obeone · September 7, 2026 14:50
diff --git a/README.md b/README.md
diff --git a/allowed-paths b/allowed-paths
 # Global allowed paths — union with $CLAUDE_PROJECT_DIR, $HOME/.claude, and
 # per-project / per-session grants. One path per line, `#` comments, blank
 # lines ignored. `~` and `~/...` expand to $HOME. Machine-local — not meant
 # to be shared across different hosts.
 #
 # Examples (uncomment / adapt to your machine):
 # ~/Documents/code
 # ~/Documents/git
 # ~/go
 # ~/projects
 # ~/.ssh                # if you want Claude to read SSH config (be careful)
 # /tmp
 # /private/tmp
 #
 # Toolchain caches are worth allowlisting too: they are build artifacts,
 # not personal data (read-only in intent; the hook cannot tell).
 # ~/.platformio/packages/framework-arduinoespressif32
 # ~/.platformio/packages/framework-arduinoespressif32-libs
diff --git a/CLAUDE.md b/CLAUDE.md
diff --git a/commands__ntfy-sub.md b/commands__ntfy-sub.md
diff --git a/commands__ntfy.md b/commands__ntfy.md
diff --git a/commands__worktree-finish.md b/commands__worktree-finish.md
diff --git a/commands__worktree-start.md b/commands__worktree-start.md
diff --git a/docs__filesystem-policy.md b/docs__filesystem-policy.md
diff --git a/docs__shared-checkout-lock.md b/docs__shared-checkout-lock.md
diff --git a/guidelines__karpathy.md b/guidelines__karpathy.md
diff --git a/hooks__backup-claude-config.sh b/hooks__backup-claude-config.sh
 #!/usr/bin/env bash
 # PreToolUse hook — snapshot ~/.claude/** files before they are modified.
 #
 # On every Edit/Write/NotebookEdit whose target lives under ~/.claude, copy
 # the *current* file to ~/.claude/.backups/<mirrored-path>.bak.<datetime>
 # before the tool overwrites it. Side-effect only: always exits 0, never
 # blocks the operation. New files (nothing to back up) are skipped.
 set -euo pipefail

 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 BACKUP_ROOT="$CLAUDE_DIR/.backups"

 # Hook payload arrives as JSON on stdin; pull out the target file path.
 payload="$(cat || true)"
 file_path="$(printf '%s' "$payload" | python3 -c 'import sys, json
 try:
    print(json.load(sys.stdin).get("tool_input", {}).get("file_path", ""))
 except Exception:
    print("")' 2>/dev/null || true)"

 # Need a real, existing regular file to snapshot.
 [ -n "$file_path" ] || exit 0
 [ -f "$file_path" ] || exit 0

 # Canonicalize (resolve the directory portion) to an absolute path.
 abs="$(cd "$(dirname "$file_path")" 2>/dev/null && pwd)/$(basename "$file_path")" || exit 0

 # Only files under ~/.claude, and never back up the backups themselves.
 case "$abs" in
  "$BACKUP_ROOT"/*) exit 0 ;;
  "$CLAUDE_DIR"/*) : ;;
  *) exit 0 ;;
 esac

 # Mirror the relative path under the backup root, suffixed with a timestamp.
 rel="${abs#"$CLAUDE_DIR"/}"
 ts="$(date +%Y%m%d-%H%M%S)"
 dest="$BACKUP_ROOT/$rel.bak.$ts"
 mkdir -p "$(dirname "$dest")"
 cp -p "$abs" "$dest" 2>/dev/null || true

 # Retention: prune backups older than 30 days, then drop empty mirror dirs.
 # Runs opportunistically here — the dir only grows when a backup is made,
 # so cleaning on write keeps it bounded without a separate scheduler.
 find "$BACKUP_ROOT" -type f -name '*.bak.*' -mtime +30 -delete 2>/dev/null || true
 find "$BACKUP_ROOT" -mindepth 1 -type d -empty -delete 2>/dev/null || true

 exit 0
diff --git a/hooks__delegation-nudge.sh b/hooks__delegation-nudge.sh
 #!/usr/bin/env bash
 # delegation-nudge.sh — PreToolUse hook (matcher: Grep|Glob|Read|Bash)
 #
 # Enforces CLAUDE.md "Rule #0 — Delegate before doing it yourself" by
 # counting inline mechanical read/search operations run by the MAIN agent
 # loop within a session. Every Nth matched call, it injects a non-blocking
 # <system-reminder> (hookSpecificOutput.additionalContext) nudging the model
 # to delegate the rest of the investigation to a cheap subagent instead of
 # grinding inline and bloating the orchestrator's context.
 #
 # Design notes:
 # - Advisory only: never blocks or denies; always exits 0 (fail-open).
 # - Skips subagents entirely (payload carries agent_id when inside one):
 #   grinding is precisely what subagents are FOR.
 # - For Bash, only counts commands that look like read/search work
 #   (grep/rg/find/cat/...), not builds, git ops, or mutations.
 # - Per-session counter in a flat /tmp file keyed by sanitized session_id,
 #   same lightweight pattern as enforce-allowed-paths.sh ad-hoc grants.
 #   Races between parallel tool calls may lose an increment; acceptable
 #   for an advisory counter.

 set -u

 # Read the whole PreToolUse JSON payload from stdin.
 payload="$(cat)" || exit 0

 # --- Skip subagents: the nudge targets the main orchestrator loop only. ---
 agent_id="$(printf '%s' "$payload" | jq -r '.agent_id // empty' 2>/dev/null)" || exit 0
 [ -n "$agent_id" ] && exit 0

 # --- Extract and sanitize session_id (it becomes part of a /tmp path). ---
 session_id="$(printf '%s' "$payload" | jq -r '.session_id // empty' 2>/dev/null)" || exit 0
 case "$session_id" in
  ''|*[!a-zA-Z0-9_-]*) exit 0 ;;  # missing or unsafe for a filename: bail silently
 esac

 tool_name="$(printf '%s' "$payload" | jq -r '.tool_name // empty' 2>/dev/null)" || exit 0

 # --- Decide whether this call counts as "inline mechanical work". ---
 case "$tool_name" in
  Grep|Glob|Read)
    : # always counted: pure lookups the main loop should mostly delegate
    ;;
  Bash)
    # Count only read/search-shaped commands; leave builds, tests, git,
    # kubectl, etc. alone. Word-boundary-ish match on common search/read
    # binaries anywhere in the command line (covers pipes and chains).
    cmd="$(printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null)" || exit 0
    if ! printf '%s' "$cmd" | grep -qE '(^|[|;&[:space:]])(grep|rg|find|fd|cat|head|tail|awk|less|tree)([[:space:]]|$)'; then
      exit 0
    fi
    ;;
  *)
    exit 0
    ;;
 esac

 # --- Increment the per-session counter. ---
 counter_file="/tmp/claude-delegation-nudge.${session_id}"
 count="$(cat "$counter_file" 2>/dev/null || echo 0)"
 case "$count" in ''|*[!0-9]*) count=0 ;; esac  # heal corrupt state
 count=$((count + 1))
 printf '%s\n' "$count" > "$counter_file" 2>/dev/null || exit 0

 # --- Nudge every 6th matched call (6, 12, 18, ...). ---
 if [ $((count % 6)) -ne 0 ]; then
  exit 0
 fi

 jq -n --arg n "$count" '{
  hookSpecificOutput: {
    hookEventName: "PreToolUse",
    additionalContext: ("Delegation check (CLAUDE.md Rule #0): the main loop has now run " + $n + " inline read/search operations (Grep/Glob/Read/Bash-search) this session. If you are mid-investigation or doing repeated mechanical lookups, STOP and delegate the rest to a subagent (Explore or executor, model=haiku/sonnet) so only conclusions enter your context. Catch yourself mid-mechanical-task -> delegate the remainder. Ignore only if each call was a genuinely one-off, already-scoped lookup.")
  }
 }'
 exit 0
diff --git a/hooks__delegation-router.py b/hooks__delegation-router.py
 #!/usr/bin/env python3
 # Version: 1.0.0
 """UserPromptSubmit hook: route work to subagents instead of the main loop.

 Reads the Claude Code hook payload on stdin, classifies the user prompt into
 one of three tiers, and emits a short routing directive as additional context.

 Tiers
 -----
 heavy
    Work that justifies loading the ``cheap-orchestration`` skill and fanning
    out parallel agents (refactors, audits, features, root-cause debugging).
 standard
    Routable work that only needs a one-line reminder to delegate with an
    explicit cheap model (fixes, docs, lookups, commits).
 none
    Trivial or conversational prompts. Nothing is injected.

 The hook is deliberately silent for tier ``none`` and de-duplicates itself per
 session, because injecting a reminder on every prompt would spend exactly the
 context budget it is supposed to protect.

 Kill switches: set ``DISABLE_CHEAP_ROUTING=1`` or ``DISABLE_OMC=1``.
 """

 from __future__ import annotations

 import json
 import os
 import re
 import sys
 import unicodedata
 from pathlib import Path

 STATE_DIR = Path.home() / ".claude" / "state" / "cheap-orchestration"

 # Phrases where the user explicitly asks for inline execution. Honour them.
 OPT_OUT = re.compile(
    r"ne delegue pas|sans deleg|pas d'agent|pas de sous-agent|toi meme|toi-meme"
    r"|no deleg|no subagent|do it yourself|inline|directement toi",
 )

 # Short acknowledgements that carry no work.
 ACK = re.compile(
    r"^(oui|non|ok|okay|yes|no|merci|thanks|continue|vas-y|vas y|go|stop"
    r"|parfait|nickel|c'est bon|ca marche)\W*$",
 )

 # Work that warrants a fan-out and the full skill.
 HEAVY = re.compile(
    r"refactor|refonte|reecri|rewrite|migrat|audit"
    r"|architecture|analyse (complete|globale|approfondie)"
    r"|partout|everywhere|tous les fichiers|all files|toute la codebase|whole (codebase|repo)"
    r"|implement|nouvelle fonctionnalite|new feature"
    r"|root cause|cause racine"
    r"|securite|security review"
    r"|benchmark|comparer"
    r"|couverture de test|test coverage|suite de tests|test suite"
    r"|planifi|\bplan\b"
    r"|\breview\b|revue de code|relis tout"
    r"|optimis|performance"
    r"|investigat|explore",
 )

 # Routable but self-contained work.
 STANDARD = re.compile(
    r"\bfix\b|corrig|\bbug\b|erreur|\berror\b"
    r"|ajoute|\badd\b|renomme|rename"
    r"|docstring|commentaire|\bdoc\b|readme|changelog"
    r"|commit|\bpush\b|\bmr\b|\bpr\b"
    r"|met[s]? a jour|update|upgrade|bump"
    r"|lint|format|typo"
    r"|ou est|where is|trouve|\bfind\b|cherche|grep|liste|\blist\b"
    r"|\btest\b|\btests\b"
    r"|supprim|delete|remove"
    r"|script|config",
 )

 HEAVY_FIRST = """<delegation-routing tier="heavy">
 Before acting: invoke the `cheap-orchestration` skill (Skill tool, skill="cheap-orchestration").
 This task warrants decomposition into parallel subagents on cheap models.
 The main loop plans, routes and synthesizes; it does not execute, and it does
 not read raw grep/file/log output. Pass `model` explicitly on every Agent call.
 </delegation-routing>"""

 HEAVY_REPEAT = """<delegation-routing tier="heavy">
 Delegable task: decompose, fan out independent units in one message, explicit
 `model` per Agent call, contracted return shape. Synthesize, do not execute.
 </delegation-routing>"""

 STANDARD_MSG = """<delegation-routing tier="standard">
 Routable: delegate via Agent with an explicit cheap `model` rather than working
 inline. Lookups/greps/status -> haiku. Scoped edits, docs, commits -> sonnet.
 End the prompt with the return shape so no raw output lands in this context.
 </delegation-routing>"""


 def normalize(text: str) -> str:
    """Lowercase and strip accents so the patterns stay readable.

