/gpt-5.6-sol:high`.
+`openai-codex/gpt-6-sol:high`.
 Chain entries are concrete selectors, not role aliases, so this pair cannot
 recurse. The hidden `switch_fable` chain stays empty.
 `modelRoles.web` is `web/firecrawl`, and `retry.fallbackChains.web` lists the
-explicit 27-entry provider order that follows it. The two keys replace the
+explicit 20-entry provider order that follows it. The two keys replace the
 retired `providers.webSearchOrder` key, which omp no longer carries in its
 settings schema. omp still accepts that key in a deployed file, expands it in
 memory into the same two keys, and then drops it, but it never writes the
 expansion back to disk. The kit therefore declares both keys itself.
-The chain is the verbatim expansion omp produces today, read back with
-`omp config get retry.fallbackChains`. It must stay complete. An explicit
-chain replaces omp's built-in web order wholesale, so a shortened list drops
-providers instead of reordering them. The first five entries keep the previous
-Firecrawl, Exa, Perplexity, Gemini, Codex preference; the remaining entries
-are omp's own ordering of the providers behind it.
+The chain starts from the expansion omp produces, read back with
+`omp config get retry.fallbackChains`. An explicit chain replaces omp's
+built-in web order wholesale, so a shortened list drops providers instead of
+reordering them. The kit makes two deliberate edits to omp's order:
+- The Codex Luna entry follows the kit's Luna generation and names
+  `openai-codex/gpt-6-luna`.
+- The owner removed every entry that named an older model:
+  `google/gemini-2.5-flash`, `google-antigravity/gemini-2.5-flash`,
+  `anthropic/claude-haiku-4-5`, `openai-codex/gpt-5.6`,
+  `openai-codex/gpt-5.5`, `xai/grok-4.5`, and `xai-oauth/grok-4.5`. omp never
+  tries those search backends now.
+The order keeps Firecrawl, Exa, Perplexity, and Codex first. The remaining
+`web/*` entries are omp's own ordering of the providers behind them.
 ## Artificial Analysis snapshot
-Source: `https://artificialanalysis.ai`, read on 2026-09-08. Every score below
-comes from one snapshot: Intelligence Index v4.3 and Coding Agent Index v1.4,
-taken from each family's release page, its per-level model pages, and the
-harness comparison pages. The v4.1.1-era figures in AA's Astra launch article
-are excluded, because index composition changed in v4.2 and again in v4.3, so
-mixing them would invalidate every ratio here. The head-to-head rows come from
-the direct `gpt-6-astra-low-vs-gpt-5-6-sol-high` comparison page, not from a
-comparison against another Sol level.
+Source: `https://artificialanalysis.ai`, read on 2026-09-22. Every figure below
+comes from that one capture at Intelligence Index v4.3.2 and Coding Agent Index
+v1.5. Each per-level row was read from the metric table of the comparison page
+`/models/comparisons/<level-slug>-vs-gpt-5-6-sol-high`. The page title named
+the requested model and level, and the page printed index v4.3.2. AA serves
+the `max` level under the bare model slug. Index composition changed in v4.2,
+again in v4.3, and again in v4.3.2, so figures from an earlier capture cannot
+be mixed with these.
+Coding Agent Index v1.5 (`/agents/coding-agents`) lists 12 harness and model
+entries. Most carry `max`. Grok Build with Grok 4.7 runs at `xhigh`, and
+Antigravity SDK with Gemini 3.8 Flash runs at `high`. Opencode with GLM-5.3
+and Kimi Code CLI with Kimi K3 name no level. The entries that involve a model
+family in this topic:
+| Harness and model | Coding Agent Index |
+|---|---:|
+| Claude Code - Fable 5.1 (max, with fallback) | 62.2 |
+| Codex - GPT-6 Astra (max) | 61.6 |
+| Claude Code - Opus 5 (max) | 59.7 |
+| Codex - GPT-6 Sol (max) | 56.7 |
+| Codex - GPT-6 Luna (max) | 41.1 |
+AA lists no Opus 5.5 entry. The page stores each score as a fraction, such as
+`0.6222`, and this table shows it multiplied by 100.
 Column meanings:
-- **Intelligence Index** - AA's weighted aggregate across its evaluation set.
-  Comparable only inside one index version.
-- **Coding Agent Index** - agentic coding score inside a named harness. AA
-  publishes it per harness, and for most effort levels it publishes nothing.
-- **Cost per Index task** - weighted average USD to run one index task,
-  including input, cache, reasoning, and answer tokens.
-- **Index output tokens** - total output tokens the model spends to complete the
+- **Index** - AA Intelligence Index, a weighted aggregate across its
+  evaluation set. Comparable only inside one index version.
+- **Cost/task** - weighted average USD to run one index task, including
+  input, cache, reasoning, and answer tokens.
+- **Tokens/task** - answer plus reasoning tokens for one index task.
+- **Index tokens** - total output tokens the model spends to complete the
   whole index run. This is the token-efficiency signal.
+- **Speed** - output tokens per second.
 - **TTFT** - seconds to the first answer token, so reasoning time counts.
+- **TB 4.0** - Terminal-Bench 4.0, one of the ten index evaluations.
+### Claude Opus 5.5 (Anthropic) - `anthropic/claude-opus-5-5`
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 58 | $5.98 | 119k | 260M | n/a | n/a | 60% |
+| xhigh | 56 | $3.46 | 66k | 100M | 72 | 165.20 | 60% |
+| high | 54 | $1.82 | 36k | 53M | 91 | 12.49 | 57% |
+| medium | 51 | $1.34 | 26k | 38M | 76 | 22.17 | 53% |
+| low | 42 | $0.55 | 10k | 20M | 94 | 4.79 | 31% |
+Price: $4.00 in, $20.00 out, $0.20 cache hit per 1M. The Anthropic platform
+documentation read the same day lists the same input, output, and cache-read
+prices. It adds a $5.00 five-minute cache write and an $8.00 one-hour cache
+write, which the AA comparison table does not show. Context 1M, maximum output
+128K. Adaptive thinking is always on, and the Claude API default effort is
+`medium`. All AA levels run with fallback. Max is the highest Intelligence
+Index in this topic at this capture. AA has not measured speed or latency for
+max. It measures a longer TTFT for medium than for high.
+`SoT/.omp/models.yml` carries the Anthropic limits and prices as an `anthropic`
+`modelOverrides` block, because the shared catalog still serves this id as a
+stub with null limits and zero cost. Remove that block once the catalog
+publishes the row.
-### GPT-6 Astra (OpenAI) - `openai-codex/gpt-6-astra`
+### Claude Fable 5.1 (Anthropic) - `anthropic/claude-fable-5-1`
-| Level | Intelligence Index | Coding Agent Index | Cost per Index task | Index output tokens | Output speed t/s | TTFT s |
-|---|---:|---:|---:|---:|---:|---:|
-| max | 53 | 67 (Codex) | $3.26 | 60M | 59 | 322.48 |
-| xhigh | 53 | n/a | $2.31 | 38M | 57 | 161.65 |
-| high | 51 | n/a | $1.72 | 26M | 55 | 45.63 |
-| medium | 50 | n/a | $1.54 | 19M | 53 | 5.42 |
-| low | 46 | n/a | $0.82 | 10M | 53 | 2.60 |
-| non-reasoning | 45 | n/a | $1.71 | 12M | n/a | n/a |
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 53 | $7.63 | 78k | 188M | 66 | 311.51 | 52% |
+| xhigh | 53 | $5.98 | 61k | 121M | 61 | 164.82 | 55% |
+| high | 51 | $3.91 | 38k | 62M | 55 | 26.22 | 52% |
+| medium | 49 | $2.98 | 28k | 44M | 55 | 8.61 | 45% |
+| low | 47 | $2.37 | 22k | 33M | 54 | 7.28 | 40% |
-Price: $10.00 in, $50.00 out, $1.00 cache read, $12.50 cache write per 1M.
-Context 1M. Knowledge cutoff 2026-04-30.
-AA lists non-reasoning above low on cost per task.
+Price: $10.00 in, $50.00 out, $0.25 cache hit per 1M. Context 1M. All levels
+run with fallback.
-### Claude Fable 5.1 (Anthropic) - `anthropic/claude-fable-5-1`
+### GPT-6 Astra (OpenAI) - `openai-codex/gpt-6-astra`
-| Level | Intelligence Index | Coding Agent Index | Cost per Index task | Index output tokens | Output speed t/s | TTFT s |
-|---|---:|---:|---:|---:|---:|---:|
-| max | 54 (estimated) | 70 (Claude Code) | n/a | n/a | 70 | 277.47 |
-| xhigh | 53 | n/a | $5.98 | n/a | 60 | 124.87 |
-| high | 51 | n/a | $3.91 | n/a | 57 | 23.70 |
-| medium | 49 | n/a | $2.98 | n/a | 56 | 9.65 |
-| low | 47 | n/a | $2.37 | n/a | 53 | 6.55 |
-Price: $10.00 in, $50.00 out, $0.25 cache read per 1M; no published cache-write
-price. Context 1M. All levels run with fallback.
-AA publishes per-task output tokens instead of index totals here: low 22k,
-medium 28k, high 38k, xhigh 61k. AA marks the max index score as estimated.
-### Claude Opus 5 (Anthropic) - `anthropic/claude-opus-5`
-| Level | Intelligence Index | Coding Agent Index | Cost per Index task | Index output tokens | Output speed t/s | TTFT s |
-|---|---:|---:|---:|---:|---:|---:|
-| max | 51 | 67 (Claude Code) | $5.86 | 140M | 54.3 | 69.92 |
-| xhigh | 50 | 68 (Claude Code) | $4.88 | 110M | 53.0 | 28.65 |
-| high | 48 | 66 (Claude Code) | $3.61 | 81M | 54.0 | 16.96 |
-| medium | 45 | 64 (Claude Code) | $2.19 | 49M | 53.6 | 3.79 |
-| low | 40 | 59 (Claude Code) | $1.10 | 26M | 53.2 | 2.32 |
-Price: $5.00 in, $25.00 out, $0.50 cache read, $6.25 cache write per 1M, with a
-5-minute cache TTL. Context 1M.
-AA reports that its Opus 5 index run fell back to Opus 4.8 for part of the set.
-### GPT-5.6 Sol (OpenAI) - `openai-codex/gpt-5.6-sol`
-| Level | Intelligence Index | Coding Agent Index | Cost per Index task | Index output tokens | Output speed t/s | TTFT s |
-|---|---:|---:|---:|---:|---:|---:|
-| max | 47 | 65 (Codex) | $1.99 | 90M | 69.8 | 132.10 |
-| xhigh | 44 | 63 (Codex) | $1.18 | 51M | 64.8 | 50.59 |
-| high | 42 | 64 (Codex) | $0.81 | 34M | 67.8 | 11.26 |
-| medium | 39 | 62 (Codex) | $0.50 | 21M | 66.6 | 4.90 |
-| low | 34 | 55 (Codex) | $0.26 | 13M | 67.1 | 2.69 |
-| non-reasoning | 28 | 43 (Codex) | n/a | n/a | 65.6 | 1.13 |
-Price: $4.00 in, $20.00 out per 1M, with a 90% cache-read discount and no
-published numeric cache price. Context 1M.
-### GPT-5.6 Luna (OpenAI) - `openai-codex/gpt-5.6-luna`
-| Level | Intelligence Index | Coding Agent Index | Cost per Index task | Index output tokens | Output speed t/s | TTFT s |
-|---|---:|---:|---:|---:|---:|---:|
-| max | 38 | 57 (Codex) | $0.18 | n/a | 121 | 168.22 |
-| xhigh | 35 | 53 (Codex) | $0.09 | n/a | 113 | 60.22 |
-| high | 33 | 52 (Codex) | n/a | n/a | 120 | 9.62 |
-| medium | 26 | 42 (Codex) | n/a | n/a | 110 | 2.18 |
-| low | 22 | 25 (Codex) | n/a | n/a | 119 | 1.78 |
-| non-reasoning | 17 | 19 (Codex) | n/a | n/a | 120 | 0.76 |
-Price: $0.20 in, $1.20 out, $0.02 cache read per 1M; no published cache-write
-price. Context 1M. AA lists cost per task only for max and xhigh.
-## Why `task` returns to Sol high
-`task` runs `openai-codex/gpt-5.6-sol:high`. The owner uses Astra only for
-main orchestration, so Astra now has a dedicated `astra` cycle stop at `xhigh`.
-The comparison below records the retired Astra-low choice beside the current
-Sol-high choice and the other measured alternatives.
-| Metric | Astra low, retired task | Sol high, current task | Sol max | Opus 5 high |
-|---|---:|---:|---:|---:|
-| Intelligence Index | 46 | 42 | 47 | 48 |
-| Cost per Index task | $0.82 | $0.81 | $1.99 | $3.61 |
-| Output tokens per task | 4k | 13k | 29k | 46k |
-| Index output tokens | 10M | 34M | 90M | 81M |
-| Answer TTFT | 2.60 s | 11.26 s | 132.10 s | 16.96 s |
-| End-to-end latency | 11.99 s | 18.64 s | 139.27 s | 26.22 s |
-| Time per task | 84.45 s | 195.67 s | 411.54 s | 525.57 s |
-| Terminal-Bench v4.0 | 42% | 21% | 40% | 46% |
-| AA-Briefcase | 1253 | 1361 | 1475 | 1557 |
-| AA-Omniscience | 41 | 20 | 22 | 34 |
-Astra low beat Sol high on intelligence, latency, and token use at effectively
-equal cost per task. It cost $0.82 against $0.81 and used 4k output tokens
-per task against 13k. Its 2.60 s TTFT beat Sol high's 11.26 s.
-That was a latency and token-budget win, not a cost saving.
-The owner reversed that trade on purpose to reserve Astra for interactive
-orchestration.
-Sol high scores 64 in the Codex Coding Agent Index and 1361 on AA-Briefcase.
-Astra low scores 1253 on AA-Briefcase. AA publishes no Astra Coding Agent
-Index except max, which scores 67 in Codex.
