chore: Update CHANGELOG.md and feed.xml

Fixes #123
2026-08-13 10:22:25 -06:00 · 2026-07-18 01:20:23 +00:00 · 2026-07-17 00:26:21 +00:00 · 2026-07-15 23:02:29 +00:00 · 2026-07-14 23:45:20 +00:00 · 2026-07-14 17:59:31 +00:00
212 changed files with 45242 additions and 194 deletions
@@ -0,0 +1,150 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
+  "name": "claude-code-plugins",
+  "version": "1.0.0",
+  "description": "Bundled plugins for Claude Code including Agent SDK development tools, PR review toolkit, and commit workflows",
+  "owner": {
+    "name": "Anthropic",
+    "email": "support@anthropic.com"
+  },
+  "plugins": [
+    {
+      "name": "agent-sdk-dev",
+      "description": "Development kit for working with the Claude Agent SDK",
+      "source": "./plugins/agent-sdk-dev",
+      "category": "development"
+    },
+    {
+      "name": "claude-opus-4-5-migration",
+      "description": "Migrate your code and prompts from Sonnet 4.x and Opus 4.1 to Opus 4.5.",
+      "version": "1.0.0",
+      "author": {
+        "name": "William Hu",
+        "email": "whu@anthropic.com"
+      },
+      "source": "./plugins/claude-opus-4-5-migration",
+      "category": "development"
+    },
+    {
+      "name": "code-review",
+      "description": "Automated code review for pull requests using multiple specialized agents with confidence-based scoring to filter false positives",
+      "version": "1.0.0",
+      "author": {
+        "name": "Boris Cherny",
+        "email": "boris@anthropic.com"
+      },
+      "source": "./plugins/code-review",
+      "category": "productivity"
+    },
+    {
+      "name": "commit-commands",
+      "description": "Commands for git commit workflows including commit, push, and PR creation",
+      "version": "1.0.0",
+      "author": {
+        "name": "Anthropic",
+        "email": "support@anthropic.com"
+      },
+      "source": "./plugins/commit-commands",
+      "category": "productivity"
+    },
+    {
+      "name": "explanatory-output-style",
+      "description": "Adds educational insights about implementation choices and codebase patterns (mimics the deprecated Explanatory output style)",
+      "version": "1.0.0",
+      "author": {
+        "name": "Dickson Tsai",
+        "email": "dickson@anthropic.com"
+      },
+      "source": "./plugins/explanatory-output-style",
+      "category": "learning"
+    },
+    {
+      "name": "feature-dev",
+      "description": "Comprehensive feature development workflow with specialized agents for codebase exploration, architecture design, and quality review",
+      "version": "1.0.0",
+      "author": {
+        "name": "Siddharth Bidasaria",
+        "email": "sbidasaria@anthropic.com"
+      },
+      "source": "./plugins/feature-dev",
+      "category": "development"
+    },
+    {
+      "name": "frontend-design",
+      "description": "Create distinctive, production-grade frontend interfaces with high design quality. Generates creative, polished code that avoids generic AI aesthetics.",
+      "version": "1.1.0",
+      "author": {
+        "name": "Prithvi Rajasekaran & Alexander Bricken",
+        "email": "prithvi@anthropic.com"
+      },
+      "source": "./plugins/frontend-design",
+      "category": "development"
+    },
+    {
+      "name": "hookify",
+      "description": "Easily create custom hooks to prevent unwanted behaviors by analyzing conversation patterns or from explicit instructions. Define rules via simple markdown files.",
+      "version": "0.1.0",
+      "author": {
+        "name": "Daisy Hollman",
+        "email": "daisy@anthropic.com"
+      },
+      "source": "./plugins/hookify",
+      "category": "productivity"
+    },
+    {
+      "name": "learning-output-style",
+      "description": "Interactive learning mode that requests meaningful code contributions at decision points (mimics the unshipped Learning output style)",
+      "version": "1.0.0",
+      "author": {
+        "name": "Boris Cherny",
+        "email": "boris@anthropic.com"
+      },
+      "source": "./plugins/learning-output-style",
+      "category": "learning"
+    },
+    {
+      "name": "plugin-dev",
+      "description": "Comprehensive toolkit for developing Claude Code plugins. Includes 7 expert skills covering hooks, MCP integration, commands, agents, and best practices. AI-assisted plugin creation and validation.",
+      "version": "0.1.0",
+      "author": {
+        "name": "Daisy Hollman",
+        "email": "daisy@anthropic.com"
+      },
+      "source": "./plugins/plugin-dev",
+      "category": "development"
+    },
+    {
+      "name": "pr-review-toolkit",
+      "description": "Comprehensive PR review agents specializing in comments, tests, error handling, type design, code quality, and code simplification",
+      "version": "1.0.0",
+      "author": {
+        "name": "Anthropic",
+        "email": "support@anthropic.com"
+      },
+      "source": "./plugins/pr-review-toolkit",
+      "category": "productivity"
+    },
+    {
+      "name": "ralph-wiggum",
+      "description": "Interactive self-referential AI loops for iterative development. Claude works on the same task repeatedly, seeing its previous work, until completion.",
+      "version": "1.0.0",
+      "author": {
+        "name": "Daisy Hollman",
+        "email": "daisy@anthropic.com"
+      },
+      "source": "./plugins/ralph-wiggum",
+      "category": "development"
+    },
+    {
+      "name": "security-guidance",
+      "description": "Security reminder hook that warns about potential security issues when editing files, including command injection, XSS, and unsafe code patterns",
+      "version": "1.0.0",
+      "author": {
+        "name": "David Dworken",
+        "email": "dworken@anthropic.com"
+      },
+      "source": "./plugins/security-guidance",
+      "category": "security"
+    }
+  ]
+}
@@ -1,5 +1,5 @@
 ---
-allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh api:*), Bash(gh issue comment:*)
+allowed-tools: Bash(./scripts/gh.sh:*), Bash(./scripts/comment-on-duplicates.sh:*)
 description: Find duplicate GitHub issues
 ---

@@ -11,27 +11,17 @@ To do this, follow these steps precisely:
 2. Use an agent to view a Github issue, and ask the agent to return a summary of the issue
 3. Then, launch 5 parallel agents to search Github for duplicates of this issue, using diverse keywords and search approaches, using the summary from #1
 4. Next, feed the results from #1 and #2 into another agent, so that it can filter out false positives, that are likely not actually duplicates of the original issue. If there are no duplicates remaining, do not proceed.
-5. Finally, comment back on the issue with a list of up to three duplicate issues (or zero, if there are no likely duplicates)
+5. Finally, use the comment script to post duplicates:
+   ```
+   ./scripts/comment-on-duplicates.sh --potential-duplicates <dup1> <dup2> <dup3>
+   ```

 Notes (be sure to tell this to your agents, too):

- Use `gh` to interact with Github, rather than web fetch
- Do not use other tools, beyond `gh` (eg. don't use other MCP servers, file edit, etc.)
+- Use `./scripts/gh.sh` to interact with Github, rather than web fetch or raw `gh`. Examples:
+  - `./scripts/gh.sh issue view 123` — view an issue
+  - `./scripts/gh.sh issue view 123 --comments` — view with comments
+  - `./scripts/gh.sh issue list --state open --limit 20` — list issues
+  - `./scripts/gh.sh search issues "query" --limit 10` — search for issues
+- Do not use other tools, beyond `./scripts/gh.sh` and the comment script (eg. don't use other MCP servers, file edit, etc.)
 - Make a todo list first
- For your comment, follow the following format precisely (assuming for this example that you found 3 suspected duplicates):
-
---
-
-Found 3 possible duplicate issues:
-
-1. <link to issue>
-2. <link to issue>
-3. <link to issue>
-
-If your issue is a duplicate, please close it and 👍 the existing issue instead.
-
-<sub>This issue will be automatically closed as a duplicate in 3 days if there are no additional comments. To prevent auto-closure, please 👎 this comment.</sub>
-
-🤖 Generated with [Claude Code](https://claude.ai/code)
-
---
@@ -0,0 +1,74 @@
+---
+allowed-tools: Bash(./scripts/gh.sh:*),Bash(./scripts/edit-issue-labels.sh:*)
+description: Triage GitHub issues by analyzing and applying labels
+---
+
+You're an issue triage assistant. Analyze the issue and manage labels.
+
+IMPORTANT: Don't post any comments or messages to the issue. Your only actions are adding or removing labels.
+
+Context:
+
+$ARGUMENTS
+
+TOOLS:
+- `./scripts/gh.sh` — wrapper for `gh` CLI. Only supports these subcommands and flags:
+  - `./scripts/gh.sh label list` — fetch all available labels
+  - `./scripts/gh.sh label list --limit 100` — fetch with limit
+  - `./scripts/gh.sh issue view 123` — read issue title, body, and labels
+  - `./scripts/gh.sh issue view 123 --comments` — read the conversation
+  - `./scripts/gh.sh issue list --state open --limit 20` — list issues
+  - `./scripts/gh.sh search issues "query"` — find similar or duplicate issues
+  - `./scripts/gh.sh search issues "query" --limit 10` — search with limit
+- `./scripts/edit-issue-labels.sh --add-label LABEL --remove-label LABEL` — add or remove labels (issue number is read from the workflow event)
+
+TASK:
+
+1. Run `./scripts/gh.sh label list` to fetch the available labels. You may ONLY use labels from this list. Never invent new labels.
+2. Run `./scripts/gh.sh issue view ISSUE_NUMBER` to read the issue details.
+3. Run `./scripts/gh.sh issue view ISSUE_NUMBER --comments` to read the conversation.
+
+**If EVENT is "issues" (new issue):**
+
+4. First, check if this issue is actually about Claude Code.
+   - Look for Claude Code signals in the issue BODY: a `Claude Code Version` field or `claude --version` output, references to the `claude` CLI command, terminal sessions, the VS Code/JetBrains extensions, `CLAUDE.md` files, `.claude/` directories, MCP servers, Cowork, Remote Control, or the web UI at claude.ai/code. If ANY such signal is present, this IS a Claude Code issue — proceed to step 5.
+   - Only if NO Claude Code signals are present: check whether a different Anthropic product (claude.ai chat, Claude Desktop/Mobile apps, the raw Anthropic API/SDK, or account billing with no CLI involvement) is the *subject* of the complaint, not merely mentioned for context. If so, apply `invalid` and stop. If ambiguous, proceed to step 5 WITHOUT applying `invalid`.
+   - The body text is authoritative. If a form dropdown (e.g. Platform) contradicts evidence in the body, trust the body — dropdowns are often mis-selected.
+
+5. Analyze and apply category labels:
+   - Type (bug, enhancement, question, etc.)
+   - Technical areas and platform
+   - Check for duplicates with `./scripts/gh.sh search issues`. Only mark as duplicate of OPEN issues.
+
+6. Evaluate lifecycle labels:
+   - `needs-repro` (bugs only, 7 days): Bug reports without clear steps to reproduce. A good repro has specific, followable steps that someone else could use to see the same issue.
+     Do NOT apply if the user already provided error messages, logs, file paths, or a description of what they did. Don't require a specific format — narrative descriptions count.
+     For model behavior issues (e.g. "Claude does X when it should do Y"), don't require traditional repro steps — examples and patterns are sufficient.
+   - `needs-info` (bugs only, 7 days): The issue needs something from the community before it can progress — e.g. error messages, versions, environment details, or answers to follow-up questions. Don't apply to questions or enhancements.
+     Do NOT apply if the user already provided version, environment, and error details. If the issue just needs engineering investigation, that's not `needs-info`.
+
+   Issues with these labels are automatically closed after the timeout if there's no response.
+   The goal is to avoid issues lingering without a clear next step.
+
+7. Apply all selected labels:
+   `./scripts/edit-issue-labels.sh --add-label "label1" --add-label "label2"`
+
+**If EVENT is "issue_comment" (comment on existing issue):**
+
+4. Evaluate lifecycle labels based on the full conversation:
+   - If the issue has `stale` or `autoclose`, remove the label — a new human comment means the issue is still active:
+     `./scripts/edit-issue-labels.sh --remove-label "stale" --remove-label "autoclose"`
+   - If the issue has `needs-repro` or `needs-info` and the missing information has now been provided, remove the label:
+     `./scripts/edit-issue-labels.sh --remove-label "needs-repro"`
+   - If the issue doesn't have lifecycle labels but clearly needs them (e.g., a maintainer asked for repro steps or more details), add the appropriate label.
+   - Comments like "+1", "me too", "same here", or emoji reactions are NOT the missing information. Only remove `needs-repro` or `needs-info` when substantive details are actually provided.
+   - Do NOT add or remove category labels (bug, enhancement, etc.) on comment events.
+
+GUIDELINES:
+- ONLY use labels from `./scripts/gh.sh label list` — never create or guess label names
+- DO NOT post any comments to the issue
+- Be conservative with lifecycle labels — only apply when clearly warranted
+- Only apply lifecycle labels (`needs-repro`, `needs-info`) to bugs — never to questions or enhancements
+- When in doubt, don't apply a lifecycle label — false positives are worse than missing labels
+- On new issues (EVENT "issues"), always apply exactly one of `bug`, `enhancement`, `question`, `invalid`, or `duplicate`. If unsure, pick the closest fit — an imperfect category label is better than none.
+- On comment events, it's okay to make no changes if nothing applies.
@@ -65,8 +65,8 @@ ENV PATH=$PATH:/usr/local/share/npm-global/bin
 ENV SHELL=/bin/zsh

 # Set the default editor and visual
-ENV EDITOR nano
-ENV VISUAL nano
+ENV EDITOR=nano
+ENV VISUAL=nano

 # Default powerline10k theme
 ARG ZSH_IN_DOCKER_VERSION=1.2.0
@@ -16,6 +16,7 @@
  "customizations": {
    "vscode": {
      "extensions": [
+        "anthropic.claude-code",
        "dbaeumer.vscode-eslint",
        "esbenp.prettier-vscode",
        "eamodio.gitlens"
@@ -51,5 +52,6 @@
  },
  "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
  "workspaceFolder": "/workspace",
-  "postCreateCommand": "sudo /usr/local/bin/init-firewall.sh"
+  "postStartCommand": "sudo /usr/local/bin/init-firewall.sh",
+  "waitFor": "postStartCommand"
 }
@@ -69,9 +69,12 @@ for domain in \
    "api.anthropic.com" \
    "sentry.io" \
    "statsig.anthropic.com" \
-    "statsig.com"; do
+    "statsig.com" \
+    "marketplace.visualstudio.com" \
+    "vscode.blob.core.windows.net" \
+    "update.code.visualstudio.com"; do
    echo "Resolving $domain..."
-    ips=$(dig +short A "$domain")
+    ips=$(dig +noall +answer A "$domain" | awk '$4 == "A" {print $5}')
    if [ -z "$ips" ]; then
        echo "ERROR: Failed to resolve $domain"
        exit 1
@@ -113,6 +116,9 @@ iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 # Then allow only specific outbound traffic to allowed domains
 iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT

+# Explicitly REJECT all other outbound traffic for immediate feedback
+iptables -A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
+
 echo "Firewall configuration complete"
 echo "Verifying firewall rules..."
 if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then
@@ -1,34 +0,0 @@
---
-name: Bug report
-about: Create a report to help us improve
-title: '[BUG] '
-labels: bug
-assignees: ''
---
-
-## Environment
- Platform (select one):
-  - [ ] Anthropic API
-  - [ ] AWS Bedrock
-  - [ ] Google Vertex AI
-  - [ ] Other: <!-- specify -->
- Claude CLI version: <!-- output of `claude --version` -->
- Operating System: <!-- e.g. macOS 14.3, Windows 11, Ubuntu 22.04 -->
- Terminal:  <!-- e.g. iTerm2, Terminal App -->
-
-## Bug Description
-<!-- A clear and concise description of the bug -->
-
-## Steps to Reproduce
-1. <!-- First step -->
-2. <!-- Second step -->
-3. <!-- And so on... -->
-
-## Expected Behavior
-<!-- What you expected to happen -->
-
-## Actual Behavior
-<!-- What actually happened -->
-
-## Additional Context
-<!-- Add any other context about the problem here, such as screenshots, logs, etc. -->
@@ -0,0 +1,188 @@
+name: 🐛 Bug Report
+description: Report a bug or unexpected behavior in Claude Code
+title: "[BUG] "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report this bug! Please fill out the sections below to help us understand and fix the issue.
+        
+        Before submitting, please check:
+        - You're using the [latest version](https://www.npmjs.com/package/@anthropic-ai/claude-code?activeTab=versions) of Claude Code (`claude --version`) 
+        - This issue hasn't already been reported by searching [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug).
+        - This is a bug, not a feature request or support question
+        
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight Checklist
+      description: Please confirm before submitting
+      options:
+        - label: I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
+          required: true
+        - label: This is a single bug report (please file separate reports for different bugs)
+          required: true
+        - label: I am using the latest version of Claude Code
+          required: true
+          
+  - type: textarea
+    id: actual
+    attributes:
+      label: What's Wrong?
+      description: Describe what's happening that shouldn't be
+      placeholder: |
+        When I try to create a Python file, Claude shows an error "EACCES: permission denied" and the file isn't created.
+        
+        The command fails immediately after accepting the file write permission...
+    validations:
+      required: true
+      
+  - type: textarea
+    id: expected
+    attributes:
+      label: What Should Happen?
+      description: Describe the expected behavior
+      placeholder: Claude should create a Python script file successfully without errors
+    validations:
+      required: true
+      
+  - type: textarea
+    id: error_output
+    attributes:
+      label: Error Messages/Logs
+      description: If you see any error messages, paste them here
+      placeholder: |
+        Paste any error output, stack traces, or relevant logs here.
+        This will be automatically formatted as code.
+      render: shell
+    validations:
+      required: false
+      
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to Reproduce
+      description: |
+        Please provide clear, numbered steps that anyone can follow to reproduce the issue.
+        **Important**: Include any necessary code, file contents, or context needed to reproduce the bug.
+        If the issue involves specific files or code, please create a minimal example.
+      placeholder: |
+        1. Create a file `test.py` with this content:
+           ```python
+           def hello():
+               print("test")
+           ```
+        2. Run `claude "add type hints to test.py"`
+        3. When prompted for file access, accept
+        4. Error appears: "Unable to parse..."
+        
+        Note: The bug only happens with Python files containing...
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: model
+    attributes:
+      label: Claude Model
+      description: Which model were you using? (Run `/model` to check)
+      options:
+        - Sonnet (default)
+        - Opus
+        - Not sure / Multiple models
+        - Other
+    validations:
+      required: false
+      
+  - type: dropdown
+    id: regression
+    attributes:
+      label: Is this a regression?
+      description: Did this work in a previous version? 
+      options:
+        - "Yes, this worked in a previous version"
+        - "No, this never worked"
+        - "I don't know"
+    validations:
+      required: true
+      
+  - type: input
+    id: working_version
+    attributes:
+      label: Last Working Version
+      description: If this is a regression, which version last worked? This helps expedite a fix.
+      placeholder: "e.g., 1.0.100"
+    validations:
+      required: false
+      
+  - type: input
+    id: version
+    attributes:
+      label: Claude Code Version
+      description: Run `claude --version` and paste the output
+      placeholder: "e.g., 1.0.123 (Claude Code)"
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      description: Which API platform are you using?
+      options:
+        - Anthropic API
+        - AWS Bedrock
+        - Google Vertex AI
+        - Other
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating System
+      options:
+        - macOS
+        - Windows
+        - Ubuntu/Debian Linux
+        - Other Linux
+        - Other
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: terminal
+    attributes:
+      label: Terminal/Shell
+      description: Which terminal are you using?
+      options:
+        - Terminal.app (macOS)
+        - Warp
+        - Cursor
+        - iTerm2
+        - IntelliJ IDEA terminal
+        - VS Code integrated terminal
+        - PyCharm terminal
+        - Windows Terminal        
+        - PowerShell
+        - WSL (Windows Subsystem for Linux)
+        - Xterm
+        - Non-interactive/CI environment
+        - Other
+    validations:
+      required: true
+      
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Information
+      description: |
+        Anything else that might help us understand the issue?
+        - Screenshots (drag and drop images here)
+        - Configuration files
+        - Related files or code
+        - Links to repositories demonstrating the issue
+      placeholder: Any additional context, screenshots, or information...
+    validations:
+      required: false
@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 💬 Discord Community
+    url: https://anthropic.com/discord
+    about: Get help, ask questions, and chat with other Claude Code users
+  - name: 📖 Documentation
+    url: https://docs.claude.com/en/docs/claude-code
+    about: Read the official documentation and guides
+  - name: 🎓 Getting Started Guide
+    url: https://docs.claude.com/en/docs/claude-code/quickstart
+    about: New to Claude Code? Start here
+  - name: 🔧 Troubleshooting Guide
+    url: https://docs.claude.com/en/docs/claude-code/troubleshooting
+    about: Common issues and how to fix them
@@ -0,0 +1,117 @@
+name: 📚 Documentation Issue
+description: Report missing, unclear, or incorrect documentation
+title: "[DOCS] "
+labels:
+  - documentation
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Help us improve our documentation!
+        
+        Good documentation is crucial for a great developer experience. Please let us know what's missing or confusing.
+        
+  - type: dropdown
+    id: doc_type
+    attributes:
+      label: Documentation Type
+      description: What kind of documentation issue is this?
+      options:
+        - Missing documentation (feature not documented)
+        - Unclear/confusing documentation
+        - Incorrect/outdated documentation
+        - Typo or formatting issue
+        - Missing code examples
+        - Broken links
+        - Other
+    validations:
+      required: true
+      
+  - type: input
+    id: location
+    attributes:
+      label: Documentation Location
+      description: Where did you encounter this issue? Provide a URL if possible
+      placeholder: "e.g., https://docs.anthropic.com/en/docs/claude-code/getting-started"
+    validations:
+      required: false
+      
+  - type: input
+    id: section
+    attributes:
+      label: Section/Topic
+      description: Which specific section or topic needs improvement?
+      placeholder: "e.g., MCP Server Configuration section"
+    validations:
+      required: true
+      
+  - type: textarea
+    id: current
+    attributes:
+      label: Current Documentation
+      description: |
+        What does the documentation currently say? 
+        Quote the specific text if applicable.
+      placeholder: |
+        The docs currently say:
+        "To configure MCP servers, add them to your configuration..."
+        
+        But it doesn't explain...
+    validations:
+      required: false
+      
+  - type: textarea
+    id: issue
+    attributes:
+      label: What's Wrong or Missing?
+      description: Explain what's incorrect, unclear, or missing
+      placeholder: |
+        The documentation doesn't explain how to:
+        - Configure multiple MCP servers
+        - Handle authentication
+        - Debug connection issues
+        
+        The example code doesn't work because...
+    validations:
+      required: true
+      
+  - type: textarea
+    id: suggested
+    attributes:
+      label: Suggested Improvement
+      description: How should the documentation be improved? Provide suggested text if possible
+      placeholder: |
+        The documentation should include:
+        
+        1. A complete example showing...
+        2. Explanation of common errors like...
+        3. Step-by-step guide for...
+        
+        Suggested text:
+        "To configure multiple MCP servers, create an array in your settings..."
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: impact
+    attributes:
+      label: Impact
+      description: How much does this documentation issue affect users?
+      options:
+        - High - Prevents users from using a feature
+        - Medium - Makes feature difficult to understand
+        - Low - Minor confusion or inconvenience
+    validations:
+      required: true
+          
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: |
+        - Screenshots showing the issue
+        - Links to related documentation
+        - Examples from other projects that do this well
+      placeholder: Any additional information that would help...
+    validations:
+      required: false
@@ -0,0 +1,132 @@
+name: ✨ Feature Request
+description: Suggest a new feature or enhancement for Claude Code
+title: "[FEATURE] "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Thanks for suggesting a feature!
+        
+        We love hearing ideas from our community. Please help us understand your use case by filling out the sections below.
+        Before submitting, please check if this feature has already been requested.
+        
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight Checklist
+      options:
+        - label: I have searched [existing requests](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20label%3Aenhancement) and this feature hasn't been requested yet
+          required: true
+        - label: This is a single feature request (not multiple features)
+          required: true
+          
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: |
+        What problem are you trying to solve? Why do you need this feature?
+        Focus on the problem, not the solution. Help us understand your workflow.
+      placeholder: |
+        I often need to work with multiple projects simultaneously, but Claude Code doesn't support...
+        
+        When I'm debugging code, I find it difficult to...
+        
+        The current workflow requires me to manually...
+    validations:
+      required: true
+      
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: |
+        How would you like this to work? Describe the ideal user experience.
+        Be specific about how you'd interact with this feature.
+      placeholder: |
+        I'd like to be able to run `claude --workspace project1,project2` to...
+        
+        There should be a command or setting that allows...
+        
+        The interface should show...
+    validations:
+      required: true
+      
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternative Solutions
+      description: |
+        What alternatives have you considered or tried?
+        Are there workarounds you're currently using?
+      placeholder: |
+        I've tried using multiple terminal windows but...
+        
+        Currently I work around this by...
+        
+        Other tools solve this by...
+    validations:
+      required: false
+      
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Priority
+      description: How important is this feature to your workflow?
+      options:
+        - Critical - Blocking my work
+        - High - Significant impact on productivity
+        - Medium - Would be very helpful
+        - Low - Nice to have
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: category
+    attributes:
+      label: Feature Category
+      description: What area does this feature relate to?
+      options:
+        - CLI commands and flags
+        - Interactive mode (TUI)
+        - File operations
+        - API and model interactions
+        - MCP server integration
+        - Performance and speed
+        - Configuration and settings
+        - Developer tools/SDK
+        - Documentation
+        - Other
+    validations:
+      required: true
+      
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Use Case Example
+      description: |
+        Provide a concrete, real-world example of when you'd use this feature.
+        Walk us through a scenario step-by-step.
+      placeholder: |
+        Example scenario:
+        1. I'm working on a React app with a Node.js backend
+        2. I need to make changes to both frontend and backend
+        3. With this feature, I could...
+        4. This would save me time because...
+    validations:
+      required: false
+      
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: |
+        - Screenshots or mockups of the proposed feature
+        - Links to similar features in other tools
+        - Technical considerations or constraints
+        - Any other relevant information
+      placeholder: Add any other context, mockups, or examples here...
+    validations:
+      required: false
@@ -0,0 +1,220 @@
+name: 🤖 Model Behavior Issue
+description: Report unexpected Claude model behavior, incorrect actions, or permission violations
+title: "[MODEL] "
+labels:
+  - model
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Report Unexpected Model Behavior
+        
+        Use this template when Claude does something unexpected, makes unwanted changes, or behaves inconsistently with your instructions.
+        
+        **This is for:** Unexpected actions, file modifications outside scope, ignoring instructions, making assumptions
+        **NOT for:** Crashes, API errors, or installation issues (use Bug Report instead)
+        
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Preflight Checklist
+      description: Please confirm before submitting
+      options:
+        - label: I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Amodel) for similar behavior reports
+          required: true
+        - label: This report does NOT contain sensitive information (API keys, passwords, etc.)
+          required: true
+          
+  - type: dropdown
+    id: behavior_type
+    attributes:
+      label: Type of Behavior Issue
+      description: What category best describes the unexpected behavior?
+      options:
+        - Claude modified files I didn't ask it to modify
+        - Claude accessed files outside the working directory
+        - Claude ignored my instructions or configuration
+        - Claude reverted/undid previous changes without asking
+        - Claude made incorrect assumptions about my project
+        - Claude refused a reasonable request
+        - Claude's behavior changed between sessions
+        - Subagent behaved unexpectedly
+        - Other unexpected behavior
+    validations:
+      required: true
+      
+  - type: textarea
+    id: what_you_asked
+    attributes:
+      label: What You Asked Claude to Do
+      description: Provide the exact prompt or command you gave
+      placeholder: |
+        I asked: "Update the README.md file to add installation instructions"
+        
+        Or I ran: `claude "fix the bug in auth.js"`
+    validations:
+      required: true
+      
+  - type: textarea
+    id: what_claude_did
+    attributes:
+      label: What Claude Actually Did
+      description: Describe step-by-step what Claude did instead
+      placeholder: |
+        1. Claude read README.md
+        2. Instead of updating it, Claude deleted the entire file
+        3. Created a new README from scratch with different content
+        4. Also modified package.json without being asked
+        5. Changed .gitignore file
+    validations:
+      required: true
+      
+  - type: textarea
+    id: expected_behavior
+    attributes:
+      label: Expected Behavior
+      description: What should Claude have done?
+      placeholder: |
+        Claude should have:
+        1. Read the existing README.md
+        2. Added an "Installation" section
+        3. Only modified that single file
+        4. Not touched any other files
+    validations:
+      required: true
+      
+  - type: textarea
+    id: files_affected
+    attributes:
+      label: Files Affected
+      description: |
+        List all files that were accessed or modified (even if you didn't expect them to be)
+      placeholder: |
+        Modified:
+        - README.md (deleted and recreated)
+        - package.json (version bumped - not requested)
+        - .gitignore (added entries - not requested)
+        
+        Read (unexpectedly):
+        - /Users/me/.ssh/config
+        - ../../../parent-directory/secrets.env
+      render: shell
+    validations:
+      required: false
+      
+  - type: dropdown
+    id: permission_mode
+    attributes:
+      label: Permission Mode
+      description: What permission settings were active?
+      options:
+        - Accept Edits was ON (auto-accepting changes)
+        - Accept Edits was OFF (manual approval required)
+        - I don't know / Not sure
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: reproducible
+    attributes:
+      label: Can You Reproduce This?
+      description: Does this happen consistently?
+      options:
+        - Yes, every time with the same prompt
+        - Sometimes (intermittent)
+        - No, only happened once
+        - Haven't tried to reproduce
+    validations:
+      required: true
+      
+  - type: textarea
+    id: reproduction_steps
+    attributes:
+      label: Steps to Reproduce
+      description: If reproducible, provide minimal steps
+      placeholder: |
+        1. Create a new directory with a simple README.md
+        2. Ask Claude Code to "improve the README"
+        3. Claude will delete and recreate the file instead of editing
+    validations:
+      required: false
+      
+  - type: dropdown
+    id: model
+    attributes:
+      label: Claude Model
+      description: Which model were you using? (Run `/model` to check)
+      options:
+        - Sonnet
+        - Opus
+        - Haiku
+        - Not sure
+        - Other
+    validations:
+      required: true
+      
+  - type: textarea
+    id: conversation_log
+    attributes:
+      label: Relevant Conversation
+      description: |
+        Include relevant parts of Claude's responses, especially where it explains what it's doing
+      placeholder: |
+        Claude said: "I'll help you update the README. Let me first delete the old one and create a fresh version..."
+        
+        [Then proceeded to delete without asking for confirmation]
+      render: markdown
+    validations:
+      required: false
+      
+  - type: dropdown
+    id: impact
+    attributes:
+      label: Impact
+      description: How severe was the impact of this behavior?
+      options:
+        - Critical - Data loss or corrupted project
+        - High - Significant unwanted changes
+        - Medium - Extra work to undo changes
+        - Low - Minor inconvenience
+    validations:
+      required: true
+      
+  - type: input
+    id: version
+    attributes:
+      label: Claude Code Version
+      description: Run `claude --version` and paste the output
+      placeholder: "e.g., 1.0.123 (Claude Code)"
+    validations:
+      required: true
+      
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      description: Which API platform are you using?
+      options:
+        - Anthropic API
+        - AWS Bedrock
+        - Google Vertex AI
+        - Other
+    validations:
+      required: true
+      
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: |
+        - Any patterns you've noticed
+        - Similar behavior in other sessions
+        - Specific file types or project structures that trigger this
+        - Screenshots if relevant
+      placeholder: |
+        This seems to happen more often with:
+        - Python projects
+        - When there are multiple similar files
+        - After long conversations
+    validations:
+      required: false
@@ -1,5 +1,5 @@
-name: Auto-close duplicate issues (DRY RUN)
-description: Dry run - logs issues that would be auto-closed as duplicates after 3 days if no response
+name: Auto-close duplicate issues
+description: Auto-closes issues that are duplicates of existing issues
 on:
  schedule:
    - cron: "0 9 * * *"
@@ -11,20 +11,21 @@ jobs:
    timeout-minutes: 10
    permissions:
      contents: read
-      issues: read
+      issues: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
-      
+
      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
        with:
          bun-version: latest
-      
+
      - name: Auto-close duplicate issues
        run: bun run scripts/auto-close-duplicates.ts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
+          STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }}
@@ -0,0 +1,44 @@
+name: Backfill Duplicate Comments
+description: Triggers duplicate detection for old issues that don't have duplicate comments
+
+on:
+  workflow_dispatch:
+    inputs:
+      days_back:
+        description: 'How many days back to look for old issues'
+        required: false
+        default: '90'
+        type: string
+      dry_run:
+        description: 'Dry run mode (true to only log what would be done)'
+        required: false
+        default: 'true'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+
+jobs:
+  backfill-duplicate-comments:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      issues: read
+      actions: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
+        with:
+          bun-version: latest
+      
+      - name: Backfill duplicate comments
+        run: bun run scripts/backfill-duplicate-comments.ts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DAYS_BACK: ${{ inputs.days_back }}
+          DRY_RUN: ${{ inputs.dry_run }}
@@ -3,6 +3,12 @@ description: Automatically dedupe GitHub issues using Claude Code
 on:
  issues:
    types: [opened]
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: 'Issue number to process for duplicate detection'
+        required: true
+        type: string

 jobs:
  claude-dedupe-issues:
@@ -11,15 +17,78 @@ jobs:
    permissions:
      contents: read
      issues: write
+      # Required to mint the OIDC token exchanged for a Claude API access token (Workload Identity Federation)
+      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run Claude Code slash command
-        uses: anthropics/claude-code-base-action@beta
+        uses: anthropics/claude-code-action@v1
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CLAUDE_CODE_SCRIPT_CAPS: '{"comment-on-duplicates.sh":1}'
        with:
-          prompt: "/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number }}"
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          claude_env: |
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          allowed_non_write_users: "*"
+          prompt: "/dedupe ${{ github.repository }}/issues/${{ github.event.issue.number || inputs.issue_number }}"
+          # Authenticate to the Claude API via Workload Identity Federation
+          # (the workflow's OIDC token is exchanged for a short-lived access
+          # token) instead of a static API key.
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+          claude_args: "--model claude-sonnet-4-5-20250929"
+
+      - name: Log duplicate comment event to Statsig
+        if: always()
+        env:
+          STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }}
+          ISSUE_NUMBER: ${{ github.event.issue.number || inputs.issue_number }}
+          REPO: ${{ github.repository }}
+          TRIGGERED_BY: ${{ github.event_name }}
+          WORKFLOW_RUN_ID: ${{ github.run_id }}
+        run: |
+          if [ -z "$STATSIG_API_KEY" ]; then
+            echo "STATSIG_API_KEY not found, skipping Statsig logging"
+            exit 0
+          fi
+          
+          # Prepare the event payload
+          EVENT_PAYLOAD=$(jq -n \
+            --arg issue_number "$ISSUE_NUMBER" \
+            --arg repo "$REPO" \
+            --arg triggered_by "$TRIGGERED_BY" \
+            --arg workflow_run_id "$WORKFLOW_RUN_ID" \
+            '{
+              events: [{
+                eventName: "github_duplicate_comment_added",
+                value: 1,
+                metadata: {
+                  repository: $repo,
+                  issue_number: ($issue_number | tonumber),
+                  triggered_by: $triggered_by,
+                  workflow_run_id: $workflow_run_id
+                },
+                time: (now | floor | tostring)
+              }]
+            }')
+          
+          # Send to Statsig API
+          echo "Logging duplicate comment event to Statsig for issue #${ISSUE_NUMBER}"
+          
+          RESPONSE=$(curl -s -w "\n%{http_code}" -X POST https://events.statsigapi.net/v1/log_event \
+            -H "Content-Type: application/json" \
+            -H "STATSIG-API-KEY: ${STATSIG_API_KEY}" \
+            -d "$EVENT_PAYLOAD")
+          
+          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+          BODY=$(echo "$RESPONSE" | head -n-1)
+          
+          if [ "$HTTP_CODE" -eq 200 ] || [ "$HTTP_CODE" -eq 202 ]; then
+            echo "Successfully logged duplicate comment event for issue #${ISSUE_NUMBER}"
+          else
+            echo "Failed to log duplicate comment event for issue #${ISSUE_NUMBER}. HTTP ${HTTP_CODE}: ${BODY}"
+          fi
@@ -1,106 +1,47 @@
 name: Claude Issue Triage
-description: Automatically triage GitHub issues using Claude Code
 on:
  issues:
    types: [opened]
+  issue_comment:
+    types: [created]

 jobs:
  triage-issue:
    runs-on: ubuntu-latest
    timeout-minutes: 10
+    if: >-
+      github.event_name == 'issues' ||
+      (github.event_name == 'issue_comment' && !github.event.issue.pull_request && github.event.comment.user.type != 'Bot')
+    concurrency:
+      group: issue-triage-${{ github.event.issue.number }}
+      cancel-in-progress: true
    permissions:
      contents: read
      issues: write
+      # Required to mint the OIDC token exchanged for a Claude API access token (Workload Identity Federation)
+      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