    Parameters
    ----------
    text : str
        Raw user prompt.

    Returns
    -------
    str
        ASCII-folded, lowercased text.
    """
    folded = unicodedata.normalize("NFKD", text)
    return "".join(c for c in folded if not unicodedata.combining(c)).lower()


 def classify(prompt: str) -> str:
    """Return the routing tier for a prompt: ``heavy``, ``standard`` or ``none``.

    Parameters
    ----------
    prompt : str
        Raw user prompt.

    Returns
    -------
    str
        One of ``"heavy"``, ``"standard"``, ``"none"``.
    """
    text = normalize(prompt).strip()

    # Slash commands carry their own instructions; do not second-guess them.
    if not text or text.startswith("/"):
        return "none"
    if ACK.match(text) or OPT_OUT.search(text):
        return "none"

    if HEAVY.search(text):
        return "heavy"
    # A very short prompt with no heavy signal is almost always conversational.
    if len(text.split()) < 4:
        return "none"
    if STANDARD.search(text):
        return "standard"
    return "none"


 def skill_already_loaded(session_id: str) -> bool:
    """Check whether the skill was already requested in this session.

    Parameters
    ----------
    session_id : str
        Claude Code session identifier from the hook payload.

    Returns
    -------
    bool
        True when the full heavy directive has already been injected.
    """
    if not session_id:
        return False
    return (STATE_DIR / session_id).exists()


 def mark_skill_loaded(session_id: str) -> None:
    """Record that the heavy directive was injected for this session.

    Parameters
    ----------
    session_id : str
        Claude Code session identifier from the hook payload.
    """
    if not session_id:
        return
    STATE_DIR.mkdir(parents=True, exist_ok=True)
    (STATE_DIR / session_id).touch()


 def main() -> None:
    """Read the hook payload, classify, and emit the routing directive."""
    if os.environ.get("DISABLE_CHEAP_ROUTING") or os.environ.get("DISABLE_OMC"):
        return

    payload = json.loads(sys.stdin.read() or "{}")
    prompt = payload.get("prompt", "")
    session_id = payload.get("session_id", "")

    tier = classify(prompt)
    if tier == "none":
        return

    loaded = skill_already_loaded(session_id)
    if tier == "heavy":
        message = HEAVY_REPEAT if loaded else HEAVY_FIRST
        mark_skill_loaded(session_id)
    else:
        # Once the skill is in context the standard nudge is pure noise.
        if loaded:
            return
        message = STANDARD_MSG

    print(json.dumps({
        "hookSpecificOutput": {
            "hookEventName": "UserPromptSubmit",
            "additionalContext": message,
        }
    }))


 if __name__ == "__main__":
    try:
        main()
    except Exception:
        # A hook must never break a session. Fail silent, fail open.
        pass
diff --git a/hooks__enforce-allowed-paths.sh b/hooks__enforce-allowed-paths.sh
 #!/usr/bin/env bash
 # Version: 1.0.1
 # PreToolUse hook: restrict Read/Write/Edit/NotebookEdit to allowed paths.
 # Allowlist lives in lib/allowed-paths-common.sh. Violations yield
 # permissionDecision "ask" (explicit user confirmation).

 set -u
 # Only enforce on this host. Set your own hostname below (or delete this
 # guard line entirely to enforce on every machine, including remote hosts
 # reached via SSH, containers, CI, etc.).
 [ "$(hostname -s 2>/dev/null)" = "my-workstation" ] || exit 0
 # shellcheck source=lib/allowed-paths-common.sh
 . "$(dirname "$0")/lib/allowed-paths-common.sh"

 payload="$(cat)"
 path="$(printf '%s' "$payload" | jq -r '
  .tool_input.file_path
  // .tool_input.path
  // .tool_input.notebook_path
  // empty
 ')"
 [ -z "$path" ] && exit 0

 session_id="$(printf '%s' "$payload" | jq -r '.session_id // empty')"

 case "$path" in
  /*) abs="$path" ;;
  *)  abs="${CLAUDE_PROJECT_DIR:-$PWD}/$path" ;;
 esac

 # include_system=0: Read/Write outside user data needs explicit approval.
 if is_path_allowed "$abs" "$session_id" 0; then
  exit 0
 fi

 jq -n --arg p "$abs" '{
  hookSpecificOutput: {
    hookEventName: "PreToolUse",
    permissionDecision: "ask",
    permissionDecisionReason: ("Path outside allowed dirs (project + ~/.claude + grants in ~/.claude/allowed-paths, $project/.claude/allowed-paths, /tmp/claude-allowed-paths.$sid): " + $p)
  }
 }'
 exit 0
diff --git a/hooks__enforce-worktree.sh b/hooks__enforce-worktree.sh
 #!/bin/bash
 # Version: 1.0.0
 # Hook: Enforce worktree policy for file modifications
 # Blocks Edit/Write operations on project files when not working in a .worktrees/ directory.
 # Whitelists configuration and metadata files that are legitimately edited outside worktrees.

 INPUT=$(cat /dev/stdin)
 FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
 CWD=$(echo "$INPUT" | jq -r '.cwd // empty')

 # If no file path, let it through (shouldn't happen for Edit/Write)
 if [[ -z "$FILE_PATH" ]]; then
    exit 0
 fi

 # Whitelist: files that can be edited outside a worktree
 # - .claude/ directory (settings, hooks, memory)
 # - CLAUDE.md project instructions
 # - .github/ directory (workflows, dependabot, etc.)
 if [[ "$FILE_PATH" == *"/.claude/"* ]] || \
   [[ "$FILE_PATH" == *"/CLAUDE.md" ]] || \
   [[ "$FILE_PATH" == *"/.github/"* ]]; then
    exit 0
 fi

 # Check if we're already in a worktree (CWD or file path contains .worktrees/)
 if [[ "$CWD" == *"/.worktrees/"* ]] || [[ "$FILE_PATH" == *"/.worktrees/"* ]]; then
    exit 0
 fi

 # Check if we're in a git repo at all (if not, don't block)
 if ! git -C "$CWD" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    exit 0
 fi

 # If we got here, we're editing a project file outside a worktree — warn only
 jq -n '{
    "hookSpecificOutput": {
        "hookEventName": "PreToolUse",
        "permissionDecision": "allow",
        "permissionDecisionReason": "⚠️ Working outside a worktree. Consider using /worktree-start for non-trivial changes."
    }
 }'
diff --git a/hooks__karpathy-guidelines.sh b/hooks__karpathy-guidelines.sh
 #!/usr/bin/env bash
 # SessionStart hook: inject the Karpathy coding guidelines into every session.
 #
 # Content is cached at ~/.claude/guidelines/karpathy.md and refreshed from
 # GitHub at most once a week. Origin: the andrej-karpathy-skills plugin
 # (github.com/forrestchang/andrej-karpathy-skills). It was installed as a plugin
 # skill, which meant a permanent entry in the model's skill listing and the odd
 # redundant auto-invocation on top of this hook; skillOverrides cannot mask
 # plugin skills, so the plugin went away and the text stayed.
 #
 # The weekly refresh is synchronous on purpose. It costs a few hundred
 # milliseconds once a week (51 of 52 startups never touch the network) and in
 # exchange the outcome is reported in the very session that performed it,
 # instead of through a marker file read by the next one. The spinner's
 # statusMessage, set in settings.json, says what the wait is for.
 #
 # Output is JSON: additionalContext carries the guidelines, systemMessage
 # reports the refresh outcome to the operator. Beware — Claude Code does NOT
 # fall back to plain text when output starts with '{' and fails to parse, it
 # drops the injection entirely. Keep the jq call valid.

 set -euo pipefail

 dir="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/guidelines"
 cache="$dir/karpathy.md"
 stamp="$dir/.karpathy-checked"
 log="$dir/.karpathy-refresh.log"
 diff_file="$dir/.karpathy-last.diff"
 url="https://raw.githubusercontent.com/forrestchang/andrej-karpathy-skills/main/skills/karpathy-guidelines/SKILL.md"

 max_age_minutes=10080   # 7 days
 timeout_refresh=10      # on the critical path: keep the worst case short

 notice=""        # non-empty => surfaced to the operator as systemMessage
 changed_diff=""  # non-empty => the diff is also appended to the model's context

 # Download, strip the YAML frontmatter, sanity-check, install atomically, and
 # describe what changed. The cache is only ever replaced by content that passed
 # every check, so a 404 page, a captive-portal redirect, or a truncated body
 # leaves it intact.
 refresh() {
  local tmp size added removed rc=0
  tmp="$(mktemp "$dir/.karpathy.XXXXXX")" || return 1
  # shellcheck disable=SC2064
  trap "rm -f '$tmp'" RETURN

  # -S omitted on purpose: a failure is already reported through systemMessage
  # and the log, so curl's own stderr would only duplicate it in the transcript.
  curl -fsL -m "$timeout_refresh" "$url" \
    | awk 'NR==1 && $0=="---" {fm=1; next} fm && $0=="---" {fm=0; next} !fm' \
    | awk 'NF {p=1} p' > "$tmp" || rc=$?

