obeone · October 23, 2026 10:41
diff --git a/README.md b/README.md
diff --git a/agents__editor.md b/agents__editor.md
diff --git a/agents__reviewer.md b/agents__reviewer.md
diff --git a/agents__scout.md b/agents__scout.md
diff --git a/agents__worker.md b/agents__worker.md
diff --git a/allowed-paths b/allowed-paths
 # Global allowed paths — union with $CLAUDE_PROJECT_DIR, $HOME/.claude, and
 # per-project / per-session grants. One path per line, `#` comments, blank
 # lines ignored. `~` and `~/...` expand to $HOME. Machine-local — not meant
 # to be shared across different hosts.
 #
 # Examples (uncomment / adapt to your machine):
 # ~/Documents/code
 # ~/Documents/git
 # ~/go
 # ~/projects
 # ~/.ssh                # if you want Claude to read SSH config (be careful)
 # /tmp
 # /private/tmp
 #
 # Toolchain caches are worth allowlisting too: they are build artifacts,
 # not personal data (read-only in intent; the hook cannot tell).
 # ~/.platformio/packages/framework-arduinoespressif32
 # ~/.platformio/packages/framework-arduinoespressif32-libs
diff --git a/CLAUDE.md b/CLAUDE.md
diff --git a/commands__ntfy-sub.md b/commands__ntfy-sub.md
diff --git a/commands__ntfy.md b/commands__ntfy.md
diff --git a/commands__worktree-finish.md b/commands__worktree-finish.md
diff --git a/commands__worktree-start.md b/commands__worktree-start.md
diff --git a/docs__filesystem-policy.md b/docs__filesystem-policy.md
diff --git a/docs__sessions.md b/docs__sessions.md
diff --git a/docs__shared-checkout-lock.md b/docs__shared-checkout-lock.md
diff --git a/guidelines__karpathy.md b/guidelines__karpathy.md
diff --git a/hooks__backup-claude-config.sh b/hooks__backup-claude-config.sh
 #!/usr/bin/env bash
 # PreToolUse hook — snapshot ~/.claude/** files before they are modified.
 #
 # On every Edit/Write/NotebookEdit whose target lives under ~/.claude, copy
 # the *current* file to ~/.claude/.backups/<mirrored-path>.bak.<datetime>
 # before the tool overwrites it. Side-effect only: always exits 0, never
 # blocks the operation. New files (nothing to back up) are skipped.
 set -euo pipefail

 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 BACKUP_ROOT="$CLAUDE_DIR/.backups"

 # Hook payload arrives as JSON on stdin; pull out the target file path.
 payload="$(cat || true)"
 file_path="$(printf '%s' "$payload" | python3 -c 'import sys, json
 try:
    print(json.load(sys.stdin).get("tool_input", {}).get("file_path", ""))
 except Exception:
    print("")' 2>/dev/null || true)"

 # Need a real, existing regular file to snapshot.
 [ -n "$file_path" ] || exit 0
 [ -f "$file_path" ] || exit 0

 # Canonicalize (resolve the directory portion) to an absolute path.
 abs="$(cd "$(dirname "$file_path")" 2>/dev/null && pwd)/$(basename "$file_path")" || exit 0

 # Only files under ~/.claude, and never back up the backups themselves.
 case "$abs" in
  "$BACKUP_ROOT"/*) exit 0 ;;
  "$CLAUDE_DIR"/*) : ;;
  *) exit 0 ;;
 esac

 # Mirror the relative path under the backup root, suffixed with a timestamp.
 rel="${abs#"$CLAUDE_DIR"/}"
 ts="$(date +%Y%m%d-%H%M%S)"
 dest="$BACKUP_ROOT/$rel.bak.$ts"
 mkdir -p "$(dirname "$dest")"
 cp -p "$abs" "$dest" 2>/dev/null || true

 # Retention: prune backups older than 30 days, then drop empty mirror dirs.
 # Runs opportunistically here — the dir only grows when a backup is made,
 # so cleaning on write keeps it bounded without a separate scheduler.
 find "$BACKUP_ROOT" -type f -name '*.bak.*' -mtime +30 -delete 2>/dev/null || true
 find "$BACKUP_ROOT" -mindepth 1 -type d -empty -delete 2>/dev/null || true

 exit 0
diff --git a/hooks__codegraph-autoinit.sh b/hooks__codegraph-autoinit.sh
 #!/usr/bin/env bash
 # Version: 1.0.0
 # SessionStart hook: SUGGEST CodeGraph init for git projects that lack an index.
 #
 # Does NOT run codegraph itself. When the project is a git repo with no
 # .codegraph/ index, it injects context (SessionStart additionalContext) asking
 # the assistant to OFFER `codegraph init` to the user; the assistant runs it
 # only on the user's confirmation. Stays silent (no output) otherwise.
 #
 # Exit 0 unconditionally: this hook must never fail a session start.

 proj="${CLAUDE_PROJECT_DIR:-$PWD}"
 cg="$(command -v codegraph 2>/dev/null || echo "$HOME/.local/bin/codegraph")"

 [ -x "$cg" ]              || exit 0   # codegraph not installed
 [ -e "$proj/.git" ]       || exit 0   # not a git repo (dir or worktree file)
 [ -d "$proj/.codegraph" ] && exit 0   # already initialized

 msg="This git project ($proj) has no CodeGraph index (.codegraph/ is absent). Offer to run \`codegraph init\` to build the structural code-intelligence index, and run it ONLY if the user agrees. Make sure .codegraph/ is git-ignored (globally or in this repo) so the index never gets committed."

 # Emit SessionStart additionalContext as valid JSON (python3 handles escaping).
 CG_MSG="$msg" python3 -c '
 import json, os
 print(json.dumps({
    "hookSpecificOutput": {
        "hookEventName": "SessionStart",
        "additionalContext": os.environ["CG_MSG"],
    }
 }))
 '

 exit 0
diff --git a/hooks__enforce-allowed-paths.sh b/hooks__enforce-allowed-paths.sh
 #!/usr/bin/env bash
 # Version: 1.0.1
 # PreToolUse hook: restrict Read/Write/Edit/NotebookEdit to allowed paths.
 # Allowlist lives in lib/allowed-paths-common.sh. Violations yield
 # permissionDecision "ask" (explicit user confirmation).

 set -u
 # Only enforce on this host. Set your own hostname below (or delete this
 # guard line entirely to enforce on every machine, including remote hosts
 # reached via SSH, containers, CI, etc.).
 [ "$(hostname -s 2>/dev/null)" = "my-workstation" ] || exit 0
 # shellcheck source=lib/allowed-paths-common.sh
 . "$(dirname "$0")/lib/allowed-paths-common.sh"

 payload="$(cat)"
 path="$(printf '%s' "$payload" | jq -r '
  .tool_input.file_path
  // .tool_input.path
  // .tool_input.notebook_path
  // empty
 ')"
 [ -z "$path" ] && exit 0

 session_id="$(printf '%s' "$payload" | jq -r '.session_id // empty')"

 case "$path" in
  /*) abs="$path" ;;
  *)  abs="${CLAUDE_PROJECT_DIR:-$PWD}/$path" ;;
 esac

 # include_system=0: Read/Write outside user data needs explicit approval.
 if is_path_allowed "$abs" "$session_id" 0; then
  exit 0
 fi

 jq -n --arg p "$abs" '{
  hookSpecificOutput: {
    hookEventName: "PreToolUse",
    permissionDecision: "ask",
    permissionDecisionReason: ("Path outside allowed dirs (project + ~/.claude + grants in ~/.claude/allowed-paths, $project/.claude/allowed-paths, /tmp/claude-allowed-paths.$sid): " + $p)
  }
 }'
 exit 0
diff --git a/hooks__enforce-worktree.sh b/hooks__enforce-worktree.sh
 #!/bin/bash
 # Version: 1.1.1
 # Hook: Enforce worktree policy for file modifications
 # Blocks Edit/Write operations on project files when not working in a .claude/worktrees/ directory.
 # Whitelists configuration and metadata files that are legitimately edited outside worktrees.

 INPUT=$(cat /dev/stdin)
 FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
 CWD=$(echo "$INPUT" | jq -r '.cwd // empty')

 # If no file path, let it through (shouldn't happen for Edit/Write)
 if [[ -z "$FILE_PATH" ]]; then
    exit 0
 fi

 # Check if we're already in a worktree (CWD or file path contains a worktree dir)
 # This check must stay ahead of the whitelist below: worktrees live inside
 # .claude/, so the whitelist would otherwise swallow every worktree file as a
 # configuration file.
 # The bare /.worktrees/ alternative is the legacy location and is transitional:
 # it stays only until the worktrees created before the move are migrated.
 if [[ "$CWD" == *"/.claude/worktrees/"* ]] || [[ "$FILE_PATH" == *"/.claude/worktrees/"* ]] || \
   [[ "$CWD" == *"/.worktrees/"* ]] || [[ "$FILE_PATH" == *"/.worktrees/"* ]]; then
    exit 0
 fi

 # Whitelist: files that can be edited outside a worktree
 # - .claude/ directory (settings, hooks, memory), worktrees excepted above
 # - CLAUDE.md project instructions
 # - .github/ directory (workflows, dependabot, etc.)
 if [[ "$FILE_PATH" == *"/.claude/"* ]] || \
   [[ "$FILE_PATH" == *"/CLAUDE.md" ]] || \
   [[ "$FILE_PATH" == *"/.github/"* ]]; then
    exit 0
 fi

 # Check if we're in a git repo at all (if not, don't block)
 if ! git -C "$CWD" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    exit 0
 fi

 # If we got here, we're editing a project file outside a worktree — warn only
 jq -n '{
    "hookSpecificOutput": {
        "hookEventName": "PreToolUse",
        "permissionDecision": "allow",
        "permissionDecisionReason": "⚠️ Working outside a worktree. Consider using /worktree-start for non-trivial changes."
    }
 }'
diff --git a/hooks__karpathy-guidelines.sh b/hooks__karpathy-guidelines.sh
 #!/usr/bin/env bash
 # SessionStart hook: inject the Karpathy coding guidelines into every session.
 #
 # Content is cached at ~/.claude/guidelines/karpathy.md and refreshed from
 # GitHub at most once a week. Origin: the andrej-karpathy-skills plugin
 # (github.com/forrestchang/andrej-karpathy-skills). It was installed as a plugin
 # skill, which meant a permanent entry in the model's skill listing and the odd
 # redundant auto-invocation on top of this hook; skillOverrides cannot mask
 # plugin skills, so the plugin went away and the text stayed.
 #
 # The weekly refresh is synchronous on purpose. It costs a few hundred
 # milliseconds once a week (51 of 52 startups never touch the network) and in
 # exchange the outcome is reported in the very session that performed it,
 # instead of through a marker file read by the next one. The spinner's
 # statusMessage, set in settings.json, says what the wait is for.
 #
 # Output is JSON: additionalContext carries the guidelines, systemMessage
 # reports the refresh outcome to the operator. Beware — Claude Code does NOT
 # fall back to plain text when output starts with '{' and fails to parse, it
 # drops the injection entirely. Keep the jq call valid.

 set -euo pipefail

 dir="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/guidelines"
 cache="$dir/karpathy.md"
 stamp="$dir/.karpathy-checked"
 log="$dir/.karpathy-refresh.log"
 diff_file="$dir/.karpathy-last.diff"
 url="https://raw.githubusercontent.com/forrestchang/andrej-karpathy-skills/main/skills/karpathy-guidelines/SKILL.md"

 max_age_minutes=10080   # 7 days
 timeout_refresh=10      # on the critical path: keep the worst case short

 notice=""        # non-empty => surfaced to the operator as systemMessage
 changed_diff=""  # non-empty => the diff is also appended to the model's context

 # Download, strip the YAML frontmatter, sanity-check, install atomically, and
 # describe what changed. The cache is only ever replaced by content that passed
 # every check, so a 404 page, a captive-portal redirect, or a truncated body
 # leaves it intact.
 refresh() {
  local tmp size added removed rc=0
  tmp="$(mktemp "$dir/.karpathy.XXXXXX")" || return 1
  # shellcheck disable=SC2064
  trap "rm -f '$tmp'" RETURN

  # -S omitted on purpose: a failure is already reported through systemMessage
  # and the log, so curl's own stderr would only duplicate it in the transcript.
  curl -fsL -m "$timeout_refresh" "$url" \
    | awk 'NR==1 && $0=="---" {fm=1; next} fm && $0=="---" {fm=0; next} !fm' \
    | awk 'NF {p=1} p' > "$tmp" || rc=$?

  if [ "$rc" -ne 0 ]; then
    printf '%s  fetch failed (rc=%s)\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$rc" >> "$log"
    notice="Karpathy guidelines: upstream check failed, using the cached copy."
    return 1
  fi

