oh-my-second-brain 0.17.0 → 0.18.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "oms",
       "description": "Oh My Second Brain convention layer for Obsidian vaults — capture, retrieve, and validate knowledge under a declared semantic convention.",
-      "version": "0.17.0",
+      "version": "0.18.1",
       "author": {
         "name": "gobeumsu",
         "email": "gobeumsu@gmail.com"
@@ -37,5 +37,5 @@
       ]
     }
   ],
-  "version": "0.17.0"
+  "version": "0.18.1"
 }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "oms",
-  "version": "0.17.0",
-  "description": "Oh My Second Brain convention layer for Obsidian vaults — eight shared skills and five MCP tools under a user-owned contract.",
+  "version": "0.18.1",
+  "description": "Oh My Second Brain convention layer for Obsidian vaults — seven shared skills and five MCP tools under a user-owned contract.",
   "author": {
     "name": "gobeumsu"
   },
@@ -19,6 +19,7 @@
     "./assets/skills/doctor/",
     "./assets/skills/link/",
     "./assets/skills/search/",
+    "./assets/skills/setup/",
     "./assets/skills/status/",
     "./assets/skills/write/"
   ]

package/.codex-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "oms",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Oh My Second Brain convention layer for Obsidian vaults — Codex native rules, skills, and MCP adapter.",
-  "_note": "oms host install writes Codex MCP config and provenance, installs ~/.codex/rules/oms.md, and installs the eight shared skills under ~/.codex/skills/oms-*.",
+  "_note": "oms host install writes Codex MCP config and provenance, installs ~/.codex/rules/oms.md, and installs the seven shared skills under ~/.codex/skills/oms-*.",
   "skills": "./assets/skills/",
   "mcpServers": "./.mcp.codex.json"
 }

package/CHANGELOG-assets.md

@@ -4,6 +4,15 @@ Skills, agents, templates, and host guidance changes belong here.
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-09-26
+
+- The Hermes README and SOUL name the skill category `knowledge-management`: filter with `skills_list(category="knowledge-management")`, since `knowledge-management/oms` matches nothing. The `status` skill describes `readTools` and `writeTools` separately.
+
+## [0.18.0] - 2026-09-25
+
+- **The `setup` skill is added (seven skills).** It walks the owner through `oms setup --questions` and `oms setup --answers`, asking each question with the recommended option first, keeping the answers file outside the vault and deleting it afterwards, and sending any loosening reseal or seal recovery to the owner's terminal. Host guidance and the `doctor`, `status`, and `write` skills no longer say the agent never runs setup; they name the skill for a first or stricter seal and keep recovery and loosening with the terminal.
+- **The `setup` skill spells out what it must never do.** It never runs `oms setup` or `oms contract setup` without `--questions` or `--answers`, never runs setup under a pty wrapper (`script`, `expect`, `unbuffer`), and never moves the vault or deletes, edits, or re-IDs `.oms/settings.json`. It notes that adding a folder, property, or template widens a closed axis, and sends a `pattern-unsafe` change to the owner's terminal. It says the skill path may add new entries, but changing a sealed template, even to make it stricter, is `template-tightened` and needs `oms setup` in the owner's terminal.
+
 ## [0.17.0] - 2026-09-25
 
 - **Breaking: host guidance describes the sealed contract.** The `interview` and `template` skills are deleted, leaving six skills. Guidance tells agents to write whole notes through `write {path, content, template?}`, to stay inside the sealed property pool, never to read or write `~/.oms/`, and to ask the user to run `oms setup` on `contract-unreadable`.

package/CHANGELOG-cli.md

@@ -4,6 +4,15 @@ Changes to the `oms` command surface belong here.
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-09-26
+
+- **`oms --version` and `oms -v` print the installed package version.** Hosts and agents can now confirm the release from the CLI. An unknown flag or extra argument still exits 1 with `[oms] Unknown command:`.
+
+## [0.18.0] - 2026-09-25
+
+- **`oms setup` and `oms contract setup` take `--questions` and `--answers <file|->`.** `--questions` prints the interview questions as JSON and seals nothing; `--answers` runs the same interview from a JSON object of answers by question id (`-` reads stdin) and seals. Missing answers return `incomplete` with the follow-up questions; an invalid, unknown, or malformed answer, an answers file inside the vault, or both flags together exit 1 and seal nothing. A reseal through `--answers` must be equal or stricter; loosening exits 1 with `status: loosening`, `{field, kind}` changes and no values, and points at `oms setup` in a terminal. The interactive setup is unchanged and keeps full authority, and the non-TTY refusal now names the two-step path.
+- **`oms contract doctor` reports `unsafePatterns`.** Each entry is `{field, kind: "pattern-unsafe"}` for a sealed pattern the seal screen now refuses; the report is unhealthy and recovery is `oms setup` in a terminal. `--answers` now accepts an answers file whose name merely starts with two dots (such as `..answers.json`) only when it is actually outside the vault; one inside the vault is refused.
+
 ## [0.17.0] - 2026-09-25
 