  if [ "$rc" -ne 0 ]; then
    printf '%s  fetch failed (rc=%s)\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$rc" >> "$log"
    notice="Karpathy guidelines: upstream check failed, using the cached copy."
    return 1
  fi

  # Bounded size and an expected first line: cheap guards against a body that
  # downloaded fine but is not the document we asked for.
  size=$(wc -c < "$tmp" | tr -d '[:space:]')   # macOS wc pads its output
  if [ "$size" -lt 500 ] || [ "$size" -gt 32768 ] || ! head -1 "$tmp" | grep -q '^# Karpathy Guidelines$'; then
    printf '%s  rejected: unexpected content (%s bytes)\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$size" >> "$log"
    notice="Karpathy guidelines: upstream returned an unexpected document, kept the cached copy."
    return 1
  fi

  if [ ! -f "$cache" ]; then
    notice="Karpathy guidelines: downloaded from GitHub ($size bytes)."
    printf '%s  bootstrapped (%s bytes)\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$size" >> "$log"
  elif cmp -s "$cache" "$tmp"; then
    # Nothing changed: stay silent. The weekly check is not news.
    :
  else
    # Keep the diff instead of throwing it away: without it the operator only
    # learns that something changed, never what. Written before the mv, while
    # the old version still exists. Counting skips the '+++'/'---' headers by
    # prefix rather than by a '^+[^+]' pattern, which would silently miss an
    # added blank line (a bare '+' has no following character to match).
    diff -u "$cache" "$tmp" > "$diff_file" || true
    added=$(awk '/^\+\+\+ /{next} /^\+/{n++} END{print n+0}' "$diff_file")
    removed=$(awk '/^--- /{next} /^-/{n++} END{print n+0}' "$diff_file")
    notice="Karpathy guidelines UPDATED from GitHub (+$added/-$removed lines). diff: $diff_file"
    changed_diff="$(cat "$diff_file")"
    printf '%s  updated (+%s/-%s lines, %s bytes)\n' \
      "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$added" "$removed" "$size" >> "$log"
  fi

  mv -f "$tmp" "$cache"
  trap - RETURN
  return 0
 }

 mkdir -p "$dir"

 # Refresh when the cache is missing (nothing to serve otherwise) or a week old.
 # Stamp on attempt, not on success: a persistently unreachable upstream must not
 # turn every startup into a failed network round trip.
 if [ ! -f "$cache" ] || [ ! -f "$stamp" ] || [ -n "$(find "$stamp" -mmin "+$max_age_minutes" 2>/dev/null)" ]; then
  touch "$stamp"
  refresh || true
 fi

 [ -f "$cache" ] || exit 0

 context="$(printf 'The following behavioral guidelines are ALWAYS active for this session:\n\n'; cat "$cache")"

 # Only on the run that actually updated the cache: hand the diff to the model so
 # it can tell the operator, in plain language, what upstream changed and whether
 # it alters how it works. Costs tokens only on that one session.
 if [ -n "$changed_diff" ]; then
  context="$(printf '%s\n\n---\n\nThese guidelines were just updated from upstream. In your first reply of this session, briefly tell the operator what changed and whether it alters how you work. Unified diff (old -> new):\n\n```diff\n%s\n```\n' "$context" "$changed_diff")"
 fi

 if [ -n "$notice" ]; then
  jq -n --arg body "$context" --arg msg "$notice" \
    '{systemMessage: $msg,
      hookSpecificOutput: {hookEventName: "SessionStart", additionalContext: $body}}'
 else
  jq -n --arg body "$context" \
    '{hookSpecificOutput: {hookEventName: "SessionStart", additionalContext: $body}}'
 fi
diff --git a/hooks__lib__allowed-paths-common.sh b/hooks__lib__allowed-paths-common.sh
 #!/usr/bin/env bash
 # Shared helpers for enforce-allowed-paths{,-bash}.sh
 #
 # Exports:
 #   is_under <path> <root>               — bool, path is root or under root
 #   is_path_allowed <abs> <sid> <sys>    — bool, abs allowed by any source
 #
 # Extra paths for ad-hoc grants are read (union) from:
 #   ~/.claude/allowed-paths                        (global, permanent)
 #   $CLAUDE_PROJECT_DIR/.claude/allowed-paths      (project, checked in or local)
 #   /tmp/claude-allowed-paths.$session_id          (current session only)
 # Format: one path per line, blank lines and `#` comments ignored.
 # `~` and `~/...` expand to $HOME.

 # Hardcoded minimum: only truly universal paths. Everything else (personal
 # data dirs, ~/.ssh, etc.) lives in ~/.claude/allowed-paths so the same
 # hook works unchanged on any machine (local, remote over SSH, container).
 _HARDCODED_USER_ROOTS=(
  "$HOME/.claude"
 )

 _SYSTEM_ROOTS=(
  /usr /bin /sbin /opt /Library /System /Applications /dev
  /tmp /var/folders /private/tmp /private/var/folders
 )

 is_under() {
  local p="$1" root="$2"
  [ "$p" = "$root" ] && return 0
  case "$p" in "$root"/*) return 0 ;; esac
  return 1
 }

 _expand_tilde() {
  case "$1" in
    "~")   printf '%s' "$HOME" ;;
    "~/"*) printf '%s' "$HOME/${1#"~/"}" ;;
    *)     printf '%s' "$1" ;;
  esac
 }

 _emit_extra_paths() {
  local session_id="$1" f line
  local files=(
    "$HOME/.claude/allowed-paths"
    "${CLAUDE_PROJECT_DIR:-$PWD}/.claude/allowed-paths"
  )
  [ -n "$session_id" ] && files+=("/tmp/claude-allowed-paths.$session_id")
  for f in "${files[@]}"; do
    [ -r "$f" ] || continue
    while IFS= read -r line || [ -n "$line" ]; do
      line="${line#"${line%%[![:space:]]*}"}"
      line="${line%"${line##*[![:space:]]}"}"
      [ -z "$line" ] && continue
      case "$line" in \#*) continue ;; esac
      _expand_tilde "$line"
      printf '\n'
    done < "$f"
  done
 }

 is_path_allowed() {
  local path="$1" session_id="${2:-}" include_system="${3:-0}"
  local proj="${CLAUDE_PROJECT_DIR:-$PWD}" root
  is_under "$path" "$proj" && return 0
  # Always allow git worktrees, both the Claude Code default location
  # (<project>/.claude/worktrees/<branch>) and the <project>/.worktrees/<branch>
  # convention. Worktree sessions run with cwd inside the worktree, but
  # CLAUDE_PROJECT_DIR is fixed at session start and may still point at the
  # main checkout, so the is_under check above would otherwise miss them.
  case "$path" in
    */.claude/worktrees/*|*/.worktrees/*) return 0 ;;
  esac
  for root in "${_HARDCODED_USER_ROOTS[@]}"; do
    is_under "$path" "$root" && return 0
  done
  if [ "$include_system" = "1" ]; then
    for root in "${_SYSTEM_ROOTS[@]}"; do
      is_under "$path" "$root" && return 0
    done
  fi
  while IFS= read -r root; do
    [ -z "$root" ] && continue
    is_under "$path" "$root" && return 0
  done < <(_emit_extra_paths "$session_id")
  return 1
 }
diff --git a/hooks__session-git-platform.sh b/hooks__session-git-platform.sh
 #!/usr/bin/env bash
 # SessionStart hook — surface the repo's git platform into session context so
 # the model never runs `git remote -v` or reasons about the host.
 #
 # Precedence: $CLAUDE_GIT_PLATFORM (exported by the `claude` launcher) wins;
 # otherwise auto-detect via git-platform-detect.sh against the session cwd.
 # Emits the result as SessionStart additionalContext (JSON — raw stdout is
 # ignored for context). Stays silent (no context) if neither yields anything.
 set -uo pipefail

 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"

 # SessionStart payload carries cwd on stdin; fall back to $PWD.
 payload="$(cat 2>/dev/null || true)"
 cwd="$(printf '%s' "$payload" | python3 -c 'import sys, json
 try:
    print(json.load(sys.stdin).get("cwd", ""))
 except Exception:
    print("")' 2>/dev/null || true)"
 [ -n "$cwd" ] || cwd="$PWD"

 line=""
 if [ -n "${CLAUDE_GIT_PLATFORM:-}" ]; then
  line="Git platform (from \$CLAUDE_GIT_PLATFORM): ${CLAUDE_GIT_PLATFORM}. Use it as-is for git-host ops (MCP-first, CLI fallback); do not run \`git remote -v\`."
 else
  detected="$(bash "$CLAUDE_DIR/scripts/git-platform-detect.sh" "$cwd" 2>/dev/null || true)"
  [ -n "$detected" ] && line="$detected"
 fi

 # Nothing to say (no override, not a git repo) → emit no context.
 [ -n "$line" ] || exit 0

 # SessionStart context MUST be JSON under hookSpecificOutput.additionalContext.
 printf '%s' "$line" | python3 -c 'import sys, json
 ctx = sys.stdin.read()
 print(json.dumps({"hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": ctx}}))'
 exit 0
diff --git a/hud__reposition.pl b/hud__reposition.pl
 #!/usr/bin/env perl
 # Reposition OMC HUD segments:
 #   - move "[OMC] ... omc update" to the far right of the git/branch line
 #   - move "Model: ..." to the far right of the stats line (5h/wk/session/ctx)
 # Right-alignment is computed against HUD_COLS (terminal width).
 # Runs AFTER the wrapper's existing per-line perl (so [OMC#x] is already [OMC]).
 use strict;
 use warnings;

 # Visible length: strip SGR escapes, then count chars.
 sub vl {
    my $s = shift;
    $s =~ s/\e\[[0-9;]*m//g;
    return length $s;
 }

 my $cols = $ENV{HUD_COLS} && $ENV{HUD_COLS} =~ /^\d+$/ ? $ENV{HUD_COLS} + 0 : 100;
 my $SEP  = "\e[2m | \e[0m";           # exact top-level element separator

 local $/;                              # slurp
 my $text = <STDIN>;
 $text = '' unless defined $text;
 my @L = split /\n/, $text, -1;

 # --- drop the "thinking" indicator segment plus one adjacent separator ---
 # (matches any SGR wrapper so it survives a format/color change)
 for my $l (@L) {
    $l =~ s/\Q$SEP\E\e\[[0-9;]*mthinking\e\[0m//
      or $l =~ s/\e\[[0-9;]*mthinking\e\[0m\Q$SEP\E//
      or $l =~ s/\e\[[0-9;]*mthinking\e\[0m//;
 }