  # Bounded size and an expected first line: cheap guards against a body that
  # downloaded fine but is not the document we asked for.
  size=$(wc -c < "$tmp" | tr -d '[:space:]')   # macOS wc pads its output
  if [ "$size" -lt 500 ] || [ "$size" -gt 32768 ] || ! head -1 "$tmp" | grep -q '^# Karpathy Guidelines$'; then
    printf '%s  rejected: unexpected content (%s bytes)\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$size" >> "$log"
    notice="Karpathy guidelines: upstream returned an unexpected document, kept the cached copy."
    return 1
  fi

  if [ ! -f "$cache" ]; then
    notice="Karpathy guidelines: downloaded from GitHub ($size bytes)."
    printf '%s  bootstrapped (%s bytes)\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$size" >> "$log"
  elif cmp -s "$cache" "$tmp"; then
    # Nothing changed: stay silent. The weekly check is not news.
    :
  else
    # Keep the diff instead of throwing it away: without it the operator only
    # learns that something changed, never what. Written before the mv, while
    # the old version still exists. Counting skips the '+++'/'---' headers by
    # prefix rather than by a '^+[^+]' pattern, which would silently miss an
    # added blank line (a bare '+' has no following character to match).
    diff -u "$cache" "$tmp" > "$diff_file" || true
    added=$(awk '/^\+\+\+ /{next} /^\+/{n++} END{print n+0}' "$diff_file")
    removed=$(awk '/^--- /{next} /^-/{n++} END{print n+0}' "$diff_file")
    notice="Karpathy guidelines UPDATED from GitHub (+$added/-$removed lines). diff: $diff_file"
    changed_diff="$(cat "$diff_file")"
    printf '%s  updated (+%s/-%s lines, %s bytes)\n' \
      "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$added" "$removed" "$size" >> "$log"
  fi

  mv -f "$tmp" "$cache"
  trap - RETURN
  return 0
 }

 mkdir -p "$dir"

 # Refresh when the cache is missing (nothing to serve otherwise) or a week old.
 # Stamp on attempt, not on success: a persistently unreachable upstream must not
 # turn every startup into a failed network round trip.
 if [ ! -f "$cache" ] || [ ! -f "$stamp" ] || [ -n "$(find "$stamp" -mmin "+$max_age_minutes" 2>/dev/null)" ]; then
  touch "$stamp"
  refresh || true
 fi

 [ -f "$cache" ] || exit 0

 context="$(printf 'The following behavioral guidelines are ALWAYS active for this session:\n\n'; cat "$cache")"

 # Only on the run that actually updated the cache: hand the diff to the model so
 # it can tell the operator, in plain language, what upstream changed and whether
 # it alters how it works. Costs tokens only on that one session.
 if [ -n "$changed_diff" ]; then
  context="$(printf '%s\n\n---\n\nThese guidelines were just updated from upstream. In your first reply of this session, briefly tell the operator what changed and whether it alters how you work. Unified diff (old -> new):\n\n```diff\n%s\n```\n' "$context" "$changed_diff")"
 fi

 if [ -n "$notice" ]; then
  jq -n --arg body "$context" --arg msg "$notice" \
    '{systemMessage: $msg,
      hookSpecificOutput: {hookEventName: "SessionStart", additionalContext: $body}}'
 else
  jq -n --arg body "$context" \
    '{hookSpecificOutput: {hookEventName: "SessionStart", additionalContext: $body}}'
 fi
diff --git a/hooks__lib__allowed-paths-common.sh b/hooks__lib__allowed-paths-common.sh
 #!/usr/bin/env bash
 # Shared helpers for enforce-allowed-paths{,-bash}.sh
 #
 # Exports:
 #   is_under <path> <root>               — bool, path is root or under root
 #   is_path_allowed <abs> <sid> <sys>    — bool, abs allowed by any source
 #
 # Extra paths for ad-hoc grants are read (union) from:
 #   ~/.claude/allowed-paths                        (global, permanent)
 #   $CLAUDE_PROJECT_DIR/.claude/allowed-paths      (project, checked in or local)
 #   /tmp/claude-allowed-paths.$session_id          (current session only)
 # Format: one path per line, blank lines and `#` comments ignored.
 # `~` and `~/...` expand to $HOME.

 # Hardcoded minimum: only truly universal paths. Everything else (personal
 # data dirs, ~/.ssh, etc.) lives in ~/.claude/allowed-paths so the same
 # hook works unchanged on any machine (local, remote over SSH, container).
 _HARDCODED_USER_ROOTS=(
  "$HOME/.claude"
 )

 _SYSTEM_ROOTS=(
  /usr /bin /sbin /opt /Library /System /Applications /dev
  /tmp /var/folders /private/tmp /private/var/folders
 )

 is_under() {
  local p="$1" root="$2"
  [ "$p" = "$root" ] && return 0
  case "$p" in "$root"/*) return 0 ;; esac
  return 1
 }

 _expand_tilde() {
  case "$1" in
    "~")   printf '%s' "$HOME" ;;
    "~/"*) printf '%s' "$HOME/${1#"~/"}" ;;
    *)     printf '%s' "$1" ;;
  esac
 }

 _emit_extra_paths() {
  local session_id="$1" f line
  local files=(
    "$HOME/.claude/allowed-paths"
    "${CLAUDE_PROJECT_DIR:-$PWD}/.claude/allowed-paths"
  )
  [ -n "$session_id" ] && files+=("/tmp/claude-allowed-paths.$session_id")
  for f in "${files[@]}"; do
    [ -r "$f" ] || continue
    while IFS= read -r line || [ -n "$line" ]; do
      line="${line#"${line%%[![:space:]]*}"}"
      line="${line%"${line##*[![:space:]]}"}"
      [ -z "$line" ] && continue
      case "$line" in \#*) continue ;; esac
      _expand_tilde "$line"
      printf '\n'
    done < "$f"
  done
 }

 is_path_allowed() {
  local path="$1" session_id="${2:-}" include_system="${3:-0}"
  local proj="${CLAUDE_PROJECT_DIR:-$PWD}" root
  is_under "$path" "$proj" && return 0
  # Always allow git worktrees at the Claude Code default location
  # (<project>/.claude/worktrees/<branch>). The second alternative,
  # <project>/.worktrees/<branch>, is the legacy location: it is tolerated
  # only for worktrees created before the move and can be dropped once none
  # of them remain.
  # Worktree sessions run with cwd inside the worktree, but
  # CLAUDE_PROJECT_DIR is fixed at session start and may still point at the
  # main checkout, so the is_under check above would otherwise miss them.
  case "$path" in
    */.claude/worktrees/*|*/.worktrees/*) return 0 ;;
  esac
  for root in "${_HARDCODED_USER_ROOTS[@]}"; do
    is_under "$path" "$root" && return 0
  done
  if [ "$include_system" = "1" ]; then
    for root in "${_SYSTEM_ROOTS[@]}"; do
      is_under "$path" "$root" && return 0
    done
  fi
  while IFS= read -r root; do
    [ -z "$root" ] && continue
    is_under "$path" "$root" && return 0
  done < <(_emit_extra_paths "$session_id")
  return 1
 }
diff --git a/hooks__session-git-platform.sh b/hooks__session-git-platform.sh
 #!/usr/bin/env bash
 # SessionStart hook — surface the repo's git platform into session context so
 # the model never runs `git remote -v` or reasons about the host.
 #
 # Precedence: $CLAUDE_GIT_PLATFORM (exported by the `claude` launcher) wins;
 # otherwise auto-detect via git-platform-detect.sh against the session cwd.
 # Emits the result as SessionStart additionalContext (JSON — raw stdout is
 # ignored for context). Stays silent (no context) if neither yields anything.
 set -uo pipefail

 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"

 # SessionStart payload carries cwd on stdin; fall back to $PWD.
 payload="$(cat 2>/dev/null || true)"
 cwd="$(printf '%s' "$payload" | python3 -c 'import sys, json
 try:
    print(json.load(sys.stdin).get("cwd", ""))
 except Exception:
    print("")' 2>/dev/null || true)"
 [ -n "$cwd" ] || cwd="$PWD"

 line=""
 if [ -n "${CLAUDE_GIT_PLATFORM:-}" ]; then
  line="Git platform (from \$CLAUDE_GIT_PLATFORM): ${CLAUDE_GIT_PLATFORM}. Use it as-is for git-host ops (MCP-first, CLI fallback); do not run \`git remote -v\`."
 else
  detected="$(bash "$CLAUDE_DIR/scripts/git-platform-detect.sh" "$cwd" 2>/dev/null || true)"
  [ -n "$detected" ] && line="$detected"
 fi

 # Nothing to say (no override, not a git repo) → emit no context.
 [ -n "$line" ] || exit 0

 # SessionStart context MUST be JSON under hookSpecificOutput.additionalContext.
 printf '%s' "$line" | python3 -c 'import sys, json
 ctx = sys.stdin.read()
 print(json.dumps({"hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": ctx}}))'
 exit 0
diff --git a/hud__reposition.pl b/hud__reposition.pl
 #!/usr/bin/env perl
 # Reposition OMC HUD segments:
 #   - move "[OMC] ... omc update" to the far right of the git/branch line
 #   - move "Model: ..." to the far right of the stats line (5h/wk/session/ctx)
 # Right-alignment is computed against HUD_COLS (terminal width).
 # Runs AFTER the wrapper's existing per-line perl (so [OMC#x] is already [OMC]).
 use strict;
 use warnings;

 # Visible length: strip SGR escapes, then count chars.
 sub vl {
    my $s = shift;
    $s =~ s/\e\[[0-9;]*m//g;
    return length $s;
 }

 my $cols = $ENV{HUD_COLS} && $ENV{HUD_COLS} =~ /^\d+$/ ? $ENV{HUD_COLS} + 0 : 100;
 my $SEP  = "\e[2m | \e[0m";           # exact top-level element separator

 local $/;                              # slurp
 my $text = <STDIN>;
 $text = '' unless defined $text;
 my @L = split /\n/, $text, -1;

 # --- drop the "thinking" indicator segment plus one adjacent separator ---
 # (matches any SGR wrapper so it survives a format/color change)
 for my $l (@L) {
    $l =~ s/\Q$SEP\E\e\[[0-9;]*mthinking\e\[0m//
      or $l =~ s/\e\[[0-9;]*mthinking\e\[0m\Q$SEP\E//
      or $l =~ s/\e\[[0-9;]*mthinking\e\[0m//;
 }

 # --- extract the OMC label+update segment (bold or dim wrapper) ---
 my $omc = '';
 for my $i (0 .. $#L) {
    if ($L[$i] =~ /(\e\[[0-9;]*m\[OMC\][^\e]*\e\[0m)/) {
        $omc = $1;
        # remove segment plus one adjacent separator (it is the first segment)
        $L[$i] =~ s/\Q$omc\E\Q$SEP\E//
          or $L[$i] =~ s/\Q$SEP\E\Q$omc\E//
          or $L[$i] =~ s/\Q$omc\E//;
        last;
    }
 }

 # --- extract the Model segment (cyan) ---
 my $model = '';
 for my $i (0 .. $#L) {
    if ($L[$i] =~ /(\e\[36mModel:[^\e]*\e\[0m)/) {
        $model = $1;
        $L[$i] =~ s/\Q$model\E\Q$SEP\E//
          or $L[$i] =~ s/\Q$SEP\E\Q$model\E//
          or $L[$i] =~ s/\Q$model\E//;
        last;
    }
 }

 # --- drop lines that became empty (whitespace-only after stripping ANSI) ---
 @L = grep { vl($_) > 0 } @L;

 # --- locate target lines by content ---
 my ($git_i, $stat_i) = (-1, -1);
 for my $i (0 .. $#L) { if ($L[$i] =~ /branch:/)                { $git_i  = $i; last } }
 for my $i (0 .. $#L) { if ($L[$i] =~ /5h:|wk:|session:|ctx:/)  { $stat_i = $i; last } }
 $git_i  = 0 if $git_i  < 0 && @L;
 if ($stat_i < 0) { $stat_i = ($git_i + 1 <= $#L) ? $git_i + 1 : $git_i; }

 # --- right-align helper (append with computed padding) ---
 my $rpad = sub {
    my ($idx, $seg) = @_;
    return if $seg eq '' || $idx < 0 || $idx > $#L;
    my $pad = $cols - vl($L[$idx]) - vl($seg);
    $pad = 1 if $pad < 1;
    $L[$idx] .= (' ' x $pad) . $seg;
 };

 # OMC -> right of git line
 $rpad->($git_i, $omc) if $omc ne '';
 # Model -> right of stats line (avoid collision with the git line)
 $rpad->($stat_i, $model) if $model ne '' && $stat_i != $git_i;

 print join("\n", @L);
diff --git a/hud__statusline-wrapper.sh b/hud__statusline-wrapper.sh
 #!/bin/sh
 # Version: 1.3.1
 # statusline-wrapper.sh
 # Runs the OMC HUD on line 1, enriched project info on line 2.
 # Requires a Nerd Font in your terminal: the folder glyph on line 2 and the
 # per-stack icons below are Nerd Font private-use codepoints, and render as
 # boxes/tofu without one.