 - **Breaking: `oms template` is removed; the contract lives under `oms setup` and `oms contract setup|extract|status|doctor`.** `oms setup` is interactive only and refuses to run without a TTY or under `OMS_NON_INTERACTIVE=1`. `oms note guide` and `oms note check` are removed; `oms note audit` judges existing notes against the seal. `oms hook pre` replaces the retired hook leaves. Older `.oms/*` files are ignored and a `templateRoots` settings key is rejected. Upgrade order: (1) install this release and run `oms host sync`; (2) back up `.oms/settings.json` and keep only `version`, `vaultId`, `templateFolder` (formerly `templateRoots`), `embedding`, and `agentRepair`; (3) run `oms setup` at a terminal to seal the vault; (4) run `oms contract doctor` and review the unexpected control files it lists under `.oms/`; (5) keep those backups while a rollback to 0.16.0 is still possible.

package/CHANGELOG-kernel.md

@@ -4,6 +4,16 @@ Domain logic changes belong here.
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-09-26
+
+- **The status `CONTRACT_OPEN` diagnostic uses the same wording and guidance as `oms contract doctor`.** A never-sealed vault reports `contract: none` with `run oms setup`, unreadable vault settings report `vault settings unreadable` with `run oms contract doctor`, and a missing vault says no contract applies. `SETTINGS_INVALID_FINDING` is exported from `src/kernel/contract/status.ts`.
+
+## [0.18.0] - 2026-09-25
+
+- **The interview can run from scripted answers and refuse a loosening reseal.** `runInterview` takes `nonLoosening`, which accepts only a first seal or a reseal of a readable seal and, before sealing, compares the new contract with the sealed one through `looseningChanges` (`src/kernel/contract/loosening.ts`). Removing a folder, property, or template, opening an axis, dropping a requirement, heading, or search exclusion, changing a type, fixed value, pattern, or apply folder, and widening an allowed list or range are loosening; for a single-valued type, fixed and allowed rules compare as value sets. Moving a sealed template's source is `removed` under `templates.<name>.source`, since search exclusion is built from sealed sources, and apply folders compare after NFC and separator normalization. The result names `{field, kind}` only. `scriptedIO` (`src/kernel/contract/scripted-interview.ts`) answers questions by id, turns a re-ask into `CONTRACT_ANSWER_INVALID`, reports an unknown id as `CONTRACT_ANSWER_UNKNOWN`, and ends `incomplete` with the unanswered questions instead of sealing.
+- **`looseningChanges` keeps a sealed template exactly as strict.** The judge enforces a scoped template on an edit only when the previous content passed it, so a stricter template would switch its checks off for notes that fail it. Under `nonLoosening`, an added required heading, required property, or narrowed rule, a narrower narrowed rule, or a narrowed property whose type becomes newly known is `template-tightened`; only a fixed value and an allowed list that accept the same single value count as equal, and headings compare after NFC normalization. Folder and property rules may still tighten, since the judge checks changed values against the next rules without relying on the previous content passing. `templateAxis` reads the property type with `Object.hasOwn`.
+- **`looseningChanges` closes three gaps.** A fixed value and an allowed list imply each other only when the field's type is single-valued (`singleValued` in `judge.ts`); for a list type or an unregistered field they compare as different kinds. A template newly given an apply folder that equals, holds, or sits inside a sealed scoped template's folder is `apply-folder-overlap`. `unsafePatternChanges` names sealed pattern rules that `patternRefusal` now refuses as `pattern-unsafe`; the `nonLoosening` interview refuses them, and the full-authority interview asks for only those rules again and keeps the rest. `contractDoctor` reports them as `unsafePatterns` and points recovery at `oms setup`. Lookups use `Object.hasOwn`, and template `narrowedRules` are built on a null-prototype object, so a field named `constructor` or `__proto__` is compared as data.
+
 ## [0.17.0] - 2026-09-25
 
 - **Breaking: the sealed contract replaces the `.oms/` policy files.** Older `.oms/*` files (template policy, taxonomy, type projection) are no longer read; `oms contract doctor` reports them as unexpected control files. `.oms/settings.json` accepts only `version`, `vaultId`, `templateFolder`, `embedding`, and `agentRepair`, and a `templateRoots` key is rejected as `VAULT_SETTINGS_INVALID`. The contract is stored under `~/.oms/vaults/<vault-id>/` and one judge (`src/kernel/contract/judge.ts`) decides every write. Upgrade order: (1) install this release and run `oms host sync`; (2) back up `.oms/settings.json` and keep only `version`, `vaultId`, `templateFolder` (formerly `templateRoots`), `embedding`, and `agentRepair`; (3) run `oms setup` at a terminal to seal the vault; (4) run `oms contract doctor` and review the unexpected control files it lists under `.oms/`; (5) keep those backups while a rollback to 0.16.0 is still possible.

package/CHANGELOG-mcp.md

@@ -4,6 +4,15 @@ MCP server tools and resources belong here.
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-09-26
+
+- `status` `readTools` lists only the read-only tools (`search`, `link`, `status`); it is now derived from each tool's `readOnlyHint`, so `write` no longer appears there. Writes stay described by `writeTools`.
+
+## [0.18.0] - 2026-09-25
+
+- The five MCP tools are unchanged. Agent-driven setup is a tool-less skill over the CLI, not an MCP operation, so no tool can publish, edit, or read the contract.
+- `doctor` `validate` output carries the contract doctor's `unsafePatterns` (`{field, kind}` only, no values). The `note-write.ts` header now notes that a crash between `link()` and removing the temp name leaves a second hard link to the new note, which nothing sweeps.
+
 ## [0.17.0] - 2026-09-25
 
