docks-kit 0.2.0 → 0.3.0

package/docks-kit

@@ -7,6 +7,10 @@ set -euo pipefail
 
 REPO_DIR="$(cd "$(dirname "$0")" && pwd)"
 
+# BEGIN GENERATED BUN PIN
+BUN_PIN="1.3.14"
+# END GENERATED BUN PIN
+
 case "$(uname -s)-$(uname -m)" in
   Linux-x86_64)   KIT_BIN="docks-kit-linux-x64" ;;
   Linux-aarch64)  KIT_BIN="docks-kit-linux-arm64" ;;
@@ -39,12 +43,8 @@ if ! BUN="$(find_bun)"; then
     echo "[docks-kit] curl missing too. Install Bun manually (https://bun.sh) or download a docks-kit release binary." >&2
     exit 1
   fi
-  # Pin the Bun release to the kit-verified version when jq can read it
-  # (the installer takes a bun-vX.Y.Z release tag as $1); latest otherwise.
-  BUN_PIN=""
-  if command -v jq >/dev/null 2>&1; then
-    BUN_PIN="$(jq -r '.tools.bun.verified // empty' "$REPO_DIR/SoT/toolchain.json" 2>/dev/null || true)"
-  fi
+  # The installer takes a bun-vX.Y.Z release tag as $1. BUN_PIN is generated
+  # from the authoring toolchain manifest alongside the embedded payload.
   tmp_installer=$(mktemp 2>/dev/null || echo "/tmp/bun-install-$$.sh")
   curl -fsSL https://bun.sh/install -o "$tmp_installer" && bash "$tmp_installer" ${BUN_PIN:+"bun-v$BUN_PIN"} >/dev/null 2>&1 || true
   rm -f "$tmp_installer"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docks-kit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills",
   "type": "module",
   "license": "MIT",
@@ -15,8 +15,6 @@
     "cli/src",
     "cli/docs",
     "cli/tsconfig.json",
-    "SoT",
-    "notification.mp3",
     "docks-kit",
     "AGENTS.md",
     "README.md"
@@ -24,6 +22,7 @@
   "scripts": {
     "typecheck": "tsc --noEmit -p cli",
     "build:binaries": "bash cli/build-binaries.sh",
+    "prepack": "bun cli/scripts/generate-sot-payload.ts --check",
     "golden:dryrun": "bun cli/test/golden-dryrun.ts",
     "golden:mutation": "bun cli/test/golden-mutation.ts",
     "test:unit": "vitest run"

package/SoT/.agents/skills.txt

@@ -1,14 +0,0 @@
-# Universal AI-agent skills (agentskills.io standard).
-# Bootstrapped to ~/.agents/skills/ by cli/src/engine-native/skillsSync.ts during ./docks-kit sync.
-# One slug per line: <owner>/<repo>. Lines starting with # are comments.
-# Each skill's canonical SKILL.md lands in ~/.agents/skills/<name>/ — Codex
-# reads that path natively; Claude Code gets a ~/.claude/skills/<name>
-# symlink to it. The skills sync names both agents the kit supports
-# (-a claude-code codex) so the CLI keeps the shared canonical copy.
-
-# Browser automation CLI — reaches JS-rendered, auth-walled, login-gated pages
-# (x.com, LinkedIn, Confluence) that built-in WebFetch can't. The skills sync
-# auto-installs the `agent-browser` npm package + downloads Chrome for Testing
-# (~175 MB) on first sync; Linux runs `agent-browser install --with-deps` which
-# may prompt for sudo to install system libs (libnss3, libatk, ...).
-vercel-labs/agent-browser