 # --- extract the OMC label+update segment (bold or dim wrapper) ---
 my $omc = '';
 for my $i (0 .. $#L) {
    if ($L[$i] =~ /(\e\[[0-9;]*m\[OMC\][^\e]*\e\[0m)/) {
        $omc = $1;
        # remove segment plus one adjacent separator (it is the first segment)
        $L[$i] =~ s/\Q$omc\E\Q$SEP\E//
          or $L[$i] =~ s/\Q$SEP\E\Q$omc\E//
          or $L[$i] =~ s/\Q$omc\E//;
        last;
    }
 }

 # --- extract the Model segment (cyan) ---
 my $model = '';
 for my $i (0 .. $#L) {
    if ($L[$i] =~ /(\e\[36mModel:[^\e]*\e\[0m)/) {
        $model = $1;
        $L[$i] =~ s/\Q$model\E\Q$SEP\E//
          or $L[$i] =~ s/\Q$SEP\E\Q$model\E//
          or $L[$i] =~ s/\Q$model\E//;
        last;
    }
 }

 # --- drop lines that became empty (whitespace-only after stripping ANSI) ---
 @L = grep { vl($_) > 0 } @L;

 # --- locate target lines by content ---
 my ($git_i, $stat_i) = (-1, -1);
 for my $i (0 .. $#L) { if ($L[$i] =~ /branch:/)                { $git_i  = $i; last } }
 for my $i (0 .. $#L) { if ($L[$i] =~ /5h:|wk:|session:|ctx:/)  { $stat_i = $i; last } }
 $git_i  = 0 if $git_i  < 0 && @L;
 if ($stat_i < 0) { $stat_i = ($git_i + 1 <= $#L) ? $git_i + 1 : $git_i; }

 # --- right-align helper (append with computed padding) ---
 my $rpad = sub {
    my ($idx, $seg) = @_;
    return if $seg eq '' || $idx < 0 || $idx > $#L;
    my $pad = $cols - vl($L[$idx]) - vl($seg);
    $pad = 1 if $pad < 1;
    $L[$idx] .= (' ' x $pad) . $seg;
 };

 # OMC -> right of git line
 $rpad->($git_i, $omc) if $omc ne '';
 # Model -> right of stats line (avoid collision with the git line)
 $rpad->($stat_i, $model) if $model ne '' && $stat_i != $git_i;

 print join("\n", @L);
diff --git a/hud__statusline-wrapper.sh b/hud__statusline-wrapper.sh
 #!/bin/sh
 # Version: 1.3.0
 # statusline-wrapper.sh
 # Runs the OMC HUD on line 1, enriched project info on line 2.
 # Requires a Nerd Font in your terminal: the folder glyph on line 2 and the
 # per-stack icons below are Nerd Font private-use codepoints, and render as
 # boxes/tofu without one.

 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

 # Read stdin once into a variable
 input=$(cat)

 # Optional side-car: hand the same payload to a usage tap, which keeps the plan
 # quota windows in ~/.claude/buddy-usage.json for an external panel to read.
 # Point USAGE_TAP at your own binary, or drop this block if you have none.
 # Backgrounded and fully redirected on purpose: this wrapper IS the status line,
 # rendered on every assistant message and by several sessions at once, so the tap
 # must never slow it down, never write to stdout, and never fail it.
 USAGE_TAP="$HOME/path/to/usage-tap/bin/buddy-usage-tap"
 if [ -x "$USAGE_TAP" ]; then
  printf '%s' "$input" | "$USAGE_TAP" >/dev/null 2>&1 &
 fi

 # Extract fields from JSON input
 cwd=$(printf '%s' "$input" | jq -r '.cwd // .workspace.current_dir // empty' 2>/dev/null)

 # Run OMC HUD with the same input, capture output
 omc_output=$(printf '%s' "$input" | sh "$SCRIPT_DIR/find-node.sh" "$SCRIPT_DIR/omc-hud.mjs" 2>/dev/null)

 # Post-process OMC output:
 #   - strip version: [OMC#4.11.5] -> [OMC]
 #   - drop " sn:X%..." segment up to next " |" or end
 #   - drop "session:XXm" segment including trailing " |" separator
 # Guarded: without perl the HUD line is passed through unprocessed rather than
 # swallowed by an empty command substitution.
 if command -v perl >/dev/null 2>&1; then
  omc_output=$(printf '%s' "$omc_output" | perl -pe '
    # 1. Strip OMC version tag
    s/\[OMC#\d+\.\d+\.\d+\]/[OMC]/g;
    # 2. Remove sn block. Format: " \e[2msn:\e[0m\e[32mXX%\e[0m\e[2m*\e[0m\e[2m(~...)\e[0m"
    s/ \e\[2msn:.*?\)\e\[0m//g;
    # 3. Remove "session:XXm" + its trailing dim " | " separator
    s/session:\e\[[0-9;]+m\d+m\e\[0m\s*\e\[2m\s*\|\s*\e\[0m\s*//g;
  ')
 fi

 # Terminal width (the same one the HUD wrapped against) for right-alignment.
 # stty on the controlling tty is reliable even though stdout is piped here.
 hud_cols=$( { stty size </dev/tty | awk '{print $2}'; } 2>/dev/null )
 case "$hud_cols" in ''|*[!0-9]*) hud_cols="$COLUMNS" ;; esac
 case "$hud_cols" in ''|*[!0-9]*) hud_cols=$(tput cols 2>/dev/null) ;; esac
 case "$hud_cols" in ''|*[!0-9]*) hud_cols=100 ;; esac

 # Reposition segments: "[OMC] ... omc update" -> far right of the git line,
 # "Model: ..." -> far right of the stats line, and drop the "thinking" badge.
 # Skip cleanly if perl or the helper script is missing: the status line still
 # renders, just without the right-alignment pass.
 if [ -f "$SCRIPT_DIR/reposition.pl" ] && command -v perl >/dev/null 2>&1; then
  omc_output=$(printf '%s' "$omc_output" | HUD_COLS="$hud_cols" perl "$SCRIPT_DIR/reposition.pl")
 fi

 # --- Helpers ---

 # Dim separator: │
 sep() {
  printf ' \033[2m│\033[0m '
 }

 # Detect git info: branch + dirty/clean
 # Falls back to multi-repo summary if cwd is a parent of several repos.
 git_info() {
  local dir="$1"
  [ -n "$dir" ] || return 0

  if git -C "$dir" rev-parse --git-dir >/dev/null 2>&1; then
    local branch
    branch=$(git -C "$dir" --no-optional-locks branch --show-current 2>/dev/null)
    [ -z "$branch" ] && branch=$(git -C "$dir" --no-optional-locks rev-parse --short HEAD 2>/dev/null)
    [ -z "$branch" ] && return 0

    local dirty=""
    if [ -n "$(git -C "$dir" --no-optional-locks status --porcelain 2>/dev/null | head -1)" ]; then
      dirty="\033[33m±\033[0m"
    else
      dirty="\033[32m✓\033[0m"
    fi

    # ahead/behind + upstream name when diverged
    local ab=""
    local upstream
    upstream=$(git -C "$dir" --no-optional-locks rev-parse --abbrev-ref '@{upstream}' 2>/dev/null)
    if [ -n "$upstream" ]; then
      local ahead behind
      ahead=$(git -C "$dir" --no-optional-locks rev-list --count '@{upstream}..HEAD' 2>/dev/null)
      behind=$(git -C "$dir" --no-optional-locks rev-list --count 'HEAD..@{upstream}' 2>/dev/null)
      [ "${ahead:-0}" -gt 0 ] && ab=" \033[32m↑${ahead}\033[0m"
      [ "${behind:-0}" -gt 0 ] && ab="${ab} \033[31m↓${behind}\033[0m"
      # Only surface upstream name when it's non-obvious (not origin/<same-branch>)
      if { [ "${ahead:-0}" -gt 0 ] || [ "${behind:-0}" -gt 0 ]; } \
         && [ "$upstream" != "origin/$branch" ]; then
        ab="${ab} \033[2m${upstream}\033[0m"
      fi
    fi

    # nf-dev-git_branch U+E725
    printf '\033[35m\xee\x9c\xa5 %s\033[0m %b%b' "$branch" "$dirty" "$ab"
    return 0
  fi

  # Not in a git repo — scan immediate subdirs for child repos
  local count=0 child single=""
  for child in "$dir"/*/; do
    [ -d "${child}.git" ] && { count=$((count+1)); single="${child%/}"; }
  done
  if [ "$count" -eq 1 ]; then
    # Single child repo: show its branch (but mark as child)
    local cb
    cb=$(git -C "$single" --no-optional-locks branch --show-current 2>/dev/null)
    [ -n "$cb" ] && printf '\033[2;35m\xee\x9c\xa5\033[0m \033[35m%s\033[0m\033[2m/%s\033[0m' "$(basename "$single")" "$cb"
  elif [ "$count" -gt 1 ]; then
    # nf-oct-repo U+EA62
    printf '\033[2;35m\xee\xa9\xa2 %d repos\033[0m' "$count"
  fi
 }

 # Detect project stack from files present
 detect_stack() {
  local dir="$1"
  [ -n "$dir" ] || return 0
  local items=""
  # Dim middle dot separator between stack icons
  local s=' \033[2m·\033[0m '

  # Python: nf-seti-python U+E235
  if [ -f "$dir/pyproject.toml" ] || [ -f "$dir/setup.py" ] || [ -f "$dir/requirements.txt" ]; then
    items="\033[33m\xee\x88\xb5\033[0m"
    # Show venv name if active
    if [ -n "$VIRTUAL_ENV" ]; then
      items="${items} \033[2m$(basename "$VIRTUAL_ENV")\033[0m"
    fi
  fi

  # Node/JS: nf-md-nodejs U+F0399 -> too many bytes, use nf-dev-javascript U+E781
  if [ -f "$dir/package.json" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[32m\xee\x9e\x81\033[0m"
  fi

  # Go: nf-seti-go U+E627
  if [ -f "$dir/go.mod" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[36m\xee\x98\xa7\033[0m"
  fi

  # Rust: nf-dev-rust U+E7A8
  if [ -f "$dir/Cargo.toml" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[31m\xee\x9e\xa8\033[0m"
  fi

  # Docker: nf-dev-docker U+E7B0
  if [ -f "$dir/Dockerfile" ] || [ -f "$dir/docker-compose.yml" ] || [ -f "$dir/compose.yaml" ] || [ -f "$dir/compose.yml" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[34m\xee\x9e\xb0\033[0m"
  fi