-The new Astra xhigh cycle stop scores 53 on the Intelligence Index, costs
-$2.31 per index task, and has 161.65 s TTFT.
-It has no published Coding Agent Index.
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 53 | $3.26 | 27k | 60M | 61 | 322.65 | 59% |
+| xhigh | 52 | $2.31 | 17k | 38M | 55 | 188.20 | 60% |
+| high | 51 | $1.73 | 12k | 26M | 50 | 79.00 | 54% |
+| medium | 50 | $1.54 | 10k | 19M | 48 | 6.19 | 49% |
+| low | 46 | $0.82 | 4k | 10M | 51 | 2.76 | 42% |
+Price: $10.00 in, $50.00 out, $1.00 cache hit per 1M. Context 1M. Knowledge
+cutoff 2026-04-30. AA publishes no non-reasoning Astra row.
+### GPT-6 Sol (OpenAI) - `openai-codex/gpt-6-sol`
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 48 | $1.06 | 31k | 77M | n/a | n/a | 44% |
+| xhigh | 44 | $0.53 | 16k | 40M | n/a | n/a | 30% |
+| high | 43 | $0.37 | 10k | 25M | n/a | n/a | 26% |
+| medium | 40 | $0.25 | 6k | 16M | n/a | n/a | 19% |
+| low | 34 | $0.13 | 3k | 9M | n/a | n/a | 9% |
+| non-reasoning | 28 | $0.33 | 5k | 8M | n/a | n/a | 13% |
+Price: $2.00 in, $10.00 out, $0.20 cache hit per 1M. OpenAI's model page lists
+a $2.50 cache write and a 1,050,000-token context with 128,000 maximum output
+tokens. It bills a prompt above 272K input tokens at 2x input and cache rates
+and 1.5x output for the full request. Knowledge cutoff 2026-04-20. The API
+effort ladder is `none, low, medium, high, xhigh, max`, with `medium` as the
+default. AA has not measured speed or latency for any level.
+### GPT-6 Luna (OpenAI) - `openai-codex/gpt-6-luna`
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 37 | $0.07 | 51k | 145M | n/a | n/a | 13% |
+| xhigh | 34 | $0.04 | 27k | 68M | n/a | n/a | 8% |
+| high | 32 | $0.03 | 20k | 47M | n/a | n/a | 5% |
+| medium | 29 | $0.02 | 11k | 28M | n/a | n/a | 3% |
+| low | 21 | $0.0045 | 2k | 8M | n/a | n/a | 0% |
+| non-reasoning | 18 | $0.01 | 4k | 7M | n/a | n/a | 2% |
+Price: $0.10 in, $0.50 out, $0.01 cache hit per 1M. OpenAI's model page lists
+a $0.125 cache write, the same context, output, long-prompt billing, and
+effort ladder as Sol, and a 2026-05-18 knowledge cutoff. AA has not measured
+speed or latency for any level.
+### GPT-5.6 Sol (OpenAI) - previous generation
+The role map no longer uses GPT-5.6 Sol. This table stays as the measured
+baseline for the GPT-6 Sol switch.
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 47 | $1.99 | 29k | 90M | 82 | 130.17 | 40% |
+| xhigh | 44 | $1.18 | 20k | 51M | 72 | 35.55 | 25% |
+| high | 42 | $0.81 | 13k | 34M | 68 | 17.49 | 21% |
+| medium | 39 | $0.50 | 8k | 21M | 58 | 5.07 | 15% |
+| low | 33 | $0.26 | 4k | 13M | 58 | 3.85 | 1% |
+| non-reasoning | 28 (estimated) | n/a | n/a | n/a | 64 | 1.22 | n/a |
+Price: $4.00 in, $20.00 out, $0.40 cache hit per 1M. Context 1M. AA marks the
+non-reasoning index score as estimated.
+### GPT-5.6 Luna (OpenAI) - previous generation
+The role map no longer uses GPT-5.6 Luna. This table stays as the measured
+baseline for the GPT-6 Luna switch.
+| Level | Index | Cost/task | Tokens/task | Index tokens | Speed t/s | TTFT s | TB 4.0 |
+|---|---:|---:|---:|---:|---:|---:|---:|
+| max | 37 | $0.18 | 41k | 154M | 145 | 122.15 | 12% |
+| xhigh | 35 | $0.09 | 24k | 85M | 143 | 40.24 | 4% |
+| high | 32 | $0.04 | 14k | 50M | 132 | 15.15 | 3% |
+| medium | 25 | $0.02 | 4k | 18M | 133 | 2.57 | 1% |
+| low | 21 | $0.01 | 3k | 10M | 131 | 1.69 | 0% |
+| non-reasoning | 16 | $0.01 | 2k | 5M | 140 | 0.81 | 1% |
+Price: $0.20 in, $1.20 out, $0.02 cache hit per 1M. Context 1M.
+## Why `task` runs GPT-6 Sol high
+`task` runs `openai-codex/gpt-6-sol:high`, the same level GPT-5.6 Sol ran
+before it. The owner uses Astra only for main orchestration, so Astra has a
+dedicated `astra` cycle stop at `xhigh`. The comparison below records the
+retired Astra-low and GPT-5.6 Sol choices beside the current GPT-6 Sol choice.
+| Metric | Astra low, retired | GPT-5.6 Sol high, previous | GPT-6 Sol high, current | GPT-6 Sol max | Opus 5.5 high, `default` |
+|---|---:|---:|---:|---:|---:|
+| Intelligence Index | 46 | 42 | 43 | 48 | 54 |
+| Cost per Index task | $0.82 | $0.81 | $0.37 | $1.06 | $1.82 |
+| Output tokens per task | 4k | 13k | 10k | 31k | 36k |
+| Index output tokens | 10M | 34M | 25M | 77M | 53M |
+| Answer TTFT | 2.76 s | 17.49 s | n/a | n/a | 12.49 s |
+| End-to-end response time | 12.49 s | 24.87 s | n/a | n/a | 18.00 s |
+| Time per index task | 87.88 s | 189.16 s | n/a | n/a | 244.35 s |
+| Terminal-Bench 4.0 | 42% | 21% | 26% | 44% | 57% |
+| AA-Briefcase v1.1 | 1261 | 1370 | 1289 | 1483 | 1705 |
+| AA-Omniscience | 41 | 20 | 27 | 27 | 41 |
+GPT-6 Sol high scores one index point above GPT-5.6 Sol high. It costs $0.37
+against $0.81 per index task and uses 10k output tokens per task against 13k.
+It also scores 26% against 21% on Terminal-Bench 4.0. AA-Briefcase is the one
+metric where the older model leads, at 1370 against 1289. AA has not measured
+GPT-6 Sol latency, so the latency comparison is open.
+Astra low still beats GPT-6 Sol high on the index, at 46 against 43, and on
+Terminal-Bench 4.0, at 42% against 26%. It costs $0.82 against $0.37 per index
+task. The owner reserves Astra for interactive orchestration.
+Opus 5.5 high scores 11 points above GPT-6 Sol high and costs $1.82 against
+$0.37 per index task. It is the `default`, `designer`, and fallback model, not
+the `task` model, so the subagent fan-out keeps the cheaper Sol.
+The `astra` cycle stop runs xhigh: index 52, $2.31 per index task, and
+188.20 s TTFT. AA publishes a Coding Agent Index entry for Astra only at max,
+paired with Codex, where it scores 61.6.
 ## How Astra is selected in practice
@@ -216,16 +321,17 @@ quick answer.
   not Sol or Astra. To move them, change `modelRoles.smol` or add a
   `task.agentModelOverrides` entry for the agent name.
 - The bundled `task` agent carries `model: "@task"` and
-  `thinking-level: auto`. It resolves Sol, and `auto` classifies each prompt
+  `thinking-level: auto`. It resolves GPT-6 Sol, and `auto` classifies each prompt
   to choose a thinking level.
 - `task.enableEffort` is `true`, so a caller can pass `effort: lo`, `med`, or
   `hi`, which overrides `auto`.
-- `task.maxEffort` is `max`, so `scout` and `sonic` run Luna `medium` by
-  default and Luna `max` with `effort: hi`.
-- The bundled `reviewer` and `security-reviewer` inherit `@task`, now Sol high.
+- `task.maxEffort` is `max`, so `scout` and `sonic` run GPT-6 Luna `medium`
+  by default and GPT-6 Luna `max` with `effort: hi`.
+- The bundled `reviewer` and `security-reviewer` inherit `@task`, now GPT-6
+  Sol high.
 - The `code-reviewer` and `plan-reviewer` override entries remain dormant.
-  Both point to `@task`, now Sol high. omp's task tool rejects both names as
-  unknown agents, so neither can spawn.
+  Both point to `@task`, now GPT-6 Sol high. omp's task tool rejects both
+  names as unknown agents, so neither can spawn.
 The runtime per-agent measurement from fresh `omp -p` runs on 2026-09-09
 predates this change. It applies to the retired Astra-low `task` configuration,
@@ -342,9 +448,13 @@ recorded default and the ladder counts in these docs in the same commit.
 ## Maintenance
-- Refresh the snapshot from the AA release page of each family
-  (`/models/releases/<slug>`), the per-level model pages, and the harness
-  comparison pages under `/agents/coding-agents/comparisons/`.
+- Refresh each per-level row from the metric table of
+  `/models/comparisons/<level-slug>-vs-gpt-5-6-sol-high`. Check that the page
+  title names the requested model and level. Take `max` from the bare model
+  slug. Do not read values from the chart payloads of the model pages: each
+  chart holds only about 20 models, so a missing value there does not mean
+  that AA has not measured it.
+- Refresh the Coding Agent Index from `/agents/coding-agents`.
 - Record the index version with the numbers. AA changes index composition
   between versions, so a score from another version is not a comparison.
 - Update the capture date in the same commit as any number.

package/cli/src/efforts.ts CHANGED Viewed

@@ -15,6 +15,7 @@ export const CODEX_REASONING_EFFORTS = [
 export const CLAUDE_ADVISOR_STATES = ["on", "off", "default"] as const;
 const VERIFIED = "2026-07-10";
+const ADVISOR_VERIFIED = "2026-09-22";
 const DEFAULT = "default";
 const upstreamEfforts = (tool: Tool): ReadonlyArray<string> =>
@@ -80,8 +81,8 @@ export function effortCatalog(tool: Tool): string {
 export function advisorCatalog(): string {
   return [
-    `Available claude advisor states (advisorModel; verified ${VERIFIED}):`,
-    "  on  — set advisorModel: fable",
+    `Available claude advisor states (advisorModel; verified ${ADVISOR_VERIFIED}):`,
+    "  on  — set advisorModel: opus",
     "  off  — unset advisorModel",
     "  default  — SoT: off (unset)",
   ].join("\n");

package/cli/src/engine-native/claudeSettingsModifiers.ts CHANGED Viewed

@@ -101,15 +101,15 @@ export function syncClaudeAdvisor(ctx: Ctx, state: string): void {
   syncClaudeSetting(ctx, {
     tag: "--claude-advisor",
     key: "advisorModel",
-    value: enabled ? "fable" : undefined,
-    dryRun: enabled ? "set .advisorModel=fable" : "delete .advisorModel (advisor disabled)",
+    value: enabled ? "opus" : undefined,
+    dryRun: enabled ? "set .advisorModel=opus" : "delete .advisorModel (advisor disabled)",
     changed: enabled
-      ? "Advisor: deployed settings advisorModel set to fable (SoT unchanged; flag-less sync reverts)"
+      ? "Advisor: deployed settings advisorModel set to opus (SoT unchanged; flag-less sync reverts)"
       : useDefault
         ? "Advisor: deployed settings advisorModel unset (SoT default: off)"
         : "Advisor: deployed settings advisorModel unset (--claude-advisor=off; SoT unchanged)",
     unchanged: enabled
-      ? "Advisor: deployed settings advisorModel already fable"
+      ? "Advisor: deployed settings advisorModel already opus"
       : `Advisor: deployed settings advisorModel already unset (${useDefault ? "SoT default: off" : "advisor off"})`,
   });
 }

package/cli/src/generated/sotPayload.ts CHANGED Viewed

@@ -1,27 +1,27 @@
 // Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.
 // Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts
-export const GENERATED_PACKAGE_VERSION = "0.17.3"
+export const GENERATED_PACKAGE_VERSION = "0.18.0"
 export const GENERATED_PAYLOAD_TEXT = {
   "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",
-  "SoT/models.json": "{\n  \"$comment\": \"Kit-verified model catalog — single source for EngineNative validators, the docks-kit CLI (models/model commands, pickers, and bare-flag help), and docs. Entries are research-proofed: update an entry and its tool-level `verified` date when a model ships or retires. Deploy-time model flags remain permissive.\",\n  \"claude\": {\n    \"verified\": \"2026-07-27\",\n    \"models\": [\n      { \"id\": \"best\", \"kind\": \"alias\", \"note\": \"Fable 5 where the org has access, latest Opus otherwise (Claude Code >=2.1.170)\" },\n      { \"id\": \"opus\", \"kind\": \"alias\", \"note\": \"latest Opus — the kit SoT default (Opus 5 on the Anthropic API from Claude Code >=2.1.219; Opus 4.6 on Microsoft Foundry)\" },\n      { \"id\": \"fable\", \"kind\": \"alias\", \"note\": \"Fable 5 — advisor opt-in default; needs org access + Claude Code >=2.1.170\" },\n      { \"id\": \"sonnet\", \"kind\": \"alias\", \"note\": \"latest Sonnet (currently Sonnet 5)\" },\n      { \"id\": \"haiku\", \"kind\": \"alias\", \"note\": \"latest Haiku (currently Haiku 4.5)\" },\n      { \"id\": \"default\", \"kind\": \"alias\", \"note\": \"engine pseudo-value: deletes the deployed model key so the account default applies\" },\n      { \"id\": \"claude-fable-5\", \"kind\": \"id\", \"note\": \"Fable 5\" },\n      { \"id\": \"claude-opus-5\", \"kind\": \"id\", \"note\": \"Opus 5 — needs Claude Code >=2.1.219\" },\n      { \"id\": \"claude-opus-4-8\", \"kind\": \"id\", \"note\": \"Opus 4.8\" },\n      { \"id\": \"claude-sonnet-5\", \"kind\": \"id\", \"note\": \"Sonnet 5\" },\n      { \"id\": \"claude-haiku-4-5-20251001\", \"kind\": \"id\", \"note\": \"Haiku 4.5\" }\n    ]\n  },\n  \"codex\": {\n    \"verified\": \"2026-07-16\",\n    \"models\": [\n      { \"id\": \"gpt-5.6-sol\", \"kind\": \"id\", \"note\": \"GPT-5.6 Sol — frontier, recommended default; the kit SoT pin\" },\n      { \"id\": \"gpt-5.6-terra\", \"kind\": \"id\", \"note\": \"GPT-5.6 Terra — balanced tier\" },\n      { \"id\": \"gpt-5.6-luna\", \"kind\": \"id\", \"note\": \"GPT-5.6 Luna — fast/light tier\" },\n      { \"id\": \"gpt-5.5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5.5\" },\n      { \"id\": \"gpt-5.1\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5\" }\n    ]\n  }\n}\n",
-  "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a package the kit installs through another tool, such as npx or `omp install`). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"floor\": \"22.22.2\",\n                \"note\": \"hosts the npm globals installed for the Claude LSP plugins; the floor is typescript-language-server 6's engines requirement, so an older Node reports `below-floor` in `docks-kit toolchain` instead of silently installing an LSP server that cannot start\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.219\", \"note\": \"kit floor — lets the `opus` alias select the newest Opus its provider offers (Anthropic API: 5; Foundry: 4.6) and subsumes Fable 5's >=2.1.170 requirement (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"omp\":    { \"kind\": \"check\", \"floor\": \"18.0.8\", \"verified\": \"18.0.8\",\n                \"note\": \"Oh My Pi harness (https://github.com/can1357/oh-my-pi); upstream-owned and self-updating through `omp update`, so sync never installs or upgrades it. `sync omp` needs the CLI only for the marketplace and plugin passes; the file deploys proceed without it\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"6.0.0\", \"verified\": \"6.0.0\",\n                \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install. Version 6 requires Node >=22.22.2 (see the `node` floor)\" },\n    \"rust-analyzer\": { \"kind\": \"check\",\n                \"note\": \"rust-analyzer-lsp server binary; claudeSync syncLspServers installs it with `rustup component add rust-analyzer` when rustup is present, so the version follows the host Rust toolchain and no verified pin applies (the bubblewrap stance for a tool the kit does not publish). A host without rustup is skipped in silence\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\", \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.4.0\", \"verified\": \"1.4.2\", \"pinnable\": true,\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.25\",\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" },\n    \"pi-intercom\": { \"kind\": \"pin\", \"verified\": \"0.13.0\",\n                \"note\": \"the cross-session messaging plugin ompSync installs with `omp install pi-intercom@<verified>` - pinned, never floating. Its broker runs under Bun because omp's flat plugin store cannot resolve the default `npx --no-install tsx` launcher\" }\n  }\n}\n",
+  "SoT/models.json": "{\n  \"$comment\": \"Kit-verified model catalog — single source for EngineNative validators, the docks-kit CLI (models/model commands, pickers, and bare-flag help), and docs. Entries are research-proofed: update an entry and its tool-level `verified` date when a model ships or retires. Deploy-time model flags remain permissive.\",\n  \"claude\": {\n    \"verified\": \"2026-09-22\",\n    \"models\": [\n      { \"id\": \"best\", \"kind\": \"alias\", \"note\": \"Fable 5.1 where the org has access, latest Opus otherwise (Claude Code >=2.1.257; Claude apps gateway sessions still resolve Fable 5)\" },\n      { \"id\": \"opus\", \"kind\": \"alias\", \"note\": \"latest Opus — the kit SoT default (Opus 5.5 from Claude Code >=2.1.280)\" },\n      { \"id\": \"fable\", \"kind\": \"alias\", \"note\": \"Fable 5.1 — needs org access + Claude Code >=2.1.257 (Claude apps gateway sessions still resolve Fable 5)\" },\n      { \"id\": \"sonnet\", \"kind\": \"alias\", \"note\": \"latest Sonnet (currently Sonnet 5)\" },\n      { \"id\": \"haiku\", \"kind\": \"alias\", \"note\": \"latest Haiku (currently Haiku 4.5)\" },\n      { \"id\": \"default\", \"kind\": \"alias\", \"note\": \"engine pseudo-value: deletes the deployed model key so the account default applies\" },\n      { \"id\": \"claude-opus-5-5\", \"kind\": \"id\", \"note\": \"Opus 5.5 — needs Claude Code >=2.1.280\" },\n      { \"id\": \"claude-fable-5-1\", \"kind\": \"id\", \"note\": \"Fable 5.1 — needs Claude Code >=2.1.257\" },\n      { \"id\": \"claude-fable-5\", \"kind\": \"id\", \"note\": \"Fable 5 (legacy)\" },\n      { \"id\": \"claude-opus-5\", \"kind\": \"id\", \"note\": \"Opus 5 (legacy)\" },\n      { \"id\": \"claude-opus-4-8\", \"kind\": \"id\", \"note\": \"Opus 4.8 (legacy)\" },\n      { \"id\": \"claude-sonnet-5\", \"kind\": \"id\", \"note\": \"Sonnet 5\" },\n      { \"id\": \"claude-haiku-4-5-20251001\", \"kind\": \"id\", \"note\": \"Haiku 4.5\" }\n    ]\n  },\n  \"codex\": {\n    \"verified\": \"2026-09-22\",\n    \"models\": [\n      { \"id\": \"gpt-6-sol\", \"kind\": \"id\", \"note\": \"GPT-6 Sol — complex coding and agentic work, recommended default; the kit SoT pin\" },\n      { \"id\": \"gpt-6-luna\", \"kind\": \"id\", \"note\": \"GPT-6 Luna — fast/light tier\" },\n      { \"id\": \"gpt-6-astra\", \"kind\": \"id\", \"note\": \"GPT-6 Astra — most capable, highest cost\" },\n      { \"id\": \"gpt-5.6-sol\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.6-terra\", \"kind\": \"id\", \"note\": \"previous generation, balanced tier\" },\n      { \"id\": \"gpt-5.6-luna\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5.5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5.5\" },\n      { \"id\": \"gpt-5.1\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5\", \"kind\": \"id\", \"note\": \"previous generation\" },\n      { \"id\": \"gpt-5-codex\", \"kind\": \"id\", \"note\": \"codex-tuned gpt-5\" }\n    ]\n  }\n}\n",
+  "SoT/toolchain.json": "{\n  \"$comment\": \"Kit toolchain manifest - DATA only (versions, floors, policy); version probing and the doctor report live in cli/src/engine-native/toolchain.ts, and the one managed install lives in cli/src/engine-native/bun.ts bunBootstrap. kind: check (doctor visibility only) | managed (kit installs it when missing) | pin (no binary probe - a version pin for a package the kit installs through another tool, such as npx or `omp install`). policy (managed only): present (install when missing, never upgrade). `verified` = last kit-tested version; `pinnable` marks a tool whose `verified` release the bootstrap can install by exact tag. Supply-chain stance: every kit-driven install is pinned to `verified` - never floating @latest (npm-worm/Shai-Hulud surface). Update `verified` after testing a new release.\",\n  \"tools\": {\n    \"jq\":     { \"kind\": \"check\", \"note\": \"optional operator CLI; EngineNative JSON and Claude runtime do not invoke it\" },\n    \"curl\":   { \"kind\": \"check\", \"note\": \"POSIX installer transport for the Bun bootstrap\" },\n    \"git\":    { \"kind\": \"check\", \"note\": \"plugin marketplaces (claude/codex clone them) + kit checkout updates\" },\n    \"node\":   { \"kind\": \"check\", \"floor\": \"22.22.2\",\n                \"note\": \"hosts the npm globals installed for the Claude LSP plugins; the floor is typescript-language-server 6's engines requirement, so an older Node reports `below-floor` in `docks-kit toolchain` instead of silently installing an LSP server that cannot start\" },\n    \"npm\":    { \"kind\": \"check\", \"note\": \"npm-global installer; also backs the intelephense version probe (`npm ls -g`)\" },\n    \"claude\": { \"kind\": \"check\", \"floor\": \"2.1.280\", \"note\": \"kit floor — lets the `opus` alias resolve to Opus 5.5, the default Opus from Claude Code 2.1.280, and subsumes the older Fable 5.1 (>=2.1.257) and Opus 5 (>=2.1.219) requirements (mirrors settings minimumVersion)\" },\n    \"codex\":  { \"kind\": \"check\", \"note\": \"upstream-owned; standalone installer prints when missing\" },\n    \"omp\":    { \"kind\": \"check\", \"floor\": \"18.0.8\", \"verified\": \"18.0.8\",\n                \"note\": \"Oh My Pi harness (https://github.com/can1357/oh-my-pi); upstream-owned and self-updating through `omp update`, so sync never installs or upgrades it. `sync omp` needs the CLI only for the marketplace and plugin passes; the file deploys proceed without it\" },\n    \"ffplay\": { \"kind\": \"check\", \"note\": \"Notification hook sound; distro-installed, so no kit floor applies\" },\n    \"bwrap\":  { \"kind\": \"check\", \"os\": \"linux\", \"floor\": \"0.9.0\",\n                \"note\": \"Codex Linux sandbox runtime; sync installs it via the distro package manager, so the floor is the kit-tested baseline (Ubuntu 24.04 LTS) and no verified pin applies\" },\n    \"intelephense\": { \"kind\": \"check\", \"floor\": \"1.18.5\", \"verified\": \"1.18.5\",\n                \"note\": \"php-lsp server; `verified` pins claudeSync syncLspServers' npm install. Version comes from `npm ls -g` — its own --version prints minified source\" },\n    \"typescript-language-server\": { \"kind\": \"check\", \"floor\": \"6.0.0\", \"verified\": \"6.0.0\",\n                \"note\": \"typescript-lsp server binary; `verified` pins claudeSync syncLspServers' npm install. Version 6 requires Node >=22.22.2 (see the `node` floor)\" },\n    \"rust-analyzer\": { \"kind\": \"check\",\n                \"note\": \"rust-analyzer-lsp server binary; claudeSync syncLspServers installs it with `rustup component add rust-analyzer` when rustup is present, so the version follows the host Rust toolchain and no verified pin applies (the bubblewrap stance for a tool the kit does not publish). A host without rustup is skipped in silence\" },\n    \"tsc\":    { \"kind\": \"check\", \"floor\": \"6.0.3\", \"verified\": \"6.0.3\", \"note\": \"typescript-lsp dependency (npm package `typescript`); `verified` pins claudeSync syncLspServers' npm install. Deliberately on the 6.x line: typescript-language-server embeds TypeScript's programmatic API, which TS7 (native) doesn't yet expose — the repo's own devDependency runs TS7 for tsc --noEmit\" },\n    \"bun\":    { \"kind\": \"managed\", \"policy\": \"present\", \"floor\": \"1.4.0\", \"verified\": \"1.4.2\", \"pinnable\": true,\n                \"note\": \"runtime for the docks-kit CLI and the Claude statusline/hook programs; bootstrap installs the verified release (installer takes bun-vX.Y.Z); self-updates via `bun upgrade` when wanted\" },\n    \"skills-cli\": { \"kind\": \"pin\", \"verified\": \"1.5.25\",\n                \"note\": \"the `skills` npm package the kit runs via `npx skills@<verified>` when SoT/.agents/skills.txt names a slug (it is empty by default) — pinned, never @latest\" },\n    \"pi-intercom\": { \"kind\": \"pin\", \"verified\": \"0.13.0\",\n                \"note\": \"the cross-session messaging plugin ompSync installs with `omp install pi-intercom@<verified>` - pinned, never floating. Its broker runs under Bun because omp's flat plugin store cannot resolve the default `npx --no-install tsx` launcher\" }\n  }\n}\n",