 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

 # Read stdin once into a variable
 input=$(cat)

 # Optional side-car: hand the same payload to a usage tap, which keeps the plan
 # quota windows in ~/.claude/buddy-usage.json for an external panel to read.
 # Point USAGE_TAP at your own binary, or drop this block if you have none.
 # Backgrounded and fully redirected on purpose: this wrapper IS the status line,
 # rendered on every assistant message and by several sessions at once, so the tap
 # must never slow it down, never write to stdout, and never fail it.
 USAGE_TAP="$HOME/path/to/usage-tap/bin/buddy-usage-tap"
 if [ -x "$USAGE_TAP" ]; then
  printf '%s' "$input" | "$USAGE_TAP" >/dev/null 2>&1 &
 fi

 # Extract fields from JSON input
 cwd=$(printf '%s' "$input" | jq -r '.cwd // .workspace.current_dir // empty' 2>/dev/null)

 # Run OMC HUD with the same input, capture output
 omc_output=$(printf '%s' "$input" | sh "$SCRIPT_DIR/find-node.sh" "$SCRIPT_DIR/omc-hud.mjs" 2>/dev/null)

 # Post-process OMC output:
 #   - strip version: [OMC#4.11.5] -> [OMC]
 #   - drop " sn:X%..." segment up to next " |" or end
 #   - drop "session:XXm" segment including trailing " |" separator
 # Guarded: without perl the HUD line is passed through unprocessed rather than
 # swallowed by an empty command substitution.
 if command -v perl >/dev/null 2>&1; then
  omc_output=$(printf '%s' "$omc_output" | perl -pe '
    # 1. Strip OMC version tag
    s/\[OMC#\d+\.\d+\.\d+\]/[OMC]/g;
    # 2. Remove sn block. Format: " \e[2msn:\e[0m\e[32mXX%\e[0m\e[2m*\e[0m\e[2m(~...)\e[0m"
    s/ \e\[2msn:.*?\)\e\[0m//g;
    # 3. Remove "session:XXm" + its trailing dim " | " separator
    s/session:\e\[[0-9;]+m\d+m\e\[0m\s*\e\[2m\s*\|\s*\e\[0m\s*//g;
    # 4. Replace d -> j in duration markers like "2d14h" (days -> jours FR)
    s/(\d+)d(\d+h)/$1j$2/g;
  ')
 fi

 # Terminal width (the same one the HUD wrapped against) for right-alignment.
 # stty on the controlling tty is reliable even though stdout is piped here.
 hud_cols=$( { stty size </dev/tty | awk '{print $2}'; } 2>/dev/null )
 case "$hud_cols" in ''|*[!0-9]*) hud_cols="$COLUMNS" ;; esac
 case "$hud_cols" in ''|*[!0-9]*) hud_cols=$(tput cols 2>/dev/null) ;; esac
 case "$hud_cols" in ''|*[!0-9]*) hud_cols=100 ;; esac

 # Reposition segments: "[OMC] ... omc update" -> far right of the git line,
 # "Model: ..." -> far right of the stats line, and drop the "thinking" badge.
 # Skip cleanly if perl or the helper script is missing: the status line still
 # renders, just without the right-alignment pass.
 if [ -f "$SCRIPT_DIR/reposition.pl" ] && command -v perl >/dev/null 2>&1; then
  omc_output=$(printf '%s' "$omc_output" | HUD_COLS="$hud_cols" perl "$SCRIPT_DIR/reposition.pl")
 fi

 # --- Helpers ---

 # Dim separator: │
 sep() {
  printf ' \033[2m│\033[0m '
 }

 # Detect git info: branch + dirty/clean
 # Falls back to multi-repo summary if cwd is a parent of several repos.
 git_info() {
  local dir="$1"
  [ -n "$dir" ] || return 0

  if git -C "$dir" rev-parse --git-dir >/dev/null 2>&1; then
    local branch
    branch=$(git -C "$dir" --no-optional-locks branch --show-current 2>/dev/null)
    [ -z "$branch" ] && branch=$(git -C "$dir" --no-optional-locks rev-parse --short HEAD 2>/dev/null)
    [ -z "$branch" ] && return 0

    local dirty=""
    if [ -n "$(git -C "$dir" --no-optional-locks status --porcelain 2>/dev/null | head -1)" ]; then
      dirty="\033[33m±\033[0m"
    else
      dirty="\033[32m✓\033[0m"
    fi

    # ahead/behind + upstream name when diverged
    local ab=""
    local upstream
    upstream=$(git -C "$dir" --no-optional-locks rev-parse --abbrev-ref '@{upstream}' 2>/dev/null)
    if [ -n "$upstream" ]; then
      local ahead behind
      ahead=$(git -C "$dir" --no-optional-locks rev-list --count '@{upstream}..HEAD' 2>/dev/null)
      behind=$(git -C "$dir" --no-optional-locks rev-list --count 'HEAD..@{upstream}' 2>/dev/null)
      [ "${ahead:-0}" -gt 0 ] && ab=" \033[32m↑${ahead}\033[0m"
      [ "${behind:-0}" -gt 0 ] && ab="${ab} \033[31m↓${behind}\033[0m"
      # Only surface upstream name when it's non-obvious (not origin/<same-branch>)
      if { [ "${ahead:-0}" -gt 0 ] || [ "${behind:-0}" -gt 0 ]; } \
         && [ "$upstream" != "origin/$branch" ]; then
        ab="${ab} \033[2m${upstream}\033[0m"
      fi
    fi

    # nf-dev-git_branch U+E725
    printf '\033[35m\xee\x9c\xa5 %s\033[0m %b%b' "$branch" "$dirty" "$ab"
    return 0
  fi

  # Not in a git repo — scan immediate subdirs for child repos
  local count=0 child single=""
  for child in "$dir"/*/; do
    [ -d "${child}.git" ] && { count=$((count+1)); single="${child%/}"; }
  done
  if [ "$count" -eq 1 ]; then
    # Single child repo: show its branch (but mark as child)
    local cb
    cb=$(git -C "$single" --no-optional-locks branch --show-current 2>/dev/null)
    [ -n "$cb" ] && printf '\033[2;35m\xee\x9c\xa5\033[0m \033[35m%s\033[0m\033[2m/%s\033[0m' "$(basename "$single")" "$cb"
  elif [ "$count" -gt 1 ]; then
    # nf-oct-repo U+EA62
    printf '\033[2;35m\xee\xa9\xa2 %d repos\033[0m' "$count"
  fi
 }

 # Detect project stack from files present
 detect_stack() {
  local dir="$1"
  [ -n "$dir" ] || return 0
  local items=""
  # Dim middle dot separator between stack icons
  local s=' \033[2m·\033[0m '

  # Python: nf-seti-python U+E235
  if [ -f "$dir/pyproject.toml" ] || [ -f "$dir/setup.py" ] || [ -f "$dir/requirements.txt" ]; then
    items="\033[33m\xee\x88\xb5\033[0m"
    # Show venv name if active
    if [ -n "$VIRTUAL_ENV" ]; then
      items="${items} \033[2m$(basename "$VIRTUAL_ENV")\033[0m"
    fi
  fi

  # Node/JS: nf-md-nodejs U+F0399 -> too many bytes, use nf-dev-javascript U+E781
  if [ -f "$dir/package.json" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[32m\xee\x9e\x81\033[0m"
  fi

  # Go: nf-seti-go U+E627
  if [ -f "$dir/go.mod" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[36m\xee\x98\xa7\033[0m"
  fi

  # Rust: nf-dev-rust U+E7A8
  if [ -f "$dir/Cargo.toml" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[31m\xee\x9e\xa8\033[0m"
  fi

  # Docker: nf-dev-docker U+E7B0
  if [ -f "$dir/Dockerfile" ] || [ -f "$dir/docker-compose.yml" ] || [ -f "$dir/compose.yaml" ] || [ -f "$dir/compose.yml" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[34m\xee\x9e\xb0\033[0m"
  fi

  # Helm: nf-md-helm U+F0833 -> use ⎈
  if [ -d "$dir/.helm" ] || [ -f "$dir/Chart.yaml" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[36m⎈\033[0m"
  fi

  [ -n "$items" ] && printf '%b' "$items"
 }

 # Build colored pwd
 colored_pwd() {
  local path="$1"
  local home="$HOME"
  case "$path" in
    "$home"/*)  path="~/${path#"$home"/}" ;;
    "$home")    path="~" ;;
  esac

  case "$path" in
    */*)
      parent="${path%/*}"
      base="${path##*/}"
      printf '\xef\x81\xbb  \033[37m%s/\033[0m\033[1;32m%s\033[0m' "$parent" "$base"
      ;;
    *)
      printf '\xef\x81\xbb  \033[1;32m%s\033[0m' "$path"
      ;;
  esac
 }

 # --- Output ---

 # Line 1: OMC HUD
 if [ -n "$omc_output" ]; then
  printf '%s\n' "$omc_output"
 fi

 # Line 2: pwd │ git │ stack
 if [ -n "$cwd" ]; then
  colored_pwd "$cwd"

  gi=$(git_info "$cwd")
  if [ -n "$gi" ]; then
    sep
    printf '%b' "$gi"
  fi

  st=$(detect_stack "$cwd")
  if [ -n "$st" ]; then
    sep
    printf '%b' "$st"
  fi

  printf '\n'
 fi
diff --git a/install.sh b/install.sh
 #!/usr/bin/env bash
 # Version: 1.1.0
 #
 # Fresh-machine installer for the public Claude Code configuration template
 # gist, with an optional private overlay gist installed on top.
 #
 # Usage:
 #   curl -fsSL https://gist.githubusercontent.com/obeone/40e576f2db145a3ec1c100ee46b1a6bb/raw/install.sh | bash
 #   curl -fsSL https://gist.githubusercontent.com/obeone/40e576f2db145a3ec1c100ee46b1a6bb/raw/install.sh | bash -s -- <overlay-gist-id-or-url>
 #   bash install.sh [--force] [<overlay-gist-id-or-url>]
 #
 # Environment:
 #   CLAUDE_CONFIG_DIR     target directory (default: $HOME/.claude)
 #   CLAUDE_TEMPLATE_GIST  template gist id or URL (default: the public template)
 #
 # Gist file names are flattened with a double underscore: "a__b__c.md"
 # installs as "a/b/c.md". The template is laid down first, then the overlay:
 # a file at the same path overwrites, a file at a new path is added. Any
 # existing file that would change is backed up to "<file>.bak.<timestamp>".
 #
 # This is meant for a fresh machine. If the target already has a
 # settings.json or CLAUDE.md that differs from what this run would install,
 # it refuses and exits 1 without writing anything: merge by hand instead
 # (see the README), or pass --force to back up the existing file and
 # overwrite it anyway.
 #
 # Everything runs from main(), called on the last line, so that a
 # "curl | bash" run is fully parsed before anything executes.

 set -euo pipefail

 DEFAULT_TEMPLATE_GIST="40e576f2db145a3ec1c100ee46b1a6bb"
 DEST="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
 WORKDIR=""
 FORCE=""

 #######################################
 # Print an informational line on stderr.
 # Arguments: $* message
 #######################################
 log() {
  printf '==> %s\n' "$*" >&2
 }

 #######################################
 # Print a warning on stderr. Does not stop the run.
 # Arguments: $* message
 #######################################
 warn() {
  printf 'WARNING: %s\n' "$*" >&2
 }

 #######################################
 # Print an error on stderr and exit non-zero.
 # Arguments: $* message
 #######################################
 die() {
  printf 'ERROR: %s\n' "$*" >&2
  exit 1
 }

 #######################################
 # Remove the temporary work directory. Installed as an EXIT trap.
 #######################################
 cleanup() {
  if [ -n "$WORKDIR" ] && [ -d "$WORKDIR" ]; then
    rm -rf "$WORKDIR"
  fi
 }

 #######################################
 # Print the usage text.
 #######################################
 usage() {
  cat <<'EOF'
 Usage: install.sh [--force] [<overlay-gist-id-or-url>]

 Installs the public Claude Code configuration template into
 ${CLAUDE_CONFIG_DIR:-$HOME/.claude}, then an optional private overlay gist on
 top of it. Existing files that change are backed up as <file>.bak.<timestamp>.

 Meant for a fresh machine: if settings.json or CLAUDE.md already exist there
 and differ from what this run would install, it refuses and exits 1 without
 writing anything. Merge by hand instead (see the README), or pass --force to
 back up the existing file and overwrite it anyway.