package/SoT/.claude/CLAUDE.md

@@ -1,146 +0,0 @@
-@RTK.md
-
-## Research Before Implementation
-
-Before writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.
-
-**Research workflow:**
-1. Use `resolve-library-id` → `query-docs` (context7) to fetch up-to-date docs for the specific library/framework
-2. If context7 doesn't cover it, read the official docs with `agent-browser` (it reaches JS-rendered, auth-walled, and login-gated pages); fall back to `WebFetch` for a simple static page
-3. Only then proceed to implementation
-
-**When to research:**
-- Installing or configuring a dependency
-- Using an API, hook, method, or pattern you haven't verified in this session
-- Upgrading or migrating between versions
-- Any task where you'd otherwise rely on training data for syntax/behavior
-
-**Do NOT:**
-- Assume API signatures, method names, or config options from memory
-- Generate framework code without checking current docs first
-- Skip research because the library "seems familiar"
-
-<constraint>
-Research the codebase before editing. Never change code you haven't read.
-</constraint>
-
-## Agentic Harness Heuristics
-
-**1. Persistence.** Keep going until the user's query is completely resolved. Only yield when sure the problem is solved. Before ending a turn, check the last paragraph: if it is a plan, a question you can answer yourself, or a promise of work not done ("I'll…"), do that work now.
-
-**2. Default to parallel.** Whenever you have multiple independent operations (reads, greps, web fetches, independent edits), invoke them in a single response with multiple tool-use blocks. Sequential calls only when output of one operation is required as input to the next.
-
-**3. Multi-pass search.** First-pass search often misses — vary the wording (colleague-questions over keywords) before concluding something doesn't exist.
-
-**4. Trace symbols.** Before modifying a symbol, trace it to its definitions and all usages. Don't assume a function's behavior or a type's shape from the call site alone.
-
-**5. Linter-loop 3-strike rule.** Don't loop more than 3 times fixing linter errors on the same file. On the third attempt, stop and ask the user — repeated failure usually means the diagnosis is wrong, not the code.
-
-**6. Read-before-Edit TTL.** If you haven't read a file with the Read tool in the last ~5 messages, re-read it before editing. Cached file content goes stale silently when the user edits between turns.
-
-**7. Big-file rule.** For files >1000 lines, prefer Grep + scoped Read (`offset` + `limit`) over reading the entire file. Whole-file reads bloat context; targeted reads keep the working set small.
-
-**8. Todo hygiene.** Use TaskCreate for items with meaningful outcome (≥5 min, distinct deliverable). Never include operational sub-actions (linting, testing, searching, examining the codebase) as their own todos — those are sub-steps in service of higher-level tasks. Mark complete immediately when done, never in batches.
-
-**9. Literal-instruction rule.** Current frontier models follow instructions literally — they do not silently generalize from intent. Phrase requirements as explicit checklists with success criteria, not narrative.
-
-**10. Context hygiene.** Prefer `/clear` at task boundaries and `/rewind` for wrong-path detours over carrying rot forward (corrections accumulate noise; rewinds preserve the prefix and discard the bad branch). On a continuing task, run `/compact` with steering before context quality degrades. Never stop, summarize, or suggest a new session on account of context limits.
-
-**11. Autonomy calibration.** For minor choices (naming, formatting, default values, which of two equivalent approaches), pick a reasonable option and note it — don't ask. Ask first only for scope changes, destructive actions, or decisions that change the deliverable. When the user is describing a problem or asking a question rather than requesting a change, the deliverable is your assessment — report findings and stop; don't apply fixes until asked. Don't close a finished task with "Want me to also…?" — run the obvious verification, then stop cleanly.
-
-**12. Capability triggering.** When the answer depends on current or version-specific information, search or fetch before answering — never answer from memory. When work fans out across independent items (many files to read, many tests to run, many candidates to check), delegate to parallel subagents; never spawn one for work you can complete directly. For verification, prefer a fresh-context subagent over self-critique. On tasks longer than a few turns, keep a running notes file and re-read it before each phase.
-
-<constraint>
-Treat the 12 heuristics above as protocol, not preference. If a turn ends without honoring an applicable one (e.g., lint-loop guard not respected, edit without re-read), self-correct in the next turn before continuing.
-</constraint>
-
-## Project Skills