   "SoT/.claude/CLAUDE.md": "## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- Upgrading or migrating between versions.\n- Any task where relying on memory could cause stale syntax or behavior.\n\nDo not:\n- Assume API signatures, method names, or config options from memory.\n- Generate framework code without checking current docs first.\n- Skip research because the library seems familiar.\n\n<constraint>\nResearch the codebase before editing. Never change code you have not read.\n</constraint>\n\n## Agentic Harness Heuristics\n\n**1. Persistence.** Keep going until the user's query is completely resolved. Only yield when sure the problem is solved. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done (\"I'll…\"), do that work now.\n\n**2. Default to parallel.** Whenever you have multiple independent operations (reads, greps, web fetches, independent edits), invoke them in a single response with multiple tool-use blocks. Sequential calls only when output of one operation is required as input to the next.\n\n**3. Multi-pass search.** First-pass search often misses — vary the wording (colleague-questions over keywords) before concluding something doesn't exist.\n\n**4. Trace symbols.** Before modifying a symbol, trace it to its definitions and all usages. Don't assume a function's behavior or a type's shape from the call site alone.\n\n**5. Linter-loop 3-strike rule.** Don't loop more than 3 times fixing linter errors on the same file. On the third attempt, stop and ask the user — repeated failure usually means the diagnosis is wrong, not the code.\n\n**6. Read-before-Edit TTL.** If you haven't read a file with the Read tool in the last ~5 messages, re-read it before editing. Cached file content goes stale silently when the user edits between turns.\n\n**7. Big-file rule.** For files >1000 lines, prefer Grep + scoped Read (`offset` + `limit`) over reading the entire file. Whole-file reads bloat context; targeted reads keep the working set small.\n\n**8. Todo hygiene.** Use TaskCreate for items with meaningful outcome (≥5 min, distinct deliverable). Never include operational sub-actions (linting, testing, searching, examining the codebase) as their own todos — those are sub-steps in service of higher-level tasks. Mark complete immediately when done, never in batches.\n\n**9. Literal-instruction rule.** Current frontier models follow instructions literally — they do not silently generalize from intent. Phrase requirements as explicit checklists with success criteria, not narrative.\n\n**10. Context hygiene.** Prefer `/clear` at task boundaries and `/rewind` for wrong-path detours over carrying rot forward (corrections accumulate noise; rewinds preserve the prefix and discard the bad branch). On a continuing task, run `/compact` with steering before context quality degrades. Never stop, summarize, or suggest a new session on account of context limits.\n\n**11. Autonomy calibration.** For minor choices (naming, formatting, default values, which of two equivalent approaches), pick a reasonable option and note it — don't ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; don't apply fixes until asked. Don't close a finished task with \"Want me to also…?\" — run the obvious verification, then stop cleanly.\n\n**12. Capability triggering.** When the answer depends on current or version-specific information, search or fetch before answering — never answer from memory. When work fans out across independent items (many files to read, many tests to run, many candidates to check), delegate to parallel subagents; never spawn one for work you can complete directly. For verification, prefer a fresh-context subagent over self-critique. On tasks longer than a few turns, keep a running notes file and re-read it before each phase.\n\n<constraint>\nTreat the 12 heuristics above as protocol, not preference. If a turn ends without honoring an applicable one (e.g., lint-loop guard not respected, edit without re-read), self-correct in the next turn before continuing.\n</constraint>\n\nReuse before invention: inventory existing code, components, conventions, and dependencies; extend them instead of creating a parallel pattern. Load only the narrow skills supported by the task and repository evidence. If a request establishes a new React/Tailwind system and no convention exists, prefer current shadcn/ui `base-*` components backed by Base UI; otherwise preserve the existing stack. Treat probe, production access, publish, push, release, and deploy as literal current-request effects—never infer external authority from a plan, schedule, review, or old receipt.\n\nFor Docks plan reviews, cross-company review is standing-authorized; do not ask for export consent. This never overrides a host or platform security denial.\n\nUse a narrow-to-broad verification ladder: direct acceptance while iterating, focused regressions next, and one full CI at the pre-commit or release boundary. Reuse still-matching evidence; rerun full CI only after a relevant edit invalidates it.\n\n<constraint>\nNo secrets in committed config. Treat plugin marketplaces, installers, and downloaded artifacts as untrusted until verified.\n</constraint>\n",
   "SoT/.claude/mcp-servers.json": "{\n  \"mcpServers\": {}\n}\n",
-  "SoT/.claude/settings.json": "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"minimumVersion\": \"2.1.219\",\n  \"model\": \"opus\",\n  \"effortLevel\": \"high\",\n  \"autoMemoryEnabled\": false,\n  \"autoDreamEnabled\": false,\n  \"skillListingMaxDescChars\": 2048,\n  \"respectGitignore\": true,\n  \"cleanupPeriodDays\": 14,\n  \"skillListingBudgetFraction\": 0.05,\n  \"env\": {\n    \"CLAUDE_CODE_MAX_OUTPUT_TOKENS\": \"64000\",\n    \"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR\": \"1\",\n    \"CLAUDE_CODE_AUTO_COMPACT_WINDOW\": \"468000\",\n    \"CLAUDE_CODE_NO_FLICKER\": \"1\"\n  },\n  \"permissions\": {\n    \"defaultMode\": \"auto\",\n    \"allow\": [\n      \"Read\",\n      \"Glob\",\n      \"Grep\",\n      \"WebSearch\",\n      \"Edit(./)\"\n    ],\n    \"deny\": [\n      \"Read(**/.env)\",\n      \"Read(**/.env.local)\",\n      \"Read(**/secrets/**)\",\n      \"Read(**/*.key)\",\n      \"Read(**/*.pem)\",\n      \"Read(**/*.p12)\",\n      \"Read(**/.credentials*)\",\n      \"Edit(**/.env)\",\n      \"Edit(**/.env.local)\",\n      \"Edit(**/secrets/**)\",\n      \"Bash(sudo *)\",\n      \"Bash(rm -rf /)\",\n      \"Bash(rm -rf / *)\",\n      \"Bash(rm -rf ~)\",\n      \"Bash(rm -rf ~ *)\",\n      \"Bash(rm -rf $HOME)\",\n      \"Bash(rm -rf $HOME *)\",\n      \"Bash(> /dev *)\",\n      \"Bash(dd if= *)\",\n      \"Bash(mkfs *)\",\n      \"Bash(eval *)\",\n      \"Bash(chmod 777 *)\",\n      \"Bash(chmod -R 777 *)\",\n      \"Bash(git push --force origin main *)\",\n      \"Bash(git push --force origin master *)\",\n      \"Bash(git push -f origin main *)\",\n      \"Bash(git push -f origin master *)\",\n      \"PowerShell(sudo *)\",\n      \"PowerShell(rm -rf /)\",\n      \"PowerShell(rm -rf / *)\",\n      \"PowerShell(rm -rf ~)\",\n      \"PowerShell(rm -rf ~ *)\",\n      \"PowerShell(rm -rf $HOME)\",\n      \"PowerShell(rm -rf $HOME *)\",\n      \"PowerShell(> /dev *)\",\n      \"PowerShell(dd if= *)\",\n      \"PowerShell(mkfs *)\",\n      \"PowerShell(eval *)\",\n      \"PowerShell(chmod 777 *)\",\n      \"PowerShell(chmod -R 777 *)\",\n      \"PowerShell(git push --force origin main *)\",\n      \"PowerShell(git push --force origin master *)\",\n      \"PowerShell(git push -f origin main *)\",\n      \"PowerShell(git push -f origin master *)\",\n      \"PowerShell(Remove-Item *-Recurse* /)\",\n      \"PowerShell(Remove-Item *-Recurse* / *)\",\n      \"PowerShell(Remove-Item / *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path / *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath / *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* ~)\",\n      \"PowerShell(Remove-Item *-Recurse* ~ *)\",\n      \"PowerShell(Remove-Item ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME *)\",\n      \"PowerShell(Remove-Item $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(Remove-Item $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\ *)\",\n      \"PowerShell(Remove-Item \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\ *)\",\n      \"PowerShell(Remove-Item *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* /)\",\n      \"PowerShell(del *-Recurse* / *)\",\n      \"PowerShell(del / *-Recurse*)\",\n      \"PowerShell(del -Path / *-Recurse*)\",\n      \"PowerShell(del -LiteralPath / *-Recurse*)\",\n      \"PowerShell(del *-Recurse* ~)\",\n      \"PowerShell(del *-Recurse* ~ *)\",\n      \"PowerShell(del ~ *-Recurse*)\",\n      \"PowerShell(del -Path ~ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $HOME)\",\n      \"PowerShell(del *-Recurse* $HOME *)\",\n      \"PowerShell(del $HOME *-Recurse*)\",\n      \"PowerShell(del -Path $HOME *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(del $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del *-Recurse* \\\\\\\\)\",\n      \"PowerShell(del *-Recurse* \\\\ *)\",\n      \"PowerShell(del \\\\ *-Recurse*)\",\n      \"PowerShell(del -Path \\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(del *-Recurse* *:\\\\ *)\",\n      \"PowerShell(del *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* /)\",\n      \"PowerShell(erase *-Recurse* / *)\",\n      \"PowerShell(erase / *-Recurse*)\",\n      \"PowerShell(erase -Path / *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath / *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* ~)\",\n      \"PowerShell(erase *-Recurse* ~ *)\",\n      \"PowerShell(erase ~ *-Recurse*)\",\n      \"PowerShell(erase -Path ~ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $HOME)\",\n      \"PowerShell(erase *-Recurse* $HOME *)\",\n      \"PowerShell(erase $HOME *-Recurse*)\",\n      \"PowerShell(erase -Path $HOME *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(erase $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* \\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* \\\\ *)\",\n      \"PowerShell(erase \\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path \\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* *:\\\\ *)\",\n      \"PowerShell(erase *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* /)\",\n      \"PowerShell(rd *-Recurse* / *)\",\n      \"PowerShell(rd / *-Recurse*)\",\n      \"PowerShell(rd -Path / *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* ~)\",\n      \"PowerShell(rd *-Recurse* ~ *)\",\n      \"PowerShell(rd ~ *-Recurse*)\",\n      \"PowerShell(rd -Path ~ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $HOME)\",\n      \"PowerShell(rd *-Recurse* $HOME *)\",\n      \"PowerShell(rd $HOME *-Recurse*)\",\n      \"PowerShell(rd -Path $HOME *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rd $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* \\\\ *)\",\n      \"PowerShell(rd \\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rd *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* /)\",\n      \"PowerShell(ri *-Recurse* / *)\",\n      \"PowerShell(ri / *-Recurse*)\",\n      \"PowerShell(ri -Path / *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath / *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* ~)\",\n      \"PowerShell(ri *-Recurse* ~ *)\",\n      \"PowerShell(ri ~ *-Recurse*)\",\n      \"PowerShell(ri -Path ~ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $HOME)\",\n      \"PowerShell(ri *-Recurse* $HOME *)\",\n      \"PowerShell(ri $HOME *-Recurse*)\",\n      \"PowerShell(ri -Path $HOME *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(ri $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* \\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* \\\\ *)\",\n      \"PowerShell(ri \\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path \\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* *:\\\\ *)\",\n      \"PowerShell(ri *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* /)\",\n      \"PowerShell(rm *-Recurse* / *)\",\n      \"PowerShell(rm / *-Recurse*)\",\n      \"PowerShell(rm -Path / *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* ~)\",\n      \"PowerShell(rm *-Recurse* ~ *)\",\n      \"PowerShell(rm ~ *-Recurse*)\",\n      \"PowerShell(rm -Path ~ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $HOME)\",\n      \"PowerShell(rm *-Recurse* $HOME *)\",\n      \"PowerShell(rm $HOME *-Recurse*)\",\n      \"PowerShell(rm -Path $HOME *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rm $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* \\\\ *)\",\n      \"PowerShell(rm \\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rm *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* /)\",\n      \"PowerShell(rmdir *-Recurse* / *)\",\n      \"PowerShell(rmdir / *-Recurse*)\",\n      \"PowerShell(rmdir -Path / *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* ~)\",\n      \"PowerShell(rmdir *-Recurse* ~ *)\",\n      \"PowerShell(rmdir ~ *-Recurse*)\",\n      \"PowerShell(rmdir -Path ~ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $HOME)\",\n      \"PowerShell(rmdir *-Recurse* $HOME *)\",\n      \"PowerShell(rmdir $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -Path $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rmdir $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* \\\\ *)\",\n      \"PowerShell(rmdir \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rmdir *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(Start-Process *-Verb RunAs*)\",\n      \"PowerShell(Invoke-Expression *)\",\n      \"PowerShell(iex *)\",\n      \"PowerShell(Format-Volume *)\",\n      \"PowerShell(icacls */grant*Everyone:F*)\",\n      \"PowerShell(icacls */grant*Everyone:(F)*)\"\n    ],\n    \"ask\": [\n      \"Bash(git clean *)\",\n      \"Bash(docker volume rm *)\",\n      \"Bash(docker system prune *)\",\n      \"PowerShell(git clean *)\",\n      \"PowerShell(docker volume rm *)\",\n      \"PowerShell(docker system prune *)\"\n    ]\n  },\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_SESSION_START__\"],\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"Notification\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_NOTIFY__\"],\n            \"timeout\": 10,\n            \"async\": true\n          }\n        ]\n      }\n    ],\n    \"PostToolUseFailure\": [\n      {\n        \"matcher\": \"Bash|PowerShell\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo '{\\\"hookSpecificOutput\\\":{\\\"hookEventName\\\":\\\"PostToolUseFailure\\\",\\\"additionalContext\\\":\\\"Last bash command failed. Repository / file state may have shifted \\u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\\\"}}'\",\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"SubagentStop\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"prompt\",\n            \"prompt\": \"You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\\n\\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\\n\\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \\\"Which mode do you prefer\\\", \\\"select an option\\\", \\\"no issues / problems / violations / blockers found\\\".\\n\\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \\u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\\n\\n3. BLOCK (return `{\\\"decision\\\":\\\"block\\\",\\\"reason\\\":\\\"<one-line explanation>\\\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \\\"the auth handler\\\" or \\\"near the database code\\\" are not acceptable as the only evidence.\\n\\nSubagent invocation JSON:\\n$ARGUMENTS\\n\\nReturn ONLY the JSON decision (no commentary, no markdown fences).\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  },\n  \"statusLine\": {\n    \"type\": \"command\",\n    \"command\": \"__DOCKS_KIT_STATUSLINE__\",\n    \"refreshInterval\": 5\n  },\n  \"enabledPlugins\": {\n    \"docks@docks\": true,\n    \"plan-lifecycle@docks\": true,\n    \"php-lsp@claude-plugins-official\": true,\n    \"rust-analyzer-lsp@claude-plugins-official\": true,\n    \"typescript-lsp@claude-plugins-official\": true\n  },\n  \"extraKnownMarketplaces\": {\n    \"docks\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"DocksDocks/docks\"\n      }\n    }\n  },\n  \"alwaysThinkingEnabled\": true,\n  \"showThinkingSummaries\": true,\n  \"viewMode\": \"default\",\n  \"theme\": \"dark-daltonized\",\n  \"skipDangerousModePermissionPrompt\": true\n}\n",