 Environment:
  CLAUDE_CONFIG_DIR     target directory (default: $HOME/.claude)
  CLAUDE_TEMPLATE_GIST  template gist id or URL (default: the public template)
 EOF
 }

 #######################################
 # Extract a 32-character hex gist id from a bare id or any gist URL
 # (gist.github.com/<user>/<id>, raw URLs, <id>.git clone URLs).
 # Arguments: $1 id or URL
 # Outputs:   the id on stdout
 # Returns:   1 if no id is found
 #######################################
 parse_gist_id() {
  local id
  # Last match wins: in a raw URL the gist id comes before the revision sha,
  # but a revision sha is 40 hex chars and never matches exactly 32 between
  # word boundaries, so the bounded pattern below picks the gist id.
  id=$(printf '%s\n' "$1" | tr 'A-F' 'a-f' \
    | grep -oE '(^|[^0-9a-f])[0-9a-f]{32}([^0-9a-f]|$)' \
    | grep -oE '[0-9a-f]{32}' | tail -n 1) || true
  [ -n "$id" ] || return 1
  printf '%s\n' "$id"
 }

 #######################################
 # Fetch a gist with git (shallow clone over HTTPS). Secret gists are
 # readable by id without authentication.
 # Arguments: $1 gist id, $2 destination directory (must not exist)
 # Returns:   non-zero on failure
 #######################################
 fetch_with_git() {
  # No terminal prompt: an unknown id makes GitHub ask for credentials, and
  # under "curl | bash" that prompt would hang or eat the piped script.
  GIT_TERMINAL_PROMPT=0 git clone --quiet --depth 1 \
    "https://gist.github.com/$1.git" "$2" </dev/null >/dev/null 2>&1
 }

 #######################################
 # Fetch a gist through the GitHub REST API, for machines without git.
 # python3 parses the JSON; curl downloads each file from its raw_url.
 # Arguments: $1 gist id, $2 destination directory (must not exist)
 # Returns:   non-zero on failure
 #######################################
 fetch_with_api() {
  local id="$1" dir="$2" json="$WORKDIR/api-$1.json" list name url
  command -v python3 >/dev/null 2>&1 || { warn "python3 is required when git is absent"; return 1; }
  command -v curl >/dev/null 2>&1 || { warn "curl is required when git is absent"; return 1; }

  curl -fsSL -H 'Accept: application/vnd.github+json' \
    "https://api.github.com/gists/$id" -o "$json" </dev/null || return 1
  mkdir -p "$dir"

  # One "name<TAB>raw_url" line per file. Every file is downloaded from its
  # raw_url rather than taken from "content", which the API truncates for
  # large files ("truncated": true). A truncated file list (over 300 files)
  # cannot be completed without a clone, so it is only reported.
  list=$(python3 - "$json" <<'PY'
 import json, sys
 data = json.load(open(sys.argv[1]))
 if data.get("truncated"):
    sys.stderr.write("WARNING: gist file list truncated by the API, use git for a full fetch\n")
 for name, meta in sorted(data.get("files", {}).items()):
    print("%s\t%s" % (name, meta["raw_url"]))
 PY
 ) || return 1

  while IFS=$'\t' read -r name url; do
    [ -n "$name" ] || continue
    curl -fsSL "$url" -o "$dir/$name" </dev/null || return 1
  done <<<"$list"
 }

 #######################################
 # Fetch a gist into a directory: git first, then the API as a fallback
 # (git absent, or the clone failed for another reason).
 # Arguments: $1 gist id, $2 destination directory, $3 label for messages
 #######################################
 fetch_gist() {
  local id="$1" dir="$2" label="$3"
  if command -v git >/dev/null 2>&1; then
    if fetch_with_git "$id" "$dir"; then
      return 0
    fi
    warn "git clone of the $label gist failed, trying the GitHub API"
    rm -rf "$dir"
  fi
  fetch_with_api "$id" "$dir" \
    || die "could not fetch the $label gist $id (wrong id, network issue, or GitHub API rate limit)"
 }

 #######################################
 # Copy a fetched gist into the staging directory, keeping flattened names.
 # Later calls overwrite earlier ones, which is how the overlay wins over
 # the template. README.md and install.sh are never installed.
 # Arguments: $1 fetched gist directory, $2 staging directory
 # Outputs:   the number of files staged on stdout
 #######################################
 stage_gist() {
  local src="$1" stage="$2" f name count=0
  for f in "$src"/*; do
    # Skip directories (the .git of a clone is hidden from the glob anyway).
    [ -f "$f" ] || continue
    name=$(basename "$f")
    case "$name" in
      README.md | install.sh) continue ;;
    esac
    # Refuse names that would unflatten outside the target directory.
    case "__${name}__" in
      *__..__* | *__.__*) die "refusing unsafe file name: $name" ;;
    esac
    cp "$f" "$stage/$name"
    count=$((count + 1))
  done
  printf '%s\n' "$count"
 }

 #######################################
 # Decide whether an installed path should be executable.
 # Arguments: $1 path relative to the target directory
 # Returns:   0 if executable, 1 otherwise
 #######################################
 wants_exec() {
  case "$1" in
    hooks/* | scripts/* | hud/* | statusline-command.sh | *.sh | *.py | *.pl) return 0 ;;
    *) return 1 ;;
  esac
 }

 #######################################
 # Install every staged file into the target directory, backing up any
 # existing file whose content changes. Because staging already merged the
 # template and the overlay, each path is written once per run, so a file
 # the overlay replaces is never backed up as a template copy.
 # Arguments: $1 staging directory
 # Globals:   DEST, TIMESTAMP; sets INSTALLED, BACKED_UP, UNCHANGED
 #######################################
 install_staged() {
  local stage="$1" f name rel target
  INSTALLED=0
  BACKED_UP=0
  UNCHANGED=0
  for f in "$stage"/*; do
    [ -f "$f" ] || continue
    name=$(basename "$f")
    # a__b__c.md -> a/b/c.md
    rel="${name//__//}"
    target="$DEST/$rel"
    mkdir -p "$(dirname "$target")"

    # Refuse to overwrite something that isn't a regular file (e.g. a
    # directory or a symlink to one), so cp can't silently drop the
    # installed file inside it instead of replacing it.
    [ -e "$target" ] && [ ! -f "$target" ] && die "not a regular file: $target"

    if [ -f "$target" ]; then
      if cmp -s "$f" "$target"; then
        # Same content: nothing to back up, nothing to write.
        UNCHANGED=$((UNCHANGED + 1))
        wants_exec "$rel" && chmod +x "$target"
        continue
      fi
      cp -p "$target" "$target.bak.$TIMESTAMP"
      BACKED_UP=$((BACKED_UP + 1))
    fi

    cp "$f" "$target"
    wants_exec "$rel" && chmod +x "$target"
    INSTALLED=$((INSTALLED + 1))
  done
 }

 #######################################
 # Refuse to overwrite a config that is not fresh. Compares settings.json and
 # CLAUDE.md, the two files where a blind replace costs something real,
 # against the staged tree (template plus overlay already merged). An absent
 # target, or one identical to what this run would write, is not a conflict.
 # Bypassed by --force, which leaves the existing backup-then-overwrite
 # behavior in install_staged() untouched.
 # Arguments: $1 staging directory
 # Globals:   DEST, FORCE
 #######################################
 guard_existing_config() {
  local stage="$1" name target conflicts=""

  [ -n "$FORCE" ] && return 0

  for name in settings.json CLAUDE.md; do
    target="$DEST/$name"
    [ -f "$target" ] && [ -f "$stage/$name" ] || continue
    cmp -s "$stage/$name" "$target" || conflicts="$conflicts $name"
  done

  [ -n "$conflicts" ] || return 0

  for name in $conflicts; do
    warn "existing $DEST/$name differs from what this run would install"
  done
  die "refusing to overwrite an existing config on what looks like a non-fresh machine; merge${conflicts} by hand instead (see the README), or re-run with --force"
 }

 #######################################
 # Entry point: parse arguments, fetch both gists, stage, install, report.
 # Arguments: [--force] [<overlay gist id or URL>], in any order
 #######################################
 main() {
  local template_id overlay_id="" overlay_arg="" stage n_template n_overlay=0 arg

  for arg in "$@"; do
    case "$arg" in
      -h | --help) usage; exit 0 ;;
      --force) FORCE=1 ;;
      -*) usage >&2; die "unknown option: $arg" ;;
      *)
        [ -z "$overlay_arg" ] || { usage >&2; die "at most one overlay id or URL expected"; }
        overlay_arg="$arg"
        ;;
    esac
  done

  template_id=$(parse_gist_id "${CLAUDE_TEMPLATE_GIST:-$DEFAULT_TEMPLATE_GIST}") \
    || die "template gist is not a gist id or URL: ${CLAUDE_TEMPLATE_GIST:-$DEFAULT_TEMPLATE_GIST}"
  if [ -n "$overlay_arg" ]; then
    overlay_id=$(parse_gist_id "$overlay_arg") || die "not a gist id or URL: $overlay_arg"
  fi

  command -v git >/dev/null 2>&1 || command -v curl >/dev/null 2>&1 \
    || die "either git or curl is required"

  # Register the cleanup trap before creating the temp dir, so a signal
  # delivered between the two cannot leak it (cleanup tolerates an unset
  # or empty WORKDIR).
  trap cleanup EXIT
  WORKDIR=$(mktemp -d "${TMPDIR:-/tmp}/claude-install.XXXXXX")
  stage="$WORKDIR/stage"
  mkdir -p "$stage"

  # Fetch everything before touching the target, so a bad overlay id fails
  # with the existing config left intact.
  log "Fetching template gist $template_id"
  fetch_gist "$template_id" "$WORKDIR/template" "template"
  if [ -n "$overlay_id" ]; then
    log "Fetching overlay gist $overlay_id"
    fetch_gist "$overlay_id" "$WORKDIR/overlay" "overlay"
  fi

  n_template=$(stage_gist "$WORKDIR/template" "$stage")
  if [ -n "$overlay_id" ]; then
    n_overlay=$(stage_gist "$WORKDIR/overlay" "$stage")
  fi

  guard_existing_config "$stage"

  log "Installing into $DEST"
  mkdir -p "$DEST"
  install_staged "$stage"

  echo
  echo "Template files: $n_template"
  [ -z "$overlay_id" ] || echo "Overlay files:  $n_overlay"
  echo "Written:        $INSTALLED"
  echo "Unchanged:      $UNCHANGED"
  echo "Backed up:      $BACKED_UP (as <file>.bak.$TIMESTAMP)"
  echo

  if [ -z "$overlay_id" ]; then
    echo "No overlay given: the four snippets/*.md files are placeholders."
    echo "Fill in identity.md, voice.md, local-env.md and local-skills.md"
    echo "under $DEST/snippets/ before relying on this config."
  fi
  if ! command -v claude >/dev/null 2>&1; then
    warn "the claude CLI is not on PATH, install Claude Code before using this config"
  fi
  echo "Restart Claude Code: settings and hooks are read at session start."
 }

 main "$@"
diff --git a/scripts__git-platform-detect.sh b/scripts__git-platform-detect.sh
 #!/usr/bin/env bash
 # Version: 1.0.0
 # Detect the git hosting platform of a repository so a session never has to
 # run `git remote -v` and reason about the host itself.
 #
 # Usage: git-platform-detect.sh [dir]   (defaults to $PWD)
 # Stdout: one summary line — platform, host, remote URL, tooling hint.
 #         Nothing if not a git repo or no remote. Always exits 0.
 #
 # Fast path: a small map of known hosts (public ones below, plus your own
 # custom hosts in the block right after this header). Unknown hosts get a
 # best-effort, short-timeout API probe (Forgejo/Gitea, then GitLab, then
 # GitHub Enterprise).
 set -uo pipefail

 # ---------------------------------------------------------------------------
 # CUSTOM HOST OVERRIDES — edit this for your own self-hosted instances.
 # Add one entry per host you use, in "host:platform:tool-hint" form. This is
 # for hosts the autodiscovery probe below might get wrong, is slow to reach,
 # or that you'd rather pin explicitly (e.g. a self-hosted GitLab whose domain
 # doesn't say "gitlab", or a personal Forgejo/Gitea instance).
 # platform must be one of: github, gitlab, forgejo, gitea, github-enterprise
 # ---------------------------------------------------------------------------
 CUSTOM_HOSTS=(
  "gitlab.example.com:gitlab:glab (self-hosted; the GitLab MCP only covers gitlab.com)"
  "forgejo.example.com:forgejo:fj CLI, or tea (see your Forgejo skill/docs if you keep one)"
 )

 bare=0
 case "${1:-}" in --platform|-p) bare=1; shift ;; esac
 dir="${1:-$PWD}"

 # Must be inside a work tree with a remote.
 git -C "$dir" rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
 url="$(git -C "$dir" remote get-url origin 2>/dev/null || true)"
 if [ -z "$url" ]; then
  first="$(git -C "$dir" remote 2>/dev/null | head -n1)"
  [ -n "$first" ] && url="$(git -C "$dir" remote get-url "$first" 2>/dev/null || true)"
 fi
 [ -n "$url" ] || exit 0

 # Extract host from ssh (git@host:path, ssh://git@host:port/path) or https URLs.
 host=""
 case "$url" in
  *://*)  host="${url#*://}"; host="${host#*@}"; host="${host%%/*}"; host="${host%%:*}" ;;
  *@*:*)  host="${url#*@}";   host="${host%%:*}" ;;
  *@*)    host="${url#*@}";   host="${host%%/*}" ;;
 esac
 [ -n "$host" ] || exit 0

 # Known hosts (no network needed): public platforms first, then your
 # CUSTOM_HOSTS overrides from above.
 platform=""; tool=""
 case "$host" in
  github.com|*.github.com) platform="github";  tool="gh" ;;
  gitlab.com)              platform="gitlab";  tool="GitLab MCP / glab" ;;
 esac
 if [ -z "$platform" ]; then
  for entry in "${CUSTOM_HOSTS[@]:-}"; do
    [ -z "$entry" ] && continue
    ehost="${entry%%:*}"; rest="${entry#*:}"
    [ "$ehost" = "$host" ] || continue
    platform="${rest%%:*}"; tool="${rest#*:}"
    break
  done
 fi