-
-Projects may have a `.claude/skills/` directory with Tool Wrapper skills managed by `/docs`. Claude Code auto-discovers these at session start — only descriptions are loaded, full content loads on demand via the Skill tool.
-
-Skills follow the [agentskills.io](https://agentskills.io) open standard:
-- **SKILL.md**: frontmatter (`name`, `description`, `user-invocable: false`, `metadata`) + body (≤500 lines)
-- **references/**: on-demand detail files (30-150 lines each), loaded when the skill instructs Claude to read them
-- **Discovery**: Claude Code scans `.claude/skills/*/SKILL.md` at session start, loads only `name` + `description` (~100 tokens per skill)
-- **Triggering**: Claude semantically matches descriptions against user tasks, invokes via `Skill` tool — no `@import` or pointer tables needed
-- **CSO (Claude Search Optimization)**: descriptions MUST start with "Use when..." and describe trigger conditions, not capabilities
-- **Third-party / vendored skills**: add an `upstream:` frontmatter block (`source`, `license`, `vendored_at: "YYYY-MM-DD"`) when vendoring a skill from an external repo. The block marks the skill as vendored so kit-specific checks (CSO start-prefix, `user-invocable`, `metadata.updated`) are relaxed and the skill's body is preserved verbatim from upstream. Universal structural checks (fenced frontmatter, name matches directory, description length, 500-line body cap) still apply.
-
-<constraint>
-After any code change affecting documented patterns, update the relevant skill in `.claude/skills/` and its `metadata.updated` frontmatter field. When introducing something new, create a skill or add a `references/` file to an existing skill.
-</constraint>
-
-## Project Agents
-
-Projects and the global kit may have a `.claude/agents/` directory containing subagent definitions. Each agent file declares its `model` (`sonnet`/`opus`/`haiku`/`inherit`/full model ID), `tools`, and system prompt. Claude Code auto-discovers them at session start and delegates when a `subagent_type` matches or when a slash command explicitly invokes them.
-
-Agent files follow this structure:
-- **Frontmatter**: `name` (kebab-case, matches filename), `description` (CSO — starts "Use when…" with a "Not for…" exclusion clause), `tools`, `model`
-- **Body** (≤500 lines): `<constraint>` blocks for non-negotiable rules, `## Workflow` with context-acknowledgment as step 1, `## Output Format`, `## Anti-Hallucination Checks`, `## Success Criteria`
-- **Model-selection resolution** (per Claude Code docs): `CLAUDE_CODE_SUBAGENT_MODEL` env var → per-invocation `model` param → agent frontmatter `model:` → parent conversation. The env var is NOT set in this kit, so per-agent frontmatter controls selection.
-
-<constraint>
-When adding a new agent: use kebab-case name matching filename, CSO-compliant description (starts "Use when…", contains a "Not" exclusion clause), explicit `model` and `tools`.
-</constraint>
-
-## Picking the right models for workflows and subagents
-
-Rankings, higher = better. Intelligence is how hard a problem the model can be handed unsupervised. Taste covers UI/UX, code quality, API design, and copy. Cost is relative spend — a tie-breaker only.
-
-| model    | cost | intelligence | taste |
-|----------|------|--------------|-------|
-| gpt-5.5  | 9    | 8            | 5     |
-| opus-4.8 | 4    | 7            | 8     |
-| sonnet-5 | 5    | 5            | 7     |
-
-Fable 5 outranks all three on intelligence and taste, but its limits are spent for now — treat opus-4.8 as the ceiling until Fable access returns, then Fable takes the top intelligence+taste slot.
-
-How to apply:
-- These are defaults, not limits. Standing permission to override: if a cheaper model's output misses the bar, rerun with a smarter one without asking. Judge the output, not the price tag — escalating costs less than shipping mediocre work.
-- Cost is a tie-breaker only; when axes conflict for anything that ships, intelligence > taste > cost.
-- Bulk/mechanical work (clear-spec implementation, data analysis, migrations): gpt-5.5.
-- Anything user-facing (UI, copy, API design) needs taste ≥ 7 → opus-4.8 (sonnet-5 when Opus is saturated).
-- Reviews of plans/implementations: opus-4.8, optionally gpt-5.5 as a second independent perspective.
-- Never use Haiku.
-- gpt-5.5 is reachable only through the Codex CLI (`~/.codex/config.toml` defaults to gpt-5.5): `codex exec` for headless implementation/analysis, `codex review` for diff review, `codex exec -s read-only` with a self-contained prompt for ad-hoc investigation, UI verification, or data analysis. Codex is more efficient than Claude on well-specced execution and stronger at computer-use and UI/UX verification — offload those and report results back.
-- Claude models run via the Agent/Workflow `model` parameter (`opus`, `sonnet`).
-
-Using gpt-5.5 inside workflows and subagents (the `model` parameter takes only Claude models, so wrap it):