 - **Breaking: `write` takes `{path, content, template?}` with no `op`.** The whole note is judged against the sealed contract and saved atomically only when allowed; a denial returns `{field, kind}` violations and one guidance command. The `guide`, `check`, and `template` operations and the `folderIntents` input are removed. `search` `templates` returns the sealed folders, property names and types, and templates; `doctor` `validate` diagnoses the seal, and `doctor` `regenerate-types` is removed with no alias.

package/CHANGELOG-vendors.md

@@ -4,6 +4,12 @@ Per-host adapter and installer changes belong here.
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-09-26
+
+## [0.18.0] - 2026-09-25
+
+- Claude, Codex, Hermes, and Gajae-Code register the new `setup` skill, so each host installs seven shared skills. Host discovery and installation now report the `setup` skill as installed.
+
 ## [0.17.0] - 2026-09-25
 
 - **Breaking: the Claude guard follows the judge.** The PostToolUse hook and the `oms-post-guard` bin are removed, and `OMS_GUARD` no longer exists. The PreToolUse write matcher is now `Write|Edit|MultiEdit|NotebookEdit`, and a second PreToolUse entry for `Read|Grep|Glob` denies access under `~/.oms/`. A write that the judge finds in violation is denied; when the judge cannot run, the call is allowed with a warning. The hook output format changed accordingly. Codex and Hermes still declare no write hook. Run `oms host sync` after upgrading to rewrite the registration.

package/CHANGELOG.md

@@ -10,6 +10,13 @@ This aggregate changelog contains changes that span multiple layers.
 
 ## [Unreleased]
 
+## [0.18.1] - 2026-09-26
+
+## [0.18.0] - 2026-09-25
+
+- **An agent can seal the vault contract by asking you each setup question.** The new tool-less `setup` skill runs `oms setup --questions`, asks the owner every question one at a time, and seals with `oms setup --answers <file|->`. That path seals a first contract or a reseal that only adds or tightens; a reseal that would loosen is refused with `{field, kind}` only and left to `oms setup` in the owner's own terminal, which keeps full authority. The public surface is seven skills, five MCP tools, and fourteen CLI families. See ADR-007 §3.
+- **An agent reseal can no longer loosen the contract in the gaps a review found.** A fixed value and an allowed list stand in for each other only for a single-valued property, so a list property's `allowed` cannot turn into a looser `fixed`. A newly scoped template whose apply folder overlaps a sealed scoped template is `apply-folder-overlap`. A sealed pattern that today's seal screen refuses (such as one over the length cap sealed by 0.17.0) is `pattern-unsafe`: `--answers` refuses it, `oms contract doctor` reports it as `unsafePatterns` with `{field, kind}` only, and the terminal `oms setup` asks for just that rule again. A sealed template may not change at all through `--answers`, not even to become stricter: the judge enforces a template only where the previous content passed it, so a stricter template would stop checking notes that fail it. Such a change is `template-tightened` and belongs to the owner's terminal `oms setup`. ADR-007 records the residual risks of a pty wrapper and of a fresh first seal after the vault or `.oms/settings.json` is moved, deleted, or re-IDed.
+
 ## [0.17.0] - 2026-09-25
 
 - **Breaking: the vault contract is sealed once by the user and judged on every write.** The interactive `oms setup` interviews folders, the property pool, and templates together and seals the contract under `~/.oms/vaults/<vault-id>/`, outside the vault; `.oms/settings.json` is the only OMS file inside it. One judge decides MCP `write {path, content, template?}` and the Claude guard hook, and a violation is refused with `{field, kind}` entries and one guidance command. `oms template`, the MCP `write` guide, check, and template operations, the `interview` and `template` skills, the PostToolUse hook, and `OMS_GUARD` are removed. The public surface is six skills, five MCP tools, and fourteen CLI families. Upgrade order: (1) install this release and run `oms host sync`; (2) back up `.oms/settings.json` and keep only `version`, `vaultId`, `templateFolder` (formerly `templateRoots`), `embedding`, and `agentRepair`; (3) run `oms setup` at a terminal to seal the vault; (4) run `oms contract doctor` and review the unexpected control files it lists under `.oms/`; (5) keep those backups while a rollback to 0.16.0 is still possible.