 # Light autodiscovery for unknown hosts — best effort, never fatal.
 if [ -z "$platform" ] && command -v curl >/dev/null 2>&1; then
  probe() { curl -s --max-time 2 "$1" 2>/dev/null; }
  if probe "https://$host/api/v1/version" | grep -q '"version"'; then
    platform="forgejo/gitea"; tool="fj / tea"
  elif probe "https://$host/api/v4/version" | grep -qE '"version"|"message"'; then
    platform="gitlab"; tool="glab"
  elif curl -s -o /dev/null --max-time 2 -w '%{http_code}' "https://$host/api/v3/" 2>/dev/null | grep -qE '^(200|401|403)$'; then
    platform="github-enterprise"; tool="gh"
  fi
 fi

 [ -n "$platform" ] || platform="unknown"
 [ -n "$tool" ] || tool="confirm manually"

 # Bare mode: emit only the platform token (nothing if unknown) — for the launcher.
 if [ "$bare" = 1 ]; then
  [ "$platform" != "unknown" ] && printf '%s\n' "$platform"
  exit 0
 fi

 printf 'Git platform (auto-detected): %s — host %s, remote %s. Tooling: MCP-first, else %s. No need to run `git remote -v`.\n' \
  "$platform" "$host" "$url" "$tool"
 exit 0
diff --git a/scripts__glab-ci-follow.sh b/scripts__glab-ci-follow.sh
 #!/usr/bin/env bash
 # Version: 1.0.0
 # glab-ci-follow — live-follow a GitLab CI pipeline on ANY host/project via glab.
 #
 # Prints a line only when something changes (the pipeline status or a job
 # status), polling every INTERVAL seconds, until the pipeline reaches a
 # terminal state (success/failed/canceled/skipped/manual) or MAX iterations.
 # Uses glab's stored per-host auth — no token in the environment.
 #
 # Usage:
 #   glab-ci-follow [-p PROJECT] [-H HOST] [--pipeline ID] [-b REF]
 #                  [-j job1,job2] [-i INTERVAL] [-n MAX] [--once]
 #
 # Defaults: PROJECT + HOST are derived from the current git repo's `origin`
 # remote; pipeline = the latest one for the current branch (or -b REF).
 #
 # Examples:
 #   glab-ci-follow                              # current repo, current branch
 #   glab-ci-follow -b develop                   # latest pipeline on develop
 #   glab-ci-follow --pipeline 12345             # a specific pipeline
 #   glab-ci-follow -p mygroup/app -H gitlab.com -b main -i 60
 #   glab-ci-follow -j build,deploy              # only watch these jobs
 set -uo pipefail

 PROJECT=""; HOST=""; PIPELINE=""; REF=""; JOBS=""; INTERVAL=120; MAX=120; ONCE=0
 while [ $# -gt 0 ]; do
  case "$1" in
    -p|--project)  PROJECT="$2"; shift 2;;
    -H|--host)     HOST="$2"; shift 2;;
    --pipeline)    PIPELINE="$2"; shift 2;;
    -b|--branch|--ref) REF="$2"; shift 2;;
    -j|--jobs)     JOBS="$2"; shift 2;;
    -i|--interval) INTERVAL="$2"; shift 2;;
    -n|--max)      MAX="$2"; shift 2;;
    --once)        ONCE=1; shift;;
    -h|--help)     sed -n '3,22p' "$0"; exit 0;;
    *) echo "unknown arg: $1" >&2; exit 2;;
  esac
 done

 # glab does the API calls and holds the per-host auth: fail early without it.
 command -v glab >/dev/null 2>&1 || { echo "glab not found in PATH (https://gitlab.com/gitlab-org/cli)" >&2; exit 2; }

 # Derive host + project path from the origin remote when not supplied.
 if [ -z "$PROJECT" ] || [ -z "$HOST" ]; then
  url=$(git remote get-url origin 2>/dev/null) || { echo "no origin remote; pass -p and -H" >&2; exit 2; }
  t="${url#*://}"; t="${t#*@}"; t="${t%.git}"      # strip scheme, user@, .git
  [ -z "$HOST" ]    && HOST="${t%%[:/]*}"
  [ -z "$PROJECT" ] && PROJECT="${t#*[:/]}"
 fi
 export GITLAB_HOST="$HOST"

 # URL-encode the project path (numeric id is left as-is).
 PENC="$PROJECT"
 case "$PROJECT" in *[!0-9]*) PENC=$(printf '%s' "$PROJECT" | sed 's#/#%2F#g');; esac

 api() { glab api "$@" 2>/dev/null; }

 if [ -z "$PIPELINE" ]; then
  [ -z "$REF" ] && REF=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
  PIPELINE=$(api "projects/${PENC}/pipelines?ref=${REF}&per_page=1" \
    | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d[0]["id"] if d else "")')
  [ -z "$PIPELINE" ] && { echo "no pipeline found for ref '$REF' in $PROJECT" >&2; exit 3; }
 fi

 echo "[follow] $HOST $PROJECT pipeline #$PIPELINE (every ${INTERVAL}s, max ${MAX})"
 PREV=$(mktemp); CUR=$(mktemp); trap 'rm -f "$PREV" "$CUR"' EXIT
 : > "$PREV"

 for ((i=0; i<MAX; i++)); do
  P=$(api "projects/${PENC}/pipelines/${PIPELINE}")
  J=$(api "projects/${PENC}/pipelines/${PIPELINE}/jobs?per_page=100")
  if [ -z "$P" ]; then echo "[follow] api error; retry in ${INTERVAL}s"; sleep "$INTERVAL"; continue; fi

  PIPE_JSON="$P" JOBS_JSON="$J" FILTER="$JOBS" python3 - > "$CUR" <<'PY'
 import os, json
 p = json.loads(os.environ["PIPE_JSON"]); jobs = json.loads(os.environ["JOBS_JSON"])
 flt = [x for x in os.environ.get("FILTER","").split(",") if x]
 print(f"pipeline\t{p.get('status','?')}")
 for x in jobs:
    if not flt or x["name"] in flt:
        print(f"{x['name']}\t{x['status']}")
 PY

  if [ -s "$PREV" ]; then
    PREVF="$PREV" python3 - "$CUR" <<'PY'
 import os, sys
 def load(fn):
    d={}
    for line in open(fn):
        if '\t' in line:
            k,v=line.rstrip('\n').split('\t',1); d[k]=v
    return d
 prev=load(os.environ["PREVF"]); cur=load(sys.argv[1])
 import datetime
 ts=datetime.datetime.now().strftime("%H:%M:%S")
 for k,v in cur.items():
    if prev.get(k)!=v:
        print(f"[{ts}] {k}: {prev.get(k,'(new)')} -> {v}")
 PY
  else
    echo "[$(date +%H:%M:%S)] baseline:"
    sed 's/\t/=/; s/^/    /' "$CUR"
  fi
  cp "$CUR" "$PREV"

  pstatus=$(awk -F'\t' '$1=="pipeline"{print $2}' "$CUR")
  case "$pstatus" in
    success|failed|canceled|skipped|manual)
      echo "[follow] pipeline terminal: $pstatus"; exit 0;;
  esac
  [ "$ONCE" = "1" ] && exit 0
  sleep "$INTERVAL"
 done
 echo "[follow] max iterations reached"
diff --git a/scripts__notify.sh b/scripts__notify.sh
 #!/usr/bin/env bash
 # notify - Cross-context notification helper for Claude Code (and humans)
 #
 # Auto-detects Kitty terminal vs macOS, handles /dev/tty redirection
 # from Claude Code's Bash tool (where stdin/stdout are pipes), and
 # falls back to alerter on macOS for actionable notifications.
 #
 # Source this file from ~/.zshrc:
 #   source ~/.claude/scripts/notify.sh
 #
 # Usage:
 #   notify "Title" "Message"
 #   notify --type=done         "Tests OK"        "12 passed"
 #   notify --type=needs-input  "Claude waiting"  "Awaiting your input"
 #   notify --type=error        "Build failed"    "Tests broke on main"
 #   notify --reply "Continue?" "Build OK"        "Deploy now"
 #   notify --help

 # Detect the macOS bundle ID of the terminal/host app that invoked us, so
 # alerter shows that app's icon and piggy-backs on its notification
 # permission. Falls back to walking the parent process tree, then VSCode.
 _notify_detect_sender() {
    case "${TERM_PROGRAM:-}" in
        Apple_Terminal) echo "com.apple.Terminal"; return ;;
        iTerm.app)      echo "com.googlecode.iterm2"; return ;;
        vscode)         echo "com.microsoft.VSCode"; return ;;
        WezTerm)        echo "com.github.wez.wezterm"; return ;;
        ghostty)        echo "com.mitchellh.ghostty"; return ;;
        Hyper)          echo "co.zeit.hyper"; return ;;
        Tabby)          echo "org.tabby"; return ;;
        warp)           echo "dev.warp.Warp-Stable"; return ;;
        Alacritty)      echo "org.alacritty"; return ;;
    esac
    [[ -n "${KITTY_WINDOW_ID:-}" || "${TERM:-}" == "xterm-kitty" ]] \
        && { echo "net.kovidgoyal.kitty"; return; }
    [[ -n "${WEZTERM_PANE:-}"      ]] && { echo "com.github.wez.wezterm"; return; }
    [[ -n "${ITERM_SESSION_ID:-}"  ]] && { echo "com.googlecode.iterm2"; return; }
    [[ -n "${VSCODE_PID:-}" || -n "${VSCODE_IPC_HOOK_CLI:-}" ]] \
        && { echo "com.microsoft.VSCode"; return; }

    local pid=$PPID exe
    while [[ -n "$pid" && "$pid" != "0" && "$pid" != "1" ]]; do
        exe=$(ps -o comm= -p "$pid" 2>/dev/null)
        case "$exe" in
            *kitty*)               echo "net.kovidgoyal.kitty";       return ;;
            *iTerm2*|*iTerm*)      echo "com.googlecode.iterm2";      return ;;
            *Code\ Helper*|*Code*) echo "com.microsoft.VSCode";       return ;;
            *Terminal*)            echo "com.apple.Terminal";         return ;;
            *WezTerm*|*wezterm*)   echo "com.github.wez.wezterm";     return ;;
            *Ghostty*|*ghostty*)   echo "com.mitchellh.ghostty";      return ;;
            *Warp*)                echo "dev.warp.Warp-Stable";       return ;;
            *Alacritty*)           echo "org.alacritty";              return ;;
            *Hyper*)               echo "co.zeit.hyper";              return ;;
        esac
        pid=$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')
    done
    echo "com.microsoft.VSCode"
 }

 notify() {
    local title=""
    local message=""
    local type=""
    local urgency=""
    local sound=""
    local icon=""
    local icon_path=""
    local app_name="Claude Code"
    local identifier=""
    local expire_after=""
    local timeout=""
    local reply=""
    local actions=""
    local sender=""
    local force_alerter=0
    local no_prefix=0

    while [[ $# -gt 0 ]]; do
        case "$1" in
            -h|--help)
                cat <<'HELP'
 notify - Send a desktop notification

 USAGE:
    notify [OPTIONS] TITLE MESSAGE

 SEMANTIC TYPES (preset icon + urgency + timeout + emoji prefix):
    --type=done         Task finished      ✅  icon=info,           timeout=10s,  urgency=low
    --type=needs-input  Waiting on user    🫵  icon=question,       sticky,       urgency=critical
    --type=error        Failure            ❌  icon=error,          sticky,       urgency=critical
    --type=progress     Long-running       ⏳  icon=system-monitor, sticky,       urgency=low
    --type=info         Default (no emoji)     icon=info,           timeout=10s,  urgency=normal

 OPTIONS (override the preset):
    -h, --help              Show this help
    --type=NAME             Semantic preset (see above)
    --urgency=LEVEL         low | normal | critical
    --sound=NAME            Sound name (system-dependent)
    --icon=NAME             Standard icon: error, info, warning, question,
                            system-monitor, help, file-manager, text-editor
    --icon-path=PATH        PNG/JPEG/GIF icon file
    --app-name=NAME         Sender app (default: "Claude Code")
    --identifier=ID         Replace/update an existing notif with the same ID
    --expire-after=DURATION Kitty: Ns / Nm / Nh / Nd / never
    --timeout=N             Alerter / notify-send: auto-close after N seconds
    --reply=PLACEHOLDER     Show text input (forces alerter on macOS)
    --actions=A,B,C         Show action buttons (forces alerter on macOS)
    --sender=BUNDLE_ID      Alerter: override the macOS app whose icon and
                            notification permission are used (auto-detected
                            from $TERM_PROGRAM / process tree by default)
    --alerter               Force alerter backend even inside Kitty
    --no-prefix             Don't prepend the type emoji to the title