-      - name: Create triage prompt
-        run: |
-          mkdir -p /tmp/claude-prompts
-          cat > /tmp/claude-prompts/triage-prompt.txt << 'EOF'
-          You're an issue triage assistant for GitHub issues. Your task is to analyze the issue and select appropriate labels from the provided list.
-
-          IMPORTANT: Don't post any comments or messages to the issue. Your only action should be to apply labels.
-
-          Issue Information:
-          - REPO: ${{ github.repository }}
-          - ISSUE_NUMBER: ${{ github.event.issue.number }}
-
-          TASK OVERVIEW:
-
-          1. First, fetch the list of labels available in this repository by running: `gh label list`. Run exactly this command with nothing else.
-
-          2. Next, use the GitHub tools to get context about the issue:
-             - You have access to these tools:
-               - mcp__github__get_issue: Use this to retrieve the current issue's details including title, description, and existing labels
-               - mcp__github__get_issue_comments: Use this to read any discussion or additional context provided in the comments
-               - mcp__github__update_issue: Use this to apply labels to the issue (do not use this for commenting)
-               - mcp__github__search_issues: Use this to find similar issues that might provide context for proper categorization and to identify potential duplicate issues
-               - mcp__github__list_issues: Use this to understand patterns in how other issues are labeled
-             - Start by using mcp__github__get_issue to get the issue details
-
-          3. Analyze the issue content, considering:
-             - The issue title and description
-             - The type of issue (bug report, feature request, question, etc.)
-             - Technical areas mentioned
-             - Severity or priority indicators
-             - User impact
-             - Components affected
-
-          4. Select appropriate labels from the available labels list provided above:
-             - Choose labels that accurately reflect the issue's nature
-             - Be specific but comprehensive
-             - Select priority labels if you can determine urgency (high-priority, med-priority, or low-priority)
-             - Consider platform labels (android, ios) if applicable
-             - If you find similar issues using mcp__github__search_issues, consider using a "duplicate" label if appropriate. Only do so if the issue is a duplicate of another OPEN issue.
-
-          5. Apply the selected labels:
-             - Use mcp__github__update_issue to apply your selected labels
-             - DO NOT post any comments explaining your decision
-             - DO NOT communicate directly with users
-             - If no labels are clearly applicable, do not apply any labels
-
-          IMPORTANT GUIDELINES:
-          - Be thorough in your analysis
-          - Only select labels from the provided list above
-          - DO NOT post any comments to the issue
-          - Your ONLY action should be to apply labels using mcp__github__update_issue
-          - It's okay to not add any labels if none are clearly applicable
-          EOF
-
-      - name: Setup GitHub MCP Server
-        run: |
-          mkdir -p /tmp/mcp-config
-          cat > /tmp/mcp-config/mcp-servers.json << 'EOF'
-          {
-            "mcpServers": {
-              "github": {
-                "command": "docker",
-                "args": [
-                  "run",
-                  "-i",
-                  "--rm",
-                  "-e",
-                  "GITHUB_PERSONAL_ACCESS_TOKEN",
-                  "ghcr.io/github/github-mcp-server:sha-7aced2b"
-                ],
-                "env": {
-                  "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
-                }
-              }
-            }
-          }
-          EOF
-
      - name: Run Claude Code for Issue Triage
-        uses: anthropics/claude-code-base-action@beta
+        timeout-minutes: 5
+        uses: anthropics/claude-code-action@v1
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          CLAUDE_CODE_SCRIPT_CAPS: '{"edit-issue-labels.sh":2}'
        with:
-          prompt_file: /tmp/claude-prompts/triage-prompt.txt
-          allowed_tools: "Bash(gh label list),mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues"
-          timeout_minutes: "5"
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          mcp_config: /tmp/mcp-config/mcp-servers.json
-          claude_env: |
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          allowed_non_write_users: "*"
+          prompt: "/triage-issue REPO: ${{ github.repository }} ISSUE_NUMBER: ${{ github.event.issue.number }} EVENT: ${{ github.event_name }}"
+          # Authenticate to the Claude API via Workload Identity Federation
+          # (the workflow's OIDC token is exchanged for a short-lived access
+          # token) instead of a static API key.
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+          claude_args: |
+            --model claude-opus-4-6
@@ -31,7 +31,14 @@ jobs:

      - name: Run Claude Code
        id: claude
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@v1
        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Authenticate to the Claude API via Workload Identity Federation
+          # (the workflow's OIDC token is exchanged for a short-lived access
+          # token) instead of a static API key.
+          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
+          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
+          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
+          anthropic_workspace_id: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
+          claude_args: "--model claude-sonnet-4-5-20250929"

@@ -0,0 +1,27 @@
+name: "Issue Lifecycle Comment"
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
+        with:
+          bun-version: latest
+
+      - name: Post lifecycle comment
+        run: bun run scripts/lifecycle-comment.ts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          LABEL: ${{ github.event.label.name }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
@@ -0,0 +1,28 @@
+name: Issue Opened Dispatch
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: read
+  actions: write
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - name: Process new issue
+        env:
+          ISSUE_URL: ${{ github.event.issue.html_url }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          TARGET_REPO: ${{ secrets.ISSUE_OPENED_DISPATCH_TARGET_REPO }}
+          GH_TOKEN: ${{ secrets.ISSUE_OPENED_DISPATCH_TOKEN }}
+        run: |
+          gh api repos/${TARGET_REPO}/dispatches \
+            -f event_type=issue_opened \
+            -f client_payload[issue_url]="${ISSUE_URL}" || {
+              exit 0
+            }
@@ -13,16 +13,65 @@ concurrency:
  group: lock-threads

 jobs:
-  lock-threads:
+  lock-closed-issues:
    runs-on: ubuntu-latest
    steps:
-      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
+      - name: Lock closed issues after 7 days of inactivity
+        uses: actions/github-script@v7
        with:
-          issue-inactive-days: "7"
-          process-only: "issues"
-          log-output: true
-          issue-comment: >
-            This issue has been automatically locked since it was
-            closed and has not had any activity for 7 days.
-            If you're experiencing a similar issue, please file a new issue
-            and reference this one if it's relevant.
+          script: |
+            const sevenDaysAgo = new Date();
+            sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+            const cutoff = sevenDaysAgo.toISOString().split('T')[0];
+
+            const lockComment = `This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.`;
+
+            const query = `repo:${context.repo.owner}/${context.repo.repo} is:issue is:closed is:unlocked updated:<${cutoff}`;
+            console.log(`Search query: ${query}`);
+
+            const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+            const MAX_PER_RUN = 250;
+            const processed = new Set();
+            let totalLocked = 0;
+
+            while (totalLocked < MAX_PER_RUN) {
+              const { data } = await github.rest.search.issuesAndPullRequests({
+                q: query,
+                sort: 'updated',
+                order: 'asc',
+                per_page: 100,
+              });
+
+              if (totalLocked === 0) {
+                console.log(`Total candidates: ${data.total_count}`);
+              }
+
+              const fresh = data.items.filter((i) => !processed.has(i.number));
+              if (fresh.length === 0) break;
+
+              for (const issue of fresh) {
+                if (totalLocked >= MAX_PER_RUN) break;
+                processed.add(issue.number);
+                try {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    body: lockComment,
+                  });
+                  await github.rest.issues.lock({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    lock_reason: 'resolved',
+                  });
+                  totalLocked++;
+                  console.log(`Locked issue #${issue.number}: ${issue.title}`);
+                  await sleep(1000);
+                } catch (error) {
+                  console.error(`Failed to lock issue #${issue.number}: ${error.message}`);
+                }
+              }
+            }
+
+            console.log(`Total issues locked: ${totalLocked}`);
@@ -0,0 +1,40 @@
+name: Log Issue Events to Statsig
+
+on:
+  issues:
+    types: [opened, closed]
+
+jobs:
+  log-to-statsig:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: read
+    steps:
+      - name: Log issue creation to Statsig
+        env:
+          STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          AUTHOR: ${{ github.event.issue.user.login }}
+          CREATED_AT: ${{ github.event.issue.created_at }}
+        run: |
+          # All values are now safely passed via environment variables
+          # No direct templating in the shell script to prevent injection attacks
+          
+          curl -X POST "https://events.statsigapi.net/v1/log_event" \
+            -H "Content-Type: application/json" \
+            -H "statsig-api-key: $STATSIG_API_KEY" \
+            -d '{
+              "events": [{
+                "eventName": "github_issue_created",
+                "metadata": {
+                  "issue_number": "'"$ISSUE_NUMBER"'",
+                  "repository": "'"$REPO"'",
+                  "title": "'"$(echo "$ISSUE_TITLE" | sed "s/\"/\\\\\"/g")"'",
+                  "author": "'"$AUTHOR"'",
+                  "created_at": "'"$CREATED_AT"'"
+                },
+                "time": '"$(date +%s)000"'
+              }]
+            }'
@@ -0,0 +1,47 @@
+name: Non-write Users Check
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  allowed-non-write-check:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - run: |
+          DIFF=$(gh pr diff "$PR_NUMBER" -R "$REPO" || true)
+
+          if ! echo "$DIFF" | grep -qE '^diff --git a/\.github/.*\.ya?ml'; then
+            exit 0
+          fi
+
+          MATCHES=$(echo "$DIFF" | grep "^+.*allowed_non_write_users" || true)
+
+          if [ -z "$MATCHES" ]; then
+            exit 0
+          fi
+
+          EXISTING=$(gh pr view "$PR_NUMBER" -R "$REPO" --json comments --jq '.comments[].body' \
+            | grep -c "<!-- non-write-users-check -->" || true)
+
+          if [ "$EXISTING" -gt 0 ]; then
+            exit 0
+          fi
+
+          gh pr comment "$PR_NUMBER" -R "$REPO" --body '<!-- non-write-users-check -->
+          **`allowed_non_write_users` detected**
+
+          This PR adds or modifies `allowed_non_write_users`, which allows users without write access to trigger Claude Code Action workflows. This can introduce security risks.
+
+          If this is a new flow, please make sure you actually need `allowed_non_write_users`. If you are editing an existing workflow, double check that you are not adding new Claude permissions which might lead to a vulnerability.
+
+          See existing workflows in this repo for safe usage examples, or contact the AppSec team.'
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
@@ -0,0 +1,42 @@
+name: "Remove Autoclose Label on Activity"
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  issues: write
+
+jobs:
+  remove-autoclose:
+    # Only run if the issue has the autoclose label
+    if: |
+      github.event.issue.state == 'open' &&
+      contains(github.event.issue.labels.*.name, 'autoclose') &&
+      github.event.comment.user.login != 'github-actions[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Remove autoclose label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            console.log(`Removing autoclose label from issue #${context.issue.number} due to new comment from ${context.payload.comment.user.login}`);
+            
+            try {
+              // Remove the autoclose label
+              await github.rest.issues.removeLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                name: 'autoclose'
+              });
+              
+              console.log(`Successfully removed autoclose label from issue #${context.issue.number}`);
+            } catch (error) {
+              // If the label was already removed or doesn't exist, that's fine
+              if (error.status === 404) {
+                console.log(`Autoclose label was already removed from issue #${context.issue.number}`);
+              } else {
+                throw error;
+              }
+            }
@@ -0,0 +1,31 @@
+name: "Issue Sweep"
+
+on:
+  schedule:
+    - cron: "0 10,22 * * *"
+  workflow_dispatch:
+
+permissions:
+  issues: write
+
+concurrency:
+  group: daily-issue-sweep
+
+jobs:
+  sweep:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
+        with:
+          bun-version: latest
+
+      - name: Enforce lifecycle timeouts
+        run: bun run scripts/sweep.ts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
+          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
@@ -0,0 +1,2 @@
+.DS_Store
+
@@ -6,33 +6,64 @@

 Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows -- all through natural language commands. Use it in your terminal, IDE, or tag @claude on Github.

-**Learn more in the [official documentation](https://docs.anthropic.com/en/docs/claude-code/overview)**.
+**Learn more in the [official documentation](https://code.claude.com/docs/en/overview)**.

 <img src="./demo.gif" />

 ## Get started
+> [!NOTE]
+> Installation via npm is deprecated. Use one of the recommended methods below.
+
+For more installation options, uninstall steps, and troubleshooting, see the [setup documentation](https://code.claude.com/docs/en/setup).

 1. Install Claude Code:

-```sh
-npm install -g @anthropic-ai/claude-code
-```
+    **MacOS/Linux (Recommended):**
+    ```bash
+    curl -fsSL https://claude.ai/install.sh | bash
+    ```
+
+    **Homebrew (MacOS/Linux):**
+    ```bash
+    brew install --cask claude-code
+    ```
+
+    **Windows (Recommended):**
+    ```powershell
+    irm https://claude.ai/install.ps1 | iex
+    ```
+
+    **WinGet (Windows):**
+    ```powershell
+    winget install Anthropic.ClaudeCode
+    ```
+
+    **NPM (Deprecated):**
+    ```bash
+    npm install -g @anthropic-ai/claude-code
+    ```

 2. Navigate to your project directory and run `claude`.

+## Plugins
+
+This repository includes several Claude Code plugins that extend functionality with custom commands and agents. See the [plugins directory](./plugins/README.md) for detailed documentation on available plugins.
+
 ## Reporting Bugs

 We welcome your feedback. Use the `/bug` command to report issues directly within Claude Code, or file a [GitHub issue](https://github.com/anthropics/claude-code/issues).

+## Connect on Discord
+
+Join the [Claude Developers Discord](https://anthropic.com/discord) to connect with other developers using Claude Code. Get help, share feedback, and discuss your projects with the community.
+
 ## Data collection, usage, and retention

 When you use Claude Code, we collect feedback, which includes usage data (such as code acceptance or rejections), associated conversation data, and user feedback submitted via the `/bug` command.

 ### How we use your data

-We may use feedback to improve our products and services, but we will not train generative models using your feedback from Claude Code. Given their potentially sensitive nature, we store user feedback transcripts for only 30 days.
-
-If you choose to send us feedback about Claude Code, such as transcripts of your usage, Anthropic may use that feedback to debug related issues and improve Claude Code's functionality (e.g., to reduce the risk of similar bugs occurring in the future).
+See our [data usage policies](https://code.claude.com/docs/en/data-usage).

 ### Privacy safeguards

@@ -5,8 +5,8 @@ Thank you for helping us keep Claude Code secure!

 The security of our systems and user data is Anthropic's top priority. We appreciate the work of security researchers acting in good faith in identifying and reporting potential vulnerabilities.

-Our security program is managed on HackerOne and we ask that any validated vulnerability in this functionality be reported through their [submission form](https://hackerone.com/anthropic-vdp/reports/new?type=team&report_type=vulnerability).
+Our security program is managed on HackerOne and we ask that any validated vulnerability in this functionality be reported through their [submission form](https://hackerone.com/4f1f16ba-10d3-4d09-9ecc-c721aad90f24/embedded_submissions/new).

-## Vulnerability Disclosure Program
+## Anthropic Bug Bounty

-Our Vulnerability Program Guidelines are defined on our [HackerOne program page](https://hackerone.com/anthropic-vdp).
+Our Bug Bounty Program Guidelines are defined on our [HackerOne program page](https://hackerone.com/anthropic).
@@ -40,14 +40,18 @@ Write-Host "Using backend: $($Backend)"
 # --- Prerequisite Check ---
 Write-Host "Checking for required commands..."
 try {
-    Get-Command $Backend -ErrorAction Stop | Out-Null
+    if (-not (Get-Command $Backend -ErrorAction SilentlyContinue)) {
+        throw "Required command '$($Backend)' not found."
+    }
    Write-Host "- $($Backend) command found."
-    Get-Command devcontainer -ErrorAction Stop | Out-Null
+    if (-not (Get-Command devcontainer -ErrorAction SilentlyContinue)) {
+        throw "Required command 'devcontainer' not found."
+    }
    Write-Host "- devcontainer command found."
 }
 catch {
-    Write-Error "A required command is not installed or not in your PATH."
-    Write-Error "Please ensure '$($_.Exception.Message.Split(':')[0])' and 'devcontainer' are installed and accessible."
+    Write-Error "A required command is not installed or not in your PATH. $($_.Exception.Message)"
+    Write-Error "Please ensure both '$Backend' and 'devcontainer' are installed and accessible in your system's PATH."
    exit 1
 }