-- Spawn a thin Claude wrapper agent with `model: 'sonnet', effort: 'low'` whose prompt tells it to write a self-contained Codex prompt, run `codex exec` via Bash, and return Codex's output verbatim. The wrapper only shuttles the prompt and result — gpt-5.5 does the work.
-
-Reaching gpt-5.5 (or a full-context worker in another project) as a persistent session — the `session-relay` skill (shared bus + `relay` CLI, Claude ⇄ Codex):
-- `codex exec` is one-shot and stateless. When the offload must be resumable, span several turns, or run in another project with that project's own config, spawn a real session instead: `relay spawn <dir> --tool codex --model gpt-5.5 --effort xhigh` (or `--tool claude --model opus` for a Claude worker), then continue it with `send` / `wake`.
-- Two independent perspectives on a plan = the red-team pair spawn: a gpt-5.5 worker and an opus worker debate over the bus, orchestrator writes the verdict — the concrete form of the "second independent perspective" review above.
-- Pin `--model`/`--effort` on every spawn/wake; never leave an unattended relay child on a top interactive default (e.g. Fable). Each spawn/wake bills the target's subscription — spawn deliberately, never in loops.
-
-## Agentic Engineering Discipline
-
-1. **State assumptions; push back when warranted.** If a requirement is ambiguous in a way that changes the deliverable, surface the ambiguity and propose 1–2 concrete interpretations in your first message — do not silently pick one and run with it. Surface inconsistencies and confusion instead of guessing past them; present tradeoffs when approaches genuinely differ; push back when the request looks wrong. Agreeable-but-wrong is the failure mode, not disagreement.
-2. **Minimum code that solves the stated problem.** Each named pattern below is a defect — catch it during generation, not after:
-
-   **Code slop**
-   - **Defensive guards** around internally-trusted calls (`try`, `if x != null`). Validate at system boundaries only.
-   - **Speculative abstraction.** No helper for one caller; no interface for one implementer. Three similar lines beats premature DRY.
-   - **Backwards-compat shims** without a caller — re-exports, deprecation aliases, untoggled feature flags. Just change the code.
-   - **Half-finished stubs.** `TODO handle later`, `throw new Error('not implemented')`. Implement or remove the path.
-   - **Underscore-rename of unused vars.** Delete the var.
-   - **Dead code left behind.** After a refactor, delete the paths, helpers, and imports the change made unreachable.
-
-   **Comment slop**
-   - **Restate-the-code.** `// increment i`. The identifier already says it.
-   - **Provenance.** `// added for ticket X`, `// used by Y`. Belongs in the PR description; rots in code.
-   - **Tombstones.** `// removed Z`, `// previously did W`. Git remembers.
-   - **Docstring bloat** on self-evident functions. One line, only when the WHY isn't obvious from the name.
-
-   **Output slop**
-   - **End-of-turn diff-restatement.** One or two sentences: what changed, what's next. Don't recap what's in the diff.
-   - **Narration tics.** "Now I'll…", "Let me check…", play-by-play between tool calls. Terse working shorthand between tool calls is fine; play-by-play is not — write a sentence when something load-bearing happens (a finding, a direction change, a blocker).
-   - **Compressed final summaries.** The final message is for a reader who didn't watch the work: outcome first, complete sentences. Shorten by dropping detail, never by compressing into fragments or arrow chains.
-3. **Surgical changes only.** Do not modify code, comments, or formatting outside the explicit scope of the request. Surface unrelated issues as follow-ups — do not fix inline.
-4. **State how success will be verified before implementing.** Name the test, build, smoke check, or diff inspection that will prove the change works. Prefer executable criteria — a test that fails before and passes after, a command with expected output — over judgment calls, and keep each change small enough that its diff is reviewable in one sitting.
-5. **Review scope follows the pipeline.** In pipeline reviews with a downstream filter (multi-agent scans, verification phases), report every issue found with confidence and severity — filtering happens downstream. In ad-hoc reviews, flag only gaps that affect correctness or the stated requirements; treat the rest as optional.
-6. **Ground every progress claim in evidence.** Before reporting progress or completion, audit each claim against a tool result from this session — show the test output, the command and what it returned. If something is unverified, say so explicitly; if tests fail, say so with the output.
-
-<constraint>
-Treat the six rules above as preventive (during generation), not remedial (after the fact). Self-correct if a turn drifts.
-</constraint>