 BACKENDS (auto-detected, override with --alerter):
    Kitty (TERM=xterm-kitty)  → kitten notify (OSC 99, fire-and-forget)
    macOS                     → alerter (Swift, supports actions/reply)
    Else                      → notify-send (best effort)

 EXIT CODES:
    0   Success (alerter: also returns action label / reply on stdout)
    1   Notification failed
    2   Bad arguments
 HELP
                return 0
                ;;
            --type=*)         type="${1#*=}"; shift ;;
            --urgency=*)      urgency="${1#*=}"; shift ;;
            --sound=*)        sound="${1#*=}"; shift ;;
            --icon=*)         icon="${1#*=}"; shift ;;
            --icon-path=*)    icon_path="${1#*=}"; shift ;;
            --app-name=*)     app_name="${1#*=}"; shift ;;
            --identifier=*)   identifier="${1#*=}"; shift ;;
            --expire-after=*) expire_after="${1#*=}"; shift ;;
            --timeout=*)      timeout="${1#*=}"; shift ;;
            --reply=*)        reply="${1#*=}"; force_alerter=1; shift ;;
            --actions=*)      actions="${1#*=}"; force_alerter=1; shift ;;
            --sender=*)       sender="${1#*=}"; shift ;;
            --alerter)        force_alerter=1; shift ;;
            --no-prefix)      no_prefix=1; shift ;;
            -*)
                echo "notify: unknown option: $1" >&2
                return 2
                ;;
            *)
                if [[ -z "$title" ]]; then
                    title="$1"
                elif [[ -z "$message" ]]; then
                    message="$1"
                else
                    echo "notify: too many positional arguments" >&2
                    return 2
                fi
                shift
                ;;
        esac
    done

    if [[ -z "$title" ]]; then
        echo "notify: TITLE required (run 'notify --help')" >&2
        return 2
    fi

    # Apply type presets — caller-supplied flags win (: ${var:=default}).
    local prefix=""
    case "${type:-info}" in
        done)
            : "${urgency:=low}"
            : "${icon:=info}"
            : "${expire_after:=10s}"
            : "${timeout:=10}"
            prefix="✅ "
            ;;
        needs-input)
            : "${urgency:=critical}"
            : "${icon:=question}"
            : "${expire_after:=never}"
            prefix="🫵 "
            ;;
        error)
            : "${urgency:=critical}"
            : "${icon:=error}"
            : "${expire_after:=never}"
            prefix="❌ "
            ;;
        progress)
            : "${urgency:=low}"
            : "${icon:=system-monitor}"
            : "${expire_after:=never}"
            prefix="⏳ "
            ;;
        info)
            : "${urgency:=normal}"
            : "${icon:=info}"
            : "${expire_after:=10s}"
            : "${timeout:=10}"
            ;;
        *)
            echo "notify: unknown --type: $type" >&2
            return 2
            ;;
    esac
    [[ $no_prefix -eq 0 && -n "$prefix" ]] && title="${prefix}${title}"

    # Inside Kitty + no actionable feedback needed → kitten notify
    if [[ $force_alerter -eq 0 ]] \
        && { [[ "$TERM" == "xterm-kitty" ]] || [[ -n "$KITTY_WINDOW_ID" ]]; } \
        && command -v kitten >/dev/null 2>&1; then

        local args=(notify --only-print-escape-code "--urgency=$urgency" "--app-name=$app_name")
        [[ -n "$icon" ]]         && args+=("--icon=$icon")
        [[ -n "$icon_path" ]]    && args+=("--icon-path=$icon_path")
        [[ -n "$sound" ]]        && args+=("--sound-name=$sound")
        [[ -n "$identifier" ]]   && args+=("--identifier=$identifier")
        [[ -n "$expire_after" ]] && args+=("--expire-after=$expire_after")
        [[ -n "$type" ]]         && args+=("--type=$type")
        args+=("$title")
        [[ -n "$message" ]] && args+=("$message")

        # /dev/tty unavailable from Claude Code's Bash tool;
        # write the OSC 99 escape to the parent claude process's PTY.
        local parent_tty
        parent_tty=$(ps -o tty= -p $PPID 2>/dev/null | tr -d ' ')
        if [[ -n "$parent_tty" && -e "/dev/$parent_tty" ]]; then
            kitten "${args[@]}" > "/dev/$parent_tty"
        else
            kitten "${args[@]}"
        fi
        return $?
    fi

    # macOS → alerter (handles actions, reply, returns user choice on stdout)
    if [[ "$(uname)" == "Darwin" ]] && command -v alerter >/dev/null 2>&1; then
        [[ -z "$sender" ]] && sender=$(_notify_detect_sender)
        local args=(--title "$title" --sender "$sender")
        [[ -n "$message" ]]                      && args+=(--message "$message")
        [[ -n "$actions" ]]                      && args+=(--actions "$actions")
        [[ -n "$reply"   ]]                      && args+=(--reply "$reply")
        [[ -n "$timeout" && "$timeout" != "0" ]] && args+=(--timeout "$timeout")
        [[ -n "$sound"   ]]                      && args+=(--sound "$sound")
        [[ "$urgency" == "critical" ]]           && args+=(--ignore-dnd)
        alerter "${args[@]}"
        return $?
    fi

    # Linux fallback → notify-send
    if command -v notify-send >/dev/null 2>&1; then
        local args=("--urgency=$urgency")
        [[ -n "$timeout" && "$timeout" != "0" ]] && args+=("--expire-time=$((timeout * 1000))")
        [[ -n "$icon" ]] && args+=("--icon=$icon")
        args+=("$title")
        [[ -n "$message" ]] && args+=("$message")
        notify-send "${args[@]}"
        return $?
    fi

    echo "notify: no notification backend available" >&2
    return 1
 }
diff --git a/scripts__worktree-start.sh b/scripts__worktree-start.sh
 #!/usr/bin/env bash
 # Version: 1.0.0
 #
 # worktree-start.sh — deterministic mechanics behind the /worktree-start command.
 #
 # Performs, in a single invocation, every step that needs no model judgement:
 # repository validation, .claude/worktrees exclusion, worktree creation, and the file
 # copies declared in the saved init config. Emits a compact report so the caller
 # spends one round-trip instead of a dozen.
 #
 # Usage:   worktree-start.sh <branch-name> [--force]
 # Exit:    0 ok | 1 usage or fatal error | 2 refused (already inside a worktree)
 #
 # Deliberately does NOT run the config's "## Commands to run": those entries
 # carry placeholders (<worktree>, $WT) and prose ("(none — ...)"), so they need
 # a substitution pass. The config is printed verbatim for the caller to handle.

 set -euo pipefail

 CFG_DIR="${HOME}/.claude/worktree-configs"

 # Print a fatal error on stderr and exit with the given status.
 die() {
    local status="$1"; shift
    printf 'ERROR     %s\n' "$*" >&2
    exit "$status"
 }

 # Emit a padded "KEY value" report line on stdout.
 say() {
    printf '%-9s %s\n' "$1" "$2"
 }

 # Append `.claude/worktrees` to an ignore file unless already listed.
 # $1: absolute path to the ignore file
 # $2: "create" to create a missing file, "skip" to leave it alone
 # Echoes a one-word status: added | ok | absent
 ensure_ignored() {
    local file="$1" mode="$2"

    if [[ ! -f "$file" ]]; then
        [[ "$mode" == "create" ]] || { printf 'absent'; return 0; }
        printf '.claude/worktrees\n' > "$file"
        printf 'added'
        return 0
    fi

    if grep -qxF '.claude/worktrees' "$file" || grep -qxF '.claude/worktrees/' "$file"; then
        printf 'ok'
        return 0
    fi

    # Guard against a file that does not end with a newline.
    [[ -s "$file" && -n "$(tail -c1 "$file")" ]] && printf '\n' >> "$file"
    printf '.claude/worktrees\n' >> "$file"
    printf 'added'
 }

 # Print the "- " bullet entries of a markdown "## <title>" section.
 # Prefix matching is intentional so "## Commands to run (from ...)" still hits.
 # $1: section title  $2: markdown file
 section_items() {
    awk -v want="## $1" '
        /^## / { insec = (index($0, want) == 1); next }
        insec && /^- / { sub(/^- /, ""); print }
    ' "$2"
 }

 # Read the "## Source project path" value of a config file, if any.
 config_source_path() {
    awk '
        /^## / { insec = (index($0, "## Source project path") == 1); next }
        insec && NF { print; exit }
    ' "$1"
 }

 # Resolve the init config for this repository.
 # Config filenames drift from the directory name (dashes vs underscores, remote
 # name), so several candidates are tried; a candidate whose declared source path
 # matches the current root wins outright over a mere filename hit.
 # $1: project root. Echoes the config path, or nothing when none matches.
 find_config() {
    local root="$1" base remote cand first="" candidates=()

    base="$(basename "$root")"
    remote="$(git -C "$root" remote get-url origin 2>/dev/null || true)"
    remote="$(basename "${remote%.git}" 2>/dev/null || true)"

    candidates=(
        "$base"
        "$(printf '%s' "$base" | tr '_' '-')"
        "$(printf '%s' "$base" | tr '-' '_')"
        "$remote"
    )

    for cand in "${candidates[@]}"; do
        [[ -n "$cand" && -f "$CFG_DIR/$cand.md" ]] || continue
        [[ -n "$first" ]] || first="$CFG_DIR/$cand.md"
        if [[ "$(config_source_path "$CFG_DIR/$cand.md")" == "$root" ]]; then
            printf '%s' "$CFG_DIR/$cand.md"
            return 0
        fi
    done

    printf '%s' "$first"
 }

 # Copy the files listed under "## Files to copy" into the worktree.
 # Entries are prose-tolerant: only the first token is taken, and prose markers
 # ("(none — ...)", "None") plus symlink rows ("a → b") are skipped. A file is
 # copied only when it actually exists in the source checkout, so annotations
 # such as ".env (if present)" resolve on their own.
 # $1: project root  $2: worktree path  $3: config file
 copy_config_files() {
    local root="$1" wt="$2" cfg="$3" line target copied=() missing=()

    while IFS= read -r line; do
        [[ "$line" == *"→"* || "$line" == *"->"* ]] && continue
        target="${line%% *}"
        [[ -n "$target" ]] || continue
        [[ "$target" == "("* ]] && continue
        case "$target" in None|none|N/A) continue ;; esac

        if [[ -e "$root/$target" ]]; then
            mkdir -p "$wt/$(dirname "$target")"
            cp -a "$root/$target" "$wt/$target"
            copied+=("$target")
        else
            missing+=("$target")
        fi
    done < <(section_items "Files to copy" "$cfg")

    [[ ${#copied[@]}  -gt 0 ]] && say "COPIED" "${copied[*]}"
    [[ ${#missing[@]} -gt 0 ]] && say "ABSENT" "${missing[*]} (not in source, skipped)"
    return 0
 }

 # Emit a one-line toolchain profile plus the env files present in the source,
 # so a first-time run can propose init steps without extra probing.
 # $1: project root
 report_profile() {
    local root="$1" profile=() envs=() targets pm

    if [[ -f "$root/package.json" ]]; then
        pm="npm"
        [[ -f "$root/pnpm-lock.yaml" ]] && pm="pnpm"
        [[ -f "$root/yarn.lock" ]]      && pm="yarn"
        [[ -f "$root/bun.lockb" ]]      && pm="bun"
        profile+=("node($pm)")
    fi
    if [[ -f "$root/pyproject.toml" ]]; then
        [[ -f "$root/uv.lock" ]] && profile+=("python(uv.lock)") || profile+=("python(pyproject)")
    fi
    compgen -G "$root/requirements*.txt" > /dev/null && profile+=("python(requirements)")
    [[ -f "$root/composer.json" ]] && profile+=("php(composer)")
    [[ -f "$root/Cargo.toml" ]]    && profile+=("rust(cargo)")
    [[ -f "$root/go.mod" ]]        && profile+=("go")
    [[ -f "$root/Gemfile" ]]       && profile+=("ruby(bundler)")
    compgen -G "$root/*.sln" > /dev/null && profile+=("dotnet")

    if [[ -f "$root/Makefile" ]]; then
        targets="$(grep -oE '^[a-zA-Z0-9_-]+:' "$root/Makefile" \
            | tr -d ':' \
            | grep -E '^(install|setup|dev|init|bootstrap|deps|build|test)' \
            | tr '\n' ',' | sed 's/,$//' || true)"
        [[ -n "$targets" ]] && profile+=("make($targets)") || profile+=("make")
    fi

    for f in "$root"/.env "$root"/.env.*; do
        [[ -e "$f" ]] && envs+=("$(basename "$f")")
    done

    say "PROFILE"  "${profile[*]:-none detected}"
    say "ENVFILES" "${envs[*]:-none}"
 }

 # --- argument parsing -------------------------------------------------------

 BRANCH=""
 FORCE=0
 for arg in "$@"; do
    case "$arg" in
        --force) FORCE=1 ;;
        -*)      die 1 "unknown flag: $arg" ;;
        *)       [[ -z "$BRANCH" ]] && BRANCH="$arg" || die 1 "unexpected argument: $arg" ;;
    esac
 done
 [[ -n "$BRANCH" ]] || die 1 "usage: worktree-start.sh <branch-name> [--force]"