@@ -0,0 +1,13 @@
+# Keep the build context to just the binary the Dockerfile COPYs. BuildKit (the
+# default, selected via the Dockerfile's syntax directive) only syncs the
+# referenced COPY source anyway, so this is a no-op there — it matters for the
+# classic builder (DOCKER_BUILDKIT=0) and as a conventional signal that the
+# .gitignore'd secrets in this directory aren't part of the image build.
+terraform/
+**/.terraform/
+*.tfstate*
+terraform.tfvars
+gateway.yaml
+secrets/
+*.pem
+client_secret_*.json
@@ -0,0 +1,12 @@
+# Local, environment-specific config — copy gateway.yaml.example -> gateway.yaml
+# (gateway.yaml.example IS committed; your filled-in gateway.yaml is not)
+gateway.yaml
+
+# Secrets / credentials — never commit
+secrets/
+client_secret_*.json
+*.pem
+
+# Release binary and pinned version — setup.sh downloads/writes these per release
+claude
+.claude-version
@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+
+# Runtime image for `claude gateway`.
+#
+# This image does NOT build the binary. It expects a prebuilt native
+# linux-x64 `claude` executable in the build context — the public Claude Code
+# release binary, which includes the `gateway` subcommand. setup.sh places it
+# at ./claude (downloading it from the public release endpoint and verifying
+# it against the release manifest if missing). Override CLAUDE_BINARY to
+# point at a different path.
+#
+# Build (with the binary at ./claude; otherwise add --build-arg CLAUDE_BINARY=<path>):
+#   docker build --platform=linux/amd64 --provenance=false -t claude-gateway .
+#
+# Run:
+#   docker run --rm -p 8080:8080 \
+#     -v "$PWD/gateway.yaml:/etc/claude/gateway.yaml:ro" \
+#     -e OIDC_CLIENT_SECRET -e GATEWAY_JWT_SECRET -e GATEWAY_POSTGRES_URL \
+#     claude-gateway
+
+ARG CLAUDE_BINARY=./claude
+
+# distroless/cc provides glibc + libstdc++ (required by the Bun-compiled
+# native binary). The :nonroot tag runs as uid/gid 65532.
+FROM gcr.io/distroless/cc-debian12:nonroot
+
+ARG CLAUDE_BINARY
+COPY --chmod=0755 ${CLAUDE_BINARY} /usr/local/bin/claude
+
+ENV CLAUDE_CONFIG_DIR=/tmp/.claude
+
+EXPOSE 8080
+USER nonroot
+
+ENTRYPOINT ["/usr/local/bin/claude", "gateway", "--config", "/etc/claude/gateway.yaml"]
@@ -0,0 +1,17 @@
+# Claude Gateway on Google Cloud
+
+Reference deployment artifacts for running Claude Gateway on GCP with Agent
+Platform (formerly Vertex AI) as the upstream: Cloud Run or GKE, Cloud SQL for
+PostgreSQL, Secret Manager, and service-account auth to Agent Platform.
+
+These files are provided as a working example rather than a supported production
+deployment. Adapt them to your own environment.
+
+- **Walkthrough**: https://code.claude.com/docs/en/claude-apps-gateway-on-gcp
+
+| File | Purpose |
+|---|---|
+| `setup.sh` | Scripts the walkthrough end to end via `gcloud` |
+| `Dockerfile` | Runtime image for the `claude gateway` binary |
+| `gateway.yaml.example` | Gateway config template, GCP-shaped (Agent Platform upstream, Google Workspace IdP) |
+| `terraform/` | Provisions the full architecture (two-pass apply — see `terraform/README.md`) |
@@ -0,0 +1,156 @@
+# gateway.yaml.example — Claude Gateway config template, GCP-shaped (walkthrough §6).
+#
+# Google Workspace IdP + Agent Platform (formerly Vertex AI) upstream, following
+# the walkthrough at https://code.claude.com/docs/en/claude-apps-gateway-on-gcp.
+# The active sections
+# below are a strict subset of the full configuration reference at
+# https://code.claude.com/docs/en/claude-apps-gateway; optional keys are included
+# commented-out.
+#
+# USAGE — this is the shippable TEMPLATE. Copy it to gateway.yaml and fill it in:
+#     cp gateway.yaml.example gateway.yaml
+#   setup.sh and terraform/ read gateway.yaml (your filled-in copy, which is
+#   gitignored). It is published as the Secret Manager secret `gateway-config`
+#   (§6) and mounted at /etc/claude/gateway.yaml — the container ENTRYPOINT runs
+#   `claude gateway --config /etc/claude/gateway.yaml`.
+#
+# Secret expansion: ${ENV_VAR} reads an env var; ${file:/path} reads a mounted file.
+# On Cloud Run, setup.sh injects the JWT / OIDC / Postgres secrets as ENV VARS
+# (Cloud Run can't mount multiple secrets into a single directory), and mounts
+# only gateway.yaml itself as a file at /etc/claude. On GKE you may use file mounts.
+#
+# BEFORE DEPLOY — replace every REPLACE_ME placeholder below (setup.sh refuses to
+# publish the config secret while any remain), and create the referenced secrets:
+#   gateway-jwt-secret           (setup.sh generates this)
+#   gateway-oidc-client-secret   (from the Google Cloud Console OAuth client)
+#   gateway-postgres-url         (setup.sh generates this)
+
+# ── Listener ─────────────────────────────────────────────────────────────────
+listen:
+  host: 0.0.0.0
+  port: 8080                      # Cloud Run sets PORT=8080; leave as-is
+  # Required. Fixes the IdP redirect_uri, the OIDC discovery doc, and the
+  # gateway-token issuer so none are derived from the client-controlled Host
+  # header (X-Forwarded-Host/-Proto are likewise never trusted). On Cloud Run
+  # the run.app URL is only assigned on the first deploy, so this starts as a
+  # placeholder for the provisioning-only first pass (login does NOT work until
+  # the real URL is set). After the first deploy, setup.sh prints the run.app
+  # URL: set it here (or your LB hostname) and re-run; setup.sh republishes the
+  # config and redeploys. Register the same host's /oauth/callback on the
+  # Google OAuth client.
+  public_url: https://set-after-first-deploy.invalid
+  # Register this exact redirect URI on the Google OAuth client:
+  #   https://<public_url host>/oauth/callback
+  #
+  # On Cloud Run (or behind any L7 LB) every request arrives via Google's front
+  # end, so the gateway sees one peer IP for all developers — set trusted_proxies
+  # so X-Forwarded-For from those proxies is trusted and per-IP rate limiting /
+  # audit IPs record the real client. 169.254.0.0/16 is Cloud Run's fixed
+  # link-local serving range; the proxy-only subnet is the one your internal ALB
+  # uses in this VPC.
+  # trusted_proxies:
+  #   - 169.254.0.0/16              # Cloud Run serving proxy (link-local peer)
+  #   - <proxy-only-subnet-cidr>    # add if fronted by your internal ALB (its proxy-only subnet)
+  #
+  # Alternative — terminate TLS in the gateway itself instead of at a proxy:
+  # tls:
+  #   cert: /certs/gateway.crt
+  #   key:  /certs/gateway.key
+
+# ── Identity provider — Google Workspace ─────────────────────────────────────
+oidc:
+  issuer: https://accounts.google.com
+  client_id: REPLACE_ME                              # Google OAuth client ID (not secret; from Cloud Console)
+  client_secret: ${OIDC_CLIENT_SECRET}
+  allowed_email_domains: [REPLACE_ME]                # e.g. [example.com] — reject id_tokens outside your org
+  # Google ignores the default offline_access scope; these two are what actually
+  # yield refresh tokens (silent renewal + the deprovision leash) from Google.
+  scopes: [openid, profile, email]
+  extra_auth_params: { access_type: offline, prompt: consent }
+  # NOTE: Google id_tokens carry NO groups claim. For group-based RBAC with
+  # Google as IdP, set `google_groups` (below) and the gateway fetches each
+  # user's Workspace groups at login via the Admin SDK Directory API.
+  # Otherwise, use email_domain matching (see managed.policies below).
+  # google_groups:
+  #   service_account_json_path: /secrets/google-sa.json  # SA with domain-wide delegation on admin.directory.group.readonly
+  #   admin_email: admin@example.com                       # a Workspace admin the SA impersonates
+  # groups_claim: groups          # Okta=groups, Entra app roles=roles — NOT Google
+  # ca_cert_pem: ${file:/secrets/idp-ca.pem}   # only for an IdP behind a private CA
+
+# ── Sessions ─────────────────────────────────────────────────────────────────
+session:
+  jwt_secret: ${GATEWAY_JWT_SECRET}   # >= 32 bytes; openssl rand -base64 32
+  # Google issues refresh tokens (above), so sessions renew silently and this
+  # mainly bounds deprovision latency. 8 is a sane default; lower toward 1 for
+  # tighter revocation. Array form rotates keys: [new, old] (index 0 signs, all verify).
+  ttl_hours: 8
+
+# ── Store (REQUIRED — the gateway refuses to boot without it) ─────────────────
+store:
+  postgres_url: ${GATEWAY_POSTGRES_URL}   # private-IP Cloud SQL; built with ?sslmode=require by setup.sh
+
+# ── Upstreams — Agent Platform ───────────────────────────────────────────────
+upstreams:
+  - provider: vertex
+    region: us-east5              # a region where the Claude models you need are published in Model Garden
+    project_id: REPLACE_ME        # your GCP project ID for Agent Platform access
+    auth: {}                      # ADC via Cloud Run SA / GKE Workload Identity (preferred — no static keys)
+    # base_url: https://us-east5-aiplatform.p.googleapis.com   # Private Service Connect endpoint
+  # Add more upstreams for failover (tried top→bottom on 5xx/timeout/501): a
+  # second region, or an anthropic/bedrock fallback. See
+  # https://code.claude.com/docs/en/claude-apps-gateway.
+
+# ── Telemetry fan-out (OPTIONAL) ─────────────────────────────────────────────
+# The CLI sends OTLP/HTTP to the gateway; the gateway fans out, stamping
+# user.id/user.email/user.groups server-side. On GCP, point at an OpenTelemetry
+# Collector with the googlecloud exporter (-> Cloud Trace / Managed Prometheus).
+# Takes effect after the second pass (once public_url is the real URL, not the
+# placeholder): when forward_to and public_url are both configured the gateway pushes
+# CLAUDE_CODE_ENABLE_TELEMETRY and the OTEL exporter selectors to every client
+# automatically — no per-developer config needed.
+# telemetry:
+#   forward_to:
+#     - url: https://otel-collector.internal.example.com:4318
+#       headers:
+#         Authorization: ${file:/secrets/otlp-token}
+#       metrics: true     # safe aggregate counters (default)
+#       logs: false       # carries bash commands / tool inputs — opt in deliberately
+#       traces: false
+
+# ── RBAC + managed settings (OPTIONAL; first-match-wins, top -> bottom) ───────
+# With Google as IdP, match on email_domain, or on group email addresses
+# (e.g. eng@example.com) once oidc.google_groups is configured above.
+# managed:
+#   policies:
+#     - match: { email_domain: example.com }
+#       cli:
+#         availableModels: [claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5]
+#         permissions: { deny: ["Read(./.env)", "Read(./secrets/**)"] }
+#     - match: {}        # catch-all floor — keep LAST
+#       cli:
+#         availableModels: [claude-sonnet-4-6, claude-haiku-4-5]
+
+# ── Admin API (OPTIONAL — enables db-mode runtime config + spend caps) ───────
+# admin_groups needs a groups claim — with Google as IdP, set
+# oidc.google_groups (above) so Workspace group email addresses populate the
+# claim, or use the bootstrap keys below instead. Named keys for
+# attribution in the audit log; 32-char minimum on key values. On Cloud Run add
+# these as env vars to --set-secrets (or terraform env value_source blocks),
+# same as the JWT/OIDC/Postgres secrets above; on GKE you may use ${file:...}.
+# admin:
+#   write_keys:
+#     - id: terraform
+#       key: ${GATEWAY_ADMIN_WRITE_KEY}
+#   read_keys:
+#     - id: reporting
+#       key: ${GATEWAY_ADMIN_READ_KEY}
+#   # admin_groups: [platform-finops@example.com]   # group emails via oidc.google_groups, or any groups-capable IdP
+
+# ── Model catalog (OPTIONAL) ─────────────────────────────────────────────────
+# Default true: every built-in Claude model is exposed and auto-translated per
+# upstream. Set false + a models: list to pin IDs (e.g. provisioned throughput).
+# auto_include_builtin_models: true
+# models:
+#   - id: claude-opus-4-8
+#     label: Claude Opus 4.8
+#     upstream_model: { vertex: claude-opus-4-8 }
@@ -0,0 +1,558 @@
+#!/usr/bin/env bash
+#
+# setup.sh — GCP setup for Claude Gateway (walkthrough §1–7b).
+#
+# Provisions, in doc order: APIs (§1), service account + IAM (§2), the gateway
+# container image in Artifact Registry (§3), a Cloud SQL (PostgreSQL) backend
+# with PRIVATE IP only (§4), the JWT + postgres-url secrets (§5), the
+# gateway.yaml config secret (§6), and a Cloud Run deploy with Direct VPC
+# egress (§7b).
+#
+# Private IP is required because public IP is disallowed by the org-policy constraint
+# `constraints/sql.restrictPublicIp`. A Cloud SQL private IP is an address inside a VPC,
+# so §4 here also provisions the prerequisite VPC + Private Services Access — the
+# one-time, irreducible networking required for private IP.
+#
+#   Section markers (§N) below map to the walkthrough:
+#   https://code.claude.com/docs/en/claude-apps-gateway-on-gcp
+#
+# Covers here:  APIs (§1) -> service account + IAM (§2) -> build & push image (§3)
+#               -> VPC + Private Services Access -> Cloud SQL (private IP only) -> database
+#               + user (§4) -> jwt + postgres-url secrets (§5) -> gateway-config
+#               secret from gateway.yaml (§6) -> Cloud Run deploy (§7b).
+# Not covered:  GKE track (§7a) — Cloud Run is the lower-friction path here.
+#
+# Idempotent: existing resources are detected and skipped, so it is safe to re-run.
+# Override any default below via environment variable, e.g. `REGION=us-east5 ./setup.sh`.
+
+set -euo pipefail
+
+# ---- configuration (env-overridable) ----------------------------------------
+PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project 2>/dev/null)}"
+REGION="${REGION:-${CLOUDSDK_COMPUTE_REGION:-us-east5}}"   # guide §1 uses us-east5 (Agent Platform model region)
+
+SA_NAME="${SA_NAME:-claude-gateway}"                       # §2 service account
+SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"
+
+# §3 image
+AR_REPO="${AR_REPO:-claude-gateway}"                       # Artifact Registry repository
+IMAGE_NAME="${IMAGE_NAME:-gateway}"
+RELEASES_URL="${RELEASES_URL:-https://downloads.claude.ai/claude-code-releases}"   # public Claude Code release endpoint
+VERSION="${VERSION:-}"                                     # Claude Code release to deploy; empty = latest release (resolved below)
+VERSION_FILE="${VERSION_FILE:-./.claude-version}"          # pins the resolved release across re-runs; delete it (or set VERSION) to upgrade
+DOCKERFILE="${DOCKERFILE:-./Dockerfile}"
+CLAUDE_BINARY="${CLAUDE_BINARY:-./claude}"                 # linux-x64 Claude Code binary; downloaded from RELEASES_URL if missing
+CLAUDE_SHA256="${CLAUDE_SHA256:-}"                         # optional: out-of-band sha256 pin for the downloaded binary, checked in addition to the release manifest
+
+VPC_NETWORK="${VPC_NETWORK:-cc-gateway-vpc}"
+SUBNET="${SUBNET:-cc-gateway-subnet}"
+SUBNET_RANGE="${SUBNET_RANGE:-10.0.0.0/24}"
+
+PSA_RANGE_NAME="${PSA_RANGE_NAME:-google-managed-services-${VPC_NETWORK}}"
+PSA_PREFIX_LENGTH="${PSA_PREFIX_LENGTH:-16}"               # /16 is GCP's recommendation; reserved, not consumed
+
+DB_INSTANCE="${DB_INSTANCE:-claude-gateway-db}"
+DB_VERSION="${DB_VERSION:-POSTGRES_16}"   # PG14+ supported; 16 is the recommended default (§4)
+DB_TIER="${DB_TIER:-db-g1-small}"
+DB_NAME="${DB_NAME:-claude_gateway}"
+DB_USER="${DB_USER:-gateway}"
+
+SECRET_NAME="${SECRET_NAME:-gateway-postgres-url}"         # §5 store.postgres_url
+JWT_SECRET_NAME="${JWT_SECRET_NAME:-gateway-jwt-secret}"   # §5 session.jwt_secret
+
+GATEWAY_YAML="${GATEWAY_YAML:-./gateway.yaml}"             # §6 config file
+CONFIG_SECRET="${CONFIG_SECRET:-gateway-config}"           # §6 mounted at /etc/claude/gateway.yaml
+
+# §7 Cloud Run deploy
+SERVICE_NAME="${SERVICE_NAME:-claude-gateway}"
+OIDC_SECRET_NAME="${OIDC_SECRET_NAME:-gateway-oidc-client-secret}"   # operator-created (Google OAuth client)
+DEPLOY="${DEPLOY:-1}"                                      # set DEPLOY=0 to provision only, no Cloud Run deploy
+INGRESS="${INGRESS:-internal}"                             # internal (default; no public URL) | internal-and-cloud-load-balancing (only if you front it with your own internal ALB)
+MAX_INSTANCES="${MAX_INSTANCES:-8}"                        # keep MAX_INSTANCES × store.max_connections (default 5) below the DB tier's max_connections (~50 on db-g1-small); raise the tier before raising this
+
+# ---- helpers ----------------------------------------------------------------
+log()  { printf '\n==> %s\n' "$*"; }
+skip() { printf '    (exists) %s\n' "$*"; }
+curl_https() { curl --proto '=https' --proto-redir '=https' --tlsv1.2 "$@"; }  # refuse plaintext/protocol-downgrade
+sha_of() { openssl dgst -sha256 "$1" | awk '{print $NF}'; }  # openssl avoids shasum/sha256sum portability gaps
+
+if [[ -z "${PROJECT_ID}" ]]; then
+  echo "ERROR: PROJECT_ID is not set and no gcloud default project is configured." >&2
+  echo "       Set it with: export PROJECT_ID=<your-project>   (or 'gcloud config set project ...')" >&2
+  exit 1
+fi
+# VERSION tags the image and selects the public Claude Code release to download.
+# The first resolved value is pinned to ${VERSION_FILE} so the documented
+# re-runs (fill gateway.yaml -> re-run; set public_url -> re-run) don't silently
+# build and deploy a newer release mid-bootstrap.
+if [[ -z "${VERSION}" && -f "${VERSION_FILE}" ]]; then
+  VERSION="$(< "${VERSION_FILE}")"
+  log "Using release pinned in ${VERSION_FILE}: ${VERSION}   (delete the file or set VERSION to change it)"
+elif [[ -z "${VERSION}" ]]; then
+  # /latest is the channel the official installer (claude.ai/install.sh) uses.
+  VERSION="$(curl_https -fsSL "${RELEASES_URL}/latest" | tr -d '[:space:]' || true)"
+  if [[ -z "${VERSION}" ]]; then
+    echo "ERROR: could not resolve the latest release from ${RELEASES_URL}/latest." >&2
+    echo "       Set VERSION to a Claude Code release version, e.g. export VERSION=2.1.195" >&2
+    exit 1
+  fi
+  log "VERSION not set — using latest Claude Code release: ${VERSION}"
+fi
+# Reject non-version content (e.g. an HTML error page served with HTTP 200)
+# before it reaches the image tag and download URLs.
+if [[ ! "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+  echo "ERROR: '${VERSION}' is not a release version (from VERSION, ${VERSION_FILE}, or ${RELEASES_URL}/latest)." >&2
+  exit 1
+fi
+printf '%s' "${VERSION}" > "${VERSION_FILE}"
+IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${AR_REPO}/${IMAGE_NAME}:${VERSION}"
+# Claude Code only connects to a gateway whose hostname resolves to private
+# addresses (a client-side /login check), so public ingress can never serve
+# clients — mirror the terraform module's validation and refuse it up front.
+if [[ "${INGRESS}" != "internal" && "${INGRESS}" != "internal-and-cloud-load-balancing" ]]; then
+  echo "ERROR: INGRESS must be 'internal' or 'internal-and-cloud-load-balancing' — Claude Code's" >&2
+  echo "       /login only accepts gateway hosts on private addresses, so public ingress cannot serve clients." >&2
+  exit 1
+fi
+
+log "Project: ${PROJECT_ID}   Region: ${REGION}   VPC: ${VPC_NETWORK}"
+
+# ---- 1 Project & API setup ------------------------------------------------
+# walkthrough §1 list (aiplatform, artifactregistry, sqladmin, secretmanager, iamcredentials)
+# plus iam/compute/servicenetworking required for the SA + private-IP networking below.
+# container.googleapis.com is for the GKE track (§7a) — harmless if you stay on Cloud Run.
+# We pass --project on every call rather than mutating your gcloud config.
+log "Enabling required APIs (§1)"
+gcloud services enable \
+  aiplatform.googleapis.com \
+  artifactregistry.googleapis.com \
+  sqladmin.googleapis.com \
+  secretmanager.googleapis.com \
+  iamcredentials.googleapis.com \
+  iam.googleapis.com \
+  compute.googleapis.com \
+  container.googleapis.com \
+  servicenetworking.googleapis.com \
+  run.googleapis.com \
+  --project="${PROJECT_ID}"
+
+# ---- 2 Service account & IAM ----------------------------------------------
+log "Creating service account ${SA_EMAIL} and granting project roles (§2)"
+if gcloud iam service-accounts describe "${SA_EMAIL}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "service account ${SA_EMAIL}"
+else
+  gcloud iam service-accounts create "${SA_NAME}" \
+    --display-name="Claude Gateway" --project="${PROJECT_ID}"
+fi
+
+# add-iam-policy-binding is idempotent (re-adding an existing binding is a no-op).
+# --condition=None avoids the interactive condition prompt in non-interactive runs.
+#
+# Only aiplatform.user is granted: the gateway reaches Cloud SQL over the VPC at
+# its PRIVATE IP with a password user (§4/§7b — direct TCP, not the Cloud SQL
+# Auth Proxy / connector), so it never calls cloudsql.instances.connect and no
+# roles/cloudsql.client grant is needed. Direct private-IP is used because the
+# gateway's store is a plain postgres_url — no proxy sidecar/socket plumbing,
+# one less moving part, and the connection string is portable across Cloud Run
+# and GKE.
+gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+  --member="serviceAccount:${SA_EMAIL}" \
+  --role="roles/aiplatform.user" --condition=None >/dev/null    # Agent Platform inference (§2)
+
+# ---- 3 Build & push image to Artifact Registry ----------------------------
+log "Ensuring Artifact Registry repo and image (§3)"
+if gcloud artifacts repositories describe "${AR_REPO}" \
+     --location="${REGION}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "Artifact Registry repo ${AR_REPO}"
+else
+  gcloud artifacts repositories create "${AR_REPO}" \
+    --repository-format=docker --location="${REGION}" --project="${PROJECT_ID}"
+fi
+
+# Image is the expensive, already-done step: skip the build+push entirely if the
+# tag already exists in the registry.
+if gcloud artifacts docker images describe "${IMAGE}" >/dev/null 2>&1; then
+  skip "image ${IMAGE}"
+else
+  # The public Claude Code release includes the gateway subcommand, so the
+  # binary comes straight from the release endpoint, verified against the
+  # release manifest's sha256. A pre-existing ${CLAUDE_BINARY} (stale version,
+  # interrupted download, hand-placed file) is verified the same way and
+  # re-downloaded on mismatch, so an unverified binary can never reach the image.
+  manifest="$(curl_https -fsSL "${RELEASES_URL}/${VERSION}/manifest.json" | tr -d '[:space:]' || true)"
+  sha_re='"linux-x64"[^}]*"checksum":"([a-f0-9]{64})"'  # structure-based: survives pretty-printed, minified, and one-line-per-platform manifests
+  if [[ ! "${manifest}" =~ ${sha_re} ]]; then
+    echo "ERROR: could not read the linux-x64 sha256 from ${RELEASES_URL}/${VERSION}/manifest.json — refusing to build." >&2
+    exit 1
+  fi
+  expected_sha="${BASH_REMATCH[1]}"
+  if [[ -f "${CLAUDE_BINARY}" && "$(sha_of "${CLAUDE_BINARY}")" == "${expected_sha}" ]]; then
+    skip "binary ${CLAUDE_BINARY} (sha256 matches release ${VERSION})"
+  else
+    if [[ -f "${CLAUDE_BINARY}" ]]; then
+      log "Existing ${CLAUDE_BINARY} does not match release ${VERSION} — re-downloading"
+    else
+      log "Downloading Claude Code ${VERSION} (linux-x64) from ${RELEASES_URL}"
+    fi
+    # Until verification passes, ANY exit (curl failure, set -e, signal, the
+    # error exit below) removes the file, so a partial download can't be
+    # silently picked up by a later run.
+    trap 'rm -f "${CLAUDE_BINARY}"' EXIT INT TERM
+    curl_https -fL -o "${CLAUDE_BINARY}" "${RELEASES_URL}/${VERSION}/linux-x64/claude"
+    actual_sha="$(sha_of "${CLAUDE_BINARY}")"
+    if [[ "${actual_sha}" != "${expected_sha}" ]]; then
+      echo "ERROR: sha256 of ${CLAUDE_BINARY} is ${actual_sha} but the release manifest says ${expected_sha} — refusing to build." >&2
+      exit 1
+    fi
+    trap - EXIT INT TERM
+    log "Verified binary sha256 ${actual_sha}"
+  fi
+  # Optional out-of-band pin, checked even for a pre-existing binary: the
+  # manifest shares an origin with the binary, so it can't defend against a
+  # compromised endpoint — CLAUDE_SHA256 can.
+  if [[ -n "${CLAUDE_SHA256}" && "$(sha_of "${CLAUDE_BINARY}")" != "${CLAUDE_SHA256}" ]]; then
+    echo "ERROR: sha256 of ${CLAUDE_BINARY} does not match CLAUDE_SHA256 (${CLAUDE_SHA256}) — refusing to build." >&2
+    exit 1
+  fi
+  chmod +x "${CLAUDE_BINARY}"
+  log "Building and pushing ${IMAGE}"
+  gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
+  # Cloud Run requires linux/amd64. --platform forces it (e.g. when building on an
+  # Apple Silicon Mac), and --provenance=false keeps buildx from wrapping the result
+  # in an OCI image index that Cloud Run rejects ("manifest ... must support amd64/linux").
+  docker build --platform=linux/amd64 --provenance=false \
+    -f "${DOCKERFILE}" --build-arg CLAUDE_BINARY="${CLAUDE_BINARY}" -t "${IMAGE}" .
+  docker push "${IMAGE}"
+fi
+
+# ---- 4 VPC + Private Services Access (private-IP prerequisite) -------------
+log "Creating VPC network and subnet"
+if gcloud compute networks describe "${VPC_NETWORK}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "network ${VPC_NETWORK}"
+else
+  gcloud compute networks create "${VPC_NETWORK}" \
+    --subnet-mode=custom --project="${PROJECT_ID}"
+fi
+
+if gcloud compute networks subnets describe "${SUBNET}" \
+     --region="${REGION}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "subnet ${SUBNET}"
+else
+  gcloud compute networks subnets create "${SUBNET}" \
+    --network="${VPC_NETWORK}" --region="${REGION}" \
+    --range="${SUBNET_RANGE}" --project="${PROJECT_ID}"
+fi
+
+log "Configuring Private Services Access (allocated range + VPC peering)"
+if gcloud compute addresses describe "${PSA_RANGE_NAME}" \
+     --global --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "allocated range ${PSA_RANGE_NAME}"
+else
+  gcloud compute addresses create "${PSA_RANGE_NAME}" \
+    --global --purpose=VPC_PEERING --prefix-length="${PSA_PREFIX_LENGTH}" \
+    --network="${VPC_NETWORK}" --project="${PROJECT_ID}"
+fi
+
+if gcloud services vpc-peerings list --network="${VPC_NETWORK}" --project="${PROJECT_ID}" \
+     --format='value(peering)' 2>/dev/null | grep -q servicenetworking; then
+  skip "servicenetworking VPC peering"
+else
+  gcloud services vpc-peerings connect \
+    --service=servicenetworking.googleapis.com \
+    --ranges="${PSA_RANGE_NAME}" \
+    --network="${VPC_NETWORK}" --project="${PROJECT_ID}"
+fi
+
+# ---- 4 Cloud SQL instance (private IP only) -------------------------------
+log "Creating Cloud SQL instance ${DB_INSTANCE} (private IP only)"
+if gcloud sql instances describe "${DB_INSTANCE}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "instance ${DB_INSTANCE}"
+else
+  gcloud sql instances create "${DB_INSTANCE}" \
+    --database-version="${DB_VERSION}" \
+    --tier="${DB_TIER}" \
+    --region="${REGION}" \
+    --network="projects/${PROJECT_ID}/global/networks/${VPC_NETWORK}" \
+    --no-assign-ip \
+    --project="${PROJECT_ID}"
+fi
+
+log "Creating database ${DB_NAME}"
+if gcloud sql databases describe "${DB_NAME}" \
+     --instance="${DB_INSTANCE}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "database ${DB_NAME}"
+else
+  gcloud sql databases create "${DB_NAME}" \
+    --instance="${DB_INSTANCE}" --project="${PROJECT_ID}"
+fi
+
+# hex (not base64) keeps the password URL-safe for the connection string below.
+log "Creating database user ${DB_USER}"
+DB_PASSWORD=""
+if gcloud sql users list --instance="${DB_INSTANCE}" --project="${PROJECT_ID}" \
+     --format='value(name)' 2>/dev/null | grep -qx "${DB_USER}"; then
+  if gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    skip "user ${DB_USER} (password unchanged; secret not rewritten)"
+  else
+    # Self-heal: a previous run died after creating the user but before writing
+    # the connection-string secret, losing the only copy of the password. The
+    # secret is the password's only consumer, so resetting it is safe and keeps
+    # re-runs able to recover from any partial state.
+    log "User ${DB_USER} exists but secret ${SECRET_NAME} is missing — resetting password"
+    DB_PASSWORD="$(openssl rand -hex 24)"
+    gcloud sql users set-password "${DB_USER}" \
+      --instance="${DB_INSTANCE}" --password="${DB_PASSWORD}" \
+      --project="${PROJECT_ID}"
+  fi
+else
+  DB_PASSWORD="$(openssl rand -hex 24)"
+  gcloud sql users create "${DB_USER}" \
+    --instance="${DB_INSTANCE}" --password="${DB_PASSWORD}" \
+    --project="${PROJECT_ID}"
+fi
+
+# ---- 5 Connection string -> Secret Manager + secretAccessor ---------------
+PRIVATE_IP="$(gcloud sql instances describe "${DB_INSTANCE}" --project="${PROJECT_ID}" \
+  --format='value(ipAddresses[0].ipAddress)')"
+
+if [[ -n "${DB_PASSWORD}" ]]; then
+  # direct private-IP form, ?sslmode=require (guide §4)
+  CONN="postgres://${DB_USER}:${DB_PASSWORD}@${PRIVATE_IP}:5432/${DB_NAME}?sslmode=require"
+  log "Storing connection string in Secret Manager secret ${SECRET_NAME}"
+  if gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    printf '%s' "${CONN}" | gcloud secrets versions add "${SECRET_NAME}" \
+      --data-file=- --project="${PROJECT_ID}"
+  else
+    printf '%s' "${CONN}" | gcloud secrets create "${SECRET_NAME}" \
+      --replication-policy=automatic --data-file=- --project="${PROJECT_ID}"
+  fi
+else
+  log "Skipping secret write (user already existed, password not available this run)"
+fi
+
+if gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  log "Granting ${SA_EMAIL} secretAccessor on ${SECRET_NAME}"
+  gcloud secrets add-iam-policy-binding "${SECRET_NAME}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None --project="${PROJECT_ID}" >/dev/null
+fi
+
+# JWT signing secret — generated once (re-runs do NOT rotate it).
+log "Ensuring JWT signing secret ${JWT_SECRET_NAME} (§5)"
+if gcloud secrets describe "${JWT_SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  skip "secret ${JWT_SECRET_NAME}"
+else
+  openssl rand -base64 32 | tr -d '\n' | gcloud secrets create "${JWT_SECRET_NAME}" \
+    --replication-policy=automatic --data-file=- --project="${PROJECT_ID}"
+fi
+gcloud secrets add-iam-policy-binding "${JWT_SECRET_NAME}" \
+  --member="serviceAccount:${SA_EMAIL}" \
+  --role="roles/secretmanager.secretAccessor" \
+  --condition=None --project="${PROJECT_ID}" >/dev/null
+
+# OIDC client secret — operator-created (the script can't generate it). Grant
+# accessor here once it exists so the deploy step doesn't fail on permission.
+if gcloud secrets describe "${OIDC_SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+  log "Granting ${SA_EMAIL} secretAccessor on ${OIDC_SECRET_NAME}"
+  gcloud secrets add-iam-policy-binding "${OIDC_SECRET_NAME}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None --project="${PROJECT_ID}" >/dev/null
+fi
+
+# ---- 6 gateway.yaml -> Secret Manager (gateway-config) --------------------
+# Published only when fully filled in: refuse to push a config that still has
+# REPLACE_ME placeholders (checked on non-comment lines so commented examples
+# and this file's header don't trip the guard).
+log "Publishing ${GATEWAY_YAML} as Secret Manager secret ${CONFIG_SECRET} (§6)"
+if [[ ! -f "${GATEWAY_YAML}" ]]; then
+  echo "    (skip) ${GATEWAY_YAML} not found — run 'cp gateway.yaml.example gateway.yaml', fill it in, then re-run (§6)."
+elif grep -vE '^[[:space:]]*#' "${GATEWAY_YAML}" | grep -q 'REPLACE_ME'; then
+  echo "    (skip) ${GATEWAY_YAML} still has REPLACE_ME placeholders to fill:"
+  grep -nE 'REPLACE_ME' "${GATEWAY_YAML}" | grep -vE '^[0-9]+:[[:space:]]*#' | sed 's/^/        /'
+  echo "        Fill them in, then re-run to publish ${CONFIG_SECRET}."
+else
+  if gcloud secrets describe "${CONFIG_SECRET}" --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    gcloud secrets versions add "${CONFIG_SECRET}" \
+      --data-file="${GATEWAY_YAML}" --project="${PROJECT_ID}"
+  else
+    gcloud secrets create "${CONFIG_SECRET}" --replication-policy=automatic \
+      --data-file="${GATEWAY_YAML}" --project="${PROJECT_ID}"
+  fi
+  gcloud secrets add-iam-policy-binding "${CONFIG_SECRET}" \
+    --member="serviceAccount:${SA_EMAIL}" \
+    --role="roles/secretmanager.secretAccessor" \
+    --condition=None --project="${PROJECT_ID}" >/dev/null
+fi
+
+# ---- 7 Cloud Run deploy (Direct VPC egress) -------------------------------
+# Direct VPC egress (--network/--subnet/--vpc-egress) puts the service on the
+# VPC so it reaches the Cloud SQL PRIVATE IP directly — matching the private-IP
+# connection string in the postgres-url secret. private-ranges-only keeps public
+# egress (Agent Platform, accounts.google.com) off the VPC, so no Cloud NAT is needed.
+# We deliberately do NOT use --add-cloudsql-instances (that's the Auth Proxy /
+# socket path, which would need a different connection string).
+#
+# Secrets: gateway.yaml is mounted as a FILE at /etc/claude (alone in its dir).
+# The JWT / OIDC / Postgres secrets are injected as ENV VARS — Cloud Run cannot
+# mount multiple secrets into one directory, and gateway.yaml references them via
+# ${ENV_VAR}. (See the env-var names in gateway.yaml: GATEWAY_JWT_SECRET etc.)
+#
+# Self-gating: deploy only once its inputs exist (config secret published + the
+# operator-provided OIDC client secret). On a first run these are missing and it
+# cleanly skips.
+RUN_URL=""
+missing=""
+gcloud secrets describe "${CONFIG_SECRET}" --project="${PROJECT_ID}" >/dev/null 2>&1 || missing="${missing} ${CONFIG_SECRET}"
+gcloud secrets describe "${OIDC_SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1 || missing="${missing} ${OIDC_SECRET_NAME}"
+# Also gate on the postgres-url secret (referenced by --set-secrets below): if it
+# is somehow absent, skip with a clear message rather than failing the deploy with
+# a raw Cloud Run missing-secret error.
+gcloud secrets describe "${SECRET_NAME}" --project="${PROJECT_ID}" >/dev/null 2>&1 || missing="${missing} ${SECRET_NAME}"
+
+if [[ "${DEPLOY}" != "1" ]]; then
+  log "Skipping Cloud Run deploy (DEPLOY=${DEPLOY}) (§7)"
+elif [[ -n "${missing// }" ]]; then
+  log "Skipping Cloud Run deploy — missing secret(s):${missing} (§7)"
+  echo "        Fill ${GATEWAY_YAML} and re-run to publish ${CONFIG_SECRET}; create ${OIDC_SECRET_NAME}"
+  echo "        from the Google OAuth client. Then re-run to deploy."
+else
+  SECRET_MOUNTS="/etc/claude/gateway.yaml=${CONFIG_SECRET}:latest"          # file mount (alone in /etc/claude)
+  SECRET_MOUNTS="${SECRET_MOUNTS},GATEWAY_JWT_SECRET=${JWT_SECRET_NAME}:latest"        # env var
+  SECRET_MOUNTS="${SECRET_MOUNTS},OIDC_CLIENT_SECRET=${OIDC_SECRET_NAME}:latest"       # env var
+  SECRET_MOUNTS="${SECRET_MOUNTS},GATEWAY_POSTGRES_URL=${SECRET_NAME}:latest"          # env var
+
+  log "Deploying Cloud Run service ${SERVICE_NAME} (§7b, Direct VPC egress)"
+  # Deploy private (--no-allow-unauthenticated avoids the interactive prompt and
+  # keeps allUsers OUT of the deploy, so a Domain-Restricted-Sharing org doesn't
+  # fail the deploy on the IAM step). Public access is attempted separately below.
+  #
+  # --ingress is passed EXPLICITLY because it is sticky across redeploys (omitting
+  # it keeps the previous value). The default, internal, keeps the *.run.app URL
+  # off the public internet — reachable only from this VPC, or from corp networks
+  # with the PSC endpoint + private run.app DNS plumbing (see terraform/README.md
+  # "Private access"). Public ingress cannot serve clients (see the INGRESS
+  # guard at the top of this script), so the two-pass OAuth bootstrap has to be
+  # completed from inside the VPC (or a PSC-connected corp network). Use
+  # internal-and-cloud-load-balancing instead if you front the service with
+  # your own internal ALB.
+  #
+  # --timeout=3600 raises Cloud Run's default 300s request timeout, which would
+  # otherwise cut off long streaming /v1/messages responses mid-stream.
+  #
+  # --max-instances bounds the Postgres connection footprint: each instance
+  # opens a pool of up to 5 connections (store.max_connections default) and
+  # db-g1-small caps at ~50 max_connections, so the default ceiling of 100
+  # instances would crash-loop new instances under load. Keep
+  # max-instances × 5 below the DB tier's max_connections; raise the DB tier
+  # (or set store.max_connections lower) before raising this.
+  gcloud run deploy "${SERVICE_NAME}" \
+    --image="${IMAGE}" \
+    --region="${REGION}" \
+    --service-account="${SA_EMAIL}" \
+    --min-instances=1 \
+    --max-instances="${MAX_INSTANCES}" \
+    --port=8080 \
+    --timeout=3600 \
+    --ingress="${INGRESS}" \
+    --network="${VPC_NETWORK}" \
+    --subnet="${SUBNET}" \
+    --vpc-egress=private-ranges-only \
+    --set-secrets="${SECRET_MOUNTS}" \
+    --no-allow-unauthenticated \
+    --project="${PROJECT_ID}"
+
+  # The gateway runs its OWN OIDC, so the Cloud Run IAM layer must allow