+  "SoT/.claude/settings.json": "{\n  \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n  \"minimumVersion\": \"2.1.280\",\n  \"model\": \"opus\",\n  \"effortLevel\": \"high\",\n  \"autoMemoryEnabled\": false,\n  \"autoDreamEnabled\": false,\n  \"skillListingMaxDescChars\": 2048,\n  \"respectGitignore\": true,\n  \"cleanupPeriodDays\": 14,\n  \"skillListingBudgetFraction\": 0.05,\n  \"env\": {\n    \"CLAUDE_CODE_MAX_OUTPUT_TOKENS\": \"64000\",\n    \"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR\": \"1\",\n    \"CLAUDE_CODE_AUTO_COMPACT_WINDOW\": \"468000\",\n    \"CLAUDE_CODE_NO_FLICKER\": \"1\"\n  },\n  \"permissions\": {\n    \"defaultMode\": \"auto\",\n    \"allow\": [\n      \"Read\",\n      \"Glob\",\n      \"Grep\",\n      \"WebSearch\",\n      \"Edit(./)\"\n    ],\n    \"deny\": [\n      \"Read(**/.env)\",\n      \"Read(**/.env.local)\",\n      \"Read(**/secrets/**)\",\n      \"Read(**/*.key)\",\n      \"Read(**/*.pem)\",\n      \"Read(**/*.p12)\",\n      \"Read(**/.credentials*)\",\n      \"Edit(**/.env)\",\n      \"Edit(**/.env.local)\",\n      \"Edit(**/secrets/**)\",\n      \"Bash(sudo *)\",\n      \"Bash(rm -rf /)\",\n      \"Bash(rm -rf / *)\",\n      \"Bash(rm -rf ~)\",\n      \"Bash(rm -rf ~ *)\",\n      \"Bash(rm -rf $HOME)\",\n      \"Bash(rm -rf $HOME *)\",\n      \"Bash(> /dev *)\",\n      \"Bash(dd if= *)\",\n      \"Bash(mkfs *)\",\n      \"Bash(eval *)\",\n      \"Bash(chmod 777 *)\",\n      \"Bash(chmod -R 777 *)\",\n      \"Bash(git push --force origin main *)\",\n      \"Bash(git push --force origin master *)\",\n      \"Bash(git push -f origin main *)\",\n      \"Bash(git push -f origin master *)\",\n      \"PowerShell(sudo *)\",\n      \"PowerShell(rm -rf /)\",\n      \"PowerShell(rm -rf / *)\",\n      \"PowerShell(rm -rf ~)\",\n      \"PowerShell(rm -rf ~ *)\",\n      \"PowerShell(rm -rf $HOME)\",\n      \"PowerShell(rm -rf $HOME *)\",\n      \"PowerShell(> /dev *)\",\n      \"PowerShell(dd if= *)\",\n      \"PowerShell(mkfs *)\",\n      \"PowerShell(eval *)\",\n      \"PowerShell(chmod 777 *)\",\n      \"PowerShell(chmod -R 777 *)\",\n      \"PowerShell(git push --force origin main *)\",\n      \"PowerShell(git push --force origin master *)\",\n      \"PowerShell(git push -f origin main *)\",\n      \"PowerShell(git push -f origin master *)\",\n      \"PowerShell(Remove-Item *-Recurse* /)\",\n      \"PowerShell(Remove-Item *-Recurse* / *)\",\n      \"PowerShell(Remove-Item / *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path / *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath / *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* ~)\",\n      \"PowerShell(Remove-Item *-Recurse* ~ *)\",\n      \"PowerShell(Remove-Item ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME)\",\n      \"PowerShell(Remove-Item *-Recurse* $HOME *)\",\n      \"PowerShell(Remove-Item $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(Remove-Item *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(Remove-Item $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* \\\\ *)\",\n      \"PowerShell(Remove-Item \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(Remove-Item *-Recurse* *:\\\\ *)\",\n      \"PowerShell(Remove-Item *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(Remove-Item -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* /)\",\n      \"PowerShell(del *-Recurse* / *)\",\n      \"PowerShell(del / *-Recurse*)\",\n      \"PowerShell(del -Path / *-Recurse*)\",\n      \"PowerShell(del -LiteralPath / *-Recurse*)\",\n      \"PowerShell(del *-Recurse* ~)\",\n      \"PowerShell(del *-Recurse* ~ *)\",\n      \"PowerShell(del ~ *-Recurse*)\",\n      \"PowerShell(del -Path ~ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $HOME)\",\n      \"PowerShell(del *-Recurse* $HOME *)\",\n      \"PowerShell(del $HOME *-Recurse*)\",\n      \"PowerShell(del -Path $HOME *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(del *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(del $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(del *-Recurse* \\\\\\\\)\",\n      \"PowerShell(del *-Recurse* \\\\ *)\",\n      \"PowerShell(del \\\\ *-Recurse*)\",\n      \"PowerShell(del -Path \\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(del *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(del *-Recurse* *:\\\\ *)\",\n      \"PowerShell(del *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(del -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* /)\",\n      \"PowerShell(erase *-Recurse* / *)\",\n      \"PowerShell(erase / *-Recurse*)\",\n      \"PowerShell(erase -Path / *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath / *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* ~)\",\n      \"PowerShell(erase *-Recurse* ~ *)\",\n      \"PowerShell(erase ~ *-Recurse*)\",\n      \"PowerShell(erase -Path ~ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $HOME)\",\n      \"PowerShell(erase *-Recurse* $HOME *)\",\n      \"PowerShell(erase $HOME *-Recurse*)\",\n      \"PowerShell(erase -Path $HOME *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(erase *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(erase $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* \\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* \\\\ *)\",\n      \"PowerShell(erase \\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path \\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(erase *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(erase *-Recurse* *:\\\\ *)\",\n      \"PowerShell(erase *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(erase -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* /)\",\n      \"PowerShell(rd *-Recurse* / *)\",\n      \"PowerShell(rd / *-Recurse*)\",\n      \"PowerShell(rd -Path / *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* ~)\",\n      \"PowerShell(rd *-Recurse* ~ *)\",\n      \"PowerShell(rd ~ *-Recurse*)\",\n      \"PowerShell(rd -Path ~ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $HOME)\",\n      \"PowerShell(rd *-Recurse* $HOME *)\",\n      \"PowerShell(rd $HOME *-Recurse*)\",\n      \"PowerShell(rd -Path $HOME *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rd *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rd $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* \\\\ *)\",\n      \"PowerShell(rd \\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rd *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rd *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rd *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rd -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* /)\",\n      \"PowerShell(ri *-Recurse* / *)\",\n      \"PowerShell(ri / *-Recurse*)\",\n      \"PowerShell(ri -Path / *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath / *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* ~)\",\n      \"PowerShell(ri *-Recurse* ~ *)\",\n      \"PowerShell(ri ~ *-Recurse*)\",\n      \"PowerShell(ri -Path ~ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $HOME)\",\n      \"PowerShell(ri *-Recurse* $HOME *)\",\n      \"PowerShell(ri $HOME *-Recurse*)\",\n      \"PowerShell(ri -Path $HOME *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(ri *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(ri $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* \\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* \\\\ *)\",\n      \"PowerShell(ri \\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path \\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(ri *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(ri *-Recurse* *:\\\\ *)\",\n      \"PowerShell(ri *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(ri -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* /)\",\n      \"PowerShell(rm *-Recurse* / *)\",\n      \"PowerShell(rm / *-Recurse*)\",\n      \"PowerShell(rm -Path / *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* ~)\",\n      \"PowerShell(rm *-Recurse* ~ *)\",\n      \"PowerShell(rm ~ *-Recurse*)\",\n      \"PowerShell(rm -Path ~ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $HOME)\",\n      \"PowerShell(rm *-Recurse* $HOME *)\",\n      \"PowerShell(rm $HOME *-Recurse*)\",\n      \"PowerShell(rm -Path $HOME *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rm *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rm $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* \\\\ *)\",\n      \"PowerShell(rm \\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rm *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rm *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rm *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rm -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* /)\",\n      \"PowerShell(rmdir *-Recurse* / *)\",\n      \"PowerShell(rmdir / *-Recurse*)\",\n      \"PowerShell(rmdir -Path / *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath / *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* ~)\",\n      \"PowerShell(rmdir *-Recurse* ~ *)\",\n      \"PowerShell(rmdir ~ *-Recurse*)\",\n      \"PowerShell(rmdir -Path ~ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath ~ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $HOME)\",\n      \"PowerShell(rmdir *-Recurse* $HOME *)\",\n      \"PowerShell(rmdir $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -Path $HOME *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $HOME *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE)\",\n      \"PowerShell(rmdir *-Recurse* $env:USERPROFILE *)\",\n      \"PowerShell(rmdir $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -Path $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath $env:USERPROFILE *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* \\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* \\\\ *)\",\n      \"PowerShell(rmdir \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath \\\\ *-Recurse*)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\\\\\)\",\n      \"PowerShell(rmdir *-Recurse* *:\\\\ *)\",\n      \"PowerShell(rmdir *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -Path *:\\\\ *-Recurse*)\",\n      \"PowerShell(rmdir -LiteralPath *:\\\\ *-Recurse*)\",\n      \"PowerShell(Start-Process *-Verb RunAs*)\",\n      \"PowerShell(Invoke-Expression *)\",\n      \"PowerShell(iex *)\",\n      \"PowerShell(Format-Volume *)\",\n      \"PowerShell(icacls */grant*Everyone:F*)\",\n      \"PowerShell(icacls */grant*Everyone:(F)*)\"\n    ],\n    \"ask\": [\n      \"Bash(git clean *)\",\n      \"Bash(docker volume rm *)\",\n      \"Bash(docker system prune *)\",\n      \"PowerShell(git clean *)\",\n      \"PowerShell(docker volume rm *)\",\n      \"PowerShell(docker system prune *)\"\n    ]\n  },\n  \"hooks\": {\n    \"SessionStart\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_SESSION_START__\"],\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"Notification\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"__DOCKS_KIT_BUN__\",\n            \"args\": [\"__DOCKS_KIT_NOTIFY__\"],\n            \"timeout\": 10,\n            \"async\": true\n          }\n        ]\n      }\n    ],\n    \"PostToolUseFailure\": [\n      {\n        \"matcher\": \"Bash|PowerShell\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"echo '{\\\"hookSpecificOutput\\\":{\\\"hookEventName\\\":\\\"PostToolUseFailure\\\",\\\"additionalContext\\\":\\\"Last bash command failed. Repository / file state may have shifted \\u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\\\"}}'\",\n            \"timeout\": 5\n          }\n        ]\n      }\n    ],\n    \"SubagentStop\": [\n      {\n        \"hooks\": [\n          {\n            \"type\": \"prompt\",\n            \"prompt\": \"You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\\n\\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\\n\\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \\\"Which mode do you prefer\\\", \\\"select an option\\\", \\\"no issues / problems / violations / blockers found\\\".\\n\\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \\u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\\n\\n3. BLOCK (return `{\\\"decision\\\":\\\"block\\\",\\\"reason\\\":\\\"<one-line explanation>\\\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \\\"the auth handler\\\" or \\\"near the database code\\\" are not acceptable as the only evidence.\\n\\nSubagent invocation JSON:\\n$ARGUMENTS\\n\\nReturn ONLY the JSON decision (no commentary, no markdown fences).\",\n            \"timeout\": 30\n          }\n        ]\n      }\n    ]\n  },\n  \"statusLine\": {\n    \"type\": \"command\",\n    \"command\": \"__DOCKS_KIT_STATUSLINE__\",\n    \"refreshInterval\": 5\n  },\n  \"enabledPlugins\": {\n    \"docks@docks\": true,\n    \"plan-lifecycle@docks\": true,\n    \"php-lsp@claude-plugins-official\": true,\n    \"rust-analyzer-lsp@claude-plugins-official\": true,\n    \"typescript-lsp@claude-plugins-official\": true\n  },\n  \"extraKnownMarketplaces\": {\n    \"docks\": {\n      \"source\": {\n        \"source\": \"github\",\n        \"repo\": \"DocksDocks/docks\"\n      }\n    }\n  },\n  \"alwaysThinkingEnabled\": true,\n  \"showThinkingSummaries\": true,\n  \"viewMode\": \"default\",\n  \"theme\": \"dark-daltonized\",\n  \"skipDangerousModePermissionPrompt\": true\n}\n",