  # Helm: nf-md-helm U+F0833 -> use ⎈
  if [ -d "$dir/.helm" ] || [ -f "$dir/Chart.yaml" ]; then
    [ -n "$items" ] && items="${items}${s}"
    items="${items}\033[36m⎈\033[0m"
  fi

  [ -n "$items" ] && printf '%b' "$items"
 }

 # Build colored pwd
 colored_pwd() {
  local path="$1"
  local home="$HOME"
  case "$path" in
    "$home"/*)  path="~/${path#"$home"/}" ;;
    "$home")    path="~" ;;
  esac

  case "$path" in
    */*)
      parent="${path%/*}"
      base="${path##*/}"
      printf '\xef\x81\xbb  \033[37m%s/\033[0m\033[1;32m%s\033[0m' "$parent" "$base"
      ;;
    *)
      printf '\xef\x81\xbb  \033[1;32m%s\033[0m' "$path"
      ;;
  esac
 }

 # --- Output ---

 # Line 1: OMC HUD
 if [ -n "$omc_output" ]; then
  printf '%s\n' "$omc_output"
 fi

 # Line 2: pwd │ git │ stack
 if [ -n "$cwd" ]; then
  colored_pwd "$cwd"

  gi=$(git_info "$cwd")
  if [ -n "$gi" ]; then
    sep
    printf '%b' "$gi"
  fi

  st=$(detect_stack "$cwd")
  if [ -n "$st" ]; then
    sep
    printf '%b' "$st"
  fi

  printf '\n'
 fi
diff --git a/scripts__git-platform-detect.sh b/scripts__git-platform-detect.sh
 #!/usr/bin/env bash
 # Version: 1.0.0
 # Detect the git hosting platform of a repository so a session never has to
 # run `git remote -v` and reason about the host itself.
 #
 # Usage: git-platform-detect.sh [dir]   (defaults to $PWD)
 # Stdout: one summary line — platform, host, remote URL, tooling hint.
 #         Nothing if not a git repo or no remote. Always exits 0.
 #
 # Fast path: a small map of known hosts (public ones below, plus your own
 # custom hosts in the block right after this header). Unknown hosts get a
 # best-effort, short-timeout API probe (Forgejo/Gitea, then GitLab, then
 # GitHub Enterprise).
 set -uo pipefail

 # ---------------------------------------------------------------------------
 # CUSTOM HOST OVERRIDES — edit this for your own self-hosted instances.
 # Add one entry per host you use, in "host:platform:tool-hint" form. This is
 # for hosts the autodiscovery probe below might get wrong, is slow to reach,
 # or that you'd rather pin explicitly (e.g. a self-hosted GitLab whose domain
 # doesn't say "gitlab", or a personal Forgejo/Gitea instance).
 # platform must be one of: github, gitlab, forgejo, gitea, github-enterprise
 # ---------------------------------------------------------------------------
 CUSTOM_HOSTS=(
  "gitlab.example.com:gitlab:glab (self-hosted; the GitLab MCP only covers gitlab.com)"
  "forgejo.example.com:forgejo:fj CLI, or tea (see your Forgejo skill/docs if you keep one)"
 )

 bare=0
 case "${1:-}" in --platform|-p) bare=1; shift ;; esac
 dir="${1:-$PWD}"

 # Must be inside a work tree with a remote.
 git -C "$dir" rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
 url="$(git -C "$dir" remote get-url origin 2>/dev/null || true)"
 if [ -z "$url" ]; then
  first="$(git -C "$dir" remote 2>/dev/null | head -n1)"
  [ -n "$first" ] && url="$(git -C "$dir" remote get-url "$first" 2>/dev/null || true)"
 fi
 [ -n "$url" ] || exit 0

 # Extract host from ssh (git@host:path, ssh://git@host:port/path) or https URLs.
 host=""
 case "$url" in
  *://*)  host="${url#*://}"; host="${host#*@}"; host="${host%%/*}"; host="${host%%:*}" ;;
  *@*:*)  host="${url#*@}";   host="${host%%:*}" ;;
  *@*)    host="${url#*@}";   host="${host%%/*}" ;;
 esac
 [ -n "$host" ] || exit 0

 # Known hosts (no network needed): public platforms first, then your
 # CUSTOM_HOSTS overrides from above.
 platform=""; tool=""
 case "$host" in
  github.com|*.github.com) platform="github";  tool="gh" ;;
  gitlab.com)              platform="gitlab";  tool="GitLab MCP / glab" ;;
 esac
 if [ -z "$platform" ]; then
  for entry in "${CUSTOM_HOSTS[@]:-}"; do
    [ -z "$entry" ] && continue
    ehost="${entry%%:*}"; rest="${entry#*:}"
    [ "$ehost" = "$host" ] || continue
    platform="${rest%%:*}"; tool="${rest#*:}"
    break
  done
 fi

 # Light autodiscovery for unknown hosts — best effort, never fatal.
 if [ -z "$platform" ] && command -v curl >/dev/null 2>&1; then
  probe() { curl -s --max-time 2 "$1" 2>/dev/null; }
  if probe "https://$host/api/v1/version" | grep -q '"version"'; then
    platform="forgejo/gitea"; tool="fj / tea"
  elif probe "https://$host/api/v4/version" | grep -qE '"version"|"message"'; then
    platform="gitlab"; tool="glab"
  elif curl -s -o /dev/null --max-time 2 -w '%{http_code}' "https://$host/api/v3/" 2>/dev/null | grep -qE '^(200|401|403)$'; then
    platform="github-enterprise"; tool="gh"
  fi
 fi

 [ -n "$platform" ] || platform="unknown"
 [ -n "$tool" ] || tool="confirm manually"

 # Bare mode: emit only the platform token (nothing if unknown) — for the launcher.
 if [ "$bare" = 1 ]; then
  [ "$platform" != "unknown" ] && printf '%s\n' "$platform"
  exit 0
 fi

 printf 'Git platform (auto-detected): %s — host %s, remote %s. Tooling: MCP-first, else %s. No need to run `git remote -v`.\n' \
  "$platform" "$host" "$url" "$tool"
 exit 0
diff --git a/scripts__notify.sh b/scripts__notify.sh
 #!/usr/bin/env bash
 # notify - Cross-context notification helper for Claude Code (and humans)
 #
 # Auto-detects Kitty terminal vs macOS, handles /dev/tty redirection
 # from Claude Code's Bash tool (where stdin/stdout are pipes), and
 # falls back to alerter on macOS for actionable notifications.
 #
 # Source this file from ~/.zshrc:
 #   source ~/.claude/scripts/notify.sh
 #
 # Usage:
 #   notify "Title" "Message"
 #   notify --type=done         "Tests OK"        "12 passed"
 #   notify --type=needs-input  "Claude waiting"  "Awaiting your input"
 #   notify --type=error        "Build failed"    "Tests broke on main"
 #   notify --reply "Continue?" "Build OK"        "Deploy now"
 #   notify --help

 # Detect the macOS bundle ID of the terminal/host app that invoked us, so
 # alerter shows that app's icon and piggy-backs on its notification
 # permission. Falls back to walking the parent process tree, then VSCode.
 _notify_detect_sender() {
    case "${TERM_PROGRAM:-}" in
        Apple_Terminal) echo "com.apple.Terminal"; return ;;
        iTerm.app)      echo "com.googlecode.iterm2"; return ;;
        vscode)         echo "com.microsoft.VSCode"; return ;;
        WezTerm)        echo "com.github.wez.wezterm"; return ;;
        ghostty)        echo "com.mitchellh.ghostty"; return ;;
        Hyper)          echo "co.zeit.hyper"; return ;;
        Tabby)          echo "org.tabby"; return ;;
        warp)           echo "dev.warp.Warp-Stable"; return ;;
        Alacritty)      echo "org.alacritty"; return ;;
    esac
    [[ -n "${KITTY_WINDOW_ID:-}" || "${TERM:-}" == "xterm-kitty" ]] \
        && { echo "net.kovidgoyal.kitty"; return; }
    [[ -n "${WEZTERM_PANE:-}"      ]] && { echo "com.github.wez.wezterm"; return; }
    [[ -n "${ITERM_SESSION_ID:-}"  ]] && { echo "com.googlecode.iterm2"; return; }
    [[ -n "${VSCODE_PID:-}" || -n "${VSCODE_IPC_HOOK_CLI:-}" ]] \
        && { echo "com.microsoft.VSCode"; return; }

    local pid=$PPID exe
    while [[ -n "$pid" && "$pid" != "0" && "$pid" != "1" ]]; do
        exe=$(ps -o comm= -p "$pid" 2>/dev/null)
        case "$exe" in
            *kitty*)               echo "net.kovidgoyal.kitty";       return ;;
            *iTerm2*|*iTerm*)      echo "com.googlecode.iterm2";      return ;;
            *Code\ Helper*|*Code*) echo "com.microsoft.VSCode";       return ;;
            *Terminal*)            echo "com.apple.Terminal";         return ;;
            *WezTerm*|*wezterm*)   echo "com.github.wez.wezterm";     return ;;
            *Ghostty*|*ghostty*)   echo "com.mitchellh.ghostty";      return ;;
            *Warp*)                echo "dev.warp.Warp-Stable";       return ;;
            *Alacritty*)           echo "org.alacritty";              return ;;
            *Hyper*)               echo "co.zeit.hyper";              return ;;
        esac
        pid=$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ')
    done
    echo "com.microsoft.VSCode"
 }

 notify() {
    local title=""
    local message=""
    local type=""
    local urgency=""
    local sound=""
    local icon=""
    local icon_path=""
    local app_name="Claude Code"
    local identifier=""
    local expire_after=""
    local timeout=""
    local reply=""
    local actions=""
    local sender=""
    local force_alerter=0
    local no_prefix=0

    while [[ $# -gt 0 ]]; do
        case "$1" in
            -h|--help)
                cat <<'HELP'
 notify - Send a desktop notification

 USAGE:
    notify [OPTIONS] TITLE MESSAGE

 SEMANTIC TYPES (preset icon + urgency + timeout + emoji prefix):
    --type=done         Task finished      ✅  icon=info,           timeout=10s,  urgency=low
    --type=needs-input  Waiting on user    🫵  icon=question,       sticky,       urgency=critical
    --type=error        Failure            ❌  icon=error,          sticky,       urgency=critical
    --type=progress     Long-running       ⏳  icon=system-monitor, sticky,       urgency=low
    --type=info         Default (no emoji)     icon=info,           timeout=10s,  urgency=normal