+  # unauthenticated. Attempt it separately and tolerate failure: Domain Restricted
+  # Sharing (iam.allowedPolicyMemberDomains) blocks allUsers in hardened orgs.
+  log "Granting public invoker (allUsers) — required for the gateway's OIDC login"
+  if gcloud run services add-iam-policy-binding "${SERVICE_NAME}" \
+       --region="${REGION}" --member=allUsers --role=roles/run.invoker \
+       --project="${PROJECT_ID}" >/dev/null 2>&1; then
+    echo "        public invoker granted."
+  else
+    echo "        WARN: allUsers rejected (likely Domain Restricted Sharing). The service is"
+    echo "              deployed but the invoker IAM check is still enabled, so requests 403"
+    echo "              before reaching the container. Preferred fix (where available):"
+    echo "                gcloud run services update ${SERVICE_NAME} --no-invoker-iam-check \\"
+    echo "                  --region=${REGION} --project=${PROJECT_ID}"
+    echo "              Alternatively: request a DRS exception for ${SERVICE_NAME}, or use the GKE"
+    echo "              track, which exposes the gateway at the network layer with no allUsers"
+    echo "              binding. An LB is NOT a fix — it does not bypass the invoker IAM check."
+  fi
+
+  RUN_URL="$(gcloud run services describe "${SERVICE_NAME}" --region="${REGION}" \
+    --project="${PROJECT_ID}" --format='value(status.url)')"
+  log "Cloud Run URL: ${RUN_URL}"
+
+  # public_url is now required (config validation refuses a non-loopback bind
+  # without it), so the template ships a placeholder for the first pass. Once we
+  # know the real URL, warn on any mismatch so the operator doesn't leave the
+  # placeholder — or a stale hostname — in place. Normalize quotes / inline
+  # comments / a trailing slash so schema-equivalent spellings compare equal.
+  # Only checked with internal ingress, where public_url should be the run.app
+  # URL; behind an internal ALB it is the ALB hostname, which this script
+  # cannot know.
+  CFG_PUBLIC_URL="$(grep -E '^[[:space:]]*public_url:' "${GATEWAY_YAML}" 2>/dev/null \
+    | head -1 \
+    | sed -E 's/^[[:space:]]*public_url:[[:space:]]*//; s/[[:space:]]+#.*$//; s/[[:space:]]*$//' \
+    || true)"
+  CFG_PUBLIC_URL="${CFG_PUBLIC_URL#[\'\"]}"; CFG_PUBLIC_URL="${CFG_PUBLIC_URL%[\'\"]}"
+  CFG_PUBLIC_URL="${CFG_PUBLIC_URL%/}"
+  if [[ "${INGRESS}" == "internal" && -n "${RUN_URL}" && "${CFG_PUBLIC_URL}" != "${RUN_URL%/}" ]]; then
+    echo "        NOTE — ${GATEWAY_YAML} has public_url: ${CFG_PUBLIC_URL:-<unset>}"
+    echo "               but this service's URL is ${RUN_URL}."
+    echo "               Set listen.public_url to ${RUN_URL} (or your LB hostname) and re-run."
+  fi
+
+  if [[ -n "${RUN_URL}" ]]; then
+    # gcloud run deploy already fails the script if the revision can't boot (it
+    # waits for the Ready condition), so what's left to verify is that the
+    # gateway is serving. The OAuth discovery document below returns 200 only
+    # after config load, OIDC discovery, upstream construction, and Postgres
+    # migration all succeed, so it doubles as an end-to-end boot check (the
+    # readiness probe proper is GET /readyz). With internal ingress the URL is
+    # reachable only from inside the VPC (or a PSC-connected corp network), so
+    # verification is left to the operator rather than attempted from here.
+    log "Verify the gateway is serving (from inside the VPC, or a PSC-connected corp network):"
+    echo "          curl -s ${RUN_URL}/.well-known/oauth-authorization-server"
+    echo "        If it isn't responding yet, check logs:"
+    echo "          gcloud run services logs read ${SERVICE_NAME} --region=${REGION} --project=${PROJECT_ID}"
+
+    log "Finish the OAuth bootstrap:"
+    echo "        1. Register this redirect URI on the Google OAuth client: ${RUN_URL}/oauth/callback"
+    echo "        2. Set listen.public_url in ${GATEWAY_YAML} to ${RUN_URL}, then re-run: INGRESS=${INGRESS} ./setup.sh"
+    echo "           (republishes ${CONFIG_SECRET} and redeploys so the IdP redirect_uri matches)."
+    echo "           With INGRESS=internal-and-cloud-load-balancing, use your internal ALB hostname"
+    echo "           instead of the run.app URL in both steps."
+  fi
+fi
+
+# ---- summary ----------------------------------------------------------------
+cat <<EOF
+
+==> Done.
+
+  Service account       ${SA_EMAIL}
+                        roles: aiplatform.user, secretmanager.secretAccessor
+  Image                 ${IMAGE}
+  Instance              ${DB_INSTANCE}
+  Connection name       ${PROJECT_ID}:${REGION}:${DB_INSTANCE}
+  Private IP            ${PRIVATE_IP}
+  Database / user       ${DB_NAME} / ${DB_USER}
+  Secrets               ${SECRET_NAME}, ${JWT_SECRET_NAME}, ${CONFIG_SECRET}
+  Cloud Run service     ${SERVICE_NAME} -> ${RUN_URL:-(not deployed yet)}   (ingress: ${INGRESS})
+
+Next steps (see https://code.claude.com/docs/en/claude-apps-gateway-on-gcp):
+  - Create the one operator-provided secret (from the Google Cloud Console OAuth client):
+      printf '%s' "<client-secret>" | gcloud secrets create ${OIDC_SECRET_NAME} \\
+        --data-file=- --project="${PROJECT_ID}"
+    setup.sh grants ${SA_EMAIL} secretAccessor on it on the next re-run.
+  - Fill in the REPLACE_ME values in ${GATEWAY_YAML}, then re-run: setup.sh publishes
+    ${CONFIG_SECRET} and deploys ${SERVICE_NAME} once both secrets exist.
+  - After the first deploy: set listen.public_url to the Cloud Run URL above (or your
+    internal ALB hostname) and register <url>/oauth/callback on the Google OAuth client,
+    then re-run to redeploy.
+  - The gateway runs its own schema migrations at boot, so ${DB_USER} needs CREATE TABLE.
+EOF
@@ -0,0 +1,13 @@
+# Never commit state (contains secrets) or local var files
+*.tfstate
+*.tfstate.*
+.terraform/
+terraform.tfvars
+*.auto.tfvars
+crash.log
+
+# The lock file holds no secrets. It's ignored here so consumers who copy this
+# example into their own repo generate (and commit) their own platform-complete
+# lock at first init — committing one from this repo would carry only one
+# platform's provider hashes.
+.terraform.lock.hcl
@@ -0,0 +1,160 @@
+# Claude Gateway — Terraform (Cloud Run)
+
+Terraform equivalent of `../setup.sh`. Lets end-users provision and manage
+the gateway with `terraform apply`. Covers the same scope ([walkthrough](https://code.claude.com/docs/en/claude-apps-gateway-on-gcp) §1–7): APIs →
+service account + IAM → Artifact Registry repo → VPC + Private Services Access →
+private-IP Cloud SQL (PG16) → secrets → Cloud Run with Direct VPC egress.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `versions.tf` | Provider pins (google, random) |
+| `variables.tf` | All inputs (defaults match `setup.sh`'s) |
+| `main.tf` | Resources |
+| `outputs.tf` | Service URL, OAuth redirect URI, SA, DB info |
+| `terraform.tfvars.example` | Copy to `terraform.tfvars` and edit |
+
+## Prerequisites
+
+1. **`../gateway.yaml` created and filled in** — copy the template first:
+   `cp ../gateway.yaml.example ../gateway.yaml`, then replace every `REPLACE_ME`
+   (Terraform reads this file and enforces no `REPLACE_ME` via a precondition).
+   Leave `public_url` at its placeholder for the first apply; set it to the
+   `run.app` URL (the `service_url` output) or your LB hostname and re-apply.
+   `gateway.yaml` is gitignored; the committed template is `gateway.yaml.example`.
+2. A **remote backend** for shared use (see below). State holds secrets — never commit it.
+
+## Deploy
+
+Terraform creates the Artifact Registry repo but does **not** build/push the
+image, so the apply is two passes: a targeted apply to create the repo, then
+build/push, then the full apply.
+
+```bash
+cp terraform.tfvars.example terraform.tfvars   # edit it
+terraform init
+
+# 1. Create just the Artifact Registry repo (the -target warning is expected):
+terraform apply -target=google_artifact_registry_repository.repo
+
+# 2. Download the public Claude Code linux-x64 release binary (it includes the
+#    `gateway` subcommand; the Dockerfile picks it up at gcp/claude), verify its
+#    sha256 against the release manifest, then build and push the image:
+BASE="https://downloads.claude.ai/claude-code-releases"
+VERSION="$(curl -fsSL --proto '=https' "${BASE}/latest")"
+curl -fL --proto '=https' --proto-redir '=https' -o ../claude \
+  "${BASE}/${VERSION}/linux-x64/claude"
+WANT="$(curl -fsSL --proto '=https' "${BASE}/${VERSION}/manifest.json" \
+  | tr -d '[:space:]' | grep -oE '"linux-x64"[^}]*' | grep -oE '[a-f0-9]{64}' | head -1)"
+[ "$(openssl dgst -sha256 ../claude | awk '{print $NF}')" = "${WANT}" ] \
+  && echo "sha256 OK" || { echo "checksum mismatch" >&2; rm -f ../claude; }
+gcloud auth configure-docker us-east5-docker.pkg.dev --quiet
+docker build --platform=linux/amd64 --provenance=false \
+  -f ../Dockerfile -t "us-east5-docker.pkg.dev/<project>/claude-gateway/gateway:${VERSION}" ..
+docker push "us-east5-docker.pkg.dev/<project>/claude-gateway/gateway:${VERSION}"
+
+# 3. Full apply:
+terraform apply
+```
+
+(`../setup.sh` §3 automates the same download-and-verify.)
+
+Set in `terraform.tfvars`:
+
+- `project_id`, `region`
+- `image_tag` (after building/pushing — step 2 above)
+- **`oidc_client_secret`** — required (the Cloud Run service mounts `latest` of
+  this secret; with no version the deploy fails). Terraform creates the
+  secret + version from it.
+- `invoker_iam_disabled` / `allow_unauthenticated` — the gateway runs its own
+  OIDC, so the Cloud Run invoker IAM check must be opened or disabled.
+  **Preferred:** `invoker_iam_disabled = true` (no `allUsers` binding; works
+  under Domain Restricted Sharing). **Fallback:** `allow_unauthenticated = true`
+  grants `allUsers` `run.invoker` — fine on a normal org, but DRS orgs reject
+  `allUsers` (set it `false` there, since an LB does **not** bypass the IAM
+  check). If both paths are blocked by org policy, use the GKE track.
+- `ingress` — defaults to **internal-only** (no public URL). Claude Code's `/login`
+  only accepts gateway hosts on private addresses, so public ingress cannot serve
+  clients; the two-pass OAuth bootstrap must be completed from inside the VPC (or a
+  PSC-connected corp network). See "Private access" below.
+
+Tear down a trial with `terraform destroy`: set `deletion_protection = false`,
+run `terraform apply` to record that in state (the provider checks the value in
+**state**, not config, so destroy would still refuse otherwise), then `terraform
+destroy`. The destroy will stop at the VPC network
+because the Private Services Access peering is intentionally left in place
+(`deletion_policy = ABANDON` — see Guard rails below); finish by deleting the
+peering manually once the Cloud SQL instance is gone, then re-run destroy:
+
+```bash
+gcloud services vpc-peerings delete --service=servicenetworking.googleapis.com \
+  --network=cc-gateway-vpc --project=<project>
+terraform destroy
+```
+
+## Guard rails
+
+Tuned so accidental deletion is hard but greenfield teardown stays easy:
+
+- `deletion_protection = true` (variable, default true) on Cloud SQL and Cloud Run —
+  blocks accidental deletion; set `false` when you intend to `terraform destroy`.
+- `disable_on_destroy = false` on APIs — tearing down config never disables APIs.
+- `deletion_policy = ABANDON` on the PSA peering — never tears down the
+  service-networking peering automatically (it's shared by every private-IP
+  service on the VPC). On the dedicated VPC this module creates, that means
+  `terraform destroy` stops at the network step; delete the peering manually
+  per the teardown note above.
+- IAM uses non-authoritative `_member` resources, so other project/secret bindings
+  are never clobbered.
+
+## Private access (internal ingress) — the default
+
+By default the service has **no public URL** (`ingress = "INGRESS_TRAFFIC_INTERNAL_ONLY"`),
+and there is no public-ingress option: Claude Code's `/login` rejects gateway hosts that
+resolve to public addresses, so public exposure cannot serve clients. Reach the service
+from inside the VPC, or via the private-access plumbing below.
+
+With internal-only ingress, `public_url` stays the `run.app` URL (Google-managed cert) —
+**no load balancer or your own certificate required**. But internal ingress alone does
+**not** let corporate on-prem clients reach `run.app`; that needs **operator /
+network-team-owned** plumbing that Cloud Run does **not** create for you (validate it's in
+place before relying on internal ingress):
+
+1. A **Private Service Connect endpoint** for Google APIs (an internal VIP in the VPC).
+2. A **Cloud DNS private zone for `run.app`** resolving `*.run.app` to that endpoint IP.
+3. **On-prem routing** to the endpoint over Cloud VPN / Interconnect.
+
+This is normally managed centrally in the network/hub project, so the module does not
+provision it. See [Private networking and Cloud Run](https://cloud.google.com/run/docs/securing/private-networking).
+For a greenfield trial without this plumbing, complete the OAuth bootstrap from inside
+the VPC — e.g. a browser proxied through an in-VPC VM (SSH SOCKS tunnel over IAP).
+
+For a **custom internal hostname or your own TLS cert**, use
+`INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER` and front the service with your own internal
+Application Load Balancer (also not provisioned by this module).
+
+## Remote state (recommended for teams)
+
+Add a backend so state is shared and locked (and out of git):
+
+```hcl
+# backend.tf
+terraform {
+  backend "gcs" {
+    bucket = "<your-tf-state-bucket>"
+    prefix = "claude-gateway/cloudrun"
+  }
+}
+```
+
+## After deploy
+
+- `terraform output service_url` / `oauth_redirect_uri`.
+- Register the redirect URI on the Google OAuth client and make sure
+  `../gateway.yaml` `public_url` matches the host.
+- Notes: Terraform does not build the image. To ship a new gateway version,
+  rerun the docker build/push under a new tag and bump `image_tag` — a bare
+  re-apply under an unchanged tag does **not** roll a new revision (Cloud Run
+  resolves the tag to a digest only at revision creation, and an unchanged
+  `image` attribute means no new revision).
@@ -0,0 +1,399 @@
+# Claude Gateway on Cloud Run — Terraform equivalent of setup.sh.
+# Section markers (§N) map to setup.sh and the walkthrough:
+# https://code.claude.com/docs/en/claude-apps-gateway-on-gcp
+
+locals {
+  config_path    = var.gateway_config_path != "" ? var.gateway_config_path : "${path.module}/../gateway.yaml"
+  gateway_config = file(local.config_path)
+  image          = "${var.region}-docker.pkg.dev/${var.project_id}/${var.ar_repo}/${var.image_name}:${var.image_tag}"
+
+  apis = [
+    "aiplatform.googleapis.com",
+    "artifactregistry.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "sqladmin.googleapis.com",
+    "secretmanager.googleapis.com",
+    "iamcredentials.googleapis.com",
+    "iam.googleapis.com",
+    "compute.googleapis.com",
+    "servicenetworking.googleapis.com",
+    "run.googleapis.com",
+  ]
+}
+
+# ── 1 Project & API setup ───────────────────────────────────────────────────
+resource "google_project_service" "apis" {
+  for_each = toset(local.apis)
+  project  = var.project_id
+  service  = each.value
+  # Don't disable APIs (or delete anything) when this config is torn down.
+  disable_on_destroy         = false
+  disable_dependent_services = false
+}
+
+# ── 2 Service account & IAM (least-privilege) ───────────────────────────────
+resource "google_service_account" "gateway" {
+  project      = var.project_id
+  account_id   = var.sa_name
+  display_name = "Claude Gateway"
+  depends_on   = [google_project_service.apis]
+}
+
+# Non-authoritative (_member) so we never clobber other project bindings.
+#
+# Only aiplatform.user is granted: the gateway reaches Cloud SQL over the VPC at
+# its private IP with a password user (direct TCP via Direct VPC egress — see §7
+# below), not via the Cloud SQL Auth Proxy / connector, so it never calls
+# cloudsql.instances.connect and no roles/cloudsql.client grant is needed.
+# Direct private-IP keeps the gateway's store a plain postgres_url with no proxy
+# sidecar/socket plumbing, and the connection string is portable across Cloud
+# Run and GKE.
+resource "google_project_iam_member" "vertex" {
+  project = var.project_id
+  role    = "roles/aiplatform.user" # Agent Platform inference
+  member  = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+# ── 3 Artifact Registry repo ────────────────────────────────────────────────
+# NOTE: image build/push is a separate step (see README) — Terraform only makes the repo.
+resource "google_artifact_registry_repository" "repo" {
+  project       = var.project_id
+  location      = var.region
+  repository_id = var.ar_repo
+  format        = "DOCKER"
+  description   = "Claude Gateway container images"
+  depends_on    = [google_project_service.apis]
+}
+
+# ── 4 VPC + Private Services Access ──────────────────────────────────────────
+resource "google_compute_network" "vpc" {
+  project                 = var.project_id
+  name                    = var.vpc_network
+  auto_create_subnetworks = false
+  depends_on              = [google_project_service.apis]
+}
+
+resource "google_compute_subnetwork" "subnet" {
+  project       = var.project_id
+  name          = var.subnet
+  region        = var.region
+  network       = google_compute_network.vpc.id
+  ip_cidr_range = var.subnet_range
+}
+
+resource "google_compute_global_address" "psa_range" {
+  project       = var.project_id
+  name          = "google-managed-services-${var.vpc_network}"
+  purpose       = "VPC_PEERING"
+  address_type  = "INTERNAL"
+  prefix_length = var.psa_prefix_length
+  network       = google_compute_network.vpc.id
+}
+
+resource "google_service_networking_connection" "psa" {
+  network                 = google_compute_network.vpc.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.psa_range.name]
+  # ABANDON: on destroy, leave the producer peering in place (deleting it can hang
+  # and would affect any other private-IP service on this VPC).
+  deletion_policy = "ABANDON"
+  # If the peering already exists (e.g. a previous apply failed partway), patch it
+  # instead of failing the create.
+  update_on_creation_fail = true
+  depends_on              = [google_project_service.apis]
+}
+
+# ── 4 Cloud SQL (private IP only) ───────────────────────────────────────────
+resource "google_sql_database_instance" "db" {
+  project             = var.project_id
+  name                = var.db_instance
+  region              = var.region
+  database_version    = var.db_version
+  deletion_protection = var.deletion_protection
+  depends_on          = [google_service_networking_connection.psa]
+
+  settings {
+    tier = var.db_tier
+    ip_configuration {
+      ipv4_enabled    = false # private IP only (org policy: sql.restrictPublicIp)
+      private_network = google_compute_network.vpc.id
+      ssl_mode        = "ENCRYPTED_ONLY"
+    }
+  }
+}
+
+resource "google_sql_database" "db" {
+  project  = var.project_id
+  name     = var.db_name
+  instance = google_sql_database_instance.db.name
+}
+
+# URL-safe (alphanumeric) so it drops cleanly into the connection string.
+# nosemgrep: terraform-generic-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "random_password" "db" {
+  length  = 32
+  special = false
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_sql_user" "gateway" {
+  project  = var.project_id
+  name     = var.db_user
+  instance = google_sql_database_instance.db.name
+  password = random_password.db.result
+  # On destroy the role owns the tables it migrated at boot, so DROP ROLE can
+  # fail (and races google_sql_database.db). ABANDON is harmless on the
+  # greenfield teardown — the whole instance is deleted anyway.
+  deletion_policy = "ABANDON"
+}
+
+# ── 5/6 Secrets + secretAccessor ────────────────────────────────────────────
+# postgres-url: connection string built from the instance's private IP.
+resource "google_secret_manager_secret" "postgres_url" {
+  project   = var.project_id
+  secret_id = var.secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "postgres_url" {
+  secret      = google_secret_manager_secret.postgres_url.id
+  secret_data = "postgres://${var.db_user}:${random_password.db.result}@${google_sql_database_instance.db.private_ip_address}:5432/${var.db_name}?sslmode=require"
+}
+
+# jwt: session signing key.
+# nosemgrep: terraform-generic-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "random_password" "jwt" {
+  length  = 48
+  special = false
+}
+
+resource "google_secret_manager_secret" "jwt" {
+  project   = var.project_id
+  secret_id = var.jwt_secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "jwt" {
+  secret      = google_secret_manager_secret.jwt.id
+  secret_data = random_password.jwt.result
+}
+
+# oidc client secret: operator-provided (from the Google OAuth client).
+resource "google_secret_manager_secret" "oidc" {
+  project   = var.project_id
+  secret_id = var.oidc_secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "oidc" {
+  count       = var.oidc_client_secret != "" ? 1 : 0
+  secret      = google_secret_manager_secret.oidc.id
+  secret_data = var.oidc_client_secret
+}
+
+# Warn (not block) at plan time when the OIDC secret value isn't set: the Cloud
+# Run service mounts gateway-oidc-client-secret:latest unconditionally, so an
+# empty value with no out-of-band version means the apply fails late at
+# revision creation. A warning (not a precondition) keeps the documented
+# out-of-band-version mode usable.
+check "oidc_client_secret_set" {
+  assert {
+    condition     = var.oidc_client_secret != ""
+    error_message = "oidc_client_secret is empty — set it in terraform.tfvars, or add a version to the gateway-oidc-client-secret secret out-of-band before applying (the Cloud Run revision mounts it at :latest and will fail without one)."
+  }
+}
+
+# config: gateway.yaml. Guard mirrors the bash REPLACE_ME check (non-comment lines).
+resource "google_secret_manager_secret" "config" {
+  project   = var.project_id
+  secret_id = var.config_secret_name
+  replication {
+    auto {}
+  }
+  depends_on = [google_project_service.apis]
+}
+
+# nosemgrep: terraform-gcp-secrets-in-state -- secrets in tfstate are inherent to TF; mitigated by the documented remote GCS backend (see README "Remote state")
+resource "google_secret_manager_secret_version" "config" {
+  secret      = google_secret_manager_secret.config.id
+  secret_data = local.gateway_config
+
+  lifecycle {
+    precondition {
+      condition = length([
+        for line in split("\n", local.gateway_config) :
+        line
+        if !startswith(trimspace(line), "#") && strcontains(line, "REPLACE_ME")
+      ]) == 0
+      error_message = "gateway.yaml still has REPLACE_ME on a non-comment line — fill it in before applying."
+    }
+  }
+}
+
+resource "google_secret_manager_secret_iam_member" "postgres_url" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.postgres_url.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "jwt" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.jwt.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "oidc" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.oidc.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+resource "google_secret_manager_secret_iam_member" "config" {
+  project   = var.project_id
+  secret_id = google_secret_manager_secret.config.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.gateway.email}"
+}
+
+# ── 7 Cloud Run (Direct VPC egress) ─────────────────────────────────────────
+resource "google_cloud_run_v2_service" "gateway" {
+  project              = var.project_id
+  name                 = var.service_name
+  location             = var.region
+  ingress              = var.ingress
+  invoker_iam_disabled = var.invoker_iam_disabled
+  deletion_protection  = var.deletion_protection
+
+  template {
+    service_account = google_service_account.gateway.email
+    scaling {
+      min_instance_count = var.min_instances
+      max_instance_count = var.max_instances
+    }
+    # Secrets are mounted at version=latest, so a config edit or secret
+    # rotation alone wouldn't diff this resource and the warm min_instances=1
+    # revision would keep the old values. Stamping a hash of the rendered
+    # config + every managed secret value forces a new revision whenever any
+    # of them change — without this, tainting random_password.db ALTERs the
+    # SQL role to the new password while the running revision keeps the old
+    # connection string and breaks on its next reconnect, and rotating the
+    # OIDC client secret leaves login failing invalid_client.
+    labels = {
+      config-sha = substr(sha256(join("", [
+        local.gateway_config,
+        random_password.db.result,
+        random_password.jwt.result,
+        var.oidc_client_secret,
+      ])), 0, 63)
+    }
+    # Cloud Run's default 300s request timeout would cut off long streaming
+    # /v1/messages responses mid-stream.
+    timeout = "3600s"
+
+    vpc_access {
+      network_interfaces {
+        network    = google_compute_network.vpc.id
+        subnetwork = google_compute_subnetwork.subnet.id
+      }
+      egress = "PRIVATE_RANGES_ONLY" # public egress (Agent Platform, accounts.google.com) bypasses the VPC -> no Cloud NAT needed
+    }
+
+    containers {
+      image = local.image
+      ports { container_port = 8080 }
+
+      # gateway.yaml mounted as a file at /etc/claude/gateway.yaml (alone in its dir).
+      volume_mounts {
+        name       = "config"
+        mount_path = "/etc/claude"
+      }
+
+      # Cloud Run can't mount multiple secrets in one dir, so the rest are env vars
+      # (gateway.yaml references them via ${ENV_VAR}).
+      env {
+        name = "GATEWAY_JWT_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.jwt.secret_id
+            version = "latest"
+          }
+        }
+      }
+      env {
+        name = "OIDC_CLIENT_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.oidc.secret_id
+            version = "latest"
+          }
+        }
+      }
+      env {
+        name = "GATEWAY_POSTGRES_URL"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.postgres_url.secret_id
+            version = "latest"
+          }
+        }
+      }
+    }
+
+    volumes {
+      name = "config"
+      secret {
+        secret = google_secret_manager_secret.config.secret_id
+        items {
+          path    = "gateway.yaml"
+          version = "latest"
+        }
+      }
+    }
+  }
+
+  depends_on = [
+    google_secret_manager_secret_iam_member.config,
+    google_secret_manager_secret_iam_member.jwt,
+    google_secret_manager_secret_iam_member.oidc,
+    google_secret_manager_secret_iam_member.postgres_url,
+    google_secret_manager_secret_version.config,
+    google_secret_manager_secret_version.postgres_url,
+    google_secret_manager_secret_version.jwt,
+    google_secret_manager_secret_version.oidc,
+    google_sql_database.db,
+    google_sql_user.gateway,
+    google_project_service.apis,
+  ]
+}
+
+# Public access at the Cloud Run IAM layer — the gateway runs its own OIDC, so the
+# invoker check must be opened or disabled (real auth stays the gateway's SSO):
+#   Preferred — disable it: invoker_iam_disabled=true on the service above. No allUsers
+#     binding at all, and it works under Domain Restricted Sharing.
+#   Fallback  — open it: this allUsers run.invoker grant. Domain Restricted Sharing orgs
+#     reject allUsers, and an LB does NOT bypass that (ingress is network-layer; the IAM
+#     check still runs) — use invoker_iam_disabled, a DRS exception, or GKE.
+# Skipped when invoker_iam_disabled=true (the grant would be redundant, and DRS rejects it).
+resource "google_cloud_run_v2_service_iam_member" "public" {
+  count    = var.allow_unauthenticated && !var.invoker_iam_disabled ? 1 : 0
+  project  = var.project_id
+  location = var.region
+  name     = google_cloud_run_v2_service.gateway.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
@@ -0,0 +1,34 @@
+output "service_url" {
+  description = "Cloud Run service URL."
+  value       = google_cloud_run_v2_service.gateway.uri
+}
+
+output "oauth_redirect_uri" {
+  description = "Register this exact URI on the Google OAuth client, and ensure gateway.yaml public_url matches the host."
+  value       = "${google_cloud_run_v2_service.gateway.uri}/oauth/callback"
+}
+
+output "service_account_email" {
+  description = "Gateway runtime service account."
+  value       = google_service_account.gateway.email
+}
+
+output "image" {
+  description = "Image the service runs (build/push this separately — see README)."
+  value       = local.image
+}
+
+output "db_connection_name" {
+  description = "Cloud SQL instance connection name (project:region:instance)."
+  value       = google_sql_database_instance.db.connection_name
+}
+
+output "db_private_ip" {
+  description = "Cloud SQL private IP."
+  value       = google_sql_database_instance.db.private_ip_address
+}
+
+output "public_invoker_granted" {
+  description = "Whether the allUsers run.invoker binding was applied (false when invoker_iam_disabled handles public access instead, or on Domain-Restricted-Sharing orgs)."
+  value       = length(google_cloud_run_v2_service_iam_member.public) > 0
+}
@@ -0,0 +1,26 @@
+# Copy to terraform.tfvars and edit. terraform.tfvars is gitignored (see .gitignore).
+
+project_id = "your-gcp-project-id"
+region     = "us-east5"
+
+image_tag = "<version>" # REQUIRED — the Claude Code release version you build and push as linux/amd64 (see README Deploy)
+
+# Public access at the Cloud Run IAM layer (the gateway runs its own OIDC):
+#   Preferred — disable the invoker check: no allUsers binding, works under Domain
+#   Restricted Sharing. Needs google provider >= 6.8 and the feature enabled for your org:
+# invoker_iam_disabled = true
+#   Fallback — grant allUsers (fine on a normal org; Domain Restricted Sharing rejects it,
+#   so there prefer invoker_iam_disabled, or use a DRS exception / GKE):
+allow_unauthenticated = true
+
+# Network reachability — a separate axis from the IAM choice above. Default is internal-only:
+# no public URL (Claude Code's /login only accepts gateway hosts on private addresses, so
+# public ingress cannot serve clients); corp on-prem reaches run.app via a PSC endpoint +
+# private run.app DNS — see README "Private access" for the prerequisites. The only
+# alternative to the internal-only default:
+# ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"   # only if you front it with your OWN internal ALB (custom hostname/cert; not provisioned here)
+
+# Google OAuth client secret: REQUIRED — uncomment and set it (Terraform creates the
+# secret version; the Cloud Run service mounts `latest`, so without a version the
+# deploy fails). Leave empty only if you add the secret version out-of-band.
+# oidc_client_secret = "GOCSPX-..."
@@ -0,0 +1,184 @@
+# Inputs — mirror the env-overridable knobs in setup.sh (same defaults).
+
+variable "project_id" {
+  description = "GCP project ID."
+  type        = string
+}
+
+variable "region" {
+  description = "Infra region for Artifact Registry, Cloud SQL, subnet, and Cloud Run. (Agent Platform region is set separately inside gateway.yaml.)"
+  type        = string
+  default     = "us-east5"
+}
+
+# ── Service account (§2) ────────────────────────────────────────────────────
+variable "sa_name" {
+  description = "Service account account_id (the part before @)."
+  type        = string
+  default     = "claude-gateway"
+}
+
+# ── Image (§3) ──────────────────────────────────────────────────────────────
+# Terraform creates the Artifact Registry repo but does NOT build/push the image
+# (that's a docker build step — see README). It references the image by tag.
+variable "ar_repo" {
+  description = "Artifact Registry Docker repository ID."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "image_name" {
+  description = "Image name within the repo."
+  type        = string
+  default     = "gateway"
+}
+
+variable "image_tag" {
+  description = "Image tag — the Claude Code release version you build and push (must already be pushed as linux/amd64). See the README Deploy section for the build command."
+  type        = string
+  validation {
+    condition     = can(regex("^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$", var.image_tag))
+    error_message = "image_tag must be a valid OCI tag — set it to the Claude Code release version you pushed (the '<version>' in terraform.tfvars.example is a placeholder)."
+  }
+}
+
+# ── Networking (§4) ─────────────────────────────────────────────────────────
+variable "vpc_network" {
+  description = "Custom VPC network name."
+  type        = string
+  default     = "cc-gateway-vpc"
+}
+
+variable "subnet" {
+  description = "Subnet name (Cloud Run Direct VPC egress attaches here)."
+  type        = string
+  default     = "cc-gateway-subnet"
+}
+
+variable "subnet_range" {
+  description = "Subnet primary CIDR."
+  type        = string
+  default     = "10.0.0.0/24"
+}
+
+variable "psa_prefix_length" {
+  description = "Prefix length for the Private Services Access allocated range (/16 is GCP's recommendation)."
+  type        = number
+  default     = 16
+}
+
+# ── Cloud SQL (§4) ──────────────────────────────────────────────────────────
+variable "db_instance" {
+  description = "Cloud SQL instance name."
+  type        = string
+  default     = "claude-gateway-db"
+}
+
+variable "db_version" {
+  description = "Postgres major version. The gateway supports PostgreSQL 14 or newer; 16 is the recommended default."
+  type        = string
+  default     = "POSTGRES_16"
+}
+
+variable "db_tier" {
+  description = "Cloud SQL machine tier."
+  type        = string
+  default     = "db-g1-small"
+}
+
+variable "db_name" {
+  description = "Database name."
+  type        = string
+  default     = "claude_gateway"
+}
+
+variable "db_user" {
+  description = "Database user (the gateway connects as this role)."
+  type        = string
+  default     = "gateway"
+}
+
+# ── Secrets (§5 / §6) ─────────────────────────────────────────────────────
+variable "secret_name" {
+  description = "Secret Manager secret holding the Postgres connection string."
+  type        = string
+  default     = "gateway-postgres-url"
+}
+
+variable "jwt_secret_name" {
+  description = "Secret Manager secret holding the session JWT signing key."
+  type        = string
+  default     = "gateway-jwt-secret"
+}
+
+variable "oidc_secret_name" {
+  description = "Secret Manager secret holding the Google OAuth client secret."
+  type        = string
+  default     = "gateway-oidc-client-secret"
+}
+
+variable "config_secret_name" {
+  description = "Secret Manager secret holding gateway.yaml (mounted at /etc/claude/gateway.yaml)."
+  type        = string
+  default     = "gateway-config"
+}
+
+variable "oidc_client_secret" {
+  description = "Google OAuth client secret value. Leave empty to NOT manage the version via Terraform (only if you add the secret version out-of-band — without one the deploy fails)."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "gateway_config_path" {
+  description = "Path to gateway.yaml. Empty = ../gateway.yaml relative to this module."
+  type        = string
+  default     = ""
+}
+
+# ── Cloud Run (§7) ──────────────────────────────────────────────────────────
+variable "service_name" {
+  description = "Cloud Run service name."
+  type        = string
+  default     = "claude-gateway"
+}
+
+variable "min_instances" {
+  description = "Minimum Cloud Run instances (1 avoids cold OIDC discovery)."
+  type        = number
+  default     = 1
+}
+
+variable "max_instances" {
+  description = "Maximum Cloud Run instances. Each instance opens a Postgres pool of up to 5 connections (the gateway's store.max_connections default) and db-g1-small caps at ~50 max_connections — keep max_instances × 5 below the DB tier's limit, or raise the tier before raising this."
+  type        = number
+  default     = 8
+}
+
+variable "ingress" {
+  description = "Cloud Run ingress — Claude Code's /login only accepts gateway hosts on private addresses, so public ingress cannot serve clients: INGRESS_TRAFFIC_INTERNAL_ONLY (default; no public URL — VPC-only; reaches corp on-prem only with the private-access prerequisites in the README; public_url stays the run.app URL, so no LB or custom cert needed) or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER (front with your own internal ALB for a custom hostname/cert)."
+  type        = string
+  default     = "INGRESS_TRAFFIC_INTERNAL_ONLY"
+  validation {