 # --- prerequisites ----------------------------------------------------------

 git rev-parse --is-inside-work-tree > /dev/null 2>&1 \
    || die 1 "not a git repository (cd into the project first)"

 # A differing common-dir means the current checkout is itself a linked worktree.
 if [[ "$(git rev-parse --git-common-dir)" != "$(git rev-parse --git-dir)" && $FORCE -eq 0 ]]; then
    die 2 "already inside a worktree — nesting refused. Re-run with --force to override."
 fi

 ROOT="$(git rev-parse --show-toplevel)"
 SOURCE_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
 WT="$ROOT/.claude/worktrees/$BRANCH"

 [[ -e "$WT" ]] && die 1 "$WT already exists"

 # --- exclusion --------------------------------------------------------------

 GI_STATUS="$(ensure_ignored "$ROOT/.gitignore" create)"
 DI_STATUS="$(ensure_ignored "$ROOT/.dockerignore" skip)"

 # --- creation ---------------------------------------------------------------

 mkdir -p "$ROOT/.claude/worktrees"

 if git show-ref --verify --quiet "refs/heads/$BRANCH"; then
    git worktree add "$WT" "$BRANCH" > /dev/null
    BRANCH_NOTE="existing branch"
 else
    git worktree add "$WT" -b "$BRANCH" > /dev/null
    BRANCH_NOTE="new branch, from $SOURCE_BRANCH"
 fi

 # --- report -----------------------------------------------------------------

 say "WORKTREE" "$WT"
 say "BRANCH"   "$BRANCH ($BRANCH_NOTE)"
 say "SOURCE"   "$ROOT ($SOURCE_BRANCH)"
 say "IGNORE"   ".gitignore=$GI_STATUS .dockerignore=$DI_STATUS"

 CONFIG="$(find_config "$ROOT")"

 if [[ -n "$CONFIG" ]]; then
    say "CONFIG" "$CONFIG"
    if [[ "$(config_source_path "$CONFIG")" != "$ROOT" ]]; then
        say "WARN" "config source path differs from $ROOT — verify it targets this repo"
    fi
    copy_config_files "$ROOT" "$WT" "$CONFIG"
    printf -- '--- config (run its commands, honour its notes) ---\n'
    cat "$CONFIG"
    printf -- '--- end config ---\n'
 else
    say "CONFIG" "none (save approved steps to $CFG_DIR/$(basename "$ROOT").md)"
    report_profile "$ROOT"
 fi
diff --git a/settings.json b/settings.json
 {
  "attribution": {
    "commit": "",
    "pr": "",
    "sessionUrl": false
  },
  "includeCoAuthoredBy": false,
  "env": {
    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1",
    "DISABLE_ERROR_REPORTING": "1",
    "DISABLE_BUG_COMMAND": "1",
    "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",
    "DISABLE_AUTOUPDATER": "0",
    "OTEL_SDK_DISABLED": "true"
  },
  "permissions": {
    "allow": [],
    "deny": [
      "Skill(terminal-title)"
    ],
    "ask": [],
    "defaultMode": "auto"
  },
  "disableClaudeAiConnectors": true,
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/backup-claude-config.sh\""
          }
        ]
      },
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "\"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/enforce-worktree.sh\""
          }
        ]
      },
      {
        "matcher": "Read|Write|Edit|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "\"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/enforce-allowed-paths.sh\""
          }
        ]
      }
    ],
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/karpathy-guidelines.sh\"",
            "statusMessage": "Karpathy guidelines: checking GitHub for a newer version...",
            "timeout": 20
          }
        ]
      },
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/session-git-platform.sh\""
          }
        ]
      }
 ,
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/codegraph-autoinit.sh\""
          }
        ]
      }
    ]
  },
  "worktree": {
    "baseRef": "fresh"
  },
  "statusLine": {
    "type": "command",
    "command": "sh ${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hud/statusline-wrapper.sh"
  },
  "enabledPlugins": {
    "security-guidance@claude-plugins-official": true,
    "context7@claude-plugins-official": true,
    "context-mode@context-mode": true,
    "codex@openai-codex": true,
    "oh-my-claudecode@omc": true
  },
  "extraKnownMarketplaces": {
    "omc": {
      "source": {
        "source": "git",
        "url": "https://github.com/Yeachan-Heo/oh-my-claudecode.git"
      }
    },
    "context-mode": {
      "source": {
        "source": "github",
        "repo": "mksglu/context-mode"
      }
    },
    "openai-codex": {
      "source": {
        "source": "github",
        "repo": "openai/codex-plugin-cc"
      }
    }
  },
  "autoMode": {
    "allow": [
      "$defaults",
      "Kubernetes operations on your own cluster (context admin@my-cluster, CUSTOMIZE), mutations included: kubectl get/describe/logs/top/explain/apply/create/delete/edit/patch/scale/rollout/exec/cp — the cluster belongs to the user, full access expected",
      "Helm operations including mutations: list/get/show/status/history/template/install/upgrade/uninstall/rollback/dependency update",
      "Flux operations including mutations: get/stats/check/tree/version/suspend/resume/reconcile/create/delete",
      "Talosctl operations including most mutations: get/health/version/dmesg/logs/services/disks/memory/cpu/apply-config — except destructive ones (reset, reboot, shutdown, wipe, etcd recovery) which still warrant a soft_deny",
      "git push to feature/topic branches you own (any branch except main/develop/stable) — push freely on personal repos as part of the worktree workflow",
      "Read-only Forgejo via fj CLI: fj pr view/list, fj issue view/list, fj release list, fj actions list/view, fj api GET",
      "Read-only GitLab via glab CLI: glab mr view/list/diff, glab issue view/list, glab ci view/list, glab api with GET method",
      "Read-only GitHub via gh CLI: gh pr view/list/diff/checks, gh issue view/list, gh run view/list, gh api with GET method",
      "Read-only Git inspection: git status/log/diff/show/blame/branch (without -D)/remote -v/stash list/worktree list/reflog/config --get",
      "Python tooling that does not mutate state: uv run pytest, uv pip list, ruff check, black --check, mypy, pyright, python -m py_compile, coverage report",
      "Docker inspection: docker ps/logs/inspect/images/version/compose ps/compose logs",
      "Reading the shell function 'notify' for sending desktop notifications (not destructive)",
      "Filesystem inspection inside the current project, $HOME/.claude, .omc, .claude, and any path listed in the allowed-paths grant files",
      "Read-only filesystem inspection on system and ephemeral paths — find/ls/grep/du/tree/cat/stat over /tmp, /private/tmp, /var/folders, /bin, /sbin, /usr, /opt, /Library, /System and OS library directories — these hold no personal data and are safe to scan recursively (mutations there still fall under the usual sudo/system soft_deny)",
      "Diagnostic SSH on a known jumphost (jumphost.example.com, CUSTOMIZE) when only running read-only commands",
      "MCP read-only queries: get_*, list_*, search_*, read_*, query_* tools across configured servers"
    ],
    "soft_deny": [
      "$defaults",
      "Catastrophic Talos operations on real hardware: talosctl reset, reboot, shutdown, wipe, etcd snapshot recovery, bootstrap — these can brick a node and require explicit approval",
      "kubectl delete on cluster-scoped or namespace-scoped destructive targets: delete namespace, delete pv, delete crd, delete node — full cluster impact, ask first",
      "helm upgrade of a release that needs several -f values files, run with only part of them — silently resets whatever the missing file pins (workload kind, replica count, node placement)",
      "Direct git push to protected branches main, develop, stable (any repo) — always require an explicit user approval before pushing or merging into those",
      "Force pushes (git push --force, --force-with-lease) and history rewrites on shared branches",
      "Skipping git hooks (--no-verify) or signing flags (--no-gpg-sign, -c commit.gpgsign=false)",
      "Merging or approving PRs/MRs into protected branches via fj/glab/gh — these always need explicit user approval",
      "Editing files outside the allowed-paths set (current project, $HOME/.claude, .omc, .claude, listed grant files); SSH-embedded paths cannot be assumed local",
      "Reading or printing secrets, .env files, credentials, private keys, kubeconfigs containing tokens, or anything under ~/.ssh without an explicit reason in the request",
      "Installing Python packages globally (pip install without uv) or modifying system Python",
      "uv pip install — prefer `uv add` so dependencies are recorded in pyproject.toml; ad-hoc `uv pip install` warrants confirmation",
      "Homebrew system mutations: brew install/uninstall/upgrade/reinstall/untap/cleanup — modify global tooling, require approval",
      "Disabling the sandbox via dangerouslyDisableSandbox unless the command demonstrably requires it (notify is a known case)",
      "Atuin shell-history queries (`atuin search`, `atuin history list`, `atuin stats`, or direct reads of ~/.local/share/atuin/history.db) require explicit user authorization in the current turn: shell history stores secrets typed inline and `!`-prefixed commands, so every lookup must be confirmed before running.",
      "Recursive or whole-tree filesystem commands whose target resolves to the user's personal data outside the active project, whichever binary performs the walk (rm -r, rm -rf, find, fd, grep -r, rg, ls -R, tree, du, stat over a glob, cp -r, mv, rsync, tar or zip over a directory, chmod -R, chown -R, python os.walk, shell globs such as ~/**). Personal data means: backup locations (anything named backup, backups or .backup, Time Machine, *.bak trees, external or mounted drives under /Volumes); other project checkouts (sibling repositories under ~/Documents or elsewhere); and the home directory browsed wholesale ($HOME itself, ~/Downloads, ~/Desktop, the ~/Documents root, ~/Pictures, ~/Movies, ~/Music, ~/.ssh, ~/Library/Mail and similar folders). The test is the target path: a command is in scope when its path argument, or the current directory it defaults to, resolves into one of those trees. It clears only when the user explicitly named that directory in the current request; a personal path the user did not mention needs confirmation. Out of scope: the active project (the whole tree rooted at the session's working directory, nested git repositories included); and the system and ephemeral trees /tmp, /private/tmp, /var/folders, /bin, /usr, /opt, /Library and /System."
    ],
    "hard_deny": [
      "$defaults",
      "Recursive deletion or recursive permission rewrite (rm -r, rm -rf, rsync --delete, find -delete, chmod -R, chown -R) over a backup location outside the active project and outside $HOME/.claude: a directory named backup, backups or .backup, a Time Machine volume, or an external drive mounted under /Volumes (the boot volume and mounted disk images excluded).",
      "Never add Co-Authored-By or any AI attribution in commits, PRs, branches, or anywhere"
    ],
    "environment": [
      "$defaults",
      "Personal context: this user-level settings file covers the user's own projects, no employer work is expected at this level",
      "Primary infra: a personal Kubernetes cluster reached through the admin@my-cluster context (CUSTOMIZE); kubectl/helm/flux always require --context=admin@my-cluster",
      "Workflow: every modification happens inside a git worktree under <project-root>/.claude/worktrees/<branch>; the main checkout stays clean. Prefer Conventional Commits in imperative mood, granular commits as work progresses, never one big final commit",
      "Git-host ops are MCP-first; fall back to the platform CLI only when the MCP is unavailable, missing a tool, or doesn't cover the host — Forgejo (forgejo.example.com) → fj, GitLab (gitlab.example.com or gitlab.com) → glab, GitHub → gh",
      "Model routing: in the main loop, delegate first to the cheapest capable agent (Rule #0 — don't spend main-loop attention on mechanical work). Within a delegated agent's own mission, prioritize quality at the right price — opus for genuine judgment/architecture/unknown-root-cause/review, sonnet for well-scoped tasks, haiku for trivial lookups",
      "The user may chat in their own language, but all code/comments/commits/PRs/markdown stay in English"
    ]
  },
  "effortLevel": "high",
  "modelSettings": {
    "claude-opus-5": {
      "effortLevel": "high"
    }
  },
  "tui": "fullscreen",
  "editorMode": "normal",
  "skipDangerousModePermissionPrompt": true,
  "skipWorkflowUsageWarning": true,
  "skipAutoPermissionPrompt": true,
  "autoCompactEnabled": true,
  "disableAgentView": false,
  "verbose": true,
  "voiceEnabled": true,
  "teammateMode": "auto",
  "remoteControlAtStartup": true,
  "preferredNotifChannel": "auto",
  "inputNeededNotifEnabled": true,
  "agentPushNotifEnabled": true,
  "attribution": {
    "commit": "",
    "pr": "",
    "sessionUrl": false
  }
 }

diff --git a/skills__cheap-orchestration__references__evidence.md b/skills__cheap-orchestration__references__evidence.md
diff --git a/skills__cheap-orchestration__references__templates.md b/skills__cheap-orchestration__references__templates.md
diff --git a/skills__cheap-orchestration__SKILL.md b/skills__cheap-orchestration__SKILL.md
diff --git a/skills__fj__SKILL.md b/skills__fj__SKILL.md
diff --git a/skills__ntfy__SKILL.md b/skills__ntfy__SKILL.md
diff --git a/skills__pr__SKILL.md b/skills__pr__SKILL.md
diff --git a/snippets__identity.md b/snippets__identity.md
diff --git a/snippets__local-env.md b/snippets__local-env.md
diff --git a/snippets__local-skills.md b/snippets__local-skills.md
diff --git a/snippets__voice.md b/snippets__voice.md
diff --git a/statusline-command.sh b/statusline-command.sh
 #!/bin/bash