 OPTIONS (override the preset):
    -h, --help              Show this help
    --type=NAME             Semantic preset (see above)
    --urgency=LEVEL         low | normal | critical
    --sound=NAME            Sound name (system-dependent)
    --icon=NAME             Standard icon: error, info, warning, question,
                            system-monitor, help, file-manager, text-editor
    --icon-path=PATH        PNG/JPEG/GIF icon file
    --app-name=NAME         Sender app (default: "Claude Code")
    --identifier=ID         Replace/update an existing notif with the same ID
    --expire-after=DURATION Kitty: Ns / Nm / Nh / Nd / never
    --timeout=N             Alerter / notify-send: auto-close after N seconds
    --reply=PLACEHOLDER     Show text input (forces alerter on macOS)
    --actions=A,B,C         Show action buttons (forces alerter on macOS)
    --sender=BUNDLE_ID      Alerter: override the macOS app whose icon and
                            notification permission are used (auto-detected
                            from $TERM_PROGRAM / process tree by default)
    --alerter               Force alerter backend even inside Kitty
    --no-prefix             Don't prepend the type emoji to the title

 BACKENDS (auto-detected, override with --alerter):
    Kitty (TERM=xterm-kitty)  → kitten notify (OSC 99, fire-and-forget)
    macOS                     → alerter (Swift, supports actions/reply)
    Else                      → notify-send (best effort)

 EXIT CODES:
    0   Success (alerter: also returns action label / reply on stdout)
    1   Notification failed
    2   Bad arguments
 HELP
                return 0
                ;;
            --type=*)         type="${1#*=}"; shift ;;
            --urgency=*)      urgency="${1#*=}"; shift ;;
            --sound=*)        sound="${1#*=}"; shift ;;
            --icon=*)         icon="${1#*=}"; shift ;;
            --icon-path=*)    icon_path="${1#*=}"; shift ;;
            --app-name=*)     app_name="${1#*=}"; shift ;;
            --identifier=*)   identifier="${1#*=}"; shift ;;
            --expire-after=*) expire_after="${1#*=}"; shift ;;
            --timeout=*)      timeout="${1#*=}"; shift ;;
            --reply=*)        reply="${1#*=}"; force_alerter=1; shift ;;
            --actions=*)      actions="${1#*=}"; force_alerter=1; shift ;;
            --sender=*)       sender="${1#*=}"; shift ;;
            --alerter)        force_alerter=1; shift ;;
            --no-prefix)      no_prefix=1; shift ;;
            -*)
                echo "notify: unknown option: $1" >&2
                return 2
                ;;
            *)
                if [[ -z "$title" ]]; then
                    title="$1"
                elif [[ -z "$message" ]]; then
                    message="$1"
                else
                    echo "notify: too many positional arguments" >&2
                    return 2
                fi
                shift
                ;;
        esac
    done

    if [[ -z "$title" ]]; then
        echo "notify: TITLE required (run 'notify --help')" >&2
        return 2
    fi

    # Apply type presets — caller-supplied flags win (: ${var:=default}).
    local prefix=""
    case "${type:-info}" in
        done)
            : "${urgency:=low}"
            : "${icon:=info}"
            : "${expire_after:=10s}"
            : "${timeout:=10}"
            prefix="✅ "
            ;;
        needs-input)
            : "${urgency:=critical}"
            : "${icon:=question}"
            : "${expire_after:=never}"
            prefix="🫵 "
            ;;
        error)
            : "${urgency:=critical}"
            : "${icon:=error}"
            : "${expire_after:=never}"
            prefix="❌ "
            ;;
        progress)
            : "${urgency:=low}"
            : "${icon:=system-monitor}"
            : "${expire_after:=never}"
            prefix="⏳ "
            ;;
        info)
            : "${urgency:=normal}"
            : "${icon:=info}"
            : "${expire_after:=10s}"
            : "${timeout:=10}"
            ;;
        *)
            echo "notify: unknown --type: $type" >&2
            return 2
            ;;
    esac
    [[ $no_prefix -eq 0 && -n "$prefix" ]] && title="${prefix}${title}"

    # Inside Kitty + no actionable feedback needed → kitten notify
    if [[ $force_alerter -eq 0 ]] \
        && { [[ "$TERM" == "xterm-kitty" ]] || [[ -n "$KITTY_WINDOW_ID" ]]; } \
        && command -v kitten >/dev/null 2>&1; then

        local args=(notify --only-print-escape-code "--urgency=$urgency" "--app-name=$app_name")
        [[ -n "$icon" ]]         && args+=("--icon=$icon")
        [[ -n "$icon_path" ]]    && args+=("--icon-path=$icon_path")
        [[ -n "$sound" ]]        && args+=("--sound-name=$sound")
        [[ -n "$identifier" ]]   && args+=("--identifier=$identifier")
        [[ -n "$expire_after" ]] && args+=("--expire-after=$expire_after")
        [[ -n "$type" ]]         && args+=("--type=$type")
        args+=("$title")
        [[ -n "$message" ]] && args+=("$message")

        # /dev/tty unavailable from Claude Code's Bash tool;
        # write the OSC 99 escape to the parent claude process's PTY.
        local parent_tty
        parent_tty=$(ps -o tty= -p $PPID 2>/dev/null | tr -d ' ')
        if [[ -n "$parent_tty" && -e "/dev/$parent_tty" ]]; then
            kitten "${args[@]}" > "/dev/$parent_tty"
        else
            kitten "${args[@]}"
        fi
        return $?
    fi

    # macOS → alerter (handles actions, reply, returns user choice on stdout)
    if [[ "$(uname)" == "Darwin" ]] && command -v alerter >/dev/null 2>&1; then
        [[ -z "$sender" ]] && sender=$(_notify_detect_sender)
        local args=(--title "$title" --sender "$sender")
        [[ -n "$message" ]]                      && args+=(--message "$message")
        [[ -n "$actions" ]]                      && args+=(--actions "$actions")
        [[ -n "$reply"   ]]                      && args+=(--reply "$reply")
        [[ -n "$timeout" && "$timeout" != "0" ]] && args+=(--timeout "$timeout")
        [[ -n "$sound"   ]]                      && args+=(--sound "$sound")
        [[ "$urgency" == "critical" ]]           && args+=(--ignore-dnd)
        alerter "${args[@]}"
        return $?
    fi

    # Linux fallback → notify-send
    if command -v notify-send >/dev/null 2>&1; then
        local args=("--urgency=$urgency")
        [[ -n "$timeout" && "$timeout" != "0" ]] && args+=("--expire-time=$((timeout * 1000))")
        [[ -n "$icon" ]] && args+=("--icon=$icon")
        args+=("$title")
        [[ -n "$message" ]] && args+=("$message")
        notify-send "${args[@]}"
        return $?
    fi