+    condition     = contains(["INGRESS_TRAFFIC_INTERNAL_ONLY", "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"], var.ingress)
+    error_message = "ingress must be INGRESS_TRAFFIC_INTERNAL_ONLY or INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER — Claude Code only connects to gateways on private addresses."
+  }
+}
+
+variable "invoker_iam_disabled" {
+  description = "PREFERRED public-access path: disable the Cloud Run invoker IAM check so requests reach the container with no allUsers binding (works under Domain Restricted Sharing). Real auth stays the gateway's own OIDC. When true, the allUsers grant below is skipped. May be blocked by org policy constraints/run.managed.requireInvokerIam, or unavailable for the org (\"invoker_iam_disabled is not currently available for your organization\") — then fall back to allow_unauthenticated. Requires google provider >= 6.8."
+  type        = bool
+  default     = false
+}
+
+variable "allow_unauthenticated" {
+  description = "Fallback public-access path: grant allUsers run.invoker (the gateway needs the IAM layer open for its own OIDC). Prefer invoker_iam_disabled. Domain Restricted Sharing orgs reject allUsers — set false there and use invoker_iam_disabled, a DRS exception, or GKE."
+  type        = bool
+  default     = true
+}
+
+variable "deletion_protection" {
+  description = "Provider-level deletion protection on Cloud SQL and Cloud Run. Keep true to avoid accidental deletion of the running deployment."
+  type        = bool
+  default     = true
+}
@@ -0,0 +1,19 @@
+# Provider + version pins for the Claude Gateway Cloud Run deployment.
+terraform {
+  required_version = ">= 1.5"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 6.8, < 7.0" # 6.8 adds invoker_iam_disabled on google_cloud_run_v2_service
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.5"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
@@ -0,0 +1,28 @@
+# MDM Deployment Examples
+
+Example templates for deploying Claude Code [managed settings](https://code.claude.com/docs/en/settings#settings-files) through Jamf, Iru (Kandji), Intune, or Group Policy. Use these as starting points — adjust them to fit your needs.
+
+All templates encode the same minimal example (`permissions.disableBypassPermissionsMode`). See the [settings reference](https://code.claude.com/docs/en/settings#available-settings) for the full list of keys, and [`../settings`](../settings) for more complete example configurations.
+
+
+## Templates
+
+> [!WARNING]
+> These examples are community-maintained templates which may be unsupported or incorrect. You are responsible for the correctness of your own deployment configuration.
+
+| File | Use with |
+| :--- | :--- |
+| [`managed-settings.json`](./managed-settings.json) | Any platform. Deploy to the [system config directory](https://code.claude.com/docs/en/settings#settings-files). |
+| [`macos/com.anthropic.claudecode.plist`](./macos/com.anthropic.claudecode.plist) | Jamf or Iru (Kandji) **Custom Settings** payload. Preference domain: `com.anthropic.claudecode`. |
+| [`macos/com.anthropic.claudecode.mobileconfig`](./macos/com.anthropic.claudecode.mobileconfig) | Full configuration profile for local testing or MDMs that take a complete profile. |
+| [`windows/Set-ClaudeCodePolicy.ps1`](./windows/Set-ClaudeCodePolicy.ps1) | Intune **Platform scripts**. Writes `managed-settings.json` to `C:\Program Files\ClaudeCode\`. |
+| [`windows/ClaudeCode.admx`](./windows/ClaudeCode.admx) + [`en-US/ClaudeCode.adml`](./windows/en-US/ClaudeCode.adml) | Group Policy or Intune **Import ADMX**. Writes `HKLM\SOFTWARE\Policies\ClaudeCode\Settings` (REG_SZ, single-line JSON). |
+
+## Tips
+- Replace the placeholder `PayloadUUID` and `PayloadOrganization` values in the `.mobileconfig` with your own (`uuidgen`)
+- Before deploying to your fleet, test on a single machine and confirm `/status` lists the source under **Setting sources** — e.g. `Enterprise managed settings (plist)` on macOS or `Enterprise managed settings (HKLM)` on Windows
+- Settings deployed this way sit at the top of the precedence order and cannot be overridden by users
+
+## Full Documentation
+
+See https://code.claude.com/docs/en/settings#settings-files for complete documentation on managed settings and settings precedence.
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>PayloadDisplayName</key>
+	<string>Claude Code Managed Settings</string>
+	<key>PayloadDescription</key>
+	<string>Configures managed settings for Claude Code.</string>
+	<key>PayloadIdentifier</key>
+	<string>com.anthropic.claudecode.profile</string>
+	<key>PayloadOrganization</key>
+	<string>Example Organization</string>
+	<key>PayloadScope</key>
+	<string>System</string>
+	<key>PayloadType</key>
+	<string>Configuration</string>
+	<key>PayloadUUID</key>
+	<string>DC3CBC17-3330-4CDE-94AC-D2342E9C88A3</string>
+	<key>PayloadVersion</key>
+	<integer>1</integer>
+	<key>PayloadContent</key>
+	<array>
+		<dict>
+			<key>PayloadDisplayName</key>
+			<string>Claude Code</string>
+			<key>PayloadIdentifier</key>
+			<string>com.anthropic.claudecode.profile.BEFD5F54-71FC-4012-82B2-94399A1E220B</string>
+			<key>PayloadType</key>
+			<string>com.apple.ManagedClient.preferences</string>
+			<key>PayloadUUID</key>
+			<string>BEFD5F54-71FC-4012-82B2-94399A1E220B</string>
+			<key>PayloadVersion</key>
+			<integer>1</integer>
+			<key>PayloadContent</key>
+			<dict>
+				<key>com.anthropic.claudecode</key>
+				<dict>
+					<key>Forced</key>
+					<array>
+						<dict>
+							<key>mcx_preference_settings</key>
+							<dict>
+								<key>permissions</key>
+								<dict>
+									<key>disableBypassPermissionsMode</key>
+									<string>disable</string>
+								</dict>
+							</dict>
+						</dict>
+					</array>
+				</dict>
+			</dict>
+		</dict>
+	</array>
+</dict>
+</plist>
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>permissions</key>
+	<dict>
+		<key>disableBypassPermissionsMode</key>
+		<string>disable</string>
+	</dict>
+</dict>
+</plist>
@@ -0,0 +1,5 @@
+{
+  "permissions": {
+    "disableBypassPermissionsMode": "disable"
+  }
+}
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"
+                   revision="1.0" schemaVersion="1.0">
+  <policyNamespaces>
+    <target prefix="claudecode" namespace="Anthropic.Policies.ClaudeCode" />
+    <using prefix="windows" namespace="Microsoft.Policies.Windows" />
+  </policyNamespaces>
+  <resources minRequiredRevision="1.0" />
+  <categories>
+    <category name="Cat_ClaudeCode" displayName="$(string.Cat_ClaudeCode)" />
+  </categories>
+  <policies>
+    <policy name="ManagedSettings"
+            class="Machine"
+            displayName="$(string.ManagedSettings)"
+            explainText="$(string.ManagedSettings_Explain)"
+            presentation="$(presentation.ManagedSettings)"
+            key="SOFTWARE\Policies\ClaudeCode">
+      <parentCategory ref="Cat_ClaudeCode" />
+      <supportedOn ref="windows:SUPPORTED_Windows_10_0" />
+      <elements>
+        <text id="SettingsJson" valueName="Settings" maxLength="1000000" required="true" />
+      </elements>
+    </policy>
+  </policies>
+</policyDefinitions>
@@ -0,0 +1,28 @@
+<#
+Deploys Claude Code managed settings as a JSON file.
+
+Intune: Devices > Scripts and remediations > Platform scripts > Add (Windows 10 and later).
+  Run this script using the logged on credentials: No
+  Run script in 64 bit PowerShell Host: Yes
+
+Claude Code reads C:\Program Files\ClaudeCode\managed-settings.json at startup
+and treats it as a managed policy source. Edit the JSON below to change the
+deployed settings; see https://code.claude.com/docs/en/settings for available keys.
+#>
+
+$ErrorActionPreference = 'Stop'
+
+$dir = Join-Path $env:ProgramFiles 'ClaudeCode'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+
+$json = @'
+{
+  "permissions": {
+    "disableBypassPermissionsMode": "disable"
+  }
+}
+'@
+
+$path = Join-Path $dir 'managed-settings.json'
+[System.IO.File]::WriteAllText($path, $json, (New-Object System.Text.UTF8Encoding($false)))
+Write-Output "Wrote $path"
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                            xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions"
+                            revision="1.0" schemaVersion="1.0">
+  <displayName>Claude Code</displayName>
+  <description>Claude Code policy settings</description>
+  <resources>
+    <stringTable>
+      <string id="Cat_ClaudeCode">Claude Code</string>
+      <string id="ManagedSettings">Managed settings (JSON)</string>
+      <string id="ManagedSettings_Explain">Configures managed settings for Claude Code.
+
+Enter the full settings configuration as a single line of JSON. The value is stored as a REG_SZ string at HKLM\SOFTWARE\Policies\ClaudeCode\Settings and is applied at the highest precedence; users cannot override these settings.
+
+Example:
+{"permissions":{"disableBypassPermissionsMode":"disable"}}
+
+For the list of available settings keys, see https://code.claude.com/docs/en/settings.
+
+If your configuration is large or you prefer to manage a JSON file directly, deploy C:\Program Files\ClaudeCode\managed-settings.json instead (see Set-ClaudeCodePolicy.ps1).</string>
+    </stringTable>
+    <presentationTable>
+      <presentation id="ManagedSettings">
+        <textBox refId="SettingsJson">
+          <label>Settings JSON:</label>
+        </textBox>
+      </presentation>
+    </presentationTable>
+  </resources>
+</policyDefinitionResources>
@@ -0,0 +1,35 @@
+# Settings Examples
+
+Example Claude Code settings files, primarily intended for organization-wide deployments. Use these as starting points — adjust them to fit your needs.
+
+These may be applied at any level of the [settings hierarchy](https://code.claude.com/docs/en/settings#settings-files), though certain properties only take effect if specified in enterprise settings (e.g. `strictKnownMarketplaces`, `allowManagedHooksOnly`, `allowManagedPermissionRulesOnly`).
+
+
+## Configuration Examples
+
+> [!WARNING]
+> These examples are community-maintained snippets which may be unsupported or incorrect. You are responsible for the correctness of your own settings configuration.
+
+| Setting | [`settings-lax.json`](./settings-lax.json) | [`settings-strict.json`](./settings-strict.json) | [`settings-bash-sandbox.json`](./settings-bash-sandbox.json) |
+|---------|:---:|:---:|:---:|
+| Disable `--dangerously-skip-permissions` | ✅ | ✅ | |
+| Block plugin marketplaces | ✅ | ✅ | |
+| Block user and project-defined permission `allow` / `ask` / `deny` | | ✅ | ✅ |
+| Block user and project-defined hooks | | ✅ | |
+| Deny web fetch and search tools | | ✅ | |
+| Bash tool requires approval | | ✅ | |
+| Bash tool must run inside of sandbox | | | ✅ |
+
+## Tips
+- Consider merging snippets of the above examples to reach your desired configuration
+- Settings files must be valid JSON
+- Before deploying configuration files to your organization, test them locally by applying to `managed-settings.json`, `settings.json` or `settings.local.json`
+- The `sandbox` property only applies to the `Bash` tool; it does not apply to other tools (like Read, Write, WebSearch, WebFetch, MCPs), hooks, or internal commands
+
+## Deploying via MDM
+
+To distribute these settings as enterprise-managed policy through Jamf, Iru (Kandji), Intune, or Group Policy, see the deployment templates in [`../mdm`](../mdm).
+
+## Full Documentation
+
+See https://code.claude.com/docs/en/settings for complete documentation on all available managed settings.
@@ -0,0 +1,18 @@
+{
+  "allowManagedPermissionRulesOnly": true,
+  "sandbox": {
+    "enabled": true,
+    "autoAllowBashIfSandboxed": false,
+    "allowUnsandboxedCommands": false,
+    "excludedCommands": [],
+    "network": {
+      "allowUnixSockets": [],
+      "allowAllUnixSockets": false,
+      "allowLocalBinding": false,
+      "allowedDomains": [],
+      "httpProxyPort": null,
+      "socksProxyPort": null
+    },
+    "enableWeakerNestedSandbox": false
+  }
+}
@@ -0,0 +1,6 @@
+{
+  "permissions": {
+    "disableBypassPermissionsMode": "disable"
+  },
+  "strictKnownMarketplaces": []
+}
@@ -0,0 +1,28 @@
+{
+  "permissions": {
+    "disableBypassPermissionsMode": "disable",
+    "ask": [
+      "Bash"
+    ],
+    "deny": [
+      "WebSearch",
+      "WebFetch"
+    ]
+  },
+  "allowManagedPermissionRulesOnly": true,
+  "allowManagedHooksOnly": true,
+  "strictKnownMarketplaces": [],
+  "sandbox": {
+    "autoAllowBashIfSandboxed": false,
+    "excludedCommands": [],
+    "network": {
+      "allowUnixSockets": [],
+      "allowAllUnixSockets": false,
+      "allowLocalBinding": false,
+      "allowedDomains": [],
+      "httpProxyPort": null,
+      "socksProxyPort": null
+    },
+    "enableWeakerNestedSandbox": false
+  }
+}
@@ -0,0 +1,601 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+  <id>https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md</id>
+  <title>Claude Code Changelog</title>
+  <subtitle>Release notes for Claude Code</subtitle>
+  <author><name>Anthropic</name></author>
+  <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md"/>
+  <link rel="self" type="application/atom+xml" href="https://raw.githubusercontent.com/anthropics/claude-code/main/feed.xml"/>
+  <updated>2026-07-18T01:20:23Z</updated>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.214</id>
+    <title>Claude Code v2.1.214</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.214"/>
+    <updated>2026-07-18T01:20:23Z</updated>
+    <content type="html">&lt;p&gt;• Fixed single-segment dir/ allow rules like Edit(src/) auto-approving writes to nested dir/ directories anywhere in the tree instead of only &amp;lt;cwd&amp;gt;/dir&lt;/p&gt;
+&lt;p&gt;• Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval&lt;/p&gt;
+&lt;p&gt;• Fixed Bash permission checks to no longer auto-approve certain help and man commands that could run unsafe options, command substitutions, or backslash paths&lt;/p&gt;
+&lt;p&gt;• Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog&lt;/p&gt;
+&lt;p&gt;• Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations&lt;/p&gt;
+&lt;p&gt;• Added a periodic progress heartbeat for long-running tool calls that previously went silent&lt;/p&gt;
+&lt;p&gt;• Added an ISO modified timestamp to memory file frontmatter&lt;/p&gt;
+&lt;p&gt;• Added message.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenance&lt;/p&gt;
+&lt;p&gt;• Added CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributes&lt;/p&gt;
+&lt;p&gt;• Added reasoning effort to the subagentStatusLine payload, so custom agent rows can render model and effort&lt;/p&gt;
+&lt;p&gt;• Added permission prompts for docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode) that previously ran without one&lt;/p&gt;
+&lt;p&gt;• Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags&lt;/p&gt;
+&lt;p&gt;• Fixed Bash tool killing the Claude session when a pkill -f pattern accidentally matched the CLI's own process (Linux)&lt;/p&gt;
+&lt;p&gt;• Fixed unbounded memory growth when --settings points at a device file or multi-GB file; oversized (&amp;gt;2 MiB) settings files now fail at startup with a clear error&lt;/p&gt;
+&lt;p&gt;• Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap&lt;/p&gt;
+&lt;p&gt;• Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task&lt;/p&gt;
+&lt;p&gt;• Fixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed the PowerShell tool reporting where.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows)&lt;/p&gt;
+&lt;p&gt;• Fixed &amp;gt; and &amp;gt;&amp;gt; under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8&lt;/p&gt;
+&lt;p&gt;• Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions parked with ← or /background and left idle keeping the background daemon and a worker process alive indefinitely&lt;/p&gt;
+&lt;p&gt;• Fixed completed background sessions being impossible to remove via claude rm or the agent view once the background service had gone idle&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store&lt;/p&gt;
+&lt;p&gt;• Fixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled&lt;/p&gt;
+&lt;p&gt;• Fixed /install-github-app and the /mcp settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached&lt;/p&gt;
+&lt;p&gt;• Fixed plugins enabled via the --settings CLI flag not loading (regression since v2.1.181)&lt;/p&gt;
+&lt;p&gt;• Fixed feature flags going stale in long-running sessions after the OAuth token rotates&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview refusing to run in repos with no merge base — it now offers to review all tracked files&lt;/p&gt;
+&lt;p&gt;• Fixed claude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory&lt;/p&gt;
+&lt;p&gt;• Fixed memory frontmatter values being silently truncated at an inline # when memory files are saved&lt;/p&gt;
+&lt;p&gt;• Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames&lt;/p&gt;
+&lt;p&gt;• Fixed a spurious "check your network" warning that appeared while the advisor was thinking&lt;/p&gt;
+&lt;p&gt;• Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation&lt;/p&gt;
+&lt;p&gt;• Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace context&lt;/p&gt;
+&lt;p&gt;• Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources&lt;/p&gt;
+&lt;p&gt;• Improved the claude rc workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directory&lt;/p&gt;
+&lt;p&gt;• Changed single-segment dir/ hook if: conditions to match only &amp;lt;cwd&amp;gt;/dir; write /dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.&lt;/p&gt;
+&lt;p&gt;• Changed file commands using -m/--magic-file or -f/--files-from to require permission instead of being auto-allowed as read-only&lt;/p&gt;
+&lt;p&gt;• Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket&lt;/p&gt;
+&lt;p&gt;• Changed SessionStart hooks to report source "fork" when a session begins as a fork instead of "resume"&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.212</id>
+    <title>Claude Code v2.1.212</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.212"/>
+    <updated>2026-07-17T00:26:21Z</updated>
+    <content type="html">&lt;p&gt;• /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask&lt;/p&gt;
+&lt;p&gt;• Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)&lt;/p&gt;
+&lt;p&gt;• Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops&lt;/p&gt;
+&lt;p&gt;• Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget&lt;/p&gt;
+&lt;p&gt;• MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS&lt;/p&gt;
+&lt;p&gt;• Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session&lt;/p&gt;
+&lt;p&gt;• Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback&lt;/p&gt;
+&lt;p&gt;• Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository&lt;/p&gt;
+&lt;p&gt;• Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections&lt;/p&gt;
+&lt;p&gt;• Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143&lt;/p&gt;
+&lt;p&gt;• Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7&lt;/p&gt;
+&lt;p&gt;• Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open&lt;/p&gt;
+&lt;p&gt;• Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji&lt;/p&gt;
+&lt;p&gt;• Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview &amp;lt;branch&amp;gt; not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear&lt;/p&gt;
+&lt;p&gt;• Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands&lt;/p&gt;
+&lt;p&gt;• Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning&lt;/p&gt;
+&lt;p&gt;• Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session&lt;/p&gt;
+&lt;p&gt;• Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode&lt;/p&gt;
+&lt;p&gt;• Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run&lt;/p&gt;
+&lt;p&gt;• Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions created with /fork losing their live-parent protection after a state write failure&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart&lt;/p&gt;
+&lt;p&gt;• Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session&lt;/p&gt;
+&lt;p&gt;• Fixed the plan-approval dialog footer splitting "ctrl+g to edit in &amp;lt;editor&amp;gt;" apart when the file path is long&lt;/p&gt;
+&lt;p&gt;• Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode&lt;/p&gt;
+&lt;p&gt;• Fixed diff previews losing their line numbers and +/- markers in narrow layouts&lt;/p&gt;
+&lt;p&gt;• Fixed @-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143&lt;/p&gt;
+&lt;p&gt;• Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding&lt;/p&gt;
+&lt;p&gt;• Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode&lt;/p&gt;
+&lt;p&gt;• Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause&lt;/p&gt;
+&lt;p&gt;• Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded&lt;/p&gt;
+&lt;p&gt;• Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff&lt;/p&gt;
+&lt;p&gt;• Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)&lt;/p&gt;
+&lt;p&gt;• Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait&lt;/p&gt;
+&lt;p&gt;• Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results&lt;/p&gt;
+&lt;p&gt;• Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view&lt;/p&gt;
+&lt;p&gt;• Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers&lt;/p&gt;
+&lt;p&gt;• Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input&lt;/p&gt;
+&lt;p&gt;• Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default&lt;/p&gt;
+&lt;p&gt;• Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal&lt;/p&gt;
+&lt;p&gt;• Changed session transcripts to record the reasoning effort level on each assistant message&lt;/p&gt;
+&lt;p&gt;• Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn&lt;/p&gt;
+&lt;p&gt;• Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"&lt;/p&gt;
+&lt;p&gt;• Updated the auth status panel title from "Cloud authentication" to "Authentication"&lt;/p&gt;
+&lt;p&gt;• Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.211</id>
+    <title>Claude Code v2.1.211</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.211"/>
+    <updated>2026-07-15T23:02:29Z</updated>
+    <content type="html">&lt;p&gt;• Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output&lt;/p&gt;
+&lt;p&gt;• Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message&lt;/p&gt;
+&lt;p&gt;• Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt&lt;/p&gt;
+&lt;p&gt;• Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store&lt;/p&gt;
+&lt;p&gt;• Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message&lt;/p&gt;
+&lt;p&gt;• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured&lt;/p&gt;
+&lt;p&gt;• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message&lt;/p&gt;
+&lt;p&gt;• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings&lt;/p&gt;
+&lt;p&gt;• Fixed file upload validation: filenames ending in a DOS device suffix (.prn) or trailing dot are now accepted, and files with multiple hard links are refused&lt;/p&gt;
+&lt;p&gt;• Fixed file uploads to Claude in Chrome from remote and CLI sessions&lt;/p&gt;
+&lt;p&gt;• Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel&lt;/p&gt;
+&lt;p&gt;• Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running&lt;/p&gt;
+&lt;p&gt;• Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id&lt;/p&gt;
+&lt;p&gt;• Fixed /loop hiding the session from /resume after a single use&lt;/p&gt;
+&lt;p&gt;• Fixed screen reader users losing the audible terminal bell after /terminal-setup or onboarding terminal setup&lt;/p&gt;
+&lt;p&gt;• Fixed background jobs on LLM gateway auth (ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing&lt;/p&gt;
+&lt;p&gt;• Fixed /clear not resetting the session cost counter — the statusline's cost now starts at $0 after /clear&lt;/p&gt;
+&lt;p&gt;• Fixed Claude in Chrome setup pages failing to open in the browser on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable&lt;/p&gt;
+&lt;p&gt;• Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link&lt;/p&gt;
+&lt;p&gt;• Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions&lt;/p&gt;
+&lt;p&gt;• Fixed routines with no schedule reporting a next run time in the year 1&lt;/p&gt;
+&lt;p&gt;• Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after /clear&lt;/p&gt;
+&lt;p&gt;• Improved terminal layout and rendering performance&lt;/p&gt;
+&lt;p&gt;• Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results&lt;/p&gt;
+&lt;p&gt;• Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments&lt;/p&gt;
+&lt;p&gt;• Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like 1e6 and 64_000&lt;/p&gt;
+&lt;p&gt;• Updated documentation links to the current docs sites&lt;/p&gt;
+&lt;p&gt;• Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees&lt;/p&gt;
+&lt;p&gt;• Changed /usage-credits to ask for confirmation before sending a request to organization admins&lt;/p&gt;
+&lt;p&gt;• Changed Vim mode s and S (substitute char/line) to work in NORMAL mode, matching vim behavior&lt;/p&gt;
+&lt;p&gt;• [VSCode] Updated the Remote Control banner to describe what it does&lt;/p&gt;
+&lt;p&gt;• Claude in Chrome: hardened file-upload path validation&lt;/p&gt;
+&lt;p&gt;• Claude in Chrome: save_to_disk on screenshot actions now writes the image to disk and returns the path; previously it did nothing&lt;/p&gt;
+&lt;p&gt;• Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.210</id>
+    <title>Claude Code v2.1.210</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.210"/>
+    <updated>2026-07-14T23:45:19Z</updated>
+    <content type="html">&lt;p&gt;• Added a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of looking stuck&lt;/p&gt;
+&lt;p&gt;• Added a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead&lt;/p&gt;
+&lt;p&gt;• Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo checkout instead of their own isolated worktree&lt;/p&gt;
+&lt;p&gt;• Fixed the ultracode keyword opt-in firing on non-human-originated input such as webhook payloads and relayed PR comments&lt;/p&gt;
+&lt;p&gt;• Fixed a rendered text fragment leaking into crash telemetry when a UI component returned content outside a styled text element&lt;/p&gt;
+&lt;p&gt;• Fixed paste markers leaking into external editors opened from Claude Code, which could appear as stray È/É characters around pasted text&lt;/p&gt;
+&lt;p&gt;• Fixed claude attach sometimes failing with "job not found" or "agent is still starting" errors during session transitions — attach now waits for the daemon to settle, and terminal resizes during a slow attach are applied once it completes&lt;/p&gt;
+&lt;p&gt;• Fixed a session crash when a tool's result renderer returned a numeric bigint value or plain text instead of a UI element&lt;/p&gt;
+&lt;p&gt;• Fixed a hook callback timeout being misreported to the model as a user rejection, which made unattended sessions stop and wait&lt;/p&gt;
+&lt;p&gt;• Fixed Claude assuming a cd took effect after its command was moved to the background; the tool result now states the working directory is unchanged&lt;/p&gt;
+&lt;p&gt;• Fixed plugin-provided MCP servers being torn down when MCP servers are re-synced mid-session&lt;/p&gt;
+&lt;p&gt;• Fixed plan approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot&lt;/p&gt;
+&lt;p&gt;• Fixed /doctor skipping its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in&lt;/p&gt;
+&lt;p&gt;• Fixed Grep content mode claiming "No matches found" when paginating past the end of results&lt;/p&gt;
+&lt;p&gt;• Fixed unmatched $1/$2 positional placeholders in skills and commands being silently stripped; they are now preserved verbatim&lt;/p&gt;
+&lt;p&gt;• Fixed plugin cache writes leaving temp files behind on failure and failing on locked-file renames on Windows and network filesystems&lt;/p&gt;
+&lt;p&gt;• Fixed background workers crash-looping when a client resets its connection to the background service&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents --effort ultracode not reaching dispatched sessions; the value was silently dropped&lt;/p&gt;
+&lt;p&gt;• Fixed pressing ← to open the agents view dropping the task tracker when returning to the session&lt;/p&gt;
+&lt;p&gt;• Fixed the agents dashboard retaining pasted images from abandoned reply drafts after their session was deleted&lt;/p&gt;
+&lt;p&gt;• Fixed killed background sessions leaving a permanent git worktree lock behind; the periodic sweep now releases locks whose owning process is gone&lt;/p&gt;
+&lt;p&gt;• Fixed SDK MCP servers registered via an initialize control request waiting until the next turn to start connecting&lt;/p&gt;
+&lt;p&gt;• Fixed returning to the agents view from a session leaving overlapping ghost frames with CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1&lt;/p&gt;
+&lt;p&gt;• Fixed late-appearing .claude/* symlinks not being reconciled into the sandbox deny-write list&lt;/p&gt;
+&lt;p&gt;• Hardened the Agent tool against indirect prompt injection via content a subagent read&lt;/p&gt;
+&lt;p&gt;• Improved the Bash/PowerShell tool message when a command hits its timeout and is auto-backgrounded, so the model can distinguish a hang from an explicit background request&lt;/p&gt;
+&lt;p&gt;• Improved auto mode: the permission classifier now defaults to Sonnet 5 for external sessions, validated on the session's first request and pinned for the session&lt;/p&gt;
+&lt;p&gt;• Improved the bundled dataviz skill's chart color validation with perceptual OKLab color difference and recalibrated color-blindness thresholds&lt;/p&gt;
+&lt;p&gt;• Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation&lt;/p&gt;
+&lt;p&gt;• Screen reader mode now announces permission mode changes aloud when cycling modes with Shift+Tab&lt;/p&gt;
+&lt;p&gt;• The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes&lt;/p&gt;
+&lt;p&gt;• Agent view: the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection&lt;/p&gt;
+&lt;p&gt;• Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.209</id>
+    <title>Claude Code v2.1.209</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.209"/>
+    <updated>2026-07-14T06:36:21Z</updated>
+    <content type="html">&lt;p&gt;• Fixed /model and other dialogs being blocked in claude agents background sessions (reverts an overly broad guard)&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.208</id>
+    <title>Claude Code v2.1.208</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.208"/>
+    <updated>2026-07-14T01:10:34Z</updated>
+    <content type="html">&lt;p&gt;• Added screen reader mode: opt-in plain-text rendering for screen reader users. Run claude --ax-screen-reader, set CLAUDE_AX_SCREEN_READER=1, or add "axScreenReader": true to settings.&lt;/p&gt;
+&lt;p&gt;• Added vimInsertModeRemaps setting: map two-key insert-mode sequences like jj to Escape in vim mode&lt;/p&gt;
+&lt;p&gt;• Added CLAUDE_CODE_PROCESS_WRAPPER: agent view and the background service now honor a corporate launcher by running every Claude Code self-spawn through a required wrapper executable&lt;/p&gt;
+&lt;p&gt;• Added mouse-click support for multi-select menus and "Other" input rows in fullscreen mode&lt;/p&gt;
+&lt;p&gt;• Fixed fast mode staying off after switching back to a model that supports it — it now restores automatically when enabled in settings&lt;/p&gt;
+&lt;p&gt;• Fixed replies typed to a background agent being lost when delivery fails — the text is now saved and delivered when the session restarts&lt;/p&gt;
+&lt;p&gt;• Fixed background-session attach failing permanently ("Couldn't start the background daemon") after an update replaced the binary a running claude agents process was launched from&lt;/p&gt;
+&lt;p&gt;• Fixed the context window (and auto-compact indicator) briefly resetting to 200k after the CLI auto-updates, causing a false "100% context used" when resuming long-context sessions&lt;/p&gt;
+&lt;p&gt;• Fixed supervised and background sessions crashing when a server closed an HTTP/2 connection with a GOAWAY while requests were in flight&lt;/p&gt;
+&lt;p&gt;• Fixed truncated stream-json/JSON output and missing result message when piping large responses from claude -p&lt;/p&gt;
+&lt;p&gt;• Fixed CLAUDE_CODE_MAX_OUTPUT_TOKENS and similar env vars silently using the mantissa of scientific-notation values (1e6 became 1)&lt;/p&gt;
+&lt;p&gt;• Fixed very large markdown tables stalling rendering or using excessive memory; tables over 200 rows show the first 200 with a "… N more rows" notice&lt;/p&gt;
+&lt;p&gt;• Fixed the Edit tool failing on files modified after reading when the target text still matches uniquely&lt;/p&gt;
+&lt;p&gt;• Fixed Read reporting empty files as "shorter than offset", Grep silently returning "No files found" for invalid regex patterns, Grep count mode under-reporting totals when paginated, and Glob crashing with an unclear error when the pattern, path, or working directory contained a null byte&lt;/p&gt;
+&lt;p&gt;• Fixed apiKeyHelper script failures being hidden behind a generic 401 after ~10 silent retries; the script's own error is now shown within 3 attempts&lt;/p&gt;
+&lt;p&gt;• Fixed Bedrock streaming requests failing with a misleading "Truncated event message received" when a gateway transforms the response — the error now names the content-type and points at the proxy&lt;/p&gt;
+&lt;p&gt;• Fixed /upgrade showing a login flow instead of the upgrade URL when the browser fails to open&lt;/p&gt;
+&lt;p&gt;• Fixed stream-json input killing the session on blank CRLF or whitespace-only lines from Windows-style SDK hosts&lt;/p&gt;
+&lt;p&gt;• Fixed headless stream-json sessions hanging permanently when a control_request carried a non-string set_model payload; the CLI now answers with an error response&lt;/p&gt;
+&lt;p&gt;• Fixed repeated "No completion record was found" notices on session resume — orphaned background tasks now collapse into a single summary&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control clients attaching to a terminal-hosted session not seeing background agents and workflow progress until a task started or stopped&lt;/p&gt;
+&lt;p&gt;• Fixed the Agent tool launching with no tools when a subagent's tools list resolves to nothing — it now returns a clear error naming the unrecognized entries&lt;/p&gt;
+&lt;p&gt;• Fixed /usage showing stale cached bars over fresher data, and /mcp not reclassifying placeholder servers after config edits&lt;/p&gt;
+&lt;p&gt;• Fixed "Change directory" in SDK hosts (e.g. Claude Desktop) failing with "A turn is in progress" on idle sessions that have a running background task&lt;/p&gt;
+&lt;p&gt;• Fixed the workflow save dialog showing ~/.claude/workflows/ instead of the CLAUDE_CONFIG_DIR location for user-scope saves&lt;/p&gt;
+&lt;p&gt;• Fixed /release-notes adding the viewed notes to the model's context — "Show all" previously injected the entire changelog into every subsequent request&lt;/p&gt;
+&lt;p&gt;• Fixed a memory leak in the agent view where pasted images were retained for the screen's lifetime after sending peek replies&lt;/p&gt;
+&lt;p&gt;• Fixed SDK sessions losing agents defined via the initialize request when a plugin refresh ran before the client attached&lt;/p&gt;
+&lt;p&gt;• Fixed several memory leaks in long sessions: MCP stdio server stderr accumulating up to 64 MB per server, LSP documents staying open indefinitely (now LRU with 50-doc cap), async hook output retained after backgrounding, and unbounded growth in headless/SDK sessions from large tool-result payloads&lt;/p&gt;
+&lt;p&gt;• Fixed a memory blowup when reading files with extremely long single lines using offset/limit — the read now returns a clean error instead of loading the whole line&lt;/p&gt;
+&lt;p&gt;• Fixed multi-second per-turn slowdowns in sessions with many permission deny/ask rules — rule matchers are now compiled once and cached&lt;/p&gt;
+&lt;p&gt;• Improved input responsiveness while agent task lists update — task updates no longer re-render the entire UI&lt;/p&gt;
+&lt;p&gt;• Reduced per-tool-call CPU overhead in print/SDK sessions with many MCP tools by caching tool-pool assembly (up to 7x faster tool rounds at high tool counts)&lt;/p&gt;
+&lt;p&gt;• Reduced memory usage by bounding the file edit read cache to 16 MB instead of pinning up to 1,000 full files&lt;/p&gt;
+&lt;p&gt;• Reduced session transcript size (up to 79x in edit-heavy sessions) and bounded checkpoint disk usage by pruning superseded file-history backups&lt;/p&gt;
+&lt;p&gt;• Reduced memory usage when resuming sessions with background agents or forks spawned from large conversations&lt;/p&gt;
+&lt;p&gt;• Completed background agents now stay listed in /tasks until cleanup instead of vanishing the moment they finish&lt;/p&gt;
+&lt;p&gt;• Attaching to a stopped background agent now shows its transcript immediately while the session warms up, instead of a blank "Session is starting" screen&lt;/p&gt;
+&lt;p&gt;• Background sessions: an older daemon no longer silently restarts workers spawned by a newer version onto the older binary&lt;/p&gt;