package/README.ko.md

@@ -18,7 +18,7 @@ Oh My Second Brain(`oms`)은 기존 Obsidian·Markdown 볼트를 AI 호스트와
 
 ## 설정
 
-`oms setup`은 `oms contract setup`과 같은 명령이다. 볼트 전체를 인터뷰해 계약을 봉인한다. 볼트 안에는 `.oms/settings.json`만 쓰고 노트는 수정하지 않는다. 대화형 터미널이 없거나 `OMS_NON_INTERACTIVE=1`이면 실행을 거부하므로 에이전트는 실행하지 않는다. 언제든 다시 실행해 재봉인할 수 있다.
+`oms setup`은 `oms contract setup`과 같은 명령이다. 볼트 전체를 인터뷰해 계약을 봉인한다. 볼트 안에는 `.oms/settings.json`만 쓰고 노트는 수정하지 않는다. 대화형 인터뷰는 터미널이 없거나 `OMS_NON_INTERACTIVE=1`이면 실행을 거부한다. 에이전트는 `setup` 스킬로만 봉인한다: `oms setup --questions`로 질문을 받아 소유자에게 하나씩 묻고, `oms setup --answers <file|->`로 첫 봉인이나 더 엄격한 재봉인만 한다. 계약을 느슨하게 하는 재봉인은 거부되고 소유자의 터미널 몫이다. 언제든 다시 실행해 재봉인할 수 있다.
 
 ```bash
 oms setup --vault /path/to/vault
@@ -46,7 +46,7 @@ oms setup                                      볼트를 인터뷰하고 계약
 oms status                                     읽기 전용 통합 상태 표시
 ```
 
-`oh-my-second-brain`이 전체 명령이고 `oms`는 짧은 별칭이다. 이 14개 family, 6개 스킬, 5개 MCP 도구는 서로 다른 집합이다. leaf 목록은 [CLI 맵](./docs/cli-map.md)에 있다.
+`oh-my-second-brain`이 전체 명령이고 `oms`는 짧은 별칭이다. 이 14개 family, 7개 스킬, 5개 MCP 도구는 서로 다른 집합이다. leaf 목록은 [CLI 맵](./docs/cli-map.md)에 있다.
 
 ### 도움말 계약
 
@@ -64,7 +64,7 @@ lexical, vector, HyDE, typed-axis 질의는 계약을 통과하지 못할 노트
 
 `write` · `search` · `link` · `status` · `doctor`
 
-6개 스킬(`distill`, `doctor`, `link`, `search`, `status`, `write`)은 호스트 workflow다. `distill`은 도구가 없다.
+7개 스킬(`distill`, `doctor`, `link`, `search`, `setup`, `status`, `write`)은 호스트 workflow다. `distill`과 `setup`은 도구가 없다. `setup`은 소유자에게 setup 질문을 하나씩 묻고 첫 봉인이나 더 엄격한 재봉인만 한다.
 
 다섯 도구는 스킬의 부분집합이며, 두 집합 모두 14개 CLI family와 다르다. 세부 기능은 다섯 도구 아래의 `op` 값으로 남는다. 봉인에는 MCP 작업도 스킬도 없다.
 
@@ -79,7 +79,7 @@ npm install -g oh-my-second-brain
 oms host install --runtime all --vault /path/to/vault --yes
 ```
 
-Gajae-Code에서는 npm 패키지를 marketplace plugin으로 설치한다: `gjc plugin install oms@oms`. GJC는 패키지 루트의 `skills/` 관례 경로에서 여섯 OMS 스킬을 찾는다.
+Gajae-Code에서는 npm 패키지를 marketplace plugin으로 설치한다: `gjc plugin install oms@oms`. GJC는 패키지 루트의 `skills/` 관례 경로에서 일곱 OMS 스킬을 찾는다.
 
 호스트 설치는 정식 볼트를 `${XDG_CONFIG_HOME:-~/.config}/oms/vault.json`에 기록하고, 관리하는 각 호스트 항목에 `oms serve mcp --vault /path/to/vault`를 새긴다. `oms host install|remove|sync|status`는 그 서명된 pointer를 호스트 통합 유지보수에만 쓴다. `oms package update`는 패키지를 업데이트하지만 호스트를 암묵적으로 sync하지 않는다. `oms host sync`를 따로 실행한다.
 

package/README.md

@@ -18,7 +18,7 @@ The authority model is in [architecture](./docs/architecture.md). Vault files ar
 
 ## Setup
 
-`oms setup` is the same command as `oms contract setup`. It interviews the whole vault and seals the contract. It writes only `.oms/settings.json` inside the vault and never modifies notes. It refuses to run without an interactive terminal or under `OMS_NON_INTERACTIVE=1`, so an agent never runs it. Run it again at any time to re-seal.
+`oms setup` is the same command as `oms contract setup`. It interviews the whole vault and seals the contract. It writes only `.oms/settings.json` inside the vault and never modifies notes. The interactive interview refuses to run without a terminal or under `OMS_NON_INTERACTIVE=1`. An agent seals only through the `setup` skill: `oms setup --questions` prints the questions, the agent asks the owner each one, and `oms setup --answers <file|->` seals a first or stricter contract. A reseal that loosens is refused there and left to the owner's terminal. Run it again at any time to re-seal.
 