    echo "notify: no notification backend available" >&2
    return 1
 }
diff --git a/settings.json b/settings.json
 {
  "env": {
    "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1",
    "DISABLE_ERROR_REPORTING": "1",
    "DISABLE_BUG_COMMAND": "1",
    "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",
    "DISABLE_AUTOUPDATER": "0",
    "OTEL_SDK_DISABLED": "true"
  },
  "permissions": {
    "allow": [],
    "deny": [
      "Skill(terminal-title)"
    ],
    "ask": [],
    "defaultMode": "auto"
  },
  "disableClaudeAiConnectors": true,
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/backup-claude-config.sh\""
          }
        ]
      },
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "\"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/enforce-worktree.sh\""
          }
        ]
      },
      {
        "matcher": "Read|Write|Edit|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "\"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/enforce-allowed-paths.sh\""
          }
        ]
      },
      {
        "matcher": "Grep|Glob|Read|Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/delegation-nudge.sh\"",
            "timeout": 5
          }
        ]
      }
    ],
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/karpathy-guidelines.sh\"",
            "statusMessage": "Karpathy guidelines: checking GitHub for a newer version...",
            "timeout": 20
          }
        ]
      },
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/session-git-platform.sh\""
          }
        ]
      }
    ],
    "UserPromptSubmit": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "python3 \"${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hooks/delegation-router.py\"",
            "timeout": 5
          }
        ]
      }
    ]
  },
  "worktree": {
    "baseRef": "fresh"
  },
  "statusLine": {
    "type": "command",
    "command": "sh ${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hud/statusline-wrapper.sh"
  },
  "enabledPlugins": {
    "security-guidance@claude-plugins-official": true,
    "context7@claude-plugins-official": true,
    "context-mode@context-mode": true,
    "codex@openai-codex": true,
    "oh-my-claudecode@omc": true
  },
  "extraKnownMarketplaces": {
    "omc": {
      "source": {
        "source": "git",
        "url": "https://github.com/Yeachan-Heo/oh-my-claudecode.git"
      }
    },
    "context-mode": {
      "source": {
        "source": "github",
        "repo": "mksglu/context-mode"
      }
    },
    "openai-codex": {
      "source": {
        "source": "github",
        "repo": "openai/codex-plugin-cc"
      }
    }
  },
  "autoMode": {
    "allow": [
      "$defaults",
      "Kubernetes operations on your own cluster (context admin@my-cluster, CUSTOMIZE), mutations included: kubectl get/describe/logs/top/explain/apply/create/delete/edit/patch/scale/rollout/exec/cp — the cluster belongs to the user, full access expected",
      "Helm operations including mutations: list/get/show/status/history/template/install/upgrade/uninstall/rollback/dependency update",
      "Flux operations including mutations: get/stats/check/tree/version/suspend/resume/reconcile/create/delete",
      "Talosctl operations including most mutations: get/health/version/dmesg/logs/services/disks/memory/cpu/apply-config — except destructive ones (reset, reboot, shutdown, wipe, etcd recovery) which still warrant a soft_deny",
      "git push to feature/topic branches you own (any branch except main/develop/stable) — push freely on personal repos as part of the worktree workflow",
      "Read-only Forgejo via fj CLI: fj pr view/list, fj issue view/list, fj release list, fj actions list/view, fj api GET",
      "Read-only GitLab via glab CLI: glab mr view/list/diff, glab issue view/list, glab ci view/list, glab api with GET method",
      "Read-only GitHub via gh CLI: gh pr view/list/diff/checks, gh issue view/list, gh run view/list, gh api with GET method",
      "Read-only Git inspection: git status/log/diff/show/blame/branch (without -D)/remote -v/stash list/worktree list/reflog/config --get",
      "Python tooling that does not mutate state: uv run pytest, uv pip list, ruff check, black --check, mypy, pyright, python -m py_compile, coverage report",
      "Docker inspection: docker ps/logs/inspect/images/version/compose ps/compose logs",
      "Reading the shell function 'notify' for sending desktop notifications (not destructive)",
      "Filesystem inspection inside the current project, $HOME/.claude, .omc, .claude, and any path listed in the allowed-paths grant files",
      "Read-only filesystem inspection on system and ephemeral paths — find/ls/grep/du/tree/cat/stat over /tmp, /private/tmp, /var/folders, /bin, /sbin, /usr, /opt, /Library, /System and OS library directories — these hold no personal data and are safe to scan recursively (mutations there still fall under the usual sudo/system soft_deny)",
      "Diagnostic SSH on a known jumphost (jumphost.example.com, CUSTOMIZE) when only running read-only commands",
      "MCP read-only queries: get_*, list_*, search_*, read_*, query_* tools across configured servers"
    ],
    "soft_deny": [
      "$defaults",
      "Catastrophic Talos operations on real hardware: talosctl reset, reboot, shutdown, wipe, etcd snapshot recovery, bootstrap — these can brick a node and require explicit approval",
      "kubectl delete on cluster-scoped or namespace-scoped destructive targets: delete namespace, delete pv, delete crd, delete node — full cluster impact, ask first",
      "helm upgrade of a release that needs several -f values files, run with only part of them — silently resets whatever the missing file pins (workload kind, replica count, node placement)",
      "Direct git push to protected branches main, develop, stable (any repo) — always require an explicit user approval before pushing or merging into those",
      "Force pushes (git push --force, --force-with-lease) and history rewrites on shared branches",
      "Skipping git hooks (--no-verify) or signing flags (--no-gpg-sign, -c commit.gpgsign=false)",
      "Merging or approving PRs/MRs into protected branches via fj/glab/gh — these always need explicit user approval",
      "Editing files outside the allowed-paths set (current project, $HOME/.claude, .omc, .claude, listed grant files); SSH-embedded paths cannot be assumed local",
      "Reading or printing secrets, .env files, credentials, private keys, kubeconfigs containing tokens, or anything under ~/.ssh without an explicit reason in the request",
      "Installing Python packages globally (pip install without uv) or modifying system Python",
      "uv pip install — prefer `uv add` so dependencies are recorded in pyproject.toml; ad-hoc `uv pip install` warrants confirmation",
      "Homebrew system mutations: brew install/uninstall/upgrade/reinstall/untap/cleanup — modify global tooling, require approval",
      "Disabling the sandbox via dangerouslyDisableSandbox unless the command demonstrably requires it (notify is a known case)",
      "Atuin shell-history queries (`atuin search`, `atuin history list`, `atuin stats`, or direct reads of ~/.local/share/atuin/history.db) require explicit user authorization in the current turn: shell history stores secrets typed inline and `!`-prefixed commands, so every lookup must be confirmed before running."
    ],
    "hard_deny": [
      "$defaults",
      "Recursive or whole-tree filesystem commands — find, fd, grep -r, rg/ripgrep without a scoped path, ls -R, tree, du, stat over a glob, rm -rf, cp -r, mv across trees, rsync, tar/zip over a directory, chmod -R, chown -R, or shell globs such as ~/** — are NEVER auto-approved when their target is the user's PERSONAL data outside the active project: backup locations (anything named backup/backups/.backup, Time Machine, *.bak trees, external or mounted drives under /Volumes), OTHER project checkouts (sibling repos under ~/Documents or elsewhere that are not the current project), or the home directory browsed wholesale — $HOME / ~ itself, ~/Downloads, ~/Desktop, ~/Documents (root), ~/Pictures, ~/Movies, ~/Music, ~/.ssh, ~/Library/Mail and similar personal folders. The ONLY exception is a directory the user explicitly named in the current request; a personal path the user did not mention is off-limits and must drop to a confirmation, never silent execution.",
      "Trigger is breadth + PERSONAL relevance + absence of an explicit user instruction: any command that walks, reads, copies, archives, or exfiltrates a large tree of the user's personal files (backups, unrelated projects, home media/document folders) that was not requested in the current turn is blocked regardless of which binary performs it (find, fd, grep, du, rsync, tar, python os.walk, etc.). System and ephemeral trees are NOT personal data and are exempt: /tmp, /private/tmp, /var/folders, /bin, /usr, /opt, /Library, /System and OS library paths may be inspected read-only.",
      "Never add Co-Authored-By or any AI attribution in commits, PRs, branches, or anywhere"
    ],
    "environment": [
      "$defaults",
      "Personal context: this user-level settings file covers the user's own projects, no employer work is expected at this level",
      "Primary infra: a personal Kubernetes cluster reached through the admin@my-cluster context (CUSTOMIZE); kubectl/helm/flux always require --context=admin@my-cluster",
      "Workflow: every modification happens inside a git worktree under <project-root>/.worktrees/<branch>; the main checkout stays clean. Prefer Conventional Commits in imperative mood, granular commits as work progresses, never one big final commit",
      "Git-host ops are MCP-first; fall back to the platform CLI only when the MCP is unavailable, missing a tool, or doesn't cover the host — Forgejo (forgejo.example.com) → fj, GitLab (gitlab.example.com or gitlab.com) → glab, GitHub → gh",
      "Model routing: in the main loop, delegate first to the cheapest capable agent (Rule #0 — don't spend main-loop attention on mechanical work). Within a delegated agent's own mission, prioritize quality at the right price — opus for genuine judgment/architecture/unknown-root-cause/review, sonnet for well-scoped tasks, haiku for trivial lookups",
      "The user may chat in their own language, but all code/comments/commits/PRs/markdown stay in English"
    ]
  },
  "effortLevel": "high",
  "modelSettings": {
    "claude-opus-5": {
      "effortLevel": "high"
    }
  },
  "tui": "fullscreen",
  "editorMode": "normal",
  "skipDangerousModePermissionPrompt": true,
  "skipWorkflowUsageWarning": true,
  "skipAutoPermissionPrompt": true,
  "autoCompactEnabled": true,
  "disableAgentView": false,
  "verbose": true,
  "voiceEnabled": true,
  "teammateMode": "auto",
  "remoteControlAtStartup": true,
  "preferredNotifChannel": "auto",
  "inputNeededNotifEnabled": true,
  "agentPushNotifEnabled": true
 }

diff --git a/skills__cheap-orchestration__SKILL.md b/skills__cheap-orchestration__SKILL.md
diff --git a/skills__fj__SKILL.md b/skills__fj__SKILL.md
diff --git a/skills__ntfy__SKILL.md b/skills__ntfy__SKILL.md
diff --git a/skills__pr__SKILL.md b/skills__pr__SKILL.md
diff --git a/snippets__identity.md b/snippets__identity.md
diff --git a/statusline-command.sh b/statusline-command.sh
 #!/bin/bash

 # Read JSON input from stdin
 input=$(cat)

 # Extract current working directory from JSON
 cwd=$(echo "$input" | jq -r '.workspace.current_dir')

 # Get user and hostname
 user=$(whoami)
 host=$(hostname -s)

 # Get current directory path
 if [ -n "$cwd" ]; then
  # Use the workspace current dir from JSON
  current_dir="$cwd"
 else
  # Fallback to pwd
  current_dir=$(pwd)
 fi

 # Replace home directory with ~
 display_dir="${current_dir/#$HOME/\~}"

 # Check if we're in a git repository (skip optional locks for speed)
 if git -C "$current_dir" rev-parse --git-dir > /dev/null 2>&1; then
  # Get git branch name
  branch=$(git -C "$current_dir" --no-optional-locks branch --show-current 2>/dev/null || echo "")

  # Get git status (check if dirty)
  if [ -n "$(git -C "$current_dir" --no-optional-locks status --porcelain 2>/dev/null)" ]; then
    git_status="±"
  else
    git_status="✓"
  fi

  if [ -n "$branch" ]; then
    git_info=" \033[33m[$branch $git_status]\033[0m"
  else
    git_info=""
  fi
 else
  git_info=""
 fi

 # Check for Python virtual environment
 venv_info=""
 if [ -n "$VIRTUAL_ENV" ]; then
  venv_name=$(basename "$VIRTUAL_ENV")
  venv_info=" \033[35m($venv_name)\033[0m"
 fi