+&lt;p&gt;• Agent view: Ctrl+X now deletes renamed-branch worktrees, never destroys unpushed commits, keeps the session row when a worktree is kept, and reused worktree names reset to the current base&lt;/p&gt;
+&lt;p&gt;• Catastrophic removals (e.g. rm -rf ~) in commands containing $(…)/backticks/&amp;lt;(…) now prompt in --dangerously-skip-permissions and auto mode, matching the plain form&lt;/p&gt;
+&lt;p&gt;• /install-github-app and the /mcp settings menu no longer open in background sessions&lt;/p&gt;
+&lt;p&gt;• MCP servers configured with an empty URL now show as "not configured" in /mcp instead of a config error&lt;/p&gt;
+&lt;p&gt;• /usage now shows your last-known usage bars with an "as of" note when the usage endpoint is rate-limited, instead of an error screen&lt;/p&gt;
+&lt;p&gt;• Fixed Bedrock auth failing with "Session token not found or invalid" for AWS SSO profiles whose sso_region differs from the Bedrock region (2.1.207 regression)&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.207</id>
+    <title>Claude Code v2.1.207</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.207"/>
+    <updated>2026-07-11T00:52:04Z</updated>
+    <content type="html">&lt;p&gt;• Auto mode is now available without CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry; disable via disableAutoMode in settings&lt;/p&gt;
+&lt;p&gt;• Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks&lt;/p&gt;
+&lt;p&gt;• Fixed remote managed settings from a non-interactive run (claude -p, the SDK) being permanently recorded as consented without ever showing the security consent dialog&lt;/p&gt;
+&lt;p&gt;• Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates&lt;/p&gt;
+&lt;p&gt;• Fixed the auto-updater overwriting a custom launcher script or symlink at ~/.local/bin/claude on every release; /doctor now reports an externally managed launcher&lt;/p&gt;
+&lt;p&gt;• Fixed compound commands with cd prompting for permission when the only output redirect was to /dev/null&lt;/p&gt;
+&lt;p&gt;• Fixed the transcript jumping above the start of the answer when a response finishes streaming&lt;/p&gt;
+&lt;p&gt;• Fixed extensions.worktreeConfig being left in the repo's .git/config (breaking go-git tools like tea) after the last worktree.sparsePaths worktree was removed&lt;/p&gt;
+&lt;p&gt;• Fixed malformed bracket patterns in rules globs, skill paths, .ignore, and .worktreeinclude breaking file reads, file suggestions, and worktree creation&lt;/p&gt;
+&lt;p&gt;• Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh&lt;/p&gt;
+&lt;p&gt;• Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web&lt;/p&gt;
+&lt;p&gt;• Fixed Deep research runs labeling every Fetch-phase agent "unknown" — chips now show the source hostname&lt;/p&gt;
+&lt;p&gt;• Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request&lt;/p&gt;
+&lt;p&gt;• Improved agent view: pasting the same text again now expands the collapsed [Pasted text #N] placeholder instead of adding a second one&lt;/p&gt;
+&lt;p&gt;• Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (waiting 3m) instead of the same timestamp twice&lt;/p&gt;
+&lt;p&gt;• Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8&lt;/p&gt;
+&lt;p&gt;• Changed auto mode to no longer read autoMode from .claude/settings.local.json (repo-resident); use ~/.claude/settings.json instead&lt;/p&gt;
+&lt;p&gt;• Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck credential_process): the 60-second stall guard now fires instead of waiting forever.&lt;/p&gt;
+&lt;p&gt;• Plugin hooks/monitors/MCP headersHelper: ${user_config.*} in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (args array) or $CLAUDE_PLUGIN_OPTION_&amp;lt;KEY&amp;gt;; monitors and headersHelper: read the value inside the script (config file or the server's env block).&lt;/p&gt;
+&lt;p&gt;• Plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json; only user, --settings, and managed settings are honored&lt;/p&gt;
+&lt;p&gt;• Fixed /usage-credits amount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.206</id>
+    <title>Claude Code v2.1.206</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.206"/>
+    <updated>2026-07-09T23:34:23Z</updated>
+    <content type="html">&lt;p&gt;• Added directory path suggestions to /cd, matching /add-dir behavior&lt;/p&gt;
+&lt;p&gt;• Added a /doctor check that proposes trimming checked-in CLAUDE.md files by cutting content Claude could derive from the codebase&lt;/p&gt;
+&lt;p&gt;• /commit-push-pr now auto-allows git push to the repo's configured push remote (remote.pushDefault, or the sole remote when only one is configured) in addition to origin&lt;/p&gt;
+&lt;p&gt;• Gateway: /login now supports Anthropic-operated public gateway endpoints&lt;/p&gt;
+&lt;p&gt;• EnterWorktree now asks for confirmation before entering a git worktree outside the project's .claude/worktrees/ directory&lt;/p&gt;
+&lt;p&gt;• Background agents now upgrade to a new version in the background right after a Claude Code update, instead of paying a slow stale-session upgrade when you attach&lt;/p&gt;
+&lt;p&gt;• Fixed an expired login failing every model with a misleading "There's an issue with the selected model" error instead of prompting to run /login&lt;/p&gt;
+&lt;p&gt;• Fixed claude --resume and --continue not responding to keyboard input on startup&lt;/p&gt;
+&lt;p&gt;• Fixed MCP servers configured via --mcp-config or .mcp.json ignoring a per-server request_timeout_ms, which caused long-running MCP tool calls to time out at the 60s default in fresh sessions&lt;/p&gt;
+&lt;p&gt;• Fixed CLAUDE_CODE_EXTRA_BODY being silently ignored by claude agents / --bg background workers; the shell-exported override now follows the dispatching session&lt;/p&gt;
+&lt;p&gt;• Fixed OAuth MCP servers requiring manual re-authentication after a single failed token refresh&lt;/p&gt;
+&lt;p&gt;• Fixed --permission-prompt-tool pointing at an MCP server crashing with "MCP tool not found" on cold start before the server finishes connecting&lt;/p&gt;
+&lt;p&gt;• Fixed /model picker rows printing a price for a different model than the row named, and stopped quoting first-party list prices on providers that don't bill them&lt;/p&gt;
+&lt;p&gt;• Fixed server-provided model rows being misplaced in the /model picker when an entitlement or allowlist restriction drops the row they were positioned against&lt;/p&gt;
+&lt;p&gt;• Fixed desktop sessions getting stuck showing "running" after a slash command was sent mid-turn&lt;/p&gt;
+&lt;p&gt;• Fixed keyboard input being ignored in the agents view when a setup prompt appeared before a bare claude --resume on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed claude rm leaving the removed job in the daemon roster, causing the row to reappear in claude agents&lt;/p&gt;
+&lt;p&gt;• Fixed /remote-control showing "Unknown command" when logged out — it now explains how to sign in&lt;/p&gt;
+&lt;p&gt;• Fixed left arrow not stepping back out of a phase or agent in the workflow detail view&lt;/p&gt;
+&lt;p&gt;• Fixed /status listing the same broken-install warning twice&lt;/p&gt;
+&lt;p&gt;• Fixed false "disused plugin" tips and skewed disuse telemetry for LSP plugins&lt;/p&gt;
+&lt;p&gt;• Fixed /doctor's update check to compare Homebrew installs against their cask's channel instead of the settings channel&lt;/p&gt;
+&lt;p&gt;• Fixed the fullscreen jump-to-bottom pill suggesting Ctrl+End on macOS, not showing rebound chords, and wrapping over the transcript&lt;/p&gt;
+&lt;p&gt;• Bedrock: fixed a multi-minute startup hang when using an awsCredentialExport helper on networks with restricted egress&lt;/p&gt;
+&lt;p&gt;• Improved /code-review findings quality on claude-opus-4-8 across all effort levels&lt;/p&gt;
+&lt;p&gt;• Improved agents view: status column now uses full terminal width instead of truncating at 64 characters&lt;/p&gt;
+&lt;p&gt;• Changed agents view: Ctrl+X now permanently removes a completed session, and sessions no longer render twice; deleted background jobs stay deleted&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.205</id>
+    <title>Claude Code v2.1.205</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.205"/>
+    <updated>2026-07-08T21:21:58Z</updated>
+    <content type="html">&lt;p&gt;• Added an auto mode rule that blocks tampering with session transcript files&lt;/p&gt;
+&lt;p&gt;• Fixed --json-schema silently producing unstructured output when the schema was invalid, and schemas using the format keyword being rejected&lt;/p&gt;
+&lt;p&gt;• Fixed a message sent while Claude was working being silently lost when the turn ended at the --max-turns limit&lt;/p&gt;
+&lt;p&gt;• Fixed Windows worktree removal deleting files outside the worktree when an NTFS junction or directory symlink existed inside it&lt;/p&gt;
+&lt;p&gt;• Fixed background agents staying shown as "failed" or "completed" in the agent list after being resumed with SendMessage&lt;/p&gt;
+&lt;p&gt;• Fixed background jobs flipping from "needs input" back to "working" in the agent list when the agent's turn contained no readable text&lt;/p&gt;
+&lt;p&gt;• Fixed claude attach erroring when a background agent was mid-upgrade restart instead of waiting for it to come back&lt;/p&gt;
+&lt;p&gt;• Fixed session-to-PR linking missing a PR created in a Bash call whose output exceeded the 30K inline limit&lt;/p&gt;
+&lt;p&gt;• Fixed claude mcp add-from-claude-desktop getting stuck when a server name contains unsupported characters; invalid names are now reported and remaining servers still import&lt;/p&gt;
+&lt;p&gt;• Fixed a plugin LSP server that fails to initialize preventing a valid LSP server from another plugin handling the same file extension&lt;/p&gt;
+&lt;p&gt;• Fixed a Windows crash when the directory Claude was launched from is deleted, locked, or unmounted while a command is running&lt;/p&gt;
+&lt;p&gt;• Fixed a crash when a file watcher was closed while a directory scan was still in flight&lt;/p&gt;
+&lt;p&gt;• Fixed project verify skills being rewritten on every session instead of only when a documented command changed&lt;/p&gt;
+&lt;p&gt;• Fixed the agent view rendering one line too high and clipping its header when the job list slightly overflowed the screen&lt;/p&gt;
+&lt;p&gt;• Fixed background tasks in the web and mobile Remote Control panels showing stale "Running" status by forwarding full task state on every membership change&lt;/p&gt;
+&lt;p&gt;• Improved auto mode to ask before running rm -rf on a variable it can't resolve from context&lt;/p&gt;
+&lt;p&gt;• Auto-update binary downloads now stream to disk instead of buffering in memory, cutting the updater's peak memory usage by roughly 400 MB&lt;/p&gt;
+&lt;p&gt;• Background task notifications now explicitly state that no human input has occurred, preventing fabricated in-transcript approvals from being acted on&lt;/p&gt;
+&lt;p&gt;• Improved agent view: sessions that edit, merge, comment on, or push to an existing PR now link it in claude agents&lt;/p&gt;
+&lt;p&gt;• Improved agent view: rows now show a colored state word and a classifier-written headline instead of raw tool call text, and the peek opens with full status including the exact ask for blocked sessions&lt;/p&gt;
+&lt;p&gt;• /doctor is now a full setup checkup that can diagnose and fix issues; /checkup is its alias&lt;/p&gt;
+&lt;p&gt;• Reserved the "Claude Browser" MCP server name (alongside "Claude Preview") ahead of the Claude Desktop pane rename; user-configured MCP servers can no longer register under either name&lt;/p&gt;
+&lt;p&gt;• Fixed Cowork VM-mode local-agent sessions failing to start with "Not logged in · Please run /login" on CLI 2.1.203+&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.204</id>
+    <title>Claude Code v2.1.204</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.204"/>
+    <updated>2026-07-08T00:27:43Z</updated>
+    <content type="html">&lt;p&gt;• Fixed hook events not streaming during SessionStart hooks in headless sessions, which could cause remote workers to be idle-reaped mid-hook&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.203</id>
+    <title>Claude Code v2.1.203</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.203"/>
+    <updated>2026-07-07T21:06:03Z</updated>
+    <content type="html">&lt;p&gt;• Added a warning when your login is about to expire, so you can re-authenticate before background sessions are interrupted&lt;/p&gt;
+&lt;p&gt;• Added a grey ⏸ badge to the footer when in manual permission mode, making the active mode always visible&lt;/p&gt;
+&lt;p&gt;• Added the session's additional working directories to MCP roots/list, with notifications/roots/list_changed sent when the set changes&lt;/p&gt;
+&lt;p&gt;• Fixed opening or switching background agent sessions on macOS stalling for 15–20 seconds due to a false low-memory detection (regression in 2.1.196)&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions becoming permanently unresponsive to attach, replies, and stop when the daemon's session token went stale — the session now recovers automatically&lt;/p&gt;
+&lt;p&gt;• Fixed returning to claude agents silently stopping running subagents and re-running the prompt from scratch — their work now carries over&lt;/p&gt;
+&lt;p&gt;• Fixed a memory and per-turn CPU regression in interactive sessions: the context-usage indicator no longer re-analyzes the entire transcript after every turn&lt;/p&gt;
+&lt;p&gt;• Fixed background agents inheriting a stale PATH from the daemon instead of the dispatching shell, causing missing tools on Windows&lt;/p&gt;
+&lt;p&gt;• Fixed background and agent-view sessions dropping a shell-exported ANTHROPIC_BASE_URL, which sent API keys to the default endpoint and failed with 401&lt;/p&gt;
+&lt;p&gt;• Fixed Bash failing with "argument list too long" in repos with many git worktrees&lt;/p&gt;
+&lt;p&gt;• Fixed worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree&lt;/p&gt;
+&lt;p&gt;• Fixed worktree creation rejecting nested repositories in multi-repo workspaces, leaving background sessions unable to isolate and edit&lt;/p&gt;
+&lt;p&gt;• Fixed background agents crash-looping when their working directory was deleted, replaced by a file, or became an invalid path — they now fail once with a clear error&lt;/p&gt;
+&lt;p&gt;• Fixed a background daemon auto-upgrade failure silently killing all running background sessions&lt;/p&gt;
+&lt;p&gt;• Fixed TaskStop and TaskOutput failing to find background agents spawned by another agent — errors now list running agents by id and description&lt;/p&gt;
+&lt;p&gt;• Fixed the claude agents composer discarding your typed message when a slash command isn't available there&lt;/p&gt;
+&lt;p&gt;• Fixed the agent list crashing when opening a stopped session whose conversation was already open in another session&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions showing "Needs input" in the agent list after the question was already answered&lt;/p&gt;
+&lt;p&gt;• Fixed background agent startup failures showing only "exit_with_message" instead of the actual error&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions ignoring effortLevel changes in settings.json when forked through the daemon&lt;/p&gt;
+&lt;p&gt;• Fixed attached background sessions ignoring CLAUDE_CODE_DISABLE_MOUSE and CLAUDE_CODE_DISABLE_MOUSE_CLICKS opt-outs&lt;/p&gt;
+&lt;p&gt;• Fixed /exit incorrectly warning about running background agents after all named agents had completed&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions started from a non-git directory unable to edit files when a WorktreeCreate hook was configured&lt;/p&gt;
+&lt;p&gt;• Fixed the @ directory picker in claude agents not showing registered git worktrees&lt;/p&gt;
+&lt;p&gt;• Fixed background task output on Windows being permanently replaced by an empty file after /clear&lt;/p&gt;
+&lt;p&gt;• Fixed content jumping when scrolling up through long transcript history&lt;/p&gt;
+&lt;p&gt;• Fixed the terminal flickering and jumping while typing in bash mode when a shell-history suggestion was shown&lt;/p&gt;
+&lt;p&gt;• Fixed literal ^[[I / ^[[O escape codes being printed when reattaching to a background session&lt;/p&gt;
+&lt;p&gt;• Fixed LSP-only plugins being incorrectly flagged for disuse when their language servers deliver diagnostics or answer navigation requests&lt;/p&gt;
+&lt;p&gt;• Improved responsiveness while long responses stream: live-preview updates no longer re-render the whole screen&lt;/p&gt;
+&lt;p&gt;• Improved subagent behavior: agents are now less likely to re-delegate their entire task to another subagent&lt;/p&gt;
+&lt;p&gt;• Reduced binary size by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily instead of inlining it&lt;/p&gt;
+&lt;p&gt;• Changed left arrow to no longer close the background tasks, diff, and workflow detail views — press Esc instead&lt;/p&gt;
+&lt;p&gt;• Changed the empty claude agents view to always show the organized sections (Needs input / Working / Completed) with descriptions&lt;/p&gt;
+&lt;p&gt;• Removed the startup "claude command missing or broken" warnings — they now appear in /doctor and /status instead&lt;/p&gt;
+&lt;p&gt;• Removed a redundant navigation hint from the claude agents footer&lt;/p&gt;
+&lt;p&gt;• [VSCode] Added a Settings toggle for "Enable Remote Control for all sessions"&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.202</id>
+    <title>Claude Code v2.1.202</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.202"/>
+    <updated>2026-07-06T22:51:10Z</updated>
+    <content type="html">&lt;p&gt;• Added a "Dynamic workflow size" setting in /config for controlling how large Claude generally makes dynamic workflows (small/medium/large agent counts) — an advisory guideline, not an enforced cap&lt;/p&gt;
+&lt;p&gt;• Added workflow.run_id and workflow.name OpenTelemetry attributes to telemetry emitted by workflow-spawned agents, so a workflow run's activity can be reconstructed from OTel data&lt;/p&gt;
+&lt;p&gt;• Fixed a crash in the inline Ctrl+R history search when accepting or cancelling while the search was still scanning the history file&lt;/p&gt;
+&lt;p&gt;• Fixed /rename on background sessions being reverted when the job restarts, which broke addressing the session by its new name&lt;/p&gt;
+&lt;p&gt;• Fixed transient mTLS handshake failures when settings were re-applied during an in-place client certificate rotation&lt;/p&gt;
+&lt;p&gt;• Fixed commands sent from Remote Control (mobile/web) into an interactive session failing with "Unknown command"&lt;/p&gt;
+&lt;p&gt;• Fixed images and files sent from the Remote Control mobile or web app without a caption being silently dropped&lt;/p&gt;
+&lt;p&gt;• Fixed the sign-in URL printed by claude auth login and claude mcp login --no-browser not being reliably clickable when it wraps over SSH — it is now emitted as a single hyperlink&lt;/p&gt;
+&lt;p&gt;• Fixed opening a chat from claude agents sometimes failing with "currently running as a background agent" followed by a worker crash/respawn loop&lt;/p&gt;
+&lt;p&gt;• Fixed workflow scripts with unicode quote escapes in strings being corrupted before parsing; workflow parse errors now show the offending line instead of always blaming TypeScript&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation retrying in an unbounded loop when the microphone or audio recorder fails — repeated capture failures now pause voice input&lt;/p&gt;
+&lt;p&gt;• Fixed /remote-control sessions showing the wrong permission mode in the mobile and web apps&lt;/p&gt;
+&lt;p&gt;• Fixed resuming a session by name, or opening the resume picker, taking minutes and using a large amount of memory in repositories with many git worktrees&lt;/p&gt;
+&lt;p&gt;• Fixed installer and updater downloads failing immediately with "aborted" when a proxy or network drops the connection mid-download — transient connection drops now retry&lt;/p&gt;
+&lt;p&gt;• Fixed re-invoking an already-loaded skill appending a duplicate copy of its instructions to context&lt;/p&gt;
+&lt;p&gt;• Improved /workflows agent list layout: wider titles, a dedicated time column, shorter model names, and no per-row tool-call counts&lt;/p&gt;
+&lt;p&gt;• Improved MCP error messages: clearer error when a server config has url but no type, suggesting "type": "http" instead of the misleading "command: expected string"&lt;/p&gt;
+&lt;p&gt;• Changed /review &amp;lt;pr&amp;gt; back to a fast single-pass review; use /code-review &amp;lt;level&amp;gt; &amp;lt;pr#&amp;gt; for the multi-agent review at a chosen effort level&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.201</id>
+    <title>Claude Code v2.1.201</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.201"/>
+    <updated>2026-07-03T23:50:29Z</updated>
+    <content type="html">&lt;p&gt;• Claude Sonnet 5 sessions no longer use the mid-conversation system role for harness reminders&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.200</id>
+    <title>Claude Code v2.1.200</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.200"/>
+    <updated>2026-07-03T16:52:26Z</updated>
+    <content type="html">&lt;p&gt;• Changed AskUserQuestion dialogs to no longer auto-continue by default; opt into an idle timeout via /config&lt;/p&gt;
+&lt;p&gt;• Changed the "default" permission mode to "Manual" across the CLI, --help, VS Code, and JetBrains; --permission-mode manual and "defaultMode": "manual" are accepted alongside default&lt;/p&gt;
+&lt;p&gt;• Fixed a crash at startup when disabledMcpServers or enabledMcpServers in .claude.json is set to a non-array value&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions silently stopping mid-turn after sleep/wake or when reopening a stalled session&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions re-running a turn cancelled with Esc after a stall respawn&lt;/p&gt;
+&lt;p&gt;• Fixed background agents never starting again after a crash left a stale daemon.lock whose PID the OS reused&lt;/p&gt;
+&lt;p&gt;• Fixed background-agent daemon handover so a reinstalled older build can no longer take over the daemon; build recency is now judged by the version's embedded build timestamp&lt;/p&gt;
+&lt;p&gt;• Fixed background-agent roster issues: transient corruption permanently disabling orphan cleanup, older binaries not preserving fields written by newer versions, and socket auth tokens being stripped during daemon restarts&lt;/p&gt;
+&lt;p&gt;• Fixed subagents cut off by a rate limit before producing any text output returning an empty result instead of failing cleanly&lt;/p&gt;
+&lt;p&gt;• Fixed control bytes from background-agent output reaching the terminal in the agent view&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents --plugin-dir &amp;lt;dir&amp;gt; not showing the plugin's agents and skills in the agent view when the flag is placed after agents&lt;/p&gt;
+&lt;p&gt;• Fixed project-scoped plugins not loading correctly from git worktrees of the same repository&lt;/p&gt;
+&lt;p&gt;• Fixed /mcp server list not tracking focus for screen readers and magnifiers&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation showing a misleading "Voice connection failed" message when a recording captures no audio&lt;/p&gt;
+&lt;p&gt;• Fixed rendering flicker under tmux 3.4+ by enabling synchronized terminal output&lt;/p&gt;
+&lt;p&gt;• Improved screen-reader output: decorative glyphs are now hidden, transcript symbols read as short labels, and nested tables read as Header: value. lines&lt;/p&gt;
+&lt;p&gt;• Improved the install script to explain when installation is killed by the system running out of memory&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.199</id>
+    <title>Claude Code v2.1.199</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.199"/>
+    <updated>2026-07-02T23:35:12Z</updated>
+    <content type="html">&lt;p&gt;• Stacked slash-skill invocations like /skill-a /skill-b do XYZ now load all leading skills (up to 5), not just the first&lt;/p&gt;
+&lt;p&gt;• Fixed SSL certificate errors (TLS-inspecting proxies, missing NODE_EXTRA_CA_CERTS, expired certs) burning retries before showing actionable guidance — they now fail immediately with the fix hint&lt;/p&gt;
+&lt;p&gt;• Fixed streaming responses being discarded when the API emits a mid-stream overloaded/server error after partial output — the partial is now kept with an incomplete-response notice&lt;/p&gt;
+&lt;p&gt;• Fixed subagents cut off by a rate limit or server error silently failing instead of returning their partial work to the parent&lt;/p&gt;
+&lt;p&gt;• Fixed subagents reporting API errors (e.g. usage limit reached) as successful results — the error is now reported to the parent agent&lt;/p&gt;
+&lt;p&gt;• Fixed the background-agent daemon on Linux killing itself and every running agent every ~50 seconds after an unclean shutdown left a corrupted worker record&lt;/p&gt;
+&lt;p&gt;• Fixed background agents failing to cold-start over SSH on macOS with "Could not switch to audit session" (regression in 2.1.196)&lt;/p&gt;
+&lt;p&gt;• Fixed claude stop being silently undone when it raced a background-agent respawn — the respawn now honors the stop&lt;/p&gt;
+&lt;p&gt;• Fixed background job progress indicators stalling for minutes while the job ran long commands&lt;/p&gt;
+&lt;p&gt;• Fixed background sessions on memory-starved machines showing a generic error — they now indicate low memory and suggest freeing resources&lt;/p&gt;
+&lt;p&gt;• Fixed remote sessions briefly flapping between Working and Idle in the agent view when a background agent completes&lt;/p&gt;
+&lt;p&gt;• Fixed idle subagents vanishing from the agent panel while other subagents were still working; surplus idle agents now collapse into an expandable summary row&lt;/p&gt;
+&lt;p&gt;• Fixed typing /model or /fast while viewing a subagent silently opening the lead's model picker — a notice now explains the command applies to the lead&lt;/p&gt;
+&lt;p&gt;• Fixed SessionStart, Setup, and SubagentStart hooks silently hiding stderr when exiting with code 2 — the error is now shown in the transcript&lt;/p&gt;
+&lt;p&gt;• Fixed claude --dangerously-skip-permissions daemon &amp;lt;subcommand&amp;gt; being treated as a chat prompt instead of running the subcommand&lt;/p&gt;
+&lt;p&gt;• Fixed SendMessage silently misrouting when a re-spawned agent reuses a previous agent's name — the tool now detects the mismatch and asks the caller to retarget&lt;/p&gt;
+&lt;p&gt;• Fixed opening or resuming a session with no new messages needlessly growing the transcript file&lt;/p&gt;
+&lt;p&gt;• Fixed backgrounding a session with ← or /background dropping its /color from the agent view row&lt;/p&gt;
+&lt;p&gt;• Fixed resetting a corrupted config file from the startup recovery dialog destroying it unrecoverably — it now backs up the file first&lt;/p&gt;
+&lt;p&gt;• Fixed Claude in Chrome repeatedly opening the reconnect page when sessions run from different builds or config directories&lt;/p&gt;
+&lt;p&gt;• Fixed plan mode not prompting for state-changing browser tool calls; read-only browser_batch calls are now correctly auto-allowed&lt;/p&gt;
+&lt;p&gt;• Transient server rate-limit errors (429s unrelated to your usage limit) are now retried automatically with backoff for subscribers instead of failing the turn&lt;/p&gt;
+&lt;p&gt;• CLAUDE_CODE_RETRY_WATCHDOG now raises the default retry count for non-capacity transient errors to 300 and lifts the cap of 15 on CLAUDE_CODE_MAX_RETRIES&lt;/p&gt;
+&lt;p&gt;• claude agents session rows now show pull-request links as bare #N without the redundant "PR" label&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.198</id>
+    <title>Claude Code v2.1.198</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.198"/>
+    <updated>2026-07-01T20:45:29Z</updated>
+    <content type="html">&lt;p&gt;• Subagents now run in the background by default, so Claude keeps working while they run and is notified when they finish (previously a gradual rollout)&lt;/p&gt;
+&lt;p&gt;• Claude in Chrome is now generally available&lt;/p&gt;
+&lt;p&gt;• Added background agent notifications in claude agents — sessions that need input or finish now fire the Notification hook (agent_needs_input / agent_completed)&lt;/p&gt;
+&lt;p&gt;• Added /dataviz skill for chart and dashboard design guidance with a runnable color-palette validator&lt;/p&gt;
+&lt;p&gt;• Gateway: added Claude Platform on AWS (anthropicAws) as an upstream provider; model-not-found responses now advance the failover chain&lt;/p&gt;
+&lt;p&gt;• Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask&lt;/p&gt;
+&lt;p&gt;• The built-in Explore agent now inherits the main session's model (capped at opus) instead of running on haiku&lt;/p&gt;
+&lt;p&gt;• Subagents and context compaction now inherit the session's extended thinking configuration, improving output quality on delegated tasks&lt;/p&gt;
+&lt;p&gt;• Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing&lt;/p&gt;
+&lt;p&gt;• Fixed excessive background classifier requests when sandboxed processes repeatedly accessed the same network host&lt;/p&gt;
+&lt;p&gt;• Fixed background tasks in web, desktop, and VS Code task panels getting stuck on "Running" after they finish or after resuming a session&lt;/p&gt;
+&lt;p&gt;• Fixed agent teams: a teammate that dies on an API error now reports "failed" to the lead, and messaging a stuck teammate wakes it to retry immediately&lt;/p&gt;
+&lt;p&gt;• Fixed the /diff panel not refreshing when you switch branches or commit outside the session&lt;/p&gt;
+&lt;p&gt;• Fixed markdown tables overflowing and wrapping their right border when rendered in fullscreen mode&lt;/p&gt;
+&lt;p&gt;• Fixed Claude Platform on AWS and Mantle sessions dead-ending with "Please run /login" when the STS token expires — awsAuthRefresh now runs automatically&lt;/p&gt;
+&lt;p&gt;• Fixed "no route to host" for local-network hosts in macOS background agent sessions by declaring Local Network entitlements&lt;/p&gt;
+&lt;p&gt;• Fixed /desktop failing with "Cannot determine working directory" after entering and exiting a worktree&lt;/p&gt;
+&lt;p&gt;• Fixed background agents repeatedly showing "Reconnecting…" every ~52 seconds on macOS while the agents view was open&lt;/p&gt;
+&lt;p&gt;• Fixed pressing ← inside claude attach &amp;lt;id&amp;gt; exiting to the shell instead of opening the agent view&lt;/p&gt;
+&lt;p&gt;• Fixed claude --bg silently creating an unattachable session when combined with --print/-p; the conflicting flags are now rejected up front&lt;/p&gt;
+&lt;p&gt;• Fixed the workflow progress view dropping the earliest agents from the list while the phase counter stayed correct in SDK and desktop-app sessions&lt;/p&gt;
+&lt;p&gt;• Fixed .claude/rules/ conditional rules not loading when the target file is reached via a symlinked path&lt;/p&gt;
+&lt;p&gt;• Fixed Cmd+click not opening URLs in fullscreen mode in Warp on macOS&lt;/p&gt;
+&lt;p&gt;• Fixed double-click word selection in fullscreen mode to select the entire URL including the scheme&lt;/p&gt;
+&lt;p&gt;• Fixed plan mode not auto-allowing read-only tool calls when a session starts in plan mode&lt;/p&gt;
+&lt;p&gt;• Fixed /branch deriving its default fork name from the compaction summary instead of the first real prompt&lt;/p&gt;
+&lt;p&gt;• Improved focus mode: subagents launched in a turn now appear in its activity summary, and completed background notifications fold into a single count&lt;/p&gt;
+&lt;p&gt;• Improved syntax highlighting accuracy in code blocks, diffs, and file previews by upgrading to highlight.js 11&lt;/p&gt;
+&lt;p&gt;• Keyboard shortcut hints now show opt/cmd instead of alt/super when connected from a Mac over SSH&lt;/p&gt;
+&lt;p&gt;• Improved API retry UX: the error reason is now shown after the second attempt, and a status page link replaces the spinner tip when the API is overloaded&lt;/p&gt;
+&lt;p&gt;• /login now opens the sign-in dialog from the claude agents view instead of saying it isn't available&lt;/p&gt;
+&lt;p&gt;• Subagents now treat messages from the agent that launched them as normal task direction; an agent's message is still never treated as the user's approval&lt;/p&gt;
+&lt;p&gt;• Removed the /agents wizard; ask Claude to create or manage subagents, or edit .claude/agents/ directly&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.197</id>
+    <title>Claude Code v2.1.197</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.197"/>
+    <updated>2026-06-30T17:56:29Z</updated>
+    <content type="html">&lt;p&gt;• Introducing Claude Sonnet 5: now the default model in Claude Code, with a native 1M-token context window and promotional pricing of $2/$10 per Mtok through August 31. Update to version 2.1.197 for access. https://www.anthropic.com/news/claude-sonnet-5&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.196</id>
+    <title>Claude Code v2.1.196</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.196"/>
+    <updated>2026-06-29T23:27:24Z</updated>
+    <content type="html">&lt;p&gt;• Added support for organization default models — admins set it in the org console; it shows as "Org default" (or "Role default") in /model when you haven't picked one yourself&lt;/p&gt;
+&lt;p&gt;• Added readable default names for sessions at start, making them easier to identify and message&lt;/p&gt;
+&lt;p&gt;• Added clickable file attachments in chat — Cmd/Ctrl-click reveals the file in Finder/Explorer&lt;/p&gt;
+&lt;p&gt;• Security: claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval&lt;/p&gt;
+&lt;p&gt;• Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted&lt;/p&gt;
+&lt;p&gt;• Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit&lt;/p&gt;
+&lt;p&gt;• Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry&lt;/p&gt;
+&lt;p&gt;• Fixed PowerShell git diff/git grep, egrep/fgrep, and quoted search patterns containing | being reported as failures when they exit 1, matching Bash behavior&lt;/p&gt;
+&lt;p&gt;• Fixed multiple claude agents side panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents&lt;/p&gt;
+&lt;p&gt;• Fixed mid-turn crash recovery for Remote sessions — sessions interrupted by a server restart now auto-resume on the next worker&lt;/p&gt;
+&lt;p&gt;• Fixed sessions moved with /cd reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters&lt;/p&gt;
+&lt;p&gt;• Fixed claude plugin validate skipping local plugins whose source is "." and stopping after the first error class&lt;/p&gt;
+&lt;p&gt;• Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents&lt;/p&gt;
+&lt;p&gt;• Fixed MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs&lt;/p&gt;
+&lt;p&gt;• Fixed /context showing 0 tokens for all tool groups on Bedrock&lt;/p&gt;
+&lt;p&gt;• Fixed /deep-research misreporting verifier failures as "all claims refuted" instead of unverified&lt;/p&gt;
+&lt;p&gt;• Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo&lt;/p&gt;
+&lt;p&gt;• Fixed claude agents session status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled&lt;/p&gt;
+&lt;p&gt;• Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated — including on Windows, where background shells are handed off instead of being killed&lt;/p&gt;
+&lt;p&gt;• Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens&lt;/p&gt;
+&lt;p&gt;• Improved /code-review workflow: merged five cleanup finders into one, cutting token usage by roughly 25%&lt;/p&gt;
+&lt;p&gt;• Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming&lt;/p&gt;
+&lt;p&gt;• The streaming idle watchdog is now on by default for all providers — it aborts and retries when a response stream produces no events for 5 minutes. Set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable.&lt;/p&gt;
+&lt;p&gt;• Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY&lt;/p&gt;
+&lt;p&gt;• Changed opening the agents view from a foreground session to require a single ← press instead of two, matching the behavior in background sessions&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.195</id>
+    <title>Claude Code v2.1.195</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.195"/>
+    <updated>2026-06-26T21:29:36Z</updated>
+    <content type="html">&lt;p&gt;• Added CLAUDE_CODE_DISABLE_MOUSE_CLICKS to disable mouse click/drag/hover in fullscreen mode while keeping wheel scroll&lt;/p&gt;
+&lt;p&gt;• Fixed hook matchers with hyphenated identifiers (e.g. code-reviewer, mcp__brave-search) accidentally substring-matching — they now exact-match. Use mcp__brave-search__.* to match all tools from a hyphenated MCP server.&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation on macOS capturing silence in long-running sessions after the default input device changes&lt;/p&gt;
+&lt;p&gt;• Fixed voice dictation auto-submit never firing for languages written without spaces (Japanese, Chinese, Thai)&lt;/p&gt;