 ```bash
 oms setup --vault /path/to/vault
@@ -46,7 +46,7 @@ oms setup                                      Interview the vault and seal its
 oms status                                     Show the read-only aggregate status
 ```
 
-`oh-my-second-brain` is the full command; `oms` is its short alias. These fourteen families, the six skills, and the five MCP tools are three different sets. The leaf map is [the CLI map](./docs/cli-map.md).
+`oh-my-second-brain` is the full command; `oms` is its short alias. These fourteen families, the seven skills, and the five MCP tools are three different sets. The leaf map is [the CLI map](./docs/cli-map.md).
 
 ### Help contract
 
@@ -64,7 +64,7 @@ Lexical, vector, HyDE, and typed-axis queries still include notes that would fai
 
 `write` · `search` · `link` · `status` · `doctor`
 
-The six skills (`distill`, `doctor`, `link`, `search`, `status`, `write`) are host workflows. `distill` is tool-less.
+The seven skills (`distill`, `doctor`, `link`, `search`, `setup`, `status`, `write`) are host workflows. `distill` and `setup` are tool-less; `setup` asks the owner each setup question and seals a first or stricter contract.
 
 The five tools are a subset of those skills, and neither set is the fourteen CLI families. Detail capabilities remain `op` values under the five tools. Sealing has no MCP operation and no skill.
 

package/assets/claude/CLAUDE.md

@@ -2,8 +2,10 @@
 
 The vault owns its conventions. The user seals folders, properties, and
 templates once, in an interactive `oms setup` they run themselves at a terminal.
-You never run it. The sealed contract lives outside the vault, and it is not
-yours to read.
+The `setup` skill may seal for them too: you ask each question, and `oms setup
+--answers` seals a first or stricter contract only. Loosening a seal and
+recovering a broken one stay with the user's terminal. The sealed contract lives
+outside the vault, and it is not yours to read.
 
 ## Writing
 
@@ -38,5 +40,5 @@ about or guess the contract's location or values.
   backfills notes. A broken or missing seal is fixed by the user running
   `oms setup`.
 
-Six skills share five MCP tools: `write`, `search`, `link`, `distill`,
-`status`, and `doctor`.
+Seven skills share five MCP tools: `write`, `search`, `link`, `distill`,
+`setup`, `status`, and `doctor`. `distill` and `setup` have no tool.

package/assets/claude/hooks/oms-guard.mjs

@@ -3,9 +3,10 @@
  * oms-guard — PreToolUse wrapper for Claude Code settings.json.
  *
  * Order: parse stdin → normalise the tool name → deny `~/.oms/**` (reads and writes,
- * no spawn) → read tools decided here (no spawn) → deny writes to this guard file and the
- * installed oms package → writes inside a configured vault (the deepest one) are judged by
- * `oms hook pre --vault <vault>`; everything else passes without a spawn.
+ * no spawn) → read tools decided here (no spawn) → deny writes to this guard file, the
+ * installed oms package and Claude's settings files → writes inside a configured vault
+ * (the deepest one) are judged by `oms hook pre --vault <vault>`; everything else passes
+ * without a spawn.
  *
  * Configuration (env vars set by the settings.json hook definition):
  *   OMS_VAULT        — primary vault path
@@ -17,8 +18,13 @@
  * A payload that cannot be parsed (or exceeds the stdin cap) is denied when its raw text
  * names a configured vault or `~/.oms`, and otherwise allowed with one stderr line.
  *
- * Known limit: `~/.claude/settings.json`, where this hook is registered, is not protected;
- * the user edits it legitimately.
+ * Claude's settings files, where this hook is registered, are write-protected like the
+ * guard itself: `settings.json` and `settings.local.json` in `~/.claude` (or
+ * `$CLAUDE_CONFIG_DIR`, `$OMS_CLAUDE_HOME`) and in each configured vault's `.claude/`.
+ * Reads stay allowed; the user edits these files outside the agent.
+ *
+ * Known limit: only the tools in the hook matchers reach this guard. A Bash command that
+ * writes one of these files is not seen here.
  */
 
 import { spawnSync } from "node:child_process";
@@ -249,6 +255,38 @@ function rawNamesProtectedPath(raw, control) {
   return text.includes("~/.oms") || protectedRoots(control).some((root) => text.includes(root));
 }
 
+const HOST_CONFIG_FILES = ["settings.json", "settings.local.json"];
+
+/** Claude config directories whose settings files hold this hook's registration. */
+function hostConfigDirs() {
+  const dirs = [path.join(homedir(), ".claude")];
+  for (const value of [process.env.CLAUDE_CONFIG_DIR, process.env.OMS_CLAUDE_HOME]) {
+    const expanded = value ? expandHome(value) : null;
+    if (expanded) dirs.push(path.resolve(expanded));
+  }
+  for (const vault of configuredVaults()) dirs.push(path.join(vault, ".claude"));
+  return dirs;
+}
+
+/** Each settings file as spelled and as resolved; a symlinked file or directory matches its target. */
+function hostConfigFiles() {
+  const files = [];
+  for (const dir of hostConfigDirs()) {
+    for (const name of HOST_CONFIG_FILES) {
+      const file = path.join(dir, name);
+      files.push(file);
+      try { files.push(realTarget(file, process.cwd())); } catch { /* the spelled form still counts */ }
+    }
+  }
+  return files;
+}
+
+/** Case-insensitive, so a differently cased name on a case-insensitive disk is still caught. */
+function isHostConfig(target, files = hostConfigFiles()) {
+  const wanted = target.toLowerCase();
+  return files.some((file) => file.toLowerCase() === wanted);
+}
+
 const PACKAGE_RUNTIME = ["dist", "assets", "node_modules", "package.json"];
 
 /**
@@ -312,7 +350,8 @@ async function main() {
     target = realTarget(expanded, cwd);
   } catch {