   "SoT/.claude/bin/statusline.mjs": "/**\n * @typedef {string | number | boolean | JsonRecord | JsonArray | null | undefined} JsonValue\n * @typedef {{ [key: string]: JsonValue }} JsonRecord\n * @typedef {Array<JsonValue>} JsonArray\n * @typedef {Record<string, string | undefined> | JsonRecord | typeof process.env} EnvInput\n * @typedef {(name: string) => string | null | undefined} WhichFn\n * @typedef {object} SyncSpawnOptions\n * @property {\"ignore\" | \"pipe\" | \"inherit\"} [stdin]\n * @property {\"ignore\" | \"pipe\" | \"inherit\"} [stdout]\n * @property {\"ignore\" | \"pipe\" | \"inherit\"} [stderr]\n * @typedef {object} SyncSpawnResult\n * @property {boolean} [success]\n * @property {Buffer | string | null | undefined} [stdout]\n * @typedef {(argv: string[], options: SyncSpawnOptions) => SyncSpawnResult} SyncSpawner\n * @typedef {object} FormatStatuslineOptions\n * @property {EnvInput} [env]\n * @property {number} [nowMs]\n * @property {string} [cwd]\n * @property {string} [branch]\n * @typedef {object} StatuslineMainOptions\n * @property {() => Promise<string>} [readStdin]\n * @property {(value: string) => void} [writeStdout]\n * @property {string} [cwd]\n * @property {EnvInput} [env]\n * @property {number} [nowMs]\n * @property {WhichFn} [which]\n * @property {SyncSpawner} [spawnSync]\n */\nconst ESC = \"\\x1b[\"\nconst PIPE = `${ESC}90m | ${ESC}0m`\nconst DOT = `${ESC}90m • ${ESC}0m`\nconst DIM = `${ESC}2m${ESC}38;2;156;162;175m`\n\n/**\n * @param {object | string | number | boolean | null | undefined} value\n * @returns {value is JsonRecord}\n */\nfunction isRecord(value) {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\n/**\n * @param {JsonValue} value\n * @returns {number | undefined}\n */\nfunction finitePercentage(value) {\n  return typeof value === \"number\" && Number.isFinite(value) && value >= 0 && value <= 100\n    ? value\n    : undefined\n}\n\n/**\n * @param {number} value\n * @returns {number}\n */\nfunction roundHalfEven(value) {\n  const lower = Math.floor(value)\n  const fraction = value - lower\n  if (fraction < 0.5) return lower\n  if (fraction > 0.5) return lower + 1\n  return lower % 2 === 0 ? lower : lower + 1\n}\n\n/**\n * @param {string} path\n * @returns {string}\n */\nfunction pathBasename(path) {\n  const parts = path.split(/[\\\\/]+/).filter((part) => part !== \"\")\n  return parts.at(-1) ?? \"\"\n}\n\n/**\n * @param {JsonRecord} input\n * @returns {string}\n */\nfunction modelName(input) {\n  const model = isRecord(input.model) && typeof input.model.display_name === \"string\"\n    ? input.model.display_name\n    : \"\"\n  const suffix = model.indexOf(\" (\")\n  return suffix === -1 ? model : model.slice(0, suffix)\n}\n\n/**\n * @param {JsonRecord} input\n * @param {string} cwd\n * @returns {string}\n */\nfunction workingDirectory(input, cwd) {\n  if (isRecord(input.workspace) && typeof input.workspace.current_dir === \"string\" && input.workspace.current_dir !== \"\") {\n    return input.workspace.current_dir\n  }\n  if (typeof input.cwd === \"string\" && input.cwd !== \"\") return input.cwd\n  return cwd\n}\n\n/**\n * @param {EnvInput} env\n * @param {number} total\n * @returns {number}\n */\nfunction compactWindow(env, total) {\n  const raw = env.CLAUDE_CODE_AUTO_COMPACT_WINDOW\n  if (typeof raw !== \"string\" || !/^[0-9]+$/.test(raw)) return total\n  const parsed = Number(raw)\n  return Number.isSafeInteger(parsed) && parsed >= 1000 && parsed < total ? parsed : total\n}\n\n/**\n * @param {number} value\n * @returns {string}\n */\nfunction formatTokensK(value) {\n  if (value < 1000) return `${value}k`\n  if (value % 1000 === 0) return `${value / 1000}M`\n  return `${(roundHalfEven(value / 100) / 10).toFixed(1)}M`\n}\n\n/**\n * @param {JsonRecord} input\n * @param {EnvInput} env\n * @returns {string}\n */\nfunction contextSegment(input, env) {\n  if (!isRecord(input.context_window)) return \"\"\n  const used = finitePercentage(input.context_window.used_percentage)\n  if (used === undefined) return \"\"\n\n  const total = input.context_window.context_window_size\n  if (typeof total !== \"number\" || !Number.isFinite(total) || total <= 0) {\n    return `${ESC}38;2;130;160;230mctx ${roundHalfEven(used)}%${ESC}0m`\n  }\n\n  const usedK = roundHalfEven((used / 100) * (total / 1000))\n  const effectiveK = Math.trunc(compactWindow(env, total) / 1000)\n  if (effectiveK <= 0) return `${ESC}38;2;130;160;230mctx ${roundHalfEven(used)}%${ESC}0m`\n  const effectivePercentage = roundHalfEven((usedK / effectiveK) * 100)\n  return `${ESC}38;2;130;160;230mctx ${effectivePercentage}%${ESC}0m ${DIM}(${formatTokensK(usedK)}/${formatTokensK(effectiveK)})${ESC}0m`\n}\n\n/**\n * @param {JsonValue} value\n * @param {number} nowMs\n * @returns {string}\n */\nfunction resetDelta(value, nowMs) {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) return \"\"\n  const seconds = Math.trunc(value) - Math.floor(nowMs / 1000)\n  if (seconds <= 0) return \"now\"\n  const days = Math.trunc(seconds / 86_400)\n  if (days > 0) return `${days}d`\n  const hours = Math.trunc((seconds % 86_400) / 3_600)\n  if (hours > 0) return `${hours}h`\n  return `${Math.trunc((seconds % 3_600) / 60)}m`\n}\n\n/**\n * @param {JsonValue} value\n * @param {string} label\n * @param {string} color\n * @param {number} nowMs\n * @returns {string}\n */\nfunction quotaWindow(value, label, color, nowMs) {\n  if (!isRecord(value)) return \"\"\n  const used = finitePercentage(value.used_percentage)\n  if (used === undefined) return \"\"\n  const delta = resetDelta(value.resets_at, nowMs)\n  const reset = delta === \"\" ? \"\" : ` ${DIM}(${delta})${ESC}0m`\n  return `${ESC}38;2;${color}m${label} ${roundHalfEven(used)}%${ESC}0m${reset}`\n}\n\n/**\n * @param {SyncSpawnResult | null | undefined} result\n * @returns {string}\n */\nfunction decodeStdout(result) {\n  const stdout = result?.stdout\n  if (stdout === undefined || stdout === null) return \"\"\n  return typeof stdout === \"string\" ? stdout : stdout.toString()\n}\n\n/**\n * @param {string} directory\n * @param {WhichFn} which\n * @param {SyncSpawner} spawnSync\n * @returns {string}\n */\nfunction resolveBranch(directory, which, spawnSync) {\n  const git = which(\"git\")\n  if (typeof git !== \"string\" || git === \"\") return \"\"\n  const commands = [\n    [git, \"-C\", directory, \"symbolic-ref\", \"--short\", \"HEAD\"],\n    [git, \"-C\", directory, \"rev-parse\", \"--short\", \"HEAD\"]\n  ]\n  for (const command of commands) {\n    try {\n      const result = spawnSync(command, { stdin: \"ignore\", stdout: \"pipe\", stderr: \"ignore\" })\n      if (result?.success === true) return decodeStdout(result).trim()\n    } catch {\n      return \"\"\n    }\n  }\n  return \"\"\n}\n\n/**\n * @param {JsonRecord} input\n * @param {FormatStatuslineOptions} [options]\n * @returns {string}\n */\nexport function formatStatusline(input, options = {}) {\n  if (!isRecord(input)) return \"\"\n  const env = isRecord(options.env) ? options.env : process.env\n  const nowMs = typeof options.nowMs === \"number\" ? options.nowMs : Date.now()\n  const cwd = typeof options.cwd === \"string\" ? options.cwd : process.cwd()\n  const branch = typeof options.branch === \"string\" ? options.branch : \"\"\n  const directory = workingDirectory(input, cwd)\n\n  const model = `${ESC}38;5;208m${ESC}1m${modelName(input)}${ESC}22m${ESC}0m`\n  const folder = `${ESC}1m${ESC}38;2;76;208;222m${pathBasename(directory)}${ESC}22m${ESC}0m`\n  const branchSegment = branch === \"\" ? \"\" : `${DOT}${ESC}1m${ESC}38;2;192;103;222m${branch}${ESC}22m${ESC}0m`\n  const context = contextSegment(input, env)\n\n  const rateLimits = isRecord(input.rate_limits) ? input.rate_limits : undefined\n  const fiveHour = quotaWindow(rateLimits?.five_hour, \"5h\", \"100;200;200\", nowMs)\n  const sevenDay = quotaWindow(rateLimits?.seven_day, \"7d\", \"230;180;90\", nowMs)\n  const quota = fiveHour === \"\" && sevenDay === \"\"\n    ? \"\"\n    : `${PIPE}${fiveHour}${fiveHour !== \"\" && sevenDay !== \"\" ? DOT : \"\"}${sevenDay}`\n\n  return `${model}${PIPE}${folder}${branchSegment}${context === \"\" ? \"\" : `${PIPE}${context}`}${quota}`\n}\n\n/**\n * @param {StatuslineMainOptions} [options]\n * @returns {Promise<number>}\n */\nexport async function main(options = {}) {\n  const readStdin = options.readStdin ?? (() => Bun.stdin.text())\n  const writeStdout = options.writeStdout ?? ((value) => process.stdout.write(value))\n  let raw\n  try {\n    raw = await readStdin()\n  } catch {\n    return 0\n  }\n\n  let input\n  try {\n    input = JSON.parse(raw)\n  } catch {\n    return 0\n  }\n  if (!isRecord(input)) return 0\n\n  const cwd = typeof options.cwd === \"string\" ? options.cwd : process.cwd()\n  const directory = workingDirectory(input, cwd)\n  const branch = resolveBranch(\n    directory,\n    options.which ?? ((name) => Bun.which(name)),\n    options.spawnSync ?? ((argv, spawnOptions) => Bun.spawnSync(argv, spawnOptions))\n  )\n  const output = formatStatusline(input, {\n    env: options.env ?? process.env,\n    nowMs: options.nowMs ?? Date.now(),\n    cwd,\n    branch\n  })\n  if (output !== \"\") writeStdout(`${output}\\n`)\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
   "SoT/.claude/bin/session-start.mjs": "/**\n * @typedef {string | number | boolean | JsonRecord | JsonArray | null | undefined} JsonValue\n * @typedef {{ [key: string]: JsonValue }} JsonRecord\n * @typedef {Array<JsonValue>} JsonArray\n * @typedef {Record<string, string | undefined> | JsonRecord} EnvInput\n * @typedef {object} SessionStartOptions\n * @property {EnvInput} [env]\n * @property {Date} [now]\n * @property {string} [home]\n * @property {(path: string) => string} [readText]\n * @property {(value: string) => void} [writeStdout]\n */\nimport { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\n\n/**\n * @param {object | string | number | boolean | null | undefined} value\n * @returns {value is JsonRecord}\n */\nfunction isRecord(value) {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\n/**\n * @param {JsonValue} value\n * @param {string} fallback\n * @returns {string}\n */\nfunction nonEmpty(value, fallback) {\n  return typeof value === \"string\" && value !== \"\" ? value : fallback\n}\n\n/**\n * @param {number} value\n * @returns {string}\n */\nfunction pad(value) {\n  return String(value).padStart(2, \"0\")\n}\n\n/**\n * @param {string} home\n * @param {(path: string) => string} readText\n * @returns {string}\n */\nfunction configuredEffort(home, readText) {\n  try {\n    const parsed = JSON.parse(readText(`${home}/.claude/settings.json`))\n    return isRecord(parsed) ? nonEmpty(parsed.effortLevel, \"default\") : \"default\"\n  } catch {\n    return \"default\"\n  }\n}\n\n/**\n * @param {Date} now\n * @returns {string}\n */\nfunction localZone(now) {\n  const part = new Intl.DateTimeFormat(\"en-US\", { timeZoneName: \"short\" })\n    .formatToParts(now)\n    .find((value) => value.type === \"timeZoneName\")\n  return part?.value ?? \"\"\n}\n\n/**\n * @param {SessionStartOptions} [options]\n * @returns {string[]}\n */\nexport function sessionStartLines(options = {}) {\n  const env = isRecord(options.env) ? options.env : process.env\n  const now = options.now instanceof Date ? options.now : new Date()\n  const home = typeof options.home === \"string\" ? options.home : homedir()\n  const readText = options.readText ?? ((path) => readFileSync(path, \"utf8\"))\n  const weekday = new Intl.DateTimeFormat(\"en-US\", { weekday: \"long\" }).format(now)\n  const date = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`\n  const time = `${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}`\n  const effort = nonEmpty(env.CLAUDE_CODE_EFFORT_LEVEL, configuredEffort(home, readText))\n  const context = env.CLAUDE_CODE_DISABLE_1M_CONTEXT === \"1\" ? \"200K\" : \"1M\"\n  const compactWindow = nonEmpty(env.CLAUDE_CODE_AUTO_COMPACT_WINDOW, \"full\")\n  const subagent = nonEmpty(env.CLAUDE_CODE_SUBAGENT_MODEL, \"default\")\n  return [\n    `[CONTEXT] Current date: ${weekday}, ${date} ${time} ${localZone(now)}`,\n    `[CONFIG] Context: ${context} | Compact-window: ${compactWindow} | Effort: ${effort} | Thinking: adaptive | Subagent: ${subagent}`\n  ]\n}\n\n/**\n * @param {SessionStartOptions} [options]\n * @returns {Promise<number>}\n */\nexport async function main(options = {}) {\n  const writeStdout = options.writeStdout ?? ((value) => process.stdout.write(value))\n  const output = {\n    hookSpecificOutput: {\n      hookEventName: \"SessionStart\",\n      additionalContext: sessionStartLines(options).join(\"\\n\")\n    }\n  }\n  writeStdout(`${JSON.stringify(output)}\\n`)\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