 # Read JSON input from stdin
 input=$(cat)

 # Extract current working directory from JSON
 cwd=$(echo "$input" | jq -r '.workspace.current_dir')

 # Get user and hostname
 user=$(whoami)
 host=$(hostname -s)

 # Get current directory path
 if [ -n "$cwd" ]; then
  # Use the workspace current dir from JSON
  current_dir="$cwd"
 else
  # Fallback to pwd
  current_dir=$(pwd)
 fi

 # Replace home directory with ~
 display_dir="${current_dir/#$HOME/\~}"

 # Check if we're in a git repository (skip optional locks for speed)
 if git -C "$current_dir" rev-parse --git-dir > /dev/null 2>&1; then
  # Get git branch name
  branch=$(git -C "$current_dir" --no-optional-locks branch --show-current 2>/dev/null || echo "")

  # Get git status (check if dirty)
  if [ -n "$(git -C "$current_dir" --no-optional-locks status --porcelain 2>/dev/null)" ]; then
    git_status="±"
  else
    git_status="✓"
  fi

  if [ -n "$branch" ]; then
    git_info=" \033[33m[$branch $git_status]\033[0m"
  else
    git_info=""
  fi
 else
  git_info=""
 fi

 # Check for Python virtual environment
 venv_info=""
 if [ -n "$VIRTUAL_ENV" ]; then
  venv_name=$(basename "$VIRTUAL_ENV")
  venv_info=" \033[35m($venv_name)\033[0m"
 fi

 # Output the status line with colors
 # Cyan user@host, Blue directory, Yellow git info, Magenta venv
 # Use %b for git_info and venv_info to interpret escape sequences
 printf "\033[36m%s@%s\033[0m \033[34m%s\033[0m%b%b" "$user" "$host" "$display_dir" "$git_info" "$venv_info"
Piece	Count	What it gives you
Agent file	`CLAUDE.md` 6.2.0	Language rules, git and PR policy, model routing and delegation, worktrees, filesystem policy, secret handling
Snippets	4	Everything personal, `@`-imported by `CLAUDE.md`
Subagents	4	`scout`, `editor`, `worker`, `reviewer`, each with its model pinned, for the delegation rules in `CLAUDE.md`
Hooks	6 (plus one shared lib)	Config backups, path enforcement, worktree warning, session context, CodeGraph init offer
Skills	4	`pr`, `fj`, `ntfy`, `cheap-orchestration`
Slash commands	4	`/worktree-start`, `/worktree-finish`, `/ntfy`, `/ntfy-sub`
Status line	2 (plus a standalone fallback)	HUD line, then colored pwd and git info
Scripts	3	Git platform detection, desktop notifications, worktree creation
Reference docs	3 (plus a guidelines seed)	Filesystem policy mechanics, shared-checkout lock protocol, separate-session rules
Installer	1	`install.sh`: template, then an optional private overlay, with backups
Snippet	What belongs in it
`snippets/identity.md`	Your names, handles and emails, personal and professional, with the triggers that say which one applies to which project
`snippets/voice.md`	Chat language and register, the shape of messages addressed to you, the style skills to load before writing in your name, and the exact active-worktree marker line
`snippets/local-env.md`	Self-hosted git hosts and the software behind them, which repos count as yours, sibling checkout roots, directories that must never be swept, the env var the secret examples should name
`snippets/local-skills.md`	Usage notes for skills that exist only on your machine, the ones this template does not ship
File	What ships	What to do
`snippets/identity.md`	`Your Name`, `yourhandle`, `you@personal.example`, `Acme`	Replace both sections with your real identities and their triggers
`snippets/voice.md`	Four commented slots with examples	Write your chat language and tone, your output style, the style skills to load before writing in your name, and your worktree marker line
`snippets/local-env.md`	`<your-git-username-or-org>`, `git.example.com`, `code.example.org`	Name your git hosts and the software behind each, your checkout roots, your protected directories
`snippets/local-skills.md`	One example bullet in a comment	Write one bullet per local-only skill, or leave it empty. Do not delete the file
`allowed-paths`	Comments only	Uncomment or add the directories you actually work in
`hooks/enforce-allowed-paths.sh`	`[ "$(hostname -s)" = "my-workstation" ]`	Set your own hostname, or delete the guard to enforce everywhere
`scripts/git-platform-detect.sh`	`CUSTOM_HOSTS` with two example hosts	List your self-hosted GitLab, Forgejo or Gitea instances
`skills/ntfy/SKILL.md`	`ntfy.example.com`, a placeholder `envchain` namespace	Replace both, and create `~/.claude/ntfy-trust.json` before arming a listener
`settings.json`	Three `CUSTOMIZE` markers	A generic cluster context (`admin@my-cluster`) and a generic jumphost (`jumphost.example.com`) in `autoMode`: replace or remove them
Event	Matcher	Hook
PreToolUse	`Edit\|Write\|NotebookEdit`	`hooks/backup-claude-config.sh`
PreToolUse	`Edit\|Write`	`hooks/enforce-worktree.sh`
PreToolUse	`Read\|Write\|Edit\|NotebookEdit`	`hooks/enforce-allowed-paths.sh`
SessionStart	(all)	`hooks/karpathy-guidelines.sh`
SessionStart	(all)	`hooks/session-git-platform.sh`
SessionStart	(all)	`hooks/codegraph-autoinit.sh`
Command	Version	What it does
`/worktree-start`	2.1.0	Creates an isolated worktree under `<project>/.claude/worktrees/<branch>`, with per-repo init steps proposed before anything runs
`/worktree-finish`	1.1.0	Merges the worktree branch back and cleans up
`/ntfy`	1.0.0	Publishes one ntfy push
`/ntfy-sub`	1.0.0	Starts, stops or reports a background ntfy listener
Published file	Installs as	Version	What it is
`CLAUDE.md`	`CLAUDE.md`	6.2.0	The agent file: language, git policy, model routing, worktrees, filesystem policy, secret handling
`snippets__identity.md`	`snippets/identity.md`	1.0.0	Personal and professional identities
`snippets__voice.md`	`snippets/voice.md`	1.0.0	Chat language, output style, writing-in-your-name rules, worktree marker
`snippets__local-env.md`	`snippets/local-env.md`	1.0.0	Git hosts, machine paths, backup and sweep conventions
`snippets__local-skills.md`	`snippets/local-skills.md`	1.0.0	Notes for skills that exist only on your machine
`settings.json`	`settings.json`	table only	Hook wiring, permissions, autoMode, plugins, status line
`allowed-paths`	`allowed-paths`	table only	Global path grants for the file-op hook
`hooks__backup-claude-config.sh`	`hooks/backup-claude-config.sh`	table only	Snapshots any `~/.claude` file before it is overwritten, with retention pruning
`hooks__enforce-worktree.sh`	`hooks/enforce-worktree.sh`	1.1.1	Warns (without blocking) when a project file is edited outside a `.claude/worktrees/` checkout
`hooks__enforce-allowed-paths.sh`	`hooks/enforce-allowed-paths.sh`	1.0.1	Allowlist on file ops, asks on violations
`hooks__lib__allowed-paths-common.sh`	`hooks/lib/allowed-paths-common.sh`	table only	Shared allowlist logic and grant-file parsing
`hooks__karpathy-guidelines.sh`	`hooks/karpathy-guidelines.sh`	table only	Injects the behavioral guidelines at session start, refreshed weekly from upstream
`hooks__codegraph-autoinit.sh`	`hooks/codegraph-autoinit.sh`	1.0.0	Offers `codegraph init` at session start in a git repo that has no `.codegraph/` index; silent without the `codegraph` CLI
`hooks__session-git-platform.sh`	`hooks/session-git-platform.sh`	table only	Exports the detected git platform into session context
`scripts__git-platform-detect.sh`	`scripts/git-platform-detect.sh`	1.0.0	Detects github, gitlab, forgejo, gitea or unknown from the origin remote
`scripts__notify.sh`	`scripts/notify.sh`	table only	The `notify` function: desktop notifications, `alerter` backend on macOS
`scripts__worktree-start.sh`	`scripts/worktree-start.sh`	1.0.0	Mechanics behind `/worktree-start`: git checks, worktree creation, saved init config file copies
`scripts__glab-ci-follow.sh`	`scripts/glab-ci-follow.sh`	1.0.0	Follows a GitLab CI pipeline on any host through `glab`, printing only status changes; host and project come from the `origin` remote
`hud__statusline-wrapper.sh`	`hud/statusline-wrapper.sh`	1.3.1	Status line: HUD on row 1, colored pwd and git info on row 2
`hud__reposition.pl`	`hud/reposition.pl`	table only	Right-aligns HUD segments; the wrapper degrades without it
`statusline-command.sh`	`statusline-command.sh`	table only	Standalone fallback status line, no plugin needed
`commands__worktree-start.md`	`commands/worktree-start.md`	2.1.0	`/worktree-start`
`commands__worktree-finish.md`	`commands/worktree-finish.md`	1.1.0	`/worktree-finish`
`commands__ntfy.md`	`commands/ntfy.md`	1.0.0	`/ntfy`
`commands__ntfy-sub.md`	`commands/ntfy-sub.md`	1.0.0	`/ntfy-sub`
`skills__pr__SKILL.md`	`skills/pr/SKILL.md`	2.1.0	Commit, push, open a PR on the detected platform
`skills__fj__SKILL.md`	`skills/fj/SKILL.md`	1.0.0	Forgejo CLI cheatsheet
`skills__ntfy__SKILL.md`	`skills/ntfy/SKILL.md`	1.0.1	Channel choice, priority floor, title convention, listener trust model
`skills__cheap-orchestration__SKILL.md`	`skills/cheap-orchestration/SKILL.md`	2.0.0	When to delegate and to whom: decision rule by size and stakes, the pinned crew, ordering and guard rules
`skills__cheap-orchestration__references__templates.md`	`skills/cheap-orchestration/references/templates.md`	table only	Spec and return templates for each subagent
`skills__cheap-orchestration__references__evidence.md`	`skills/cheap-orchestration/references/evidence.md`	table only	Benchmark numbers behind each delegation rule
`agents__scout.md`	`agents/scout.md`	table only	Haiku, read-only: answers code questions with `path:line` facts
`agents__editor.md`	`agents/editor.md`	table only	Haiku: mechanical edits with no design choice (docstrings, renames, formatting)
`agents__worker.md`	`agents/worker.md`	table only	Sonnet: any other well-specified unit whose output is files, tests included
`agents__reviewer.md`	`agents/reviewer.md`	table only	Opus: one restriction and polish pass at the end of a long session
`docs__filesystem-policy.md`	`docs/filesystem-policy.md`	table only	Grant-file format, search locations, enforcement blind spots
`docs__shared-checkout-lock.md`	`docs/shared-checkout-lock.md`	table only	The `.agent.lock` protocol for editing a shared checkout
`docs__sessions.md`	`docs/sessions.md`	table only	Launching, messaging and authority rules for separate Claude sessions
`guidelines__karpathy.md`	`guidelines/karpathy.md`	table only	Seed cache for the guidelines hook, not a hard dependency
`install.sh`	not installed	1.1.0	The installer: template, optional overlay, backups, exec bits, refuses to overwrite a non-fresh config without `--force`
name	editor
description	Haiku editor for bulk mechanical edits that need no design decisions - adding docstrings or comments, renames, formatting, moving code verbatim - in one file or a few files. Very cheap. Give it the exact rule to apply and the constraints; it reads the code itself. Returns a short report, never file contents.
model	haiku
tools	Read, Edit, Write, Bash, Grep, Glob
name	reviewer
description	Opus final reviewer, run once after every unit of a long multi-part task is done. First checks that the diff respects every restriction the task sets (for example "only add docstrings"), then fixes polish directly - the doc style the task asks for, missing tests for listed requirements and edge cases, stale path:line references, accuracy of notes and docs. Never changes code behaviour. Give it the task text verbatim; it reads git diff itself. Returns a short report, never file contents.
model	opus
tools	Read, Edit, Write, Bash, Grep, Glob
name	scout
description	Haiku read-only code scout. Use it for any question about the code you need answered before deciding or writing a spec (where X is defined or used, call paths, which functions lack Y, what a test expects, which command runs the checks). Returns at most 15 lines of facts with path:line, never file contents. Never edits.
model	haiku
tools	Read, Grep, Glob, Bash
omitClaudeMd	true
maxTurns	30
name	worker
description	Sonnet implementer for any well-specified unit of work whose output is files - a feature or bug fix from a spec, tests, docs or notes with path:line references, docstrings, type annotations, a refactor. Edits files and runs the tests itself. Give it the full spec and acceptance criteria; it reads the code it needs. Returns a short report, never file contents.
model	sonnet
tools	Read, Edit, Write, Bash, Grep, Glob