     const textual = path.resolve(cwd, expanded);
-    const exposed = protectedRoots(control).some((root) => atOrUnder(root, textual)) || (searches && under(textual, control));
+    const exposed = protectedRoots(control).some((root) => atOrUnder(root, textual)) || (searches && under(textual, control))
+      || (WRITE_TOOLS.has(tool) && isHostConfig(textual));
     if (exposed) { deny(UNSAFE_PATH_REASON); return; }
     process.stderr.write("[oms] guard could not resolve the target; allowed.\n");
     allow();
@@ -328,6 +367,7 @@ async function main() {
   }
 
   if (guardOwnedRoots().some((root) => atOrUnder(root, target))) { deny(CONTROL_PATH_REASON); return; }
+  if (isHostConfig(target)) { deny(CONTROL_PATH_REASON); return; }
 
   const vault = configuredVaults()
     .filter((root) => under(root, target))

package/assets/codex/AGENTS.md

@@ -6,8 +6,10 @@
 
 The vault owns its conventions. The user seals folders, properties, and
 templates once, in an interactive `oms setup` they run themselves at a terminal.
-You never run it. The sealed contract lives outside the vault, and it is not
-yours to read. `~/.oms` is off-limits. Inside the vault, `.oms/settings.json` is
+The `setup` skill may seal for them too: you ask each question, and `oms setup
+--answers` seals a first or stricter contract only. Loosening a seal and
+recovering a broken one stay with the user's terminal. The sealed contract lives
+outside the vault, and it is not yours to read. `~/.oms` is off-limits. Inside the vault, `.oms/settings.json` is
 the only OMS file.
 
 ## Writing
@@ -40,5 +42,5 @@ guess the contract's location or values.
   backfills notes. A broken or missing seal is fixed by the user running
   `oms setup`.
 
-Codex installs six shared skills (`write`, `search`, `link`, `distill`,
-`status`, `doctor`) backed by the five public MCP tools.
+Codex installs seven shared skills (`write`, `search`, `link`, `distill`,
+`setup`, `status`, `doctor`) backed by the five public MCP tools.

package/assets/codex/rules/oms.md

@@ -1,8 +1,9 @@
 # Oh My Second Brain for Codex
 
 The vault owns its conventions. The user seals them once with an interactive
-`oms setup` they run themselves. You never run it, and the sealed contract is
-not yours to read.
+`oms setup` they run themselves, or through the `setup` skill, which seals a
+first or stricter contract only. Loosening stays with their terminal, and the
+sealed contract is not yours to read.
 
 | User intent | Preferred surface |
 |---|---|

package/assets/hermes/README.md

@@ -5,10 +5,15 @@ Installed by `oms host install --runtime hermes` into:
 - `~/.hermes/skills/knowledge-management/oms/`
 - `~/.hermes/config.yaml` as `mcp_servers.oms`
 
-The shared skill bundle contains six skills: `write`, `search`, `link`,
-`distill`, `status`, and `doctor`. Runtime operations use the five MCP tools
+The shared skill bundle contains seven skills: `write`, `search`, `link`,
+`distill`, `setup`, `status`, and `doctor`. Runtime operations use the five MCP tools
 through `oms serve mcp`.
 
+Hermes takes a skill's category from the first path segment only, so these
+skills are listed under `knowledge-management`. Filter with
+`skills_list(category="knowledge-management")`; the category
+`knowledge-management/oms` matches nothing.
+
 Agents write notes with MCP `write {path, content, template?}`. OMS judges each
 note against the contract the user sealed with `oms setup`. A denial returns
 only `{field, kind}` and a guidance command. There is no completion operation

package/assets/hermes/SOUL.md

@@ -2,8 +2,10 @@
 
 The vault owns its conventions. The user seals folders, properties, and
 templates once, in an interactive `oms setup` they run themselves at a terminal.
-You never run it. The sealed contract lives outside the vault, and it is not
-yours to read. `~/.oms` is off-limits. Inside the vault, `.oms/settings.json` is
+The `setup` skill may seal for them too: you ask each question, and `oms setup
+--answers` seals a first or stricter contract only. Loosening a seal and
+recovering a broken one stay with the user's terminal. The sealed contract lives
+outside the vault, and it is not yours to read. `~/.oms` is off-limits. Inside the vault, `.oms/settings.json` is
 the only OMS file.
 
 ## Writing
@@ -35,5 +37,7 @@ about or guess the contract's location or values.
   notes or backfills guessed values. A broken or missing seal is fixed by the
   user running `oms setup`.
 
-Hermes uses six shared skills (`write`, `search`, `link`, `distill`, `status`,
-`doctor`) backed by the five public MCP tools.
+Hermes uses seven shared skills (`write`, `search`, `link`, `distill`, `setup`,
+`status`, `doctor`) backed by the five public MCP tools. Their skill category
+is `knowledge-management`, so list them with
+`skills_list(category="knowledge-management")`.

package/assets/hermes-manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "oms",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Oh My Second Brain convention layer for Obsidian vaults — Hermes skill bundle and MCP adapter.",
-  "_note": "oms host install writes ~/.hermes/config.yaml mcp_servers.oms and installs the six shared skills with provenance under ~/.hermes/skills/knowledge-management/oms/."
+  "_note": "oms host install writes ~/.hermes/config.yaml mcp_servers.oms and installs the seven shared skills with provenance under ~/.hermes/skills/knowledge-management/oms/."
 }

package/assets/skills/doctor/SKILL.md

@@ -19,8 +19,8 @@ Diagnose the seal and derived indexes, then run only the repair the user named.
 - `build-graph` and `cleanup` repair the derived graph or semantic index the user named.