   "SoT/.claude/bin/notify.mjs": "/**\n * @typedef {(name: string) => string | null | undefined} WhichFn\n * @typedef {(path: string) => Promise<boolean>} FileExistsFn\n * @typedef {object} QuietSpawnOptions\n * @property {\"ignore\" | \"pipe\" | \"inherit\"} [stdin]\n * @property {\"ignore\" | \"pipe\" | \"inherit\"} [stdout]\n * @property {\"ignore\" | \"pipe\" | \"inherit\"} [stderr]\n * @typedef {(argv: string[], options: QuietSpawnOptions) => void} QuietSpawner\n * @typedef {object} PlayerOptions\n * @property {string} [platform]\n * @property {string} [sound]\n * @property {WhichFn} [which]\n * @typedef {object} NotifyOptions\n * @property {string} [platform]\n * @property {string} [sound]\n * @property {WhichFn} [which]\n * @property {FileExistsFn} [fileExists]\n * @property {QuietSpawner} [spawnSync]\n */\nconst DEFAULT_SOUND = `${import.meta.dir}/../notification.mp3`\n\n/**\n * @param {PlayerOptions} [options]\n * @returns {string[] | undefined}\n */\nexport function selectPlayer(options = {}) {\n  const platform = options.platform ?? process.platform\n  const sound = options.sound ?? DEFAULT_SOUND\n  const which = options.which ?? ((name) => Bun.which(name))\n  if (platform === \"darwin\") {\n    const afplay = which(\"afplay\")\n    if (typeof afplay === \"string\" && afplay !== \"\") return [afplay, sound]\n  }\n  const ffplay = which(\"ffplay\")\n  if (typeof ffplay === \"string\" && ffplay !== \"\") {\n    return [ffplay, \"-nodisp\", \"-autoexit\", \"-loglevel\", \"quiet\", sound]\n  }\n  const paplay = which(\"paplay\")\n  if (typeof paplay === \"string\" && paplay !== \"\") return [paplay, sound]\n  const aplay = which(\"aplay\")\n  if (typeof aplay === \"string\" && aplay !== \"\") return [aplay, \"-q\", sound]\n  return undefined\n}\n\n/**\n * @param {NotifyOptions} [options]\n * @returns {Promise<number>}\n */\nexport async function main(options = {}) {\n  const sound = options.sound ?? DEFAULT_SOUND\n  const fileExists = options.fileExists ?? ((path) => Bun.file(path).exists())\n  if (!await fileExists(sound)) return 0\n  const command = selectPlayer({ ...options, sound })\n  if (command === undefined) return 0\n  const spawnSync = options.spawnSync ?? ((argv, spawnOptions) => Bun.spawnSync(argv, spawnOptions))\n  spawnSync(command, { stdin: \"ignore\", stdout: \"ignore\", stderr: \"ignore\" })\n  return 0\n}\n\nif (import.meta.main) process.exit(await main())\n",
   "SoT/.codex/AGENTS.md": "# AGENTS.md\n\n## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- Upgrading or migrating between versions.\n- Any task where relying on memory could cause stale syntax or behavior.\n\nDo not:\n- Assume API signatures, method names, or config options from memory.\n- Generate framework code without checking current docs first.\n- Skip research because the library seems familiar.\n\n<constraint>\nResearch the codebase before editing. Never change code you have not read.\n</constraint>\n\n## Agentic Harness Heuristics\n\nModel-agnostic operating rules for coding-agent work.\n\n1. Persistence. Keep going until the user's request is actually handled. Only yield when the problem is solved or a concrete blocker is identified. Resolve in the fewest useful tool loops — once you can answer the core request with evidence, answer. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done, do that work now.\n2. Default to parallel. When multiple reads, searches, inspections, or independent checks can run without depending on each other, run them together.\n3. Multi-pass search. First-pass search often misses — vary the wording before concluding something does not exist.\n4. Trace symbols. Before modifying a symbol, trace its definition and usages. Do not infer behavior from one call site.\n5. Linter-loop 3-strike rule. Do not loop more than 3 times fixing the same lint/test failure without reassessing the diagnosis.\n6. Read-before-edit TTL. If you have not read a file recently, re-read it before editing. User edits can make cached context stale.\n7. Big-file rule. For files over 1000 lines, prefer targeted search plus scoped reads over whole-file reads.\n8. Task hygiene. Track meaningful deliverables, not operational sub-steps. Mark work complete as soon as it is done.\n9. Literal-instruction rule. Treat explicit user requirements as checklists with success criteria. Do not silently broaden scope.\n10. Context hygiene. Prefer a fresh session at task boundaries over carrying stale context; preserve useful state before quality decays. Never stop, summarize, or suggest a new session on account of context limits.\n11. Autonomy calibration. For minor choices (naming, formatting, defaults, equivalent approaches), pick a reasonable option and note it — do not ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; do not apply fixes until asked.\n12. Capability triggering. Search or fetch current documentation when the answer depends on current or version-specific information. When work fans out across independent items, parallelize or delegate; never delegate work you can complete directly. For verification, prefer a fresh-context check over self-critique. On long tasks, keep running notes and re-read them between phases.\n\n<constraint>\nTreat these heuristics as protocol. If a turn violates an applicable rule, self-correct before continuing.\n</constraint>\n\nReuse before invention: inventory existing code, components, conventions, and dependencies; extend them instead of creating a parallel pattern. Load only the narrow skills supported by the task and repository evidence. If a request establishes a new React/Tailwind system and no convention exists, prefer current shadcn/ui `base-*` components backed by Base UI; otherwise preserve the existing stack. Treat probe, production access, publish, push, release, and deploy as literal current-request effects—never infer external authority from a plan, schedule, review, or old receipt.\n\nFor Docks plan reviews, cross-company review is standing-authorized; do not ask for export consent. This never overrides a host or platform security denial.\n\nUse a narrow-to-broad verification ladder: direct acceptance while iterating, focused regressions next, and one full CI at the pre-commit or release boundary. Reuse still-matching evidence; rerun full CI only after a relevant edit invalidates it.\n\n<constraint>\nNo secrets in committed config. Treat plugin marketplaces, installers, and downloaded artifacts as untrusted until verified.\n</constraint>\n",
-  "SoT/.codex/config.toml": "model = \"gpt-5.6-sol\"\nmodel_reasoning_effort = \"high\"\nplan_mode_reasoning_effort = \"high\"\nmodel_reasoning_summary = \"concise\"\nmodel_verbosity = \"low\"\npersonality = \"pragmatic\"\nweb_search = \"live\"\nproject_doc_max_bytes = 131072\napproval_policy = \"on-request\"\nsandbox_mode = \"workspace-write\"\napprovals_reviewer = \"auto_review\"\n\n[sandbox_workspace_write]\nnetwork_access = true\n\n[windows]\nsandbox = \"elevated\"\n\n[features]\nmemories = true\n\n[memories]\ndedicated_tools = true\nmax_rollout_age_days = 30\n\n[agents]\nmax_threads = 12\nmax_depth = 2\n\n[tui]\nstatus_line_use_colors = true\nstatus_line = [\n  \"model-with-reasoning\",\n  \"current-dir\",\n  \"git-branch\",\n  \"context-used\",\n  \"five-hour-limit\",\n  \"weekly-limit\",\n]\n\n[plugins.\"docks@docks\"]\nenabled = true\n\n[plugins.\"plan-lifecycle@docks\"]\nenabled = true\n",
+  "SoT/.codex/config.toml": "model = \"gpt-6-sol\"\nmodel_reasoning_effort = \"high\"\nplan_mode_reasoning_effort = \"high\"\nmodel_reasoning_summary = \"concise\"\nmodel_verbosity = \"low\"\npersonality = \"pragmatic\"\nweb_search = \"live\"\nproject_doc_max_bytes = 131072\napproval_policy = \"on-request\"\nsandbox_mode = \"workspace-write\"\napprovals_reviewer = \"auto_review\"\n\n[sandbox_workspace_write]\nnetwork_access = true\n\n[windows]\nsandbox = \"elevated\"\n\n[features]\nmemories = true\n\n[memories]\ndedicated_tools = true\nmax_rollout_age_days = 30\n\n[agents]\nmax_threads = 12\nmax_depth = 2\n\n[tui]\nstatus_line_use_colors = true\nstatus_line = [\n  \"model-with-reasoning\",\n  \"current-dir\",\n  \"git-branch\",\n  \"context-used\",\n  \"five-hour-limit\",\n  \"weekly-limit\",\n]\n\n[plugins.\"docks@docks\"]\nenabled = true\n\n[plugins.\"plan-lifecycle@docks\"]\nenabled = true\n",
   "SoT/.codex/plugins/marketplace.json": "{\n  \"name\": \"docks\",\n  \"interface\": {\n    \"displayName\": \"DocksDocks\"\n  },\n  \"plugins\": [\n    {\n      \"name\": \"docks\",\n      \"source\": {\n        \"source\": \"git-subdir\",\n        \"url\": \"https://github.com/DocksDocks/docks.git\",\n        \"path\": \"./plugins/docks\",\n        \"ref\": \"main\"\n      },\n      \"policy\": {\n        \"installation\": \"AVAILABLE\",\n        \"authentication\": \"ON_INSTALL\"\n      },\n      \"category\": \"Productivity\"\n    },\n    {\n      \"name\": \"plan-lifecycle\",\n      \"source\": {\n        \"source\": \"git-subdir\",\n        \"url\": \"https://github.com/DocksDocks/docks.git\",\n        \"path\": \"./plugins/plan-lifecycle\",\n        \"ref\": \"main\"\n      },\n      \"policy\": {\n        \"installation\": \"AVAILABLE\",\n        \"authentication\": \"ON_INSTALL\"\n      },\n      \"category\": \"Productivity\"\n    }\n  ]\n}\n",
   "SoT/.codex/rules/docks.rules": "prefix_rule(pattern=[\"pwd\"], decision=\"allow\")\nprefix_rule(pattern=[\"ls\"], decision=\"allow\")\nprefix_rule(pattern=[\"cat\"], decision=\"allow\")\nprefix_rule(pattern=[\"head\"], decision=\"allow\")\nprefix_rule(pattern=[\"tail\"], decision=\"allow\")\nprefix_rule(pattern=[\"wc\"], decision=\"allow\")\nprefix_rule(pattern=[\"nl\"], decision=\"allow\")\nprefix_rule(pattern=[\"grep\"], decision=\"allow\")\nprefix_rule(pattern=[\"sort\"], decision=\"allow\")\nprefix_rule(pattern=[\"uniq\"], decision=\"allow\")\nprefix_rule(pattern=[\"diff\"], decision=\"allow\")\nprefix_rule(pattern=[\"which\"], decision=\"allow\")\nprefix_rule(pattern=[\"date\"], decision=\"allow\")\nprefix_rule(pattern=[\"basename\"], decision=\"allow\")\nprefix_rule(pattern=[\"dirname\"], decision=\"allow\")\nprefix_rule(pattern=[\"realpath\"], decision=\"allow\")\nprefix_rule(pattern=[\"readlink\"], decision=\"allow\")\nprefix_rule(pattern=[\"jq\"], decision=\"allow\")\nprefix_rule(pattern=[\"tree\"], decision=\"allow\")\nprefix_rule(pattern=[\"cut\"], decision=\"allow\")\nprefix_rule(pattern=[\"tr\"], decision=\"allow\")\nprefix_rule(pattern=[\"echo\"], decision=\"allow\")\nprefix_rule(pattern=[\"printf\"], decision=\"allow\")\nprefix_rule(pattern=[\"printenv\"], decision=\"allow\")\nprefix_rule(pattern=[\"uname\"], decision=\"allow\")\nprefix_rule(pattern=[\"file\"], decision=\"allow\")\nprefix_rule(pattern=[\"stat\"], decision=\"allow\")\nprefix_rule(pattern=[\"du\"], decision=\"allow\")\nprefix_rule(pattern=[\"id\"], decision=\"allow\")\nprefix_rule(pattern=[\"whoami\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"git\", \"status\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"diff\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"log\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"show\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"blame\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"rev-parse\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"ls-files\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"grep\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"ls-tree\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"branch\", \"--show-current\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"branch\", \"-vv\"], decision=\"allow\")\nprefix_rule(pattern=[\"git\", \"mv\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"gh\", \"pr\", \"view\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"list\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"diff\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"status\"], decision=\"allow\")\nprefix_rule(pattern=[\"gh\", \"pr\", \"checks\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"docker\", \"ps\"], decision=\"allow\")\n\nprefix_rule(pattern=[\"git\", \"push\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"reset\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"clean\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"merge\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"rebase\"], decision=\"prompt\")\nprefix_rule(pattern=[\"git\", \"checkout\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"mv\"], decision=\"prompt\")\nprefix_rule(pattern=[\"chmod\"], decision=\"prompt\")\nprefix_rule(pattern=[\"chown\"], decision=\"prompt\")\nprefix_rule(pattern=[\"kill\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pkill\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"npm\", \"install\"], decision=\"prompt\")\nprefix_rule(pattern=[\"npm\", \"uninstall\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pnpm\", \"add\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pnpm\", \"remove\"], decision=\"prompt\")\nprefix_rule(pattern=[\"yarn\", \"add\"], decision=\"prompt\")\nprefix_rule(pattern=[\"yarn\", \"remove\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip\", \"install\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip\", \"uninstall\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip3\", \"install\"], decision=\"prompt\")\nprefix_rule(pattern=[\"pip3\", \"uninstall\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"docker\", \"run\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"stop\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"volume\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"system\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"up\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"down\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker\", \"compose\", \"stop\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"up\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"down\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"rm\"], decision=\"prompt\")\nprefix_rule(pattern=[\"docker-compose\", \"stop\"], decision=\"prompt\")\n\n# `tail -f`/`--follow` never returns and hangs the agent (bare `tail` stays allowed above).\nprefix_rule(pattern=[\"tail\", \"-f\"], decision=\"prompt\")\nprefix_rule(pattern=[\"tail\", \"--follow\"], decision=\"prompt\")\n# rg and `sed -n` are prompt, NOT allow: argv-prefix matching cannot gate their\n# code-exec forms (rg --pre=CMD or a reordered --pre; sed -n 'e CMD' / -ni) while a\n# shorter allow prefix would auto-approve the whole command.\nprefix_rule(pattern=[\"rg\"], decision=\"prompt\")\nprefix_rule(pattern=[\"sed\", \"-n\"], decision=\"prompt\")\nprefix_rule(pattern=[\"find\"], decision=\"prompt\")\nprefix_rule(pattern=[\"sed\", \"-i\"], decision=\"prompt\")\nprefix_rule(pattern=[\"sed\", \"--in-place\"], decision=\"prompt\")\nprefix_rule(pattern=[\"awk\"], decision=\"prompt\")\nprefix_rule(pattern=[\"xargs\"], decision=\"prompt\")\nprefix_rule(pattern=[\"tee\"], decision=\"prompt\")\nprefix_rule(pattern=[\"curl\"], decision=\"prompt\")\nprefix_rule(pattern=[\"env\"], decision=\"prompt\")\n\nprefix_rule(pattern=[\"sudo\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"eval\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"mkfs\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"dd\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"--force\", \"origin\", \"main\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"--force\", \"origin\", \"master\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"-f\", \"origin\", \"main\"], decision=\"forbidden\")\nprefix_rule(pattern=[\"git\", \"push\", \"-f\", \"origin\", \"master\"], decision=\"forbidden\")\n",