+&lt;p&gt;• Fixed external plugins enabled only by project .claude/settings.json not requiring explicit install consent on every loader path&lt;/p&gt;
+&lt;p&gt;• Fixed /plugin Enable/Disable not working when a plugin's plugin.json name differs from its marketplace entry name&lt;/p&gt;
+&lt;p&gt;• Fixed background jobs disappearing from claude agents or losing data when written by a newer Claude Code version&lt;/p&gt;
+&lt;p&gt;• Fixed reopening a crashed background task showing a blank screen for up to 5 seconds instead of its restart&lt;/p&gt;
+&lt;p&gt;• Fixed background agent daemons running unreachable when the control socket fails to start, blocking restarts&lt;/p&gt;
+&lt;p&gt;• Improved voice mode on Linux: now distinguishes "no microphone" from "SoX not installed" when SoX is present but no audio capture device exists&lt;/p&gt;
+&lt;p&gt;• Improved claude agents completed list to fill available vertical space; on short terminals the header compacts so live sessions stay visible&lt;/p&gt;
+&lt;p&gt;• Improved Remote session startup with a provisioning checklist while the container starts&lt;/p&gt;</content>
+  </entry>
+  <entry>
+    <id>https://github.com/anthropics/claude-code/releases/tag/v2.1.193</id>
+    <title>Claude Code v2.1.193</title>
+    <link rel="alternate" type="text/html" href="https://github.com/anthropics/claude-code/releases/tag/v2.1.193"/>
+    <updated>2026-06-25T21:45:51Z</updated>
+    <content type="html">&lt;p&gt;• Added autoMode.classifyAllShell setting to route all Bash/PowerShell commands through the auto-mode classifier instead of only arbitrary-code-execution patterns&lt;/p&gt;
+&lt;p&gt;• Added auto-mode denial reasons to the transcript, the denial toast, and /permissions recent denials&lt;/p&gt;
+&lt;p&gt;• Added claude_code.assistant_response OpenTelemetry log event containing the model's response text. Redacted unless OTEL_LOG_ASSISTANT_RESPONSES=1; when that var is unset it follows OTEL_LOG_USER_PROMPTS, so deployments that already log prompt content will start receiving response content on upgrade — set OTEL_LOG_ASSISTANT_RESPONSES=0 to keep prompts-only.&lt;/p&gt;
+&lt;p&gt;• Added live file path autocomplete to bash mode (!)&lt;/p&gt;
+&lt;p&gt;• Added a startup notice when MCP servers need authentication, pointing at /mcp&lt;/p&gt;
+&lt;p&gt;• Added automatic memory-pressure reaping for idle background shell commands (disable with CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1)&lt;/p&gt;
+&lt;p&gt;• Fixed /model and other client-data-gated UI showing stale/empty state immediately after /login&lt;/p&gt;
+&lt;p&gt;• Fixed backgrounding (←←) spuriously cancelling with "N background tasks would be abandoned" when all running tasks carry over to the new session&lt;/p&gt;
+&lt;p&gt;• Fixed pinned background agents being re-prompted to "Continue from where you left off" after every auto-update&lt;/p&gt;
+&lt;p&gt;• Fixed backgrounding the main turn spawning a phantom "general-purpose (resumed)" subagent that re-ran the main conversation&lt;/p&gt;
+&lt;p&gt;• Fixed agent panel hiding sibling agents when viewing a subagent&lt;/p&gt;
+&lt;p&gt;• Improved background agents: the launch result no longer instructs Claude to "end your response" — it keeps working on other tasks while the agent runs&lt;/p&gt;
+&lt;p&gt;• Improved MCP headersHelper auth: the helper now re-runs and reconnects automatically when a tool call returns 401/403&lt;/p&gt;
+&lt;p&gt;• Improved plugin auto-rename: marketplace renames maps are now followed automatically, updating your settings to the new name&lt;/p&gt;
+&lt;p&gt;• Improved /add-dir message when the directory is already a working directory&lt;/p&gt;</content>
+  </entry>
+</feed>
@@ -0,0 +1,77 @@
+# Claude Code Plugins
+
+This directory contains some official Claude Code plugins that extend functionality through custom commands, agents, and workflows. These are examples of what's possible with the Claude Code plugin system—many more plugins are available through community marketplaces.
+
+## What are Claude Code Plugins?
+
+Claude Code plugins are extensions that enhance Claude Code with custom slash commands, specialized agents, hooks, and MCP servers. Plugins can be shared across projects and teams, providing consistent tooling and workflows.
+
+Learn more in the [official plugins documentation](https://docs.claude.com/en/docs/claude-code/plugins).
+
+## Plugins in This Directory
+
+| Name | Description | Contents |
+|------|-------------|----------|
+| [agent-sdk-dev](./agent-sdk-dev/) | Development kit for working with the Claude Agent SDK | **Command:** `/new-sdk-app` - Interactive setup for new Agent SDK projects<br>**Agents:** `agent-sdk-verifier-py`, `agent-sdk-verifier-ts` - Validate SDK applications against best practices |
+| [claude-opus-4-5-migration](./claude-opus-4-5-migration/) | Migrate code and prompts from Sonnet 4.x and Opus 4.1 to Opus 4.5 | **Skill:** `claude-opus-4-5-migration` - Automated migration of model strings, beta headers, and prompt adjustments |
+| [code-review](./code-review/) | Automated PR code review using multiple specialized agents with confidence-based scoring to filter false positives | **Command:** `/code-review` - Automated PR review workflow<br>**Agents:** 5 parallel Sonnet agents for CLAUDE.md compliance, bug detection, historical context, PR history, and code comments |
+| [commit-commands](./commit-commands/) | Git workflow automation for committing, pushing, and creating pull requests | **Commands:** `/commit`, `/commit-push-pr`, `/clean_gone` - Streamlined git operations |
+| [explanatory-output-style](./explanatory-output-style/) | Adds educational insights about implementation choices and codebase patterns (mimics the deprecated Explanatory output style) | **Hook:** SessionStart - Injects educational context at the start of each session |
+| [feature-dev](./feature-dev/) | Comprehensive feature development workflow with a structured 7-phase approach | **Command:** `/feature-dev` - Guided feature development workflow<br>**Agents:** `code-explorer`, `code-architect`, `code-reviewer` - For codebase analysis, architecture design, and quality review |
+| [frontend-design](./frontend-design/) | Create distinctive, production-grade frontend interfaces that avoid generic AI aesthetics | **Skill:** `frontend-design` - Auto-invoked for frontend work, providing guidance on bold design choices, typography, animations, and visual details |
+| [hookify](./hookify/) | Easily create custom hooks to prevent unwanted behaviors by analyzing conversation patterns or explicit instructions | **Commands:** `/hookify`, `/hookify:list`, `/hookify:configure`, `/hookify:help`<br>**Agent:** `conversation-analyzer` - Analyzes conversations for problematic behaviors<br>**Skill:** `writing-rules` - Guidance on hookify rule syntax |
+| [learning-output-style](./learning-output-style/) | Interactive learning mode that requests meaningful code contributions at decision points (mimics the unshipped Learning output style) | **Hook:** SessionStart - Encourages users to write meaningful code (5-10 lines) at decision points while receiving educational insights |
+| [plugin-dev](./plugin-dev/) | Comprehensive toolkit for developing Claude Code plugins with 7 expert skills and AI-assisted creation | **Command:** `/plugin-dev:create-plugin` - 8-phase guided workflow for building plugins<br>**Agents:** `agent-creator`, `plugin-validator`, `skill-reviewer`<br>**Skills:** Hook development, MCP integration, plugin structure, settings, commands, agents, and skill development |
+| [pr-review-toolkit](./pr-review-toolkit/) | Comprehensive PR review agents specializing in comments, tests, error handling, type design, code quality, and code simplification | **Command:** `/pr-review-toolkit:review-pr` - Run with optional review aspects (comments, tests, errors, types, code, simplify, all)<br>**Agents:** `comment-analyzer`, `pr-test-analyzer`, `silent-failure-hunter`, `type-design-analyzer`, `code-reviewer`, `code-simplifier` |
+| [ralph-wiggum](./ralph-wiggum/) | Interactive self-referential AI loops for iterative development. Claude works on the same task repeatedly until completion | **Commands:** `/ralph-loop`, `/cancel-ralph` - Start/stop autonomous iteration loops<br>**Hook:** Stop - Intercepts exit attempts to continue iteration |
+| [security-guidance](./security-guidance/) | Security reminder hook that warns about potential security issues when editing files | **Hook:** PreToolUse - Monitors 9 security patterns including command injection, XSS, eval usage, dangerous HTML, pickle deserialization, and os.system calls |
+
+## Installation
+
+These plugins are included in the Claude Code repository. To use them in your own projects:
+
+1. Install Claude Code globally:
+```bash
+npm install -g @anthropic-ai/claude-code
+```
+
+2. Navigate to your project and run Claude Code:
+```bash
+claude
+```
+
+3. Use the `/plugin` command to install plugins from marketplaces, or configure them in your project's `.claude/settings.json`.
+
+For detailed plugin installation and configuration, see the [official documentation](https://docs.claude.com/en/docs/claude-code/plugins).
+
+## Plugin Structure
+
+Each plugin follows the standard Claude Code plugin structure:
+
+```
+plugin-name/
+├── .claude-plugin/
+│   └── plugin.json          # Plugin metadata
+├── commands/                # Slash commands (optional)
+├── agents/                  # Specialized agents (optional)
+├── skills/                  # Agent Skills (optional)
+├── hooks/                   # Event handlers (optional)
+├── .mcp.json                # External tool configuration (optional)
+└── README.md                # Plugin documentation
+```
+
+## Contributing
+
+When adding new plugins to this directory:
+
+1. Follow the standard plugin structure
+2. Include a comprehensive README.md
+3. Add plugin metadata in `.claude-plugin/plugin.json`
+4. Document all commands and agents
+5. Provide usage examples
+
+## Learn More
+
+- [Claude Code Documentation](https://docs.claude.com/en/docs/claude-code/overview)
+- [Plugin System Documentation](https://docs.claude.com/en/docs/claude-code/plugins)
+- [Agent SDK Documentation](https://docs.claude.com/en/api/agent-sdk/overview)
@@ -0,0 +1,9 @@
+{
+  "name": "agent-sdk-dev",
+  "description": "Claude Agent SDK Development Plugin",
+  "version": "1.0.0",
+  "author": {
+    "name": "Ashwin Bhat",
+    "email": "ashwin@anthropic.com"
+  }
+}
@@ -0,0 +1,208 @@
+# Agent SDK Development Plugin
+
+A comprehensive plugin for creating and verifying Claude Agent SDK applications in Python and TypeScript.
+
+## Overview
+
+The Agent SDK Development Plugin streamlines the entire lifecycle of building Agent SDK applications, from initial scaffolding to verification against best practices. It helps you quickly start new projects with the latest SDK versions and ensures your applications follow official documentation patterns.
+
+## Features
+
+### Command: `/new-sdk-app`
+
+Interactive command that guides you through creating a new Claude Agent SDK application.
+
+**What it does:**
+- Asks clarifying questions about your project (language, name, agent type, starting point)
+- Checks for and installs the latest SDK version
+- Creates all necessary project files and configuration
+- Sets up proper environment files (.env.example, .gitignore)
+- Provides a working example tailored to your use case
+- Runs type checking (TypeScript) or syntax validation (Python)
+- Automatically verifies the setup using the appropriate verifier agent
+
+**Usage:**
+```bash
+/new-sdk-app my-project-name
+```
+
+Or simply:
+```bash
+/new-sdk-app
+```
+
+The command will interactively ask you:
+1. Language choice (TypeScript or Python)
+2. Project name (if not provided)
+3. Agent type (coding, business, custom)
+4. Starting point (minimal, basic, or specific example)
+5. Tooling preferences (npm/yarn/pnpm or pip/poetry)
+
+**Example:**
+```bash
+/new-sdk-app customer-support-agent
+# → Creates a new Agent SDK project for a customer support agent
+# → Sets up TypeScript or Python environment
+# → Installs latest SDK version
+# → Verifies the setup automatically
+```
+
+### Agent: `agent-sdk-verifier-py`
+
+Thoroughly verifies Python Agent SDK applications for correct setup and best practices.
+
+**Verification checks:**
+- SDK installation and version
+- Python environment setup (requirements.txt, pyproject.toml)
+- Correct SDK usage and patterns
+- Agent initialization and configuration
+- Environment and security (.env, API keys)
+- Error handling and functionality
+- Documentation completeness
+
+**When to use:**
+- After creating a new Python SDK project
+- After modifying an existing Python SDK application
+- Before deploying a Python SDK application
+
+**Usage:**
+The agent runs automatically after `/new-sdk-app` creates a Python project, or you can trigger it by asking:
+```
+"Verify my Python Agent SDK application"
+"Check if my SDK app follows best practices"
+```
+
+**Output:**
+Provides a comprehensive report with:
+- Overall status (PASS / PASS WITH WARNINGS / FAIL)
+- Critical issues that prevent functionality
+- Warnings about suboptimal patterns
+- List of passed checks
+- Specific recommendations with SDK documentation references
+
+### Agent: `agent-sdk-verifier-ts`
+
+Thoroughly verifies TypeScript Agent SDK applications for correct setup and best practices.
+
+**Verification checks:**
+- SDK installation and version
+- TypeScript configuration (tsconfig.json)
+- Correct SDK usage and patterns
+- Type safety and imports
+- Agent initialization and configuration
+- Environment and security (.env, API keys)
+- Error handling and functionality
+- Documentation completeness
+
+**When to use:**
+- After creating a new TypeScript SDK project
+- After modifying an existing TypeScript SDK application
+- Before deploying a TypeScript SDK application
+
+**Usage:**
+The agent runs automatically after `/new-sdk-app` creates a TypeScript project, or you can trigger it by asking:
+```
+"Verify my TypeScript Agent SDK application"
+"Check if my SDK app follows best practices"
+```
+
+**Output:**
+Provides a comprehensive report with:
+- Overall status (PASS / PASS WITH WARNINGS / FAIL)
+- Critical issues that prevent functionality
+- Warnings about suboptimal patterns
+- List of passed checks
+- Specific recommendations with SDK documentation references
+
+## Workflow Example
+
+Here's a typical workflow using this plugin:
+
+1. **Create a new project:**
+```bash
+/new-sdk-app code-reviewer-agent
+```
+
+2. **Answer the interactive questions:**
+```
+Language: TypeScript
+Agent type: Coding agent (code review)
+Starting point: Basic agent with common features
+```
+
+3. **Automatic verification:**
+The command automatically runs `agent-sdk-verifier-ts` to ensure everything is correctly set up.
+
+4. **Start developing:**
+```bash
+# Set your API key
+echo "ANTHROPIC_API_KEY=your_key_here" > .env
+
+# Run your agent
+npm start
+```
+
+5. **Verify after changes:**
+```
+"Verify my SDK application"
+```
+
+## Installation
+
+This plugin is included in the Claude Code repository. To use it:
+
+1. Ensure Claude Code is installed
+2. The plugin commands and agents are automatically available
+
+## Best Practices
+
+- **Always use the latest SDK version**: `/new-sdk-app` checks for and installs the latest version
+- **Verify before deploying**: Run the verifier agent before deploying to production
+- **Keep API keys secure**: Never commit `.env` files or hardcode API keys
+- **Follow SDK documentation**: The verifier agents check against official patterns
+- **Type check TypeScript projects**: Run `npx tsc --noEmit` regularly
+- **Test your agents**: Create test cases for your agent's functionality
+
+## Resources
+
+- [Agent SDK Overview](https://docs.claude.com/en/api/agent-sdk/overview)
+- [TypeScript SDK Reference](https://docs.claude.com/en/api/agent-sdk/typescript)
+- [Python SDK Reference](https://docs.claude.com/en/api/agent-sdk/python)
+- [Agent SDK Examples](https://docs.claude.com/en/api/agent-sdk/examples)
+
+## Troubleshooting
+
+### Type errors in TypeScript project
+
+**Issue**: TypeScript project has type errors after creation
+
+**Solution**:
+- The `/new-sdk-app` command runs type checking automatically
+- If errors persist, check that you're using the latest SDK version
+- Verify your `tsconfig.json` matches SDK requirements
+
+### Python import errors
+
+**Issue**: Cannot import from `claude_agent_sdk`
+
+**Solution**:
+- Ensure you've installed dependencies: `pip install -r requirements.txt`
+- Activate your virtual environment if using one
+- Check that the SDK is installed: `pip show claude-agent-sdk`
+
+### Verification fails with warnings
+
+**Issue**: Verifier agent reports warnings
+
+**Solution**:
+- Review the specific warnings in the report
+- Check the SDK documentation references provided
+- Warnings don't prevent functionality but indicate areas for improvement
+
+## Author
+
+Ashwin Bhat (ashwin@anthropic.com)
+
+## Version
+
+1.0.0
@@ -0,0 +1,140 @@
+---
+name: agent-sdk-verifier-py
+description: Use this agent to verify that a Python Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a Python Agent SDK app has been created or modified.
+model: sonnet
+---
+
+You are a Python Agent SDK application verifier. Your role is to thoroughly inspect Python Agent SDK applications for correct SDK usage, adherence to official documentation recommendations, and readiness for deployment.
+
+## Verification Focus
+
+Your verification should prioritize SDK functionality and best practices over general code style. Focus on:
+
+1. **SDK Installation and Configuration**:
+
+   - Verify `claude-agent-sdk` is installed (check requirements.txt, pyproject.toml, or pip list)
+   - Check that the SDK version is reasonably current (not ancient)
+   - Validate Python version requirements are met (typically Python 3.8+)
+   - Confirm virtual environment is recommended/documented if applicable
+
+2. **Python Environment Setup**:
+
+   - Check for requirements.txt or pyproject.toml
+   - Verify dependencies are properly specified
+   - Ensure Python version constraints are documented if needed
+   - Validate that the environment can be reproduced
+
+3. **SDK Usage and Patterns**:
+
+   - Verify correct imports from `claude_agent_sdk` (or appropriate SDK module)
+   - Check that agents are properly initialized according to SDK docs
+   - Validate that agent configuration follows SDK patterns (system prompts, models, etc.)
+   - Ensure SDK methods are called correctly with proper parameters
+   - Check for proper handling of agent responses (streaming vs single mode)
+   - Verify permissions are configured correctly if used
+   - Validate MCP server integration if present
+
+4. **Code Quality**:
+
+   - Check for basic syntax errors
+   - Verify imports are correct and available
+   - Ensure proper error handling
+   - Validate that the code structure makes sense for the SDK
+
+5. **Environment and Security**:
+
+   - Check that `.env.example` exists with `ANTHROPIC_API_KEY`
+   - Verify `.env` is in `.gitignore`
+   - Ensure API keys are not hardcoded in source files
+   - Validate proper error handling around API calls
+
+6. **SDK Best Practices** (based on official docs):
+
+   - System prompts are clear and well-structured
+   - Appropriate model selection for the use case
+   - Permissions are properly scoped if used
+   - Custom tools (MCP) are correctly integrated if present
+   - Subagents are properly configured if used
+   - Session handling is correct if applicable
+
+7. **Functionality Validation**:
+
+   - Verify the application structure makes sense for the SDK
+   - Check that agent initialization and execution flow is correct
+   - Ensure error handling covers SDK-specific errors
+   - Validate that the app follows SDK documentation patterns
+
+8. **Documentation**:
+   - Check for README or basic documentation
+   - Verify setup instructions are present (including virtual environment setup)
+   - Ensure any custom configurations are documented
+   - Confirm installation instructions are clear
+
+## What NOT to Focus On
+
+- General code style preferences (PEP 8 formatting, naming conventions, etc.)
+- Python-specific style choices (snake_case vs camelCase debates)
+- Import ordering preferences
+- General Python best practices unrelated to SDK usage
+
+## Verification Process
+
+1. **Read the relevant files**:
+
+   - requirements.txt or pyproject.toml
+   - Main application files (main.py, app.py, src/\*, etc.)
+   - .env.example and .gitignore
+   - Any configuration files
+
+2. **Check SDK Documentation Adherence**:
+
+   - Use WebFetch to reference the official Python SDK docs: https://docs.claude.com/en/api/agent-sdk/python
+   - Compare the implementation against official patterns and recommendations
+   - Note any deviations from documented best practices
+
+3. **Validate Imports and Syntax**:
+
+   - Check that all imports are correct
+   - Look for obvious syntax errors
+   - Verify SDK is properly imported
+
+4. **Analyze SDK Usage**:
+   - Verify SDK methods are used correctly
+   - Check that configuration options match SDK documentation
+   - Validate that patterns follow official examples
+
+## Verification Report Format
+
+Provide a comprehensive report:
+
+**Overall Status**: PASS | PASS WITH WARNINGS | FAIL
+
+**Summary**: Brief overview of findings
+
+**Critical Issues** (if any):
+
+- Issues that prevent the app from functioning
+- Security problems
+- SDK usage errors that will cause runtime failures
+- Syntax errors or import problems
+
+**Warnings** (if any):
+
+- Suboptimal SDK usage patterns
+- Missing SDK features that would improve the app
+- Deviations from SDK documentation recommendations
+- Missing documentation or setup instructions
+
+**Passed Checks**:
+
+- What is correctly configured
+- SDK features properly implemented
+- Security measures in place
+
+**Recommendations**:
+
+- Specific suggestions for improvement
+- References to SDK documentation
+- Next steps for enhancement
+
+Be thorough but constructive. Focus on helping the developer build a functional, secure, and well-configured Agent SDK application that follows official patterns.
@@ -0,0 +1,145 @@
+---
+name: agent-sdk-verifier-ts
+description: Use this agent to verify that a TypeScript Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a TypeScript Agent SDK app has been created or modified.
+model: sonnet
+---
+
+You are a TypeScript Agent SDK application verifier. Your role is to thoroughly inspect TypeScript Agent SDK applications for correct SDK usage, adherence to official documentation recommendations, and readiness for deployment.
+
+## Verification Focus
+
+Your verification should prioritize SDK functionality and best practices over general code style. Focus on:
+
+1. **SDK Installation and Configuration**:
+
+   - Verify `@anthropic-ai/claude-agent-sdk` is installed
+   - Check that the SDK version is reasonably current (not ancient)
+   - Confirm package.json has `"type": "module"` for ES modules support
+   - Validate that Node.js version requirements are met (check package.json engines field if present)
+
+2. **TypeScript Configuration**:
+
+   - Verify tsconfig.json exists and has appropriate settings for the SDK
+   - Check module resolution settings (should support ES modules)
+   - Ensure target is modern enough for the SDK
+   - Validate that compilation settings won't break SDK imports
+
+3. **SDK Usage and Patterns**:
+
+   - Verify correct imports from `@anthropic-ai/claude-agent-sdk`
+   - Check that agents are properly initialized according to SDK docs
+   - Validate that agent configuration follows SDK patterns (system prompts, models, etc.)
+   - Ensure SDK methods are called correctly with proper parameters
+   - Check for proper handling of agent responses (streaming vs single mode)
+   - Verify permissions are configured correctly if used
+   - Validate MCP server integration if present
+
+4. **Type Safety and Compilation**:
+
+   - Run `npx tsc --noEmit` to check for type errors
+   - Verify that all SDK imports have correct type definitions
+   - Ensure the code compiles without errors
+   - Check that types align with SDK documentation
+
+5. **Scripts and Build Configuration**:
+
+   - Verify package.json has necessary scripts (build, start, typecheck)
+   - Check that scripts are correctly configured for TypeScript/ES modules
+   - Validate that the application can be built and run
+
+6. **Environment and Security**:
+
+   - Check that `.env.example` exists with `ANTHROPIC_API_KEY`
+   - Verify `.env` is in `.gitignore`
+   - Ensure API keys are not hardcoded in source files
+   - Validate proper error handling around API calls
+
+7. **SDK Best Practices** (based on official docs):
+
+   - System prompts are clear and well-structured
+   - Appropriate model selection for the use case
+   - Permissions are properly scoped if used
+   - Custom tools (MCP) are correctly integrated if present
+   - Subagents are properly configured if used
+   - Session handling is correct if applicable
+
+8. **Functionality Validation**:
+
+   - Verify the application structure makes sense for the SDK
+   - Check that agent initialization and execution flow is correct
+   - Ensure error handling covers SDK-specific errors
+   - Validate that the app follows SDK documentation patterns
+
+9. **Documentation**:
+   - Check for README or basic documentation
+   - Verify setup instructions are present if needed
+   - Ensure any custom configurations are documented
+
+## What NOT to Focus On
+
+- General code style preferences (formatting, naming conventions, etc.)
+- Whether developers use `type` vs `interface` or other TypeScript style choices
+- Unused variable naming conventions
+- General TypeScript best practices unrelated to SDK usage
+
+## Verification Process
+
+1. **Read the relevant files**:
+
+   - package.json
+   - tsconfig.json
+   - Main application files (index.ts, src/\*, etc.)
+   - .env.example and .gitignore
+   - Any configuration files
+
+2. **Check SDK Documentation Adherence**:
+
+   - Use WebFetch to reference the official TypeScript SDK docs: https://docs.claude.com/en/api/agent-sdk/typescript
+   - Compare the implementation against official patterns and recommendations
+   - Note any deviations from documented best practices
+
+3. **Run Type Checking**:
+
+   - Execute `npx tsc --noEmit` to verify no type errors
+   - Report any compilation issues
+
+4. **Analyze SDK Usage**:
+   - Verify SDK methods are used correctly
+   - Check that configuration options match SDK documentation
+   - Validate that patterns follow official examples
+
+## Verification Report Format
+
+Provide a comprehensive report:
+
+**Overall Status**: PASS | PASS WITH WARNINGS | FAIL
+
+**Summary**: Brief overview of findings
+
+**Critical Issues** (if any):
+
+- Issues that prevent the app from functioning
+- Security problems
+- SDK usage errors that will cause runtime failures
+- Type errors or compilation failures
+
+**Warnings** (if any):
+
+- Suboptimal SDK usage patterns
+- Missing SDK features that would improve the app
+- Deviations from SDK documentation recommendations
+- Missing documentation
+
+**Passed Checks**:
+
+- What is correctly configured
+- SDK features properly implemented
+- Security measures in place
+
+**Recommendations**:
+
+- Specific suggestions for improvement
+- References to SDK documentation
+- Next steps for enhancement
+
+Be thorough but constructive. Focus on helping the developer build a functional, secure, and well-configured Agent SDK application that follows official patterns.
@@ -0,0 +1,176 @@
+---
+description: Create and setup a new Claude Agent SDK application
+argument-hint: [project-name]
+---
+
+You are tasked with helping the user create a new Claude Agent SDK application. Follow these steps carefully:
+
+## Reference Documentation
+
+Before starting, review the official documentation to ensure you provide accurate and up-to-date guidance. Use WebFetch to read these pages:
+
+1. **Start with the overview**: https://docs.claude.com/en/api/agent-sdk/overview
+2. **Based on the user's language choice, read the appropriate SDK reference**:
+   - TypeScript: https://docs.claude.com/en/api/agent-sdk/typescript
+   - Python: https://docs.claude.com/en/api/agent-sdk/python
+3. **Read relevant guides mentioned in the overview** such as:
+   - Streaming vs Single Mode
+   - Permissions
+   - Custom Tools
+   - MCP integration
+   - Subagents
+   - Sessions
+   - Any other relevant guides based on the user's needs
+
+**IMPORTANT**: Always check for and use the latest versions of packages. Use WebSearch or WebFetch to verify current versions before installation.
+
+## Gather Requirements
+
+IMPORTANT: Ask these questions one at a time. Wait for the user's response before asking the next question. This makes it easier for the user to respond.
+
+Ask the questions in this order (skip any that the user has already provided via arguments):
+
+1. **Language** (ask first): "Would you like to use TypeScript or Python?"
+
+   - Wait for response before continuing
+
+2. **Project name** (ask second): "What would you like to name your project?"
+
+   - If $ARGUMENTS is provided, use that as the project name and skip this question
+   - Wait for response before continuing
+
+3. **Agent type** (ask third, but skip if #2 was sufficiently detailed): "What kind of agent are you building? Some examples:
+
+   - Coding agent (SRE, security review, code review)
+   - Business agent (customer support, content creation)
+   - Custom agent (describe your use case)"
+   - Wait for response before continuing
+
+4. **Starting point** (ask fourth): "Would you like:
+
+   - A minimal 'Hello World' example to start
+   - A basic agent with common features
+   - A specific example based on your use case"
+   - Wait for response before continuing
+
+5. **Tooling choice** (ask fifth): Let the user know what tools you'll use, and confirm with them that these are the tools they want to use (for example, they may prefer pnpm or bun over npm). Respect the user's preferences when executing on the requirements.
+
+After all questions are answered, proceed to create the setup plan.
+
+## Setup Plan
+
+Based on the user's answers, create a plan that includes:
+
+1. **Project initialization**:
+
+   - Create project directory (if it doesn't exist)
+   - Initialize package manager:
+     - TypeScript: `npm init -y` and setup `package.json` with type: "module" and scripts (include a "typecheck" script)
+     - Python: Create `requirements.txt` or use `poetry init`
+   - Add necessary configuration files:
+     - TypeScript: Create `tsconfig.json` with proper settings for the SDK
+     - Python: Optionally create config files if needed
+
+2. **Check for Latest Versions**:
+
+   - BEFORE installing, use WebSearch or check npm/PyPI to find the latest version
+   - For TypeScript: Check https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk
+   - For Python: Check https://pypi.org/project/claude-agent-sdk/
+   - Inform the user which version you're installing
+
+3. **SDK Installation**:
+
+   - TypeScript: `npm install @anthropic-ai/claude-agent-sdk@latest` (or specify latest version)
+   - Python: `pip install claude-agent-sdk` (pip installs latest by default)
+   - After installation, verify the installed version:
+     - TypeScript: Check package.json or run `npm list @anthropic-ai/claude-agent-sdk`
+     - Python: Run `pip show claude-agent-sdk`
+
+4. **Create starter files**:
+
+   - TypeScript: Create an `index.ts` or `src/index.ts` with a basic query example
+   - Python: Create a `main.py` with a basic query example
+   - Include proper imports and basic error handling
+   - Use modern, up-to-date syntax and patterns from the latest SDK version
+
+5. **Environment setup**:
+
+   - Create a `.env.example` file with `ANTHROPIC_API_KEY=your_api_key_here`
+   - Add `.env` to `.gitignore`
+   - Explain how to get an API key from https://console.anthropic.com/
+
+6. **Optional: Create .claude directory structure**:
+   - Offer to create `.claude/` directory for agents, commands, and settings
+   - Ask if they want any example subagents or slash commands
+
+## Implementation
+
+After gathering requirements and getting user confirmation on the plan:
+
+1. Check for latest package versions using WebSearch or WebFetch
+2. Execute the setup steps
+3. Create all necessary files
+4. Install dependencies (always use latest stable versions)
+5. Verify installed versions and inform the user
+6. Create a working example based on their agent type
+7. Add helpful comments in the code explaining what each part does
+8. **VERIFY THE CODE WORKS BEFORE FINISHING**:
+   - For TypeScript:
+     - Run `npx tsc --noEmit` to check for type errors
+     - Fix ALL type errors until types pass completely
+     - Ensure imports and types are correct
+     - Only proceed when type checking passes with no errors
+   - For Python:
+     - Verify imports are correct
+     - Check for basic syntax errors
+   - **DO NOT consider the setup complete until the code verifies successfully**
+
+## Verification
+
+After all files are created and dependencies are installed, use the appropriate verifier agent to validate that the Agent SDK application is properly configured and ready for use:
+
+1. **For TypeScript projects**: Launch the **agent-sdk-verifier-ts** agent to validate the setup
+2. **For Python projects**: Launch the **agent-sdk-verifier-py** agent to validate the setup
+3. The agent will check SDK usage, configuration, functionality, and adherence to official documentation
+4. Review the verification report and address any issues
+
+## Getting Started Guide
+
+Once setup is complete and verified, provide the user with:
+
+1. **Next steps**:
+
+   - How to set their API key
+   - How to run their agent:
+     - TypeScript: `npm start` or `node --loader ts-node/esm index.ts`
+     - Python: `python main.py`
+
+2. **Useful resources**:
+
+   - Link to TypeScript SDK reference: https://docs.claude.com/en/api/agent-sdk/typescript
+   - Link to Python SDK reference: https://docs.claude.com/en/api/agent-sdk/python
+   - Explain key concepts: system prompts, permissions, tools, MCP servers
+
+3. **Common next steps**:
+   - How to customize the system prompt
+   - How to add custom tools via MCP
+   - How to configure permissions
+   - How to create subagents
+
+## Important Notes
+
+- **ALWAYS USE LATEST VERSIONS**: Before installing any packages, check for the latest versions using WebSearch or by checking npm/PyPI directly
+- **VERIFY CODE RUNS CORRECTLY**:
+  - For TypeScript: Run `npx tsc --noEmit` and fix ALL type errors before finishing
+  - For Python: Verify syntax and imports are correct
+  - Do NOT consider the task complete until the code passes verification
+- Verify the installed version after installation and inform the user
+- Check the official documentation for any version-specific requirements (Node.js version, Python version, etc.)
+- Always check if directories/files already exist before creating them
+- Use the user's preferred package manager (npm, yarn, pnpm for TypeScript; pip, poetry for Python)
+- Ensure all code examples are functional and include proper error handling
+- Use modern syntax and patterns that are compatible with the latest SDK version
+- Make the experience interactive and educational
+- **ASK QUESTIONS ONE AT A TIME** - Do not ask multiple questions in a single response
+
+Begin by asking the FIRST requirement question only. Wait for the user's answer before proceeding to the next question.
@@ -0,0 +1,9 @@
+{
+  "name": "claude-opus-4-5-migration",
+  "version": "1.0.0",
+  "description": "Migrate your code and prompts from Sonnet 4.x and Opus 4.1 to Opus 4.5.",
+  "author": {
+    "name": "William Hu",
+    "email": "whu@anthropic.com"
+  }
+}
@@ -0,0 +1,21 @@
+# Claude Opus 4.5 Migration Plugin
+
+Migrate your code and prompts from Sonnet 4.x and Opus 4.1 to Opus 4.5.
+
+## Overview
+
+This skill updates your code and prompts to be compatible with Opus 4.5. It automates the migration process, handling model strings, beta headers, and other configuration details. If you run into any issues with Opus 4.5 after migration, you can continue using this skill to adjust your prompts.
+
+## Usage
+
+```
+"Migrate my codebase to Opus 4.5"
+```
+
+## Learn More
+
+Refer to our [prompting guide](https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-4-best-practices) for best practices on prompting Claude models.
+
+## Authors
+
+William Hu (whu@anthropic.com)
@@ -0,0 +1,105 @@
+---
+name: claude-opus-4-5-migration