package/SoT/.claude/fetch-usage.sh

@@ -1,66 +0,0 @@
-#!/bin/bash
-# Async Stop hook: refreshes the /oauth/usage stats the statusline reads.
-
-exec 2>/dev/null
-
-CACHE_FILE="/tmp/.claude_usage_cache"
-TOKEN_CACHE="/tmp/.claude_token_cache"
-CREDS_FILE="$HOME/.claude/.credentials.json"
-TOKEN_MAX_AGE=900 # 15 minutes
-
-file_mtime() {
-  if [ "$(uname)" = "Darwin" ]; then
-    stat -f %m "$1" 2>/dev/null || echo 0
-  else
-    stat -c %Y "$1" 2>/dev/null || echo 0
-  fi
-}
-
-# Newer credentials than the usage cache => possible account switch; drop it to avoid showing the previous account.
-if [ -f "$CACHE_FILE" ] && [ -f "$CREDS_FILE" ] \
-   && [ "$(file_mtime "$CREDS_FILE")" -ge "$(file_mtime "$CACHE_FILE")" ]; then
-  rm -f "$CACHE_FILE"
-fi
-
-token=""
-if [ -f "$TOKEN_CACHE" ]; then
-  cache_mtime=$(file_mtime "$TOKEN_CACHE")
-  age=$(( $(date +%s) - cache_mtime ))
-  creds_mtime=0
-  [ -f "$CREDS_FILE" ] && creds_mtime=$(file_mtime "$CREDS_FILE")
-  if [ "$age" -lt "$TOKEN_MAX_AGE" ] && [ "$creds_mtime" -lt "$cache_mtime" ]; then
-    token=$(cat "$TOKEN_CACHE")
-  fi
-fi
-
-if [ -z "$token" ]; then
-  if [ -f "$CREDS_FILE" ]; then
-    token=$(jq -r '.claudeAiOauth.accessToken // empty' "$CREDS_FILE")
-  fi
-  # macOS Keychain fallback
-  if [ -z "$token" ] && command -v security >/dev/null 2>&1; then
-    creds=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null)
-    [ -n "$creds" ] && token=$(echo "$creds" | jq -r '.claudeAiOauth.accessToken // empty')
-  fi
-  [ -z "$token" ] && exit 0
-  echo "$token" > "$TOKEN_CACHE"
-fi
-
-response=$(curl -s --max-time 3 \
-  -H "Authorization: Bearer $token" \
-  -H "anthropic-beta: oauth-2025-04-20" \
-  "https://api.anthropic.com/oauth/usage")
-
-[ -z "$response" ] && exit 0
-
-five_h=$(echo "$response" | jq -r '.five_hour.utilization // empty' | awk '{printf "%.0f", $1}')
-seven_d=$(echo "$response" | jq -r '.seven_day.utilization // empty' | awk '{printf "%.0f", $1}')
-five_h_reset=$(echo "$response" | jq -r '.five_hour.resets_at // empty')
-seven_d_reset=$(echo "$response" | jq -r '.seven_day.resets_at // empty')
-
-# Numeric-range guard: a schema change would otherwise poison the cache silently.
-if [ -n "$five_h" ] && [ -n "$seven_d" ] \
-   && echo "$five_h"  | grep -qE '^[0-9]+$' && [ "$five_h"  -ge 0 ] && [ "$five_h"  -le 100 ] 2>/dev/null \
-   && echo "$seven_d" | grep -qE '^[0-9]+$' && [ "$seven_d" -ge 0 ] && [ "$seven_d" -le 100 ] 2>/dev/null; then
-  printf '%s\n%s\n%s\n%s\n' "$five_h" "$seven_d" "$five_h_reset" "$seven_d_reset" > "$CACHE_FILE"
-fi

package/SoT/.claude/hooks/notify.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-SOUND="$HOME/.claude/notification.mp3"
-[ -f "$SOUND" ] || exit 0
-
-if [ "$(uname)" = "Darwin" ]; then
-  command -v afplay >/dev/null 2>&1 && exec afplay "$SOUND"
-fi
-
-command -v ffplay >/dev/null 2>&1 && exec ffplay -nodisp -autoexit -loglevel quiet "$SOUND"
-command -v paplay >/dev/null 2>&1 && exec paplay "$SOUND"
-command -v aplay  >/dev/null 2>&1 && exec aplay -q "$SOUND"
-exit 0