   "SoT/.omp/AGENTS.md": "# Global OMP guidance\n\n- Verify unfamiliar or version-sensitive APIs and configuration against current official documentation before implementation.\n- When the user asks for an assessment rather than a change, report findings without editing.\n- For Docks plan reviews, cross-company review is standing-authorized; host security policy still applies.\n- Please remove all mannered prose.\n\n## Asking me things\n\nA question typed in prose is just text I may or may not act on. The `ask` tool renders a\nblocking picker, waits indefinitely (`ask.timeout = 0`), and records my answer in the\ntranscript. If you actually need an answer, it MUST go through `ask`.\n\nMUST use `ask` before:\n- Anything irreversible or destructive: deleting/overwriting files or data you did not create,\n  force-push, history rewrite, dropping tables, running migrations, mass rename, touching\n  secrets/credentials, or publishing outward (release, upstream PR, issue, comment).\n- Two or more viable approaches whose tradeoffs are mine to own: schema/API/protocol shape,\n  adding a dependency, or establishing a convention this repo does not already have.\n- A fact only I hold: intended semantics of an ambiguous requirement, which of several\n  conflicting existing patterns is canonical, or which environment/account/target to use.\n- A request that contradicts the repo: surface the conflict and let me resolve it; never\n  silently pick one side.\n\nIf `ask` is not registered — subagent, headless, or `-p` print runs, where `hasUI` is false —\nthe MUST above cannot be satisfied: do not fabricate the call and do not stall on it. Take the\nconservative reversible option and put the question, plus the assumption you made, in your\nfinal report so whoever spawned you can decide.\n\nNEVER use `ask` for:\n- Permission to begin, or to confirm scope already stated in the request.\n- Anything a tool, grep, or doc can answer — go read it.\n- A cheap reversible choice — take the conservative option and say which you took.\n- Something already answered earlier in the conversation.\n\nBatch every open question into one `ask` call with multiple questions; do not serialize\nround trips. Being overruled ends the discussion — execute my call without relitigating.\n\n## Output Standard\n\nApply Simplified Technical English to all agent text. This includes responses, messages,\ndocumentation, comments, and interface text.\n\nReply in the language I use, and apply every rule below to that language.\n\nA rule that names English grammar applies only to English. The contraction ban is one\nsuch rule. In another language, follow the normal grammar of that language. Portuguese,\nSpanish, French, Italian, and German merge a preposition with an article, and that merge\nis required, not optional.\n\nTreat the word limits as approximate outside English. Some languages need more words to\ncarry the same content.\n\n- Use the simplest precise technical term.\n- Use each term consistently.\n- Expand an abbreviation at its first occurrence.\n- Explain a technical term when I ask for an explanation.\n- Write complete and grammatically correct sentences.\n- Use active voice and identify the actor.\n- Use the imperative form for instructions.\n- Put only one action in each instruction sentence.\n- Put a necessary condition before its instruction.\n- Use simple verb tenses.\n- Do not use contractions, idioms, or slang. Avoid humor and rhetorical questions.\n- Keep procedural sentences to 20 words or fewer.\n- Keep descriptive sentences to 25 words or fewer.\n- Keep each paragraph to one topic and six sentences or fewer.\n- Do not use more than three nouns together.\n- Use vertical lists for complex information.\n- Put a warning or caution before a related hazardous instruction.\n\n### Naming\n\n- Say what the thing does before you name it. Put the technical term after the plain\n  description, once, in parentheses.\n- Do not use a technical term as the only name for something you just introduced.\n- Prefer the short common word. Use \"use\", not \"utilize\". Use \"set up\", not \"provision\".\n- Do not explain by metaphor alone. A metaphor may follow a literal statement.\n",
-  "SoT/.omp/config.yml": "statusLine:\n  compactThinkingLevel: false\n\ndefaultThinkingLevel: high\n\ncycleOrder:\n  - smol\n  - default\n  - slow\n  - fable\n  - astra\n\ntier:\n  openai: none\n  anthropic: none\n\nadvisor:\n  enabled: true\n  syncBacklog: \"1\"\n\ngithub:\n  enabled: true\n\nfind:\n  enabled: true\n\ntask:\n  eager: always\n  showResolvedModelBadge: true\n  softRequestBudget: 200\n  softRequestBudgetNotice: true\n  batch: true\n  enableLsp: true\n  enableEffort: true\n  maxEffort: max\n  maxConcurrency: 16\n  maxRecursionDepth: 2\n  maxRuntimeMs: 3600000\n  agentModelOverrides:\n    reviewer: \"@task\"\n    security-reviewer: \"@task\"\n    code-reviewer: \"@task\"\n    plan-reviewer: \"@task\"\n\nmodelRoles:\n  smol: openai-codex/gpt-5.6-luna:medium\n  advisor: openai-codex/gpt-5.6-sol:medium\n  designer: anthropic/claude-opus-5:high\n  plan: anthropic/claude-opus-5:xhigh\n  commit: openai-codex/gpt-5.6-luna:medium\n  task: openai-codex/gpt-5.6-sol:high\n  vision: anthropic/claude-opus-5:medium\n  tiny: openai-codex/gpt-5.6-luna:low\n  default: anthropic/claude-opus-5:high\n  slow: anthropic/claude-opus-5:xhigh\n  fable: anthropic/claude-fable-5-1:medium\n  switch_fable: anthropic/claude-fable-5-1:medium\n  astra: openai-codex/gpt-6-astra:xhigh\n  web: web/firecrawl\n\nmodelTags:\n  fable:\n    name: Fable 5.1\n  switch_fable:\n    name: Fable switch default\n    hidden: true\n  astra:\n    name: GPT-6 Astra\n\ndisplay:\n  showTokenUsage: true\n\nproviders:\n  anthropic:\n    serverSideFallback: false\n  fetch: auto\n  webSearchTimeoutSeconds: 30\n\nretry:\n  usageAwareFallback: true\n  fallbackChains:\n    default:\n      - openai-codex/gpt-5.6-sol:high\n    advisor:\n      - anthropic/claude-opus-5:medium\n    task:\n      - anthropic/claude-opus-5:high\n    vision:\n      - openai-codex/gpt-5.6-sol:medium\n    smol:\n      - anthropic/claude-opus-5:low\n    tiny:\n      - anthropic/claude-opus-5:low\n    commit:\n      - anthropic/claude-opus-5:medium\n    switch_fable: []\n    fable:\n      - openai-codex/gpt-6-astra:xhigh\n    astra:\n      - anthropic/claude-fable-5-1:medium\n    web:\n      - web/exa\n      - web/perplexity\n      - google/gemini-2.5-flash\n      - openai-codex/gpt-5.6-luna\n      - web/parallel\n      - google-antigravity/gemini-2.5-flash\n      - anthropic/claude-haiku-4-5\n      - openai-codex/gpt-5.6\n      - openai-codex/gpt-5.5\n      - xai/grok-4.5\n      - xai-oauth/grok-4.5\n      - web/zai\n      - web/tinyfish\n      - web/jina\n      - web/kagi\n      - web/tavily\n      - web/brave\n      - web/kimi\n      - web/synthetic\n      - web/ollama\n      - web/searxng\n      - web/startpage\n      - web/duckduckgo\n      - web/ecosia\n      - web/google\n      - web/mojeek\n      - web/public\n\nincludeWorkspaceTree: false\n\nbranchSummary:\n  enabled: true\n\ncommands:\n  enableOpencodeProject: false\n  enableOpencodeUser: false\n\nskills:\n  enableClaudeUser: false\n  enableCodexUser: false\n  enableAgentsUser: true\n\nsteeringMode: all\n\ndev:\n  autoqa: false\n  autoqaConsent: denied\n\ncompaction:\n  thresholdTokens: -1\n  idleEnabled: true\n  handoffSaveToDisk: true\n\ndoubleEscapeAction: tree\ntextVerbosity: low\n\nfeatures:\n  unexpectedStopDetection: smart\n\ncodexResets:\n  autoRedeem: \"no\"\n\nstartup:\n  quiet: true\n\ntools:\n  approvalMode: yolo\n",
+  "SoT/.omp/config.yml": "statusLine:\n  compactThinkingLevel: false\n\ndefaultThinkingLevel: high\n\ncycleOrder:\n  - smol\n  - default\n  - slow\n  - fable\n  - astra\n\ntier:\n  openai: none\n  anthropic: none\n\nadvisor:\n  enabled: true\n  syncBacklog: \"1\"\n\ngithub:\n  enabled: true\n\nfind:\n  enabled: true\n\ntask:\n  eager: always\n  showResolvedModelBadge: true\n  softRequestBudget: 200\n  softRequestBudgetNotice: true\n  batch: true\n  enableLsp: true\n  enableEffort: true\n  maxEffort: max\n  maxConcurrency: 16\n  maxRecursionDepth: 2\n  maxRuntimeMs: 3600000\n  agentModelOverrides:\n    reviewer: \"@task\"\n    security-reviewer: \"@task\"\n    code-reviewer: \"@task\"\n    plan-reviewer: \"@task\"\n\nmodelRoles:\n  smol: openai-codex/gpt-6-luna:medium\n  advisor: openai-codex/gpt-6-sol:medium\n  designer: anthropic/claude-opus-5-5:high\n  plan: anthropic/claude-opus-5-5:xhigh\n  commit: openai-codex/gpt-6-luna:medium\n  task: openai-codex/gpt-6-sol:high\n  vision: anthropic/claude-opus-5-5:medium\n  tiny: openai-codex/gpt-6-luna:low\n  default: anthropic/claude-opus-5-5:high\n  slow: anthropic/claude-opus-5-5:xhigh\n  fable: anthropic/claude-fable-5-1:medium\n  switch_fable: anthropic/claude-fable-5-1:medium\n  astra: openai-codex/gpt-6-astra:xhigh\n  web: web/firecrawl\n\nmodelTags:\n  fable:\n    name: Fable 5.1\n  switch_fable:\n    name: Fable switch default\n    hidden: true\n  astra:\n    name: GPT-6 Astra\n\ndisplay:\n  showTokenUsage: true\n\nproviders:\n  anthropic:\n    serverSideFallback: false\n  fetch: auto\n  webSearchTimeoutSeconds: 30\n\nretry:\n  usageAwareFallback: true\n  fallbackChains:\n    default:\n      - openai-codex/gpt-6-sol:high\n    advisor:\n      - anthropic/claude-opus-5-5:medium\n    task:\n      - anthropic/claude-opus-5-5:high\n    vision:\n      - openai-codex/gpt-6-sol:medium\n    smol:\n      - anthropic/claude-opus-5-5:low\n    tiny:\n      - anthropic/claude-opus-5-5:low\n    commit:\n      - anthropic/claude-opus-5-5:medium\n    switch_fable: []\n    fable:\n      - openai-codex/gpt-6-astra:xhigh\n    astra:\n      - anthropic/claude-fable-5-1:medium\n    web:\n      - web/exa\n      - web/perplexity\n      - openai-codex/gpt-6-luna\n      - web/parallel\n      - web/zai\n      - web/tinyfish\n      - web/jina\n      - web/kagi\n      - web/tavily\n      - web/brave\n      - web/kimi\n      - web/synthetic\n      - web/ollama\n      - web/searxng\n      - web/startpage\n      - web/duckduckgo\n      - web/ecosia\n      - web/google\n      - web/mojeek\n      - web/public\n\nincludeWorkspaceTree: false\n\nbranchSummary:\n  enabled: true\n\ncommands:\n  enableOpencodeProject: false\n  enableOpencodeUser: false\n\nskills:\n  enableClaudeUser: false\n  enableCodexUser: false\n  enableAgentsUser: true\n\nsteeringMode: all\n\ndev:\n  autoqa: false\n  autoqaConsent: denied\n\ncompaction:\n  thresholdTokens: -1\n  idleEnabled: true\n  handoffSaveToDisk: true\n\ndoubleEscapeAction: tree\ntextVerbosity: low\n\nfeatures:\n  unexpectedStopDetection: smart\n\ncodexResets:\n  autoRedeem: \"no\"\n\nstartup:\n  quiet: true\n\ntools:\n  approvalMode: yolo\n",
   "SoT/.omp/intercom.json": "{\n  \"brokerCommand\": \"bun\",\n  \"brokerArgs\": []\n}\n",
   "SoT/.omp/mcp.json": "{\n  \"$schema\": \"https://raw.githubusercontent.com/can1357/oh-my-pi/main/packages/coding-agent/src/config/mcp-schema.json\",\n  \"disabledServers\": [\n    \"chrome-devtools\",\n    \"context7:context7\",\n    \"openaiDeveloperDocs\"\n  ]\n}\n",
-  "SoT/.omp/models.yml": "providers:\n  openai-codex:\n    modelOverrides:\n      gpt-6-astra:\n        thinking:\n          mode: effort\n          efforts:\n            - low\n            - medium\n            - high\n            - xhigh\n            - max\n          defaultLevel: xhigh\n"
+  "SoT/.omp/models.yml": "providers:\n  # Temporary metadata for an id the shared models.dev catalog still publishes\n  # as an empty stub. Remove this block once that catalog row carries the real\n  # context window, output cap, ladder, and prices. `defaultLevel` is the kit's\n  # choice for a bare selector, not the Claude API default, which is `medium`.\n  anthropic:\n    modelOverrides:\n      claude-opus-5-5:\n        name: Claude Opus 5.5\n        reasoning: true\n        input:\n          - text\n          - image\n        contextWindow: 1000000\n        maxTokens: 128000\n        cost:\n          input: 4\n          output: 20\n          cacheRead: 0.2\n          cacheWrite: 5\n        thinking:\n          mode: effort\n          efforts:\n            - low\n            - medium\n            - high\n            - xhigh\n            - max\n          defaultLevel: high\n  openai-codex:\n    modelOverrides:\n      gpt-6-astra:\n        thinking:\n          mode: effort\n          efforts:\n            - low\n            - medium\n            - high\n            - xhigh\n            - max\n          defaultLevel: xhigh\n"
 } as const
 export const GENERATED_PAYLOAD_BASE64 = {
@@ -50,4 +50,4 @@ export const GENERATED_PAYLOAD_PATHS = [
   "notification.mp3"
 ] as const
-export const GENERATED_PAYLOAD_HASH = "89c8d1e1b65fe34bf9fddf07c9a1992357fffe2b59342cbd2a0610f8ca39d808"
+export const GENERATED_PAYLOAD_HASH = "7e1487e35a77ece787b20094714b2ff3bb976ecae32f08889d1ecf7ac3346a0a"

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "docks-kit",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "description": "Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills",
   "type": "module",
   "license": "MIT",