 - `sync-embeddings` takes exactly one `mode`: `sync`, `embed`, or `repair`. `repair` also requires `repairMode: "rebuild"` or `"drop"` and may set `dryRun`. It backs up the engine store and checks the rebuilt or absent result. It is not forced embedding. Do not send retired boolean `embed` or `force` switches, and do not send repair-only fields with `sync` or `embed`.
 
-A broken or missing seal is recovered by the user running `oms setup` at a terminal; you never run it. The only automatic seal repair is `oms contract doctor --fix`, which re-indexes a moved or unindexed vault and nothing else. `oms contract doctor` also names the unexpected `.oms` entries for the person at the CLI.
+A broken or missing seal is recovered by the user running `oms setup` at a terminal; recovery is never done through the `setup` skill. The only automatic seal repair is `oms contract doctor --fix`, which re-indexes a moved or unindexed vault and nothing else. `oms contract doctor` also names the unexpected `.oms` entries for the person at the CLI.
 
 Index repairs run only when explicitly requested and do not edit notes. There is no default-value backfill: OMS never rewrites a note.
 
-The surface is five MCP tools and six skills.
+The surface is five MCP tools and seven skills.

package/assets/skills/search/SKILL.md

@@ -37,4 +37,4 @@ A typed axis fails loudly on an undeclared field. Remove the typed axis rather t
 
 Search never creates `.oms` and never mutates templates, notes, the contract, or indexes. A search call does not grant edit rights.
 
-The surface is five MCP tools and six skills.
+The surface is five MCP tools and seven skills.

package/assets/skills/setup/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: setup
+description: Seal the vault contract by asking the owner each setup question, then running `oms setup --answers`. Seals a first or stricter contract only.
+---
+
+# setup
+
+Seal the vault contract for the owner without a terminal interview. This is a host recipe skill: it has no MCP tool. It drives two CLI steps, `oms setup --questions` and `oms setup --answers <file>`, and the owner answers every question. You never invent, guess, or fill in an answer.
+
+```text
+/setup [--reask] [--vault <path>]
+```
+
+Always pass the vault with `--vault <path>`. A vault inferred from the current directory is refused.
+
+## Flow
+
+1. Run `oms setup --questions --vault <path>` (add `--reask` only when the owner wants to be asked again about items declined at an earlier seal). It prints JSON: `status` is `questions`, `questions` lists `{id, prompt, kind, choices?, default?}`, and `notes` holds interview lines worth showing the owner. It seals nothing.
+2. Ask the owner each question with AskUserQuestion, one question at a time, in the order printed. Put the recommended option first: the `default` when there is one, otherwise the first of `choices`. A `confirm` question takes yes or no, a `choice` question takes one of `choices`, and a `text` question takes the owner's own words. When the owner skips a question, leave its id out; never answer for them.
+3. Write the answers as one JSON object from question id to answer (`true`/`false` for confirm, the chosen string for choice, a string or number for text) to a temporary file outside the vault, for example under the system temp directory. Run `oms setup --answers <file> --vault <path>`.
+4. Read the JSON result and loop:
+   - `incomplete`: the answers opened follow-up questions, listed in `questions`. Ask those the same way, merge them into the same file, and run `--answers` again. When only `seal` remains, show the owner the `notes` (the contract preview), ask whether to seal, and set `"seal": true` only on a yes.
+   - `sealed`: done. Delete the answers file and run `oms contract doctor --vault <path>` to confirm the seal.
+   - `rejected`: the diagnostic names the question id and why (`CONTRACT_ANSWER_INVALID`, `CONTRACT_ANSWER_UNKNOWN`, `CONTRACT_ANSWERS_INVALID`). Ask the owner that question again and rerun. Nothing was sealed.
+   - `loosening`: the answers would loosen the sealed contract. `changes` names each field and kind of change, never a value. Nothing was sealed. Tell the owner that only they can loosen a contract, by running `oms setup` themselves in a terminal. Do not retry with other answers to get around it. A `template-tightened` change means the answers make a sealed template stricter; that is refused too, because the judge enforces a template relative to the note's previous content, so a stricter template would stop checking notes that fail it. A `pattern-unsafe` change means a sealed pattern that today's seal screen refuses (for example one over the length limit); only the owner's terminal `oms setup` can replace it, and it asks for just that rule again.
+   - `refused`: the seal needs recovery. Tell the owner to run `oms contract doctor`, then `oms setup` themselves in a terminal.
+   - `aborted`: the owner declined to seal. Nothing was sealed.
+
+## Rules
+
+- The answers file is the only file you write. Keep it outside the vault (an answers file inside the vault is refused) and delete it when the run ends.
+- Never read, list, or edit `~/.oms` or any sealed contract file. The CLI output is the whole interface.
+- The values the owner gives (allowed values, patterns, ranges) are part of the hidden contract. Do not repeat them into notes, messages to others, or memory.
+- `--answers` seals a first contract, or a reseal that only adds or tightens. Removing a folder, property, or template, dropping a requirement, or widening a rule is loosening, and it belongs to the owner's own terminal.