package/SoT/.claude/mcp-servers.json

@@ -1,10 +0,0 @@
-{
-  "mcpServers": {
-    "chrome-devtools": {
-      "type": "stdio",
-      "command": "npx",
-      "args": ["-y", "chrome-devtools-mcp@1.5.0"],
-      "env": {}
-    }
-  }
-}

package/SoT/.claude/settings.json

@@ -1,235 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "minimumVersion": "2.1.170",
-  "model": "opus",
-  "advisorModel": "fable",
-  "effortLevel": "xhigh",
-  "autoMemoryEnabled": true,
-  "skillListingMaxDescChars": 2048,
-  "respectGitignore": true,
-  "cleanupPeriodDays": 14,
-  "skillListingBudgetFraction": 0.05,
-  "env": {
-    "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "64000",
-    "CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR": "1",
-    "CLAUDE_CODE_AUTO_COMPACT_WINDOW": "468000",
-    "CLAUDE_CODE_NO_FLICKER": "1"
-  },
-  "permissions": {
-    "defaultMode": "auto",
-    "allow": [
-      "Read",
-      "Glob",
-      "Grep",
-      "WebFetch",
-      "WebSearch",
-      "Edit(./)",
-      "Write(./)",
-      "Bash(git *)",
-      "Bash(git add *)",
-      "Bash(git commit *)",
-      "Bash(git status *)",
-      "Bash(git diff *)",
-      "Bash(git log *)",
-      "Bash(git branch *)",
-      "Bash(git checkout *)",
-      "Bash(git switch *)",
-      "Bash(git stash *)",
-      "Bash(git fetch *)",
-      "Bash(git pull *)",
-      "Bash(git tag *)",
-      "Bash(git show *)",
-      "Bash(git blame *)",
-      "Bash(git worktree *)",
-      "Bash(gh *)",
-      "Bash(pnpm *)",
-      "Bash(npm *)",
-      "Bash(npx *)",
-      "Bash(node *)",
-      "Bash(docker *)",
-      "Bash(docker-compose *)",
-      "Bash(rtk *)",
-      "Bash(ls *)",
-      "Bash(cat *)",
-      "Bash(find *)",
-      "Bash(grep *)",
-      "Bash(head *)",
-      "Bash(tail *)",
-      "Bash(wc *)",
-      "Bash(sort *)",
-      "Bash(uniq *)",
-      "Bash(diff *)",
-      "Bash(which *)",
-      "Bash(pwd *)",
-      "Bash(date *)",
-      "Bash(mkdir *)",
-      "Bash(basename *)",
-      "Bash(dirname *)",
-      "Bash(realpath *)",
-      "Bash(jq *)",
-      "Bash(curl *)",
-      "Bash(tree *)",
-      "Bash(sed *)",
-      "Bash(awk *)",
-      "Bash(cut *)",
-      "Bash(tr *)",
-      "Bash(tee *)",
-      "Bash(echo *)",
-      "Bash(printf *)",
-      "Bash(env *)",
-      "Bash(printenv *)",
-      "Bash(uname *)",
-      "Bash(file *)",
-      "Bash(stat *)",
-      "Bash(du *)",
-      "Bash(id *)",
-      "Bash(whoami *)",
-      "Bash(php *)",
-      "Bash(composer *)",
-      "Bash(python3 *)",
-      "Bash(python *)",
-      "Bash(pip *)",
-      "Bash(pip3 *)"
-    ],
-    "deny": [
-      "Read(**/.env)",
-      "Read(**/.env.local)",
-      "Read(**/secrets/**)",
-      "Read(**/*.key)",
-      "Read(**/*.pem)",
-      "Read(**/*.p12)",
-      "Read(**/.credentials*)",
-      "Edit(**/.env)",
-      "Edit(**/.env.local)",
-      "Edit(**/secrets/**)",
-      "Write(**/.env)",
-      "Write(**/.env.local)",
-      "Write(**/secrets/**)",
-      "Bash(sudo *)",
-      "Bash(rm -rf /)",
-      "Bash(rm -rf / *)",
-      "Bash(rm -rf ~)",
-      "Bash(rm -rf ~ *)",
-      "Bash(rm -rf $HOME)",
-      "Bash(rm -rf $HOME *)",
-      "Bash(> /dev *)",
-      "Bash(dd if= *)",
-      "Bash(mkfs *)",
-      "Bash(eval *)",
-      "Bash(chmod 777 *)",
-      "Bash(chmod -R 777 *)",
-      "Bash(git push --force origin main *)",
-      "Bash(git push --force origin master *)",
-      "Bash(git push -f origin main *)",
-      "Bash(git push -f origin master *)"
-    ],
-    "ask": [
-      "Bash(git clean *)",
-      "Bash(docker volume rm *)",