 # Output the status line with colors
 # Cyan user@host, Blue directory, Yellow git info, Magenta venv
 # Use %b for git_info and venv_info to interpret escape sequences
 printf "\033[36m%s@%s\033[0m \033[34m%s\033[0m%b%b" "$user" "$host" "$display_dir" "$git_info" "$venv_info"
Asset	Version	What it is
`CLAUDE.md`	4.2.0	The single self-contained agent file: language rules, git policy, model routing, worktrees, filesystem policy, secret handling
`snippets__identity.md`	1.0.0	Personal vs professional identity, `@`-imported by `CLAUDE.md`
`settings.json`	(table only)	Hook wiring, permissions, autoMode, plugins, status line
`allowed-paths`	(table only)	Global path grants for the file-op enforcement hook
`hooks__enforce-worktree.sh`	1.0.0	PreToolUse `Edit\|Write`: warns (non-blocking) when a project file is edited outside a `.worktrees/` checkout
`hooks__enforce-allowed-paths.sh`	1.0.1	PreToolUse `Read\|Write\|Edit\|NotebookEdit`: allowlist on file ops, asks on violations
`hooks__lib__allowed-paths-common.sh`	1.1.0	Shared allowlist logic and grant-file parsing for the hook above
`hooks__backup-claude-config.sh`	1.0.0	PreToolUse `Edit\|Write\|NotebookEdit`: snapshots any `~/.claude` file before it is overwritten, with retention pruning
`hooks__delegation-nudge.sh`	1.0.0	PreToolUse `Grep\|Glob\|Read\|Bash`: counts inline read/search calls in the main loop and periodically nudges it to delegate to a subagent
`hooks__delegation-router.py`	1.0.0	UserPromptSubmit: classifies each prompt and injects a routing directive, or asks for the `cheap-orchestration` skill on heavy work
`hooks__karpathy-guidelines.sh`	1.0.0	SessionStart: injects a behavioural guidelines document into every session, weekly refresh from upstream
`hooks__session-git-platform.sh`	1.0.0	SessionStart: exports the detected git platform into session context so the model never runs `git remote -v`
`scripts__git-platform-detect.sh`	1.0.0	Detects github/gitlab/forgejo/gitea/unknown from the origin remote; has a `CUSTOM_HOSTS` list for self-hosted instances
`scripts__notify.sh`	2.0.0	`notify` shell function: desktop notifications with terminal detection, `alerter` backend on macOS for replies and buttons
`hud__statusline-wrapper.sh`	1.2.0	Status line: OMC HUD on line 1 (post-processed), colored pwd and git info on line 2
`hud__reposition.pl`	1.0.0	Perl helper the wrapper uses to right-align HUD segments; the wrapper degrades gracefully without it
`statusline-command.sh`	1.0.0	Standalone fallback status line, no OMC needed
`commands__worktree-start.md`	1.0.2	`/worktree-start`: create an isolated worktree with per-repo init steps
`commands__worktree-finish.md`	1.0.1	`/worktree-finish`: merge the worktree branch back and clean up
`commands__ntfy.md`	1.0.0	`/ntfy`: publish one ntfy push notification
`commands__ntfy-sub.md`	1.0.0	`/ntfy-sub`: start/stop/report a background ntfy topic listener
`skills__pr__SKILL.md`	2.1.0	`/pr`: commit, push, open a PR on the detected platform, optional auto-merge
`skills__fj__SKILL.md`	1.0.0	`fj` (Forgejo CLI) cheatsheet
`skills__cheap-orchestration__SKILL.md`	1.0.0	Routing matrix, fan-out patterns, and return contracts for delegating work to cheap subagents
`skills__ntfy__SKILL.md`	1.0.1	Desktop vs phone-push channel choice, priority floor, title convention, listener trust model
`docs__filesystem-policy.md`	1.0.0	Reference behind the CLAUDE.md filesystem policy: grant-file format, search locations, enforcement blind spots
`docs__shared-checkout-lock.md`	1.0.0	The `.agent.lock` protocol for editing a shared checkout instead of a worktree
`guidelines__karpathy.md`	1.0.0	Seed cache for the karpathy hook (see notes: not a hard dependency)
Event	Matcher	Hook
PreToolUse	`Edit\|Write\|NotebookEdit`	`hooks/backup-claude-config.sh`
PreToolUse	`Edit\|Write`	`hooks/enforce-worktree.sh`
PreToolUse	`Read\|Write\|Edit\|NotebookEdit`	`hooks/enforce-allowed-paths.sh`
PreToolUse	`Grep\|Glob\|Read\|Bash`	`hooks/delegation-nudge.sh`
UserPromptSubmit	(all)	`hooks/delegation-router.py`
SessionStart	(all)	`hooks/karpathy-guidelines.sh`
SessionStart	(all)	`hooks/session-git-platform.sh`
	# Global allowed paths — union with $CLAUDE_PROJECT_DIR, $HOME/.claude, and
	# per-project / per-session grants. One path per line, `#` comments, blank
	# lines ignored. `~` and `~/...` expand to $HOME. Machine-local — not meant
	# to be shared across different hosts.
	#
	# Examples (uncomment / adapt to your machine):
	# ~/Documents/code
	# ~/Documents/git
	# ~/go
	# ~/projects
	# ~/.ssh # if you want Claude to read SSH config (be careful)
	# /tmp
	# /private/tmp
	#
	# Toolchain caches are worth allowlisting too: they are build artifacts,
	# not personal data (read-only in intent; the hook cannot tell).
	# ~/.platformio/packages/framework-arduinoespressif32
	# ~/.platformio/packages/framework-arduinoespressif32-libs
description	Listen to a ntfy topic in the background and act on what arrives
argument-hint	[topic] [--as human\|alert\|agent] \| stop [topic] \| status
allowed-tools	Bash(envchain ntfy-creds:*), Monitor, TaskStop, AskUserQuestion, Skill
description	Send a ntfy notification to the user's phone
argument-hint	[-t title] [-p 4-5] [-T tags] [--md] <message>
allowed-tools	Bash(envchain ntfy-creds:*), Skill
description	Merge the current worktree branch back into the source branch and clean up
version	1.0.0
description	Create a git worktree for the current project to isolate modifications
version	2.0.0
Scope	Path
Global	`$HOME/.claude/allowed-paths`
Project	`$CLAUDE_PROJECT_DIR/.claude/allowed-paths`
Session	`/tmp/claude-allowed-paths.$session_id`
	#!/usr/bin/env bash
	# PreToolUse hook — snapshot ~/.claude/** files before they are modified.
	#
	# On every Edit/Write/NotebookEdit whose target lives under ~/.claude, copy
	# the current file to ~/.claude/.backups/<mirrored-path>.bak.<datetime>
	# before the tool overwrites it. Side-effect only: always exits 0, never
	# blocks the operation. New files (nothing to back up) are skipped.
	set -euo pipefail

	CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
	BACKUP_ROOT="$CLAUDE_DIR/.backups"

	# Hook payload arrives as JSON on stdin; pull out the target file path.
	payload="$(cat \|\| true)"
	file_path="$(printf '%s' "$payload" \| python3 -c 'import sys, json
	try:
	print(json.load(sys.stdin).get("tool_input", {}).get("file_path", ""))
	except Exception:
	print("")' 2>/dev/null \|\| true)"

	# Need a real, existing regular file to snapshot.
	[ -n "$file_path" ] \|\| exit 0
	[ -f "$file_path" ] \|\| exit 0

	# Canonicalize (resolve the directory portion) to an absolute path.
	abs="$(cd "$(dirname "$file_path")" 2>/dev/null && pwd)/$(basename "$file_path")" \|\| exit 0

	# Only files under ~/.claude, and never back up the backups themselves.
	case "$abs" in
	"$BACKUP_ROOT"/*) exit 0 ;;
	"$CLAUDE_DIR"/*) : ;;
	*) exit 0 ;;
	esac

	# Mirror the relative path under the backup root, suffixed with a timestamp.
	rel="${abs#"$CLAUDE_DIR"/}"
	ts="$(date +%Y%m%d-%H%M%S)"
	dest="$BACKUP_ROOT/$rel.bak.$ts"
	mkdir -p "$(dirname "$dest")"
	cp -p "$abs" "$dest" 2>/dev/null \|\| true

	# Retention: prune backups older than 30 days, then drop empty mirror dirs.
	# Runs opportunistically here — the dir only grows when a backup is made,
	# so cleaning on write keeps it bounded without a separate scheduler.
	find "$BACKUP_ROOT" -type f -name '.bak.' -mtime +30 -delete 2>/dev/null \|\| true
	find "$BACKUP_ROOT" -mindepth 1 -type d -empty -delete 2>/dev/null \|\| true

	exit 0
	#!/usr/bin/env bash
	# delegation-nudge.sh — PreToolUse hook (matcher: Grep\|Glob\|Read\|Bash)
	#
	# Enforces CLAUDE.md "Rule #0 — Delegate before doing it yourself" by
	# counting inline mechanical read/search operations run by the MAIN agent
	# loop within a session. Every Nth matched call, it injects a non-blocking
	# <system-reminder> (hookSpecificOutput.additionalContext) nudging the model
	# to delegate the rest of the investigation to a cheap subagent instead of
	# grinding inline and bloating the orchestrator's context.
	#
	# Design notes:
	# - Advisory only: never blocks or denies; always exits 0 (fail-open).
	# - Skips subagents entirely (payload carries agent_id when inside one):
	# grinding is precisely what subagents are FOR.
	# - For Bash, only counts commands that look like read/search work
	# (grep/rg/find/cat/...), not builds, git ops, or mutations.
	# - Per-session counter in a flat /tmp file keyed by sanitized session_id,
	# same lightweight pattern as enforce-allowed-paths.sh ad-hoc grants.
	# Races between parallel tool calls may lose an increment; acceptable
	# for an advisory counter.

	set -u

	# Read the whole PreToolUse JSON payload from stdin.
	payload="$(cat)" \|\| exit 0

	# --- Skip subagents: the nudge targets the main orchestrator loop only. ---
	agent_id="$(printf '%s' "$payload" \| jq -r '.agent_id // empty' 2>/dev/null)" \|\| exit 0
	[ -n "$agent_id" ] && exit 0

	# --- Extract and sanitize session_id (it becomes part of a /tmp path). ---
	session_id="$(printf '%s' "$payload" \| jq -r '.session_id // empty' 2>/dev/null)" \|\| exit 0
	case "$session_id" in
	''\|[!a-zA-Z0-9_-]) exit 0 ;; # missing or unsafe for a filename: bail silently
	esac

	tool_name="$(printf '%s' "$payload" \| jq -r '.tool_name // empty' 2>/dev/null)" \|\| exit 0

	# --- Decide whether this call counts as "inline mechanical work". ---
	case "$tool_name" in
	Grep\|Glob\|Read)
	: # always counted: pure lookups the main loop should mostly delegate
	;;
	Bash)
	# Count only read/search-shaped commands; leave builds, tests, git,
	# kubectl, etc. alone. Word-boundary-ish match on common search/read
	# binaries anywhere in the command line (covers pipes and chains).
	cmd="$(printf '%s' "$payload" \| jq -r '.tool_input.command // empty' 2>/dev/null)" \|\| exit 0
	if ! printf '%s' "$cmd" \| grep -qE '(^\|[\|;&[:space:]])(grep\|rg\|find\|fd\|cat\|head\|tail\|awk\|less\|tree)([[:space:]]\|$)'; then
	exit 0
	fi
	;;
	*)
	exit 0
	;;
	esac

	# --- Increment the per-session counter. ---
	counter_file="/tmp/claude-delegation-nudge.${session_id}"
	count="$(cat "$counter_file" 2>/dev/null \|\| echo 0)"
	case "$count" in ''\|[!0-9]) count=0 ;; esac # heal corrupt state
	count=$((count + 1))
	printf '%s\n' "$count" > "$counter_file" 2>/dev/null \|\| exit 0

	# --- Nudge every 6th matched call (6, 12, 18, ...). ---
	if [ $((count % 6)) -ne 0 ]; then
	exit 0
	fi

	jq -n --arg n "$count" '{
	hookSpecificOutput: {
	hookEventName: "PreToolUse",
	additionalContext: ("Delegation check (CLAUDE.md Rule #0): the main loop has now run " + $n + " inline read/search operations (Grep/Glob/Read/Bash-search) this session. If you are mid-investigation or doing repeated mechanical lookups, STOP and delegate the rest to a subagent (Explore or executor, model=haiku/sonnet) so only conclusions enter your context. Catch yourself mid-mechanical-task -> delegate the remainder. Ignore only if each call was a genuinely one-off, already-scoped lookup.")
	}
	}'
	exit 0