+- The reseal may add new folders, properties, and templates, and tighten folder and property rules. Changing an existing sealed template, even to make it stricter, needs `oms setup` in the owner's terminal: the judge enforces templates relative to the previous content, so a stricter template stops checking notes that fail it. When a template's source changed, answer its questions exactly as before.
+- Adding is allowed but is not neutral: registering a new folder, property, or template widens that closed axis, so notes the sealed contract refused there can be written afterwards. Ask the owner about every addition; never add one they did not answer for.
+- A write denied as `unregistered-folder` or `unknown-property` is not yours to clear. Do not create the folder, add the type to `.obsidian/types.json`, or answer the registration question yourself so that the write passes. Ask the owner, and register the folder or property only when they answer. Nothing but that answer enforces this.
+- Never run `oms setup` or `oms contract setup` without `--questions` or `--answers`. The interactive interview is the owner's, in their own terminal.
+- Never run setup under a pseudo-terminal wrapper such as `script`, `expect`, or `unbuffer`, and never set up a terminal for it. The interactive gate only checks for a TTY, so a wrapper would take the owner's full authority, including loosening.
+- Never move or rename the vault with Bash, and never delete, edit, or re-ID `.oms/settings.json`. Either makes the vault look never sealed, so `--answers` would take a fresh first seal in place of the owner's contract.
+
+The surface is five MCP tools and seven skills.

package/assets/skills/status/SKILL.md

@@ -20,14 +20,15 @@ With `op` absent, `status` returns the combined read-only view:
 - `generationDigest` and `diagnostics` for the derived state.
 - The runtime history for this host and vault.
 - `engineGraph`: graph status.
-- `writeTools` and `readTools`: whether writes are gated by a verified target and a readable contract, or disabled and why.
+- `writeTools`: whether writes are gated by a verified target and a readable contract, or disabled and why.
+- `readTools`: the read-only MCP tools (`search`, `link`, `status`). `write` and `doctor` are not listed because they can mutate the vault.
 
 Use `status { op: "graph" }` only for graph status. Do not send `graph` when requesting the combined view.
 
-A drifted or missing template is reported, never resealed here. The fix is the user running `oms setup` at a terminal; you never run it. `oms contract status` shows the same posture and template states from the CLI.
+A drifted or missing template is reported, never resealed here. The fix is a reseal: the user running `oms setup` at a terminal, or the `setup` skill when the reseal only adds or tightens. `oms contract status` shows the same posture and template states from the CLI.
 
 Status never rebuilds indexes, repairs notes, creates `.oms`, or writes the vault. Do not turn a health report into a claim that a note is finished.
 
 Report runtime history separately: events live outside the vault and are scoped to the current host and vault. A missing event means unobserved, never unused. Distinguish actual mutation time from observation time; external drift gives a changed-between interval, not an invented modification timestamp. Surface `LEDGER_APPEND_FAILED` explicitly without claiming a successful vault write failed.
 
-The surface is five MCP tools and six skills.
+The surface is five MCP tools and seven skills.

package/assets/skills/write/SKILL.md

@@ -31,10 +31,10 @@ The judge answers allow or deny. Allow writes the note atomically and returns `{
 
 Placement is explicit: an explicit path, otherwise the folder meaning the user approved, otherwise ask. There is no Inbox fallback.
 
-A vault with no sealed contract accepts any note inside it. A contract that cannot be read denies writes until the user restores it with `oms setup`; you never run it. Paths outside the vault and the vault's control paths are always denied.
+A vault with no sealed contract accepts any note inside it. A contract that cannot be read denies writes until the user restores it with `oms setup` at a terminal; the `setup` skill does not recover a broken seal. Paths outside the vault and the vault's control paths are always denied.
 
 ## Host file tools
 
 In Claude Code, native writes into the vault go through the same judge in the PreToolUse hook. When the hook cannot reach the judge, it allows the write with one warning and records the failure for `oms contract doctor`. Codex and Hermes declare no write hook, so use MCP `write` for vault notes there.
 
-The surface is five MCP tools and six skills.
+The surface is five MCP tools and seven skills.

package/core/AGENTS.md

@@ -7,9 +7,12 @@ Hermes, and others). The vault's meaning belongs to the user.
 
 The user states what the vault means once, by running the interactive `oms setup` at
 a terminal. The interview covers folders, the property pool, and the templates in the
-template folder together, and seals the result as the vault contract. Agents never
-seal: `oms setup` refuses to run without a terminal or under
-`OMS_NON_INTERACTIVE=1`, and there is no MCP operation or skill for it.
+template folder together, and seals the result as the vault contract. The interactive
+interview refuses to run without a terminal or under `OMS_NON_INTERACTIVE=1`. An agent
+seals only through the `setup` skill: `oms setup --questions` prints the questions, the
+agent asks the owner each one, and `oms setup --answers <file>` seals a first or stricter
+contract. A reseal that loosens is refused there and belongs to the terminal. There is no
+MCP operation for setup.
 
 - The sealed contract lives outside the vault under `~/.oms/`. That directory is
   off-limits: do not read, search, or write anything under it.