-      "Bash(docker system prune *)"
-    ]
-  },
-  "hooks": {
-    "SessionStart": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "echo \"[CONTEXT] Current date: $(date '+%A, %Y-%m-%d %H:%M:%S %Z')\"",
-            "timeout": 5
-          },
-          {
-            "type": "command",
-            "command": "echo \"[CONFIG] Context: $([ \\\"${CLAUDE_CODE_DISABLE_1M_CONTEXT:-0}\\\" = \\\"1\\\" ] && echo '200K' || echo '1M') | Compact-window: ${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-full} | Effort: ${CLAUDE_CODE_EFFORT_LEVEL:-$(jq -r .effortLevel $HOME/.claude/settings.json 2>/dev/null || echo default)} | Thinking: adaptive | Subagent: ${CLAUDE_CODE_SUBAGENT_MODEL:-default}\"",
-            "timeout": 5
-          }
-        ]
-      }
-    ],
-    "Notification": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "[ -x \"$HOME/.claude/hooks/notify.sh\" ] && \"$HOME/.claude/hooks/notify.sh\" || true",
-            "timeout": 10,
-            "async": true
-          }
-        ]
-      }
-    ],
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "rtk hook claude"
-          }
-        ]
-      }
-    ],
-    "PostToolUseFailure": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PostToolUseFailure\",\"additionalContext\":\"Last bash command failed. Repository / file state may have shifted \u2014 re-read affected files before retrying. If the failure is a missing dependency or env mismatch, surface it to the user rather than retrying blindly.\"}}'",
-            "timeout": 5
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bash $HOME/.claude/fetch-usage.sh",
-            "timeout": 5,
-            "async": true
-          }
-        ]
-      }
-    ],
-    "SubagentStop": [
-      {
-        "hooks": [
-          {
-            "type": "prompt",
-            "prompt": "You are a quality gate for subagent outputs in a multi-agent code-analysis pipeline.\n\nEvaluate the subagent's `last_assistant_message` field (in the JSON below) against these requirements:\n\n1. ALLOW (return `{}`): Mode-selection or no-issues responses. Examples: \"Which mode do you prefer\", \"select an option\", \"no issues / problems / violations / blockers found\".\n\n2. ALLOW (return `{}`): Output contains at least one concrete file:line citation \u2014 e.g. `src/auth.ts:42`, `lib/db.ts:100-115`, or path references that include line numbers.\n\n3. BLOCK (return `{\"decision\":\"block\",\"reason\":\"<one-line explanation>\"}`): Output claims about code or findings WITHOUT concrete file:line citations. Vague references like \"the auth handler\" or \"near the database code\" are not acceptable as the only evidence.\n\nSubagent invocation JSON:\n$ARGUMENTS\n\nReturn ONLY the JSON decision (no commentary, no markdown fences).",
-            "timeout": 30
-          }
-        ]
-      }
-    ]
-  },
-  "statusLine": {
-    "type": "command",
-    "command": "~/.claude/statusline.sh",
-    "refreshInterval": 5
-  },
-  "enabledPlugins": {
-    "context7@claude-plugins-official": true,
-    "frontend-design@claude-plugins-official": true,
-    "php-lsp@claude-plugins-official": true,
-    "typescript-lsp@claude-plugins-official": true,
-    "docks@docks": true,
-    "session-relay@docks": true,
-    "effect-kit@docks": true
-  },
-  "extraKnownMarketplaces": {
-    "docks": {
-      "source": {
-        "source": "github",
-        "repo": "DocksDocks/docks"
-      }
-    }
-  },
-  "alwaysThinkingEnabled": true,
-  "showThinkingSummaries": true,
-  "viewMode": "default",
-  "theme": "dark-daltonized",
-  "skipDangerousModePermissionPrompt": true
-}