+description: Migrate prompts and code from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5. Use when the user wants to update their codebase, prompts, or API calls to use Opus 4.5. Handles model string updates and prompt adjustments for known Opus 4.5 behavioral differences. Does NOT migrate Haiku 4.5.
+---
+
+# Opus 4.5 Migration Guide
+
+One-shot migration from Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5.
+
+## Migration Workflow
+
+1. Search codebase for model strings and API calls
+2. Update model strings to Opus 4.5 (see platform-specific strings below)
+3. Remove unsupported beta headers
+4. Add effort parameter set to `"high"` (see `references/effort.md`)
+5. Summarize all changes made
+6. Tell the user: "If you encounter any issues with Opus 4.5, let me know and I can help adjust your prompts."
+
+## Model String Updates
+
+Identify which platform the codebase uses, then replace model strings accordingly.
+
+### Unsupported Beta Headers
+
+Remove the `context-1m-2025-08-07` beta header if present—it is not yet supported with Opus 4.5. Leave a comment noting this:
+
+```python
+# Note: 1M context beta (context-1m-2025-08-07) not yet supported with Opus 4.5
+```
+
+### Target Model Strings (Opus 4.5)
+
+| Platform | Opus 4.5 Model String |
+|----------|----------------------|
+| Anthropic API (1P) | `claude-opus-4-5-20251101` |
+| AWS Bedrock | `anthropic.claude-opus-4-5-20251101-v1:0` |
+| Google Vertex AI | `claude-opus-4-5@20251101` |
+| Azure AI Foundry | `claude-opus-4-5-20251101` |
+
+### Source Model Strings to Replace
+
+| Source Model | Anthropic API (1P) | AWS Bedrock | Google Vertex AI |
+|--------------|-------------------|-------------|------------------|
+| Sonnet 4.0 | `claude-sonnet-4-20250514` | `anthropic.claude-sonnet-4-20250514-v1:0` | `claude-sonnet-4@20250514` |
+| Sonnet 4.5 | `claude-sonnet-4-5-20250929` | `anthropic.claude-sonnet-4-5-20250929-v1:0` | `claude-sonnet-4-5@20250929` |
+| Opus 4.1 | `claude-opus-4-1-20250422` | `anthropic.claude-opus-4-1-20250422-v1:0` | `claude-opus-4-1@20250422` |
+
+**Do NOT migrate**: Any Haiku models (e.g., `claude-haiku-4-5-20251001`).
+
+## Prompt Adjustments
+
+Opus 4.5 has known behavioral differences from previous models. **Only apply these fixes if the user explicitly requests them or reports a specific issue.** By default, just update model strings.
+
+**Integration guidelines**: When adding snippets, don't just append them to prompts. Integrate them thoughtfully:
+- Use XML tags (e.g., `<code_guidelines>`, `<tool_usage>`) to organize additions
+- Match the style and structure of the existing prompt
+- Place snippets in logical locations (e.g., coding guidelines near other coding instructions)
+- If the prompt already uses XML tags, add new content within appropriate existing tags or create consistent new ones
+
+### 1. Tool Overtriggering
+
+Opus 4.5 is more responsive to system prompts. Aggressive language that prevented undertriggering on previous models may now cause overtriggering.
+
+**Apply if**: User reports tools being called too frequently or unnecessarily.
+
+**Find and soften**:
+- `CRITICAL:` → remove or soften
+- `You MUST...` → `You should...`
+- `ALWAYS do X` → `Do X`
+- `NEVER skip...` → `Don't skip...`
+- `REQUIRED` → remove or soften
+
+Only apply to tool-triggering instructions. Leave other uses of emphasis alone.
+
+### 2. Over-Engineering Prevention
+
+Opus 4.5 tends to create extra files, add unnecessary abstractions, or build unrequested flexibility.
+
+**Apply if**: User reports unwanted files, excessive abstraction, or unrequested features. Add the snippet from `references/prompt-snippets.md`.
+
+### 3. Code Exploration
+
+Opus 4.5 can be overly conservative about exploring code, proposing solutions without reading files.
+
+**Apply if**: User reports the model proposing fixes without inspecting relevant code. Add the snippet from `references/prompt-snippets.md`.
+
+### 4. Frontend Design
+
+**Apply if**: User requests improved frontend design quality or reports generic-looking outputs.
+
+Add the frontend aesthetics snippet from `references/prompt-snippets.md`.
+
+### 5. Thinking Sensitivity
+
+When extended thinking is not enabled (the default), Opus 4.5 is particularly sensitive to the word "think" and its variants. Extended thinking is enabled only if the API request contains a `thinking` parameter.
+
+**Apply if**: User reports issues related to "thinking" while extended thinking is not enabled (no `thinking` parameter in request).
+
+Replace "think" with alternatives like "consider," "believe," or "evaluate."
+
+## Reference
+
+See `references/prompt-snippets.md` for the full text of each snippet to add.
+
+See `references/effort.md` for configuring the effort parameter (only if user requests it).
@@ -0,0 +1,70 @@
+# Effort Parameter (Beta)
+
+**Add effort set to `"high"` during migration.** This is the default configuration for best performance with Opus 4.5.
+
+## Overview
+
+Effort controls how eagerly Claude spends tokens. It affects all tokens: thinking, text responses, and function calls.
+
+| Effort | Use Case |
+|--------|----------|
+| `high` | Best performance, deep reasoning (default) |
+| `medium` | Balance of cost/latency vs. performance |
+| `low` | Simple, high-volume queries; significant token savings |
+
+## Implementation
+
+Requires beta flag `effort-2025-11-24` in API calls.
+
+**Python SDK:**
+```python
+response = client.messages.create(
+    model="claude-opus-4-5-20251101",
+    max_tokens=1024,
+    betas=["effort-2025-11-24"],
+    output_config={
+        "effort": "high"  # or "medium" or "low"
+    },
+    messages=[...]
+)
+```
+
+**TypeScript SDK:**
+```typescript
+const response = await client.messages.create({
+  model: "claude-opus-4-5-20251101",
+  max_tokens: 1024,
+  betas: ["effort-2025-11-24"],
+  output_config: {
+    effort: "high"  // or "medium" or "low"
+  },
+  messages: [...]
+});
+```
+
+**Raw API:**
+```json
+{
+  "model": "claude-opus-4-5-20251101",
+  "max_tokens": 1024,
+  "anthropic-beta": "effort-2025-11-24",
+  "output_config": {
+    "effort": "high"
+  },
+  "messages": [...]
+}
+```
+
+## Effort vs. Thinking Budget
+
+Effort is independent of thinking budget:
+
+- High effort + no thinking = more tokens, but no thinking tokens
+- High effort + 32k thinking = more tokens, but thinking capped at 32k
+
+## Recommendations
+
+1. First determine effort level, then set thinking budget
+2. Best performance: high effort + high thinking budget
+3. Cost/latency optimization: medium effort
+4. Simple high-volume queries: low effort
@@ -0,0 +1,106 @@
+# Prompt Snippets for Opus 4.5
+
+Only apply these snippets if the user explicitly requests them or reports a specific issue. By default, the migration should only update model strings.
+
+## 1. Tool Overtriggering
+
+**Problem**: Prompts designed to reduce undertriggering on previous models may cause Opus 4.5 to overtrigger.
+
+**When to add**: User reports tools being called too frequently or unnecessarily.
+
+**Solution**: Replace aggressive language with normal phrasing.
+
+| Before | After |
+|--------|-------|
+| `CRITICAL: You MUST use this tool when...` | `Use this tool when...` |
+| `ALWAYS call the search function before...` | `Call the search function before...` |
+| `You are REQUIRED to...` | `You should...` |
+| `NEVER skip this step` | `Don't skip this step` |
+
+## 2. Over-Engineering Prevention
+
+**Problem**: Opus 4.5 may create extra files, add unnecessary abstractions, or build unrequested flexibility.
+
+**When to add**: User reports unwanted files, excessive abstraction, or unrequested features.
+
+**Snippet to add to system prompt**:
+
+```
+- Avoid over-engineering. Only make changes that are directly requested or clearly necessary. Keep solutions simple and focused.
+- Don't add features, refactor code, or make "improvements" beyond what was asked. A bug fix doesn't need surrounding code cleaned up. A simple feature doesn't need extra configurability.
+- Don't add error handling, fallbacks, or validation for scenarios that can't happen. Trust internal code and framework guarantees. Only validate at system boundaries (user input, external APIs). Don't use backwards-compatibility shims when you can just change the code.
+- Don't create helpers, utilities, or abstractions for one-time operations. Don't design for hypothetical future requirements. The right amount of complexity is the minimum needed for the current task. Reuse existing abstractions where possible and follow the DRY principle.
+```
+
+## 3. Code Exploration
+
+**Problem**: Opus 4.5 may propose solutions without reading code or make assumptions about unread files.
+
+**When to add**: User reports the model proposing fixes without inspecting relevant code.
+
+**Snippet to add to system prompt**:
+
+```
+ALWAYS read and understand relevant files before proposing code edits. Do not speculate about code you have not inspected. If the user references a specific file/path, you MUST open and inspect it before explaining or proposing fixes. Be rigorous and persistent in searching code for key facts. Thoroughly review the style, conventions, and abstractions of the codebase before implementing new features or abstractions.
+```
+
+## 4. Frontend Design Quality
+
+**Problem**: Default frontend outputs may look generic ("AI slop" aesthetic).
+
+**When to add**: User requests improved frontend design quality or reports generic-looking outputs.
+
+**Snippet to add to system prompt**:
+
+```xml
+<frontend_aesthetics>
+You tend to converge toward generic, "on distribution" outputs. In frontend design, this creates what users call the "AI slop" aesthetic. Avoid this: make creative, distinctive frontends that surprise and delight.
+
+Focus on:
+- Typography: Choose fonts that are beautiful, unique, and interesting. Avoid generic fonts like Arial and Inter; opt instead for distinctive choices that elevate the frontend's aesthetics.
+- Color & Theme: Commit to a cohesive aesthetic. Use CSS variables for consistency. Dominant colors with sharp accents outperform timid, evenly-distributed palettes. Draw from IDE themes and cultural aesthetics for inspiration.
+- Motion: Use animations for effects and micro-interactions. Prioritize CSS-only solutions for HTML. Use Motion library for React when available. Focus on high-impact moments: one well-orchestrated page load with staggered reveals (animation-delay) creates more delight than scattered micro-interactions.
+- Backgrounds: Create atmosphere and depth rather than defaulting to solid colors. Layer CSS gradients, use geometric patterns, or add contextual effects that match the overall aesthetic.
+
+Avoid generic AI-generated aesthetics:
+- Overused font families (Inter, Roboto, Arial, system fonts)
+- Clichéd color schemes (particularly purple gradients on white backgrounds)
+- Predictable layouts and component patterns
+- Cookie-cutter design that lacks context-specific character
+
+Interpret creatively and make unexpected choices that feel genuinely designed for the context. Vary between light and dark themes, different fonts, different aesthetics. You still tend to converge on common choices (Space Grotesk, for example) across generations. Avoid this: it is critical that you think outside the box!
+</frontend_aesthetics>
+```
+
+## 5. Thinking Sensitivity
+
+**Problem**: When extended thinking is not enabled (the default), Opus 4.5 is particularly sensitive to the word "think" and its variants.
+
+Extended thinking is not enabled by default. It is only enabled if the API request contains a `thinking` parameter:
+```json
+"thinking": {
+    "type": "enabled",
+    "budget_tokens": 10000
+}
+```
+
+**When to apply**: User reports issues related to "thinking" while extended thinking is not enabled (no `thinking` parameter in their request).
+
+**Solution**: Replace "think" with alternative words.
+
+| Before | After |
+|--------|-------|
+| `think about` | `consider` |
+| `think through` | `evaluate` |
+| `I think` | `I believe` |
+| `think carefully` | `consider carefully` |
+| `thinking` | `reasoning` / `considering` |
+
+## Usage Guidelines
+
+1. **Integrate thoughtfully** - Don't just append snippets; weave them into the existing prompt structure
+2. **Use XML tags** - Wrap additions in descriptive tags (e.g., `<coding_guidelines>`, `<tool_behavior>`) that match or complement existing prompt structure
+3. **Match prompt style** - If the prompt is concise, trim the snippet; if verbose, keep full detail
+4. **Place logically** - Put coding snippets near other coding instructions, tool guidance near tool definitions, etc.
+5. **Preserve existing content** - Insert snippets without removing functional content
+6. **Summarize changes** - After migration, list all model string updates and prompt modifications made
@@ -0,0 +1,10 @@
+{
+  "name": "code-review",
+  "description": "Automated code review for pull requests using multiple specialized agents with confidence-based scoring",
+  "version": "1.0.0",
+  "author": {
+    "name": "Boris Cherny",
+    "email": "boris@anthropic.com"
+  }
+}
+
@@ -0,0 +1,258 @@
+# Code Review Plugin
+
+Automated code review for pull requests using multiple specialized agents with confidence-based scoring to filter false positives.
+
+## Overview
+
+The Code Review Plugin automates pull request review by launching multiple agents in parallel to independently audit changes from different perspectives. It uses confidence scoring to filter out false positives, ensuring only high-quality, actionable feedback is posted.
+
+## Commands
+
+### `/code-review`
+
+Performs automated code review on a pull request using multiple specialized agents.
+
+**What it does:**
+1. Checks if review is needed (skips closed, draft, trivial, or already-reviewed PRs)
+2. Gathers relevant CLAUDE.md guideline files from the repository
+3. Summarizes the pull request changes
+4. Launches 4 parallel agents to independently review:
+   - **Agents #1 & #2**: Audit for CLAUDE.md compliance
+   - **Agent #3**: Scan for obvious bugs in changes
+   - **Agent #4**: Analyze git blame/history for context-based issues
+5. Scores each issue 0-100 for confidence level
+6. Filters out issues below 80 confidence threshold
+7. Outputs review (to terminal by default, or as PR comment with `--comment` flag)
+
+**Usage:**
+```bash
+/code-review [--comment]
+```
+
+**Options:**
+- `--comment`: Post the review as a comment on the pull request (default: outputs to terminal only)
+
+**Example workflow:**
+```bash
+# On a PR branch, run locally (outputs to terminal):
+/code-review
+
+# Post review as PR comment:
+/code-review --comment
+
+# Claude will:
+# - Launch 4 review agents in parallel
+# - Score each issue for confidence
+# - Output issues ≥80 confidence (to terminal or PR depending on flag)
+# - Skip if no high-confidence issues found
+```
+
+**Features:**
+- Multiple independent agents for comprehensive review
+- Confidence-based scoring reduces false positives (threshold: 80)
+- CLAUDE.md compliance checking with explicit guideline verification
+- Bug detection focused on changes (not pre-existing issues)
+- Historical context analysis via git blame
+- Automatic skipping of closed, draft, or already-reviewed PRs
+- Links directly to code with full SHA and line ranges
+
+**Review comment format:**
+```markdown
+## Code review
+
+Found 3 issues:
+
+1. Missing error handling for OAuth callback (CLAUDE.md says "Always handle OAuth errors")
+
+https://github.com/owner/repo/blob/abc123.../src/auth.ts#L67-L72
+
+2. Memory leak: OAuth state not cleaned up (bug due to missing cleanup in finally block)
+
+https://github.com/owner/repo/blob/abc123.../src/auth.ts#L88-L95
+
+3. Inconsistent naming pattern (src/conventions/CLAUDE.md says "Use camelCase for functions")
+
+https://github.com/owner/repo/blob/abc123.../src/utils.ts#L23-L28
+```
+
+**Confidence scoring:**
+- **0**: Not confident, false positive
+- **25**: Somewhat confident, might be real
+- **50**: Moderately confident, real but minor
+- **75**: Highly confident, real and important
+- **100**: Absolutely certain, definitely real
+
+**False positives filtered:**
+- Pre-existing issues not introduced in PR
+- Code that looks like a bug but isn't
+- Pedantic nitpicks
+- Issues linters will catch
+- General quality issues (unless in CLAUDE.md)
+- Issues with lint ignore comments
+
+## Installation
+
+This plugin is included in the Claude Code repository. The command is automatically available when using Claude Code.
+
+## Best Practices
+
+### Using `/code-review`
+- Maintain clear CLAUDE.md files for better compliance checking
+- Trust the 80+ confidence threshold - false positives are filtered
+- Run on all non-trivial pull requests
+- Review agent findings as a starting point for human review
+- Update CLAUDE.md based on recurring review patterns
+
+### When to use
+- All pull requests with meaningful changes
+- PRs touching critical code paths
+- PRs from multiple contributors
+- PRs where guideline compliance matters
+
+### When not to use
+- Closed or draft PRs (automatically skipped anyway)
+- Trivial automated PRs (automatically skipped)
+- Urgent hotfixes requiring immediate merge
+- PRs already reviewed (automatically skipped)
+
+## Workflow Integration
+
+### Standard PR review workflow:
+```bash
+# Create PR with changes
+# Run local review (outputs to terminal)
+/code-review
+
+# Review the automated feedback
+# Make any necessary fixes
+
+# Optionally post as PR comment
+/code-review --comment
+
+# Merge when ready
+```
+
+### As part of CI/CD:
+```bash
+# Trigger on PR creation or update
+# Use --comment flag to post review comments
+/code-review --comment
+# Skip if review already exists
+```
+
+## Requirements
+
+- Git repository with GitHub integration
+- GitHub CLI (`gh`) installed and authenticated
+- CLAUDE.md files (optional but recommended for guideline checking)
+
+## Troubleshooting
+
+### Review takes too long
+
+**Issue**: Agents are slow on large PRs
+
+**Solution**:
+- Normal for large changes - agents run in parallel
+- 4 independent agents ensure thoroughness
+- Consider splitting large PRs into smaller ones
+
+### Too many false positives
+
+**Issue**: Review flags issues that aren't real
+
+**Solution**:
+- Default threshold is 80 (already filters most false positives)
+- Make CLAUDE.md more specific about what matters
+- Consider if the flagged issue is actually valid
+
+### No review comment posted
+
+**Issue**: `/code-review` runs but no comment appears
+
+**Solution**:
+Check if:
+- PR is closed (reviews skipped)
+- PR is draft (reviews skipped)
+- PR is trivial/automated (reviews skipped)
+- PR already has review (reviews skipped)
+- No issues scored ≥80 (no comment needed)
+
+### Link formatting broken
+
+**Issue**: Code links don't render correctly in GitHub
+
+**Solution**:
+Links must follow this exact format:
+```
+https://github.com/owner/repo/blob/[full-sha]/path/file.ext#L[start]-L[end]
+```
+- Must use full SHA (not abbreviated)
+- Must use `#L` notation
+- Must include line range with at least 1 line of context
+
+### GitHub CLI not working
+
+**Issue**: `gh` commands fail
+
+**Solution**:
+- Install GitHub CLI: `brew install gh` (macOS) or see [GitHub CLI installation](https://cli.github.com/)
+- Authenticate: `gh auth login`
+- Verify repository has GitHub remote
+
+## Tips
+
+- **Write specific CLAUDE.md files**: Clear guidelines = better reviews
+- **Include context in PRs**: Helps agents understand intent
+- **Use confidence scores**: Issues ≥80 are usually correct
+- **Iterate on guidelines**: Update CLAUDE.md based on patterns
+- **Review automatically**: Set up as part of PR workflow
+- **Trust the filtering**: Threshold prevents noise
+
+## Configuration
+
+### Adjusting confidence threshold
+
+The default threshold is 80. To adjust, modify the command file at `commands/code-review.md`:
+```markdown
+Filter out any issues with a score less than 80.
+```
+
+Change `80` to your preferred threshold (0-100).
+
+### Customizing review focus
+
+Edit `commands/code-review.md` to add or modify agent tasks:
+- Add security-focused agents
+- Add performance analysis agents
+- Add accessibility checking agents
+- Add documentation quality checks
+
+## Technical Details
+
+### Agent architecture
+- **2x CLAUDE.md compliance agents**: Redundancy for guideline checks
+- **1x bug detector**: Focused on obvious bugs in changes only
+- **1x history analyzer**: Context from git blame and history
+- **Nx confidence scorers**: One per issue for independent scoring
+
+### Scoring system
+- Each issue independently scored 0-100
+- Scoring considers evidence strength and verification
+- Threshold (default 80) filters low-confidence issues
+- For CLAUDE.md issues: verifies guideline explicitly mentions it
+
+### GitHub integration
+Uses `gh` CLI for:
+- Viewing PR details and diffs
+- Fetching repository data
+- Reading git blame and history
+- Posting review comments
+
+## Author
+
+Boris Cherny (boris@anthropic.com)
+
+## Version
+
+1.0.0
@@ -0,0 +1,109 @@
+---
+allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*), Bash(gh pr list:*), mcp__github_inline_comment__create_inline_comment
+description: Code review a pull request
+---
+
+Provide a code review for the given pull request.
+
+**Agent assumptions (applies to all agents and subagents):**
+- All tools are functional and will work without error. Do not test tools or make exploratory calls. Make sure this is clear to every subagent that is launched.
+- Only call a tool if it is required to complete the task. Every tool call should have a clear purpose.
+
+To do this, follow these steps precisely:
+
+1. Launch a haiku agent to check if any of the following are true:
+   - The pull request is closed
+   - The pull request is a draft
+   - The pull request does not need code review (e.g. automated PR, trivial change that is obviously correct)
+   - Claude has already commented on this PR (check `gh pr view <PR> --comments` for comments left by claude)
+
+   If any condition is true, stop and do not proceed.
+
+Note: Still review Claude generated PR's.
+
+2. Launch a haiku agent to return a list of file paths (not their contents) for all relevant CLAUDE.md files including:
+   - The root CLAUDE.md file, if it exists
+   - Any CLAUDE.md files in directories containing files modified by the pull request
+
+3. Launch a sonnet agent to view the pull request and return a summary of the changes
+
+4. Launch 4 agents in parallel to independently review the changes. Each agent should return the list of issues, where each issue includes a description and the reason it was flagged (e.g. "CLAUDE.md adherence", "bug"). The agents should do the following:
+
+   Agents 1 + 2: CLAUDE.md compliance sonnet agents
+   Audit changes for CLAUDE.md compliance in parallel. Note: When evaluating CLAUDE.md compliance for a file, you should only consider CLAUDE.md files that share a file path with the file or parents.
+
+   Agent 3: Opus bug agent (parallel subagent with agent 4)
+   Scan for obvious bugs. Focus only on the diff itself without reading extra context. Flag only significant bugs; ignore nitpicks and likely false positives. Do not flag issues that you cannot validate without looking at context outside of the git diff.
+
+   Agent 4: Opus bug agent (parallel subagent with agent 3)
+   Look for problems that exist in the introduced code. This could be security issues, incorrect logic, etc. Only look for issues that fall within the changed code.
+
+   **CRITICAL: We only want HIGH SIGNAL issues.** Flag issues where:
+   - The code will fail to compile or parse (syntax errors, type errors, missing imports, unresolved references)
+   - The code will definitely produce wrong results regardless of inputs (clear logic errors)
+   - Clear, unambiguous CLAUDE.md violations where you can quote the exact rule being broken
+
+   Do NOT flag:
+   - Code style or quality concerns
+   - Potential issues that depend on specific inputs or state
+   - Subjective suggestions or improvements
+
+   If you are not certain an issue is real, do not flag it. False positives erode trust and waste reviewer time.
+
+   In addition to the above, each subagent should be told the PR title and description. This will help provide context regarding the author's intent.
+
+5. For each issue found in the previous step by agents 3 and 4, launch parallel subagents to validate the issue. These subagents should get the PR title and description along with a description of the issue. The agent's job is to review the issue to validate that the stated issue is truly an issue with high confidence. For example, if an issue such as "variable is not defined" was flagged, the subagent's job would be to validate that is actually true in the code. Another example would be CLAUDE.md issues. The agent should validate that the CLAUDE.md rule that was violated is scoped for this file and is actually violated. Use Opus subagents for bugs and logic issues, and sonnet agents for CLAUDE.md violations.
+
+6. Filter out any issues that were not validated in step 5. This step will give us our list of high signal issues for our review.
+
+7. Output a summary of the review findings to the terminal:
+   - If issues were found, list each issue with a brief description.
+   - If no issues were found, state: "No issues found. Checked for bugs and CLAUDE.md compliance."
+
+   If `--comment` argument was NOT provided, stop here. Do not post any GitHub comments.
+
+   If `--comment` argument IS provided and NO issues were found, post a summary comment using `gh pr comment` and stop.
+
+   If `--comment` argument IS provided and issues were found, continue to step 8.
+
+8. Create a list of all comments that you plan on leaving. This is only for you to make sure you are comfortable with the comments. Do not post this list anywhere.
+
+9. Post inline comments for each issue using `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`. For each comment:
+   - Provide a brief description of the issue
+   - For small, self-contained fixes, include a committable suggestion block
+   - For larger fixes (6+ lines, structural changes, or changes spanning multiple locations), describe the issue and suggested fix without a suggestion block
+   - Never post a committable suggestion UNLESS committing the suggestion fixes the issue entirely. If follow up steps are required, do not leave a committable suggestion.
+
+   **IMPORTANT: Only post ONE comment per unique issue. Do not post duplicate comments.**
+
+Use this list when evaluating issues in Steps 4 and 5 (these are false positives, do NOT flag):
+
+- Pre-existing issues
+- Something that appears to be a bug but is actually correct
+- Pedantic nitpicks that a senior engineer would not flag
+- Issues that a linter will catch (do not run the linter to verify)
+- General code quality concerns (e.g., lack of test coverage, general security issues) unless explicitly required in CLAUDE.md
+- Issues mentioned in CLAUDE.md but explicitly silenced in the code (e.g., via a lint ignore comment)
+
+Notes:
+
+- Use gh CLI to interact with GitHub (e.g., fetch pull requests, create comments). Do not use web fetch.
+- Create a todo list before starting.
+- You must cite and link each issue in inline comments (e.g., if referring to a CLAUDE.md, include a link to it).
+- If no issues are found and `--comment` argument is provided, post a comment with the following format:
+
+---
+
+## Code review
+
+No issues found. Checked for bugs and CLAUDE.md compliance.
+
+---
+
+- When linking to code in inline comments, follow the following format precisely, otherwise the Markdown preview won't render correctly: https://github.com/anthropics/claude-code/blob/c21d3c10bc8e898b7ac1a2d745bdc9bc4e423afe/package.json#L10-L15
+  - Requires full git sha
+  - You must provide the full sha. Commands like `https://github.com/owner/repo/blob/$(git rev-parse HEAD)/foo/bar` will not work, since your comment will be directly rendered in Markdown.
+  - Repo name must match the repo you're code reviewing
+  - # sign after the file name
+  - Line range format is L[start]-L[end]
+  - Provide at least 1 line of context before and after, centered on the line you are commenting about (eg. if you are commenting about lines 5-6, you should link to `L4-7`)
@@ -0,0 +1,10 @@
+{
+  "name": "commit-commands",
+  "description": "Streamline your git workflow with simple commands for committing, pushing, and creating pull requests",
+  "version": "1.0.0",
+  "author": {
+    "name": "Anthropic",
+    "email": "support@anthropic.com"
+  }
+}
+
@@ -0,0 +1,225 @@
+# Commit Commands Plugin
+
+Streamline your git workflow with simple commands for committing, pushing, and creating pull requests.
+
+## Overview
+
+The Commit Commands Plugin automates common git operations, reducing context switching and manual command execution. Instead of running multiple git commands, use a single slash command to handle your entire workflow.
+
+## Commands
+
+### `/commit`
+
+Creates a git commit with an automatically generated commit message based on staged and unstaged changes.
+
+**What it does:**
+1. Analyzes current git status
+2. Reviews both staged and unstaged changes
+3. Examines recent commit messages to match your repository's style
+4. Drafts an appropriate commit message
+5. Stages relevant files
+6. Creates the commit
+
+**Usage:**
+```bash
+/commit
+```
+
+**Example workflow:**
+```bash
+# Make some changes to your code
+# Then simply run:
+/commit
+
+# Claude will:
+# - Review your changes
+# - Stage the files
+# - Create a commit with an appropriate message
+# - Show you the commit status
+```
+
+**Features:**
+- Automatically drafts commit messages that match your repo's style
+- Follows conventional commit practices
+- Avoids committing files with secrets (.env, credentials.json)
+- Includes Claude Code attribution in commit message
+
+### `/commit-push-pr`
+
+Complete workflow command that commits, pushes, and creates a pull request in one step.
+
+**What it does:**
+1. Creates a new branch (if currently on main)
+2. Stages and commits changes with an appropriate message
+3. Pushes the branch to origin
+4. Creates a pull request using `gh pr create`
+5. Provides the PR URL
+
+**Usage:**
+```bash
+/commit-push-pr
+```
+
+**Example workflow:**
+```bash
+# Make your changes
+# Then run:
+/commit-push-pr
+
+# Claude will:
+# - Create a feature branch (if needed)
+# - Commit your changes
+# - Push to remote
+# - Open a PR with summary and test plan
+# - Give you the PR URL to review
+```
+
+**Features:**
+- Analyzes all commits in the branch (not just the latest)
+- Creates comprehensive PR descriptions with:
+  - Summary of changes (1-3 bullet points)
+  - Test plan checklist
+  - Claude Code attribution
+- Handles branch creation automatically
+- Uses GitHub CLI (`gh`) for PR creation
+
+**Requirements:**
+- GitHub CLI (`gh`) must be installed and authenticated
+- Repository must have a remote named `origin`
+
+### `/clean_gone`
+
+Cleans up local branches that have been deleted from the remote repository.
+
+**What it does:**
+1. Lists all local branches to identify [gone] status
+2. Identifies and removes worktrees associated with [gone] branches
+3. Deletes all branches marked as [gone]
+4. Provides feedback on removed branches
+
+**Usage:**
+```bash
+/clean_gone
+```
+
+**Example workflow:**
+```bash
+# After PRs are merged and remote branches are deleted
+/clean_gone
+
+# Claude will:
+# - Find all branches marked as [gone]
+# - Remove any associated worktrees
+# - Delete the stale local branches
+# - Report what was cleaned up
+```
+
+**Features:**
+- Handles both regular branches and worktree branches
+- Safely removes worktrees before deleting branches
+- Shows clear feedback about what was removed
+- Reports if no cleanup was needed
+
+**When to use:**
+- After merging and deleting remote branches
+- When your local branch list is cluttered with stale branches
+- During regular repository maintenance
+
+## Installation
+
+This plugin is included in the Claude Code repository. The commands are automatically available when using Claude Code.
+
+## Best Practices
+
+### Using `/commit`
+- Review the staged changes before committing
+- Let Claude analyze your changes and match your repo's commit style
+- Trust the automated message, but verify it's accurate
+- Use for routine commits during development
+
+### Using `/commit-push-pr`
+- Use when you're ready to create a PR
+- Ensure all your changes are complete and tested
+- Claude will analyze the full branch history for the PR description
+- Review the PR description and edit if needed
+- Use when you want to minimize context switching
+
+### Using `/clean_gone`
+- Run periodically to keep your branch list clean
+- Especially useful after merging multiple PRs
+- Safe to run - only removes branches already deleted remotely
+- Helps maintain a tidy local repository
+
+## Workflow Integration
+
+### Quick commit workflow:
+```bash
+# Write code
+/commit
+# Continue development
+```
+
+### Feature branch workflow:
+```bash
+# Develop feature across multiple commits
+/commit  # First commit
+# More changes
+/commit  # Second commit
+# Ready to create PR
+/commit-push-pr
+```
+
+### Maintenance workflow:
+```bash
+# After several PRs are merged
+/clean_gone
+# Clean workspace ready for next feature
+```
+
+## Requirements
+
+- Git must be installed and configured
+- For `/commit-push-pr`: GitHub CLI (`gh`) must be installed and authenticated
+- Repository must be a git repository with a remote
+
+## Troubleshooting
+
+### `/commit` creates empty commit
+
+**Issue**: No changes to commit
+
+**Solution**:
+- Ensure you have unstaged or staged changes
+- Run `git status` to verify changes exist
+
+### `/commit-push-pr` fails to create PR
+
+**Issue**: `gh pr create` command fails
+
+**Solution**:
+- Install GitHub CLI: `brew install gh` (macOS) or see [GitHub CLI installation](https://cli.github.com/)
+- Authenticate: `gh auth login`
+- Ensure repository has a GitHub remote
+
+### `/clean_gone` doesn't find branches
+
+**Issue**: No branches marked as [gone]
+
+**Solution**:
+- Run `git fetch --prune` to update remote tracking
+- Branches must be deleted from the remote to show as [gone]
+
+## Tips
+
+- **Combine with other tools**: Use `/commit` during development, then `/commit-push-pr` when ready
+- **Let Claude draft messages**: The commit message analysis learns from your repo's style
+- **Regular cleanup**: Run `/clean_gone` weekly to maintain a clean branch list
+- **Review before pushing**: Always review the commit message and changes before pushing
+
+## Author
+
+Anthropic (support@anthropic.com)
+
+## Version
+
+1.0.0
@@ -0,0 +1,53 @@
+---
+description: Cleans up all git branches marked as [gone] (branches that have been deleted on the remote but still exist locally), including removing associated worktrees.
+---
+
+## Your Task
+
+You need to execute the following bash commands to clean up stale local branches that have been deleted from the remote repository.
+
+## Commands to Execute
+
+1. **First, list branches to identify any with [gone] status**
+   Execute this command:
+   ```bash
+   git branch -v
+   ```
+   
+   Note: Branches with a '+' prefix have associated worktrees and must have their worktrees removed before deletion.
+
+2. **Next, identify worktrees that need to be removed for [gone] branches**
+   Execute this command:
+   ```bash
+   git worktree list
+   ```
+
+3. **Finally, remove worktrees and delete [gone] branches (handles both regular and worktree branches)**
+   Execute this command:
+   ```bash
+   # Process all [gone] branches, removing '+' prefix if present
+   git branch -v | grep '\[gone\]' | sed 's/^[+* ]//' | awk '{print $1}' | while read branch; do
+     echo "Processing branch: $branch"
+     # Find and remove worktree if it exists
+     worktree=$(git worktree list | grep "\\[$branch\\]" | awk '{print $1}')
+     if [ ! -z "$worktree" ] && [ "$worktree" != "$(git rev-parse --show-toplevel)" ]; then
+       echo "  Removing worktree: $worktree"
+       git worktree remove --force "$worktree"
+     fi
+     # Delete the branch
+     echo "  Deleting branch: $branch"
+     git branch -D "$branch"
+   done
+   ```
+
+## Expected Behavior
+
+After executing these commands, you will:
+
+- See a list of all local branches with their status
+- Identify and remove any worktrees associated with [gone] branches
+- Delete all branches marked as [gone]
+- Provide feedback on which worktrees and branches were removed
+
+If no branches are marked as [gone], report that no cleanup was needed.
+
@@ -0,0 +1,20 @@
+---
+allowed-tools: Bash(git checkout --branch:*), Bash(git add:*), Bash(git status:*), Bash(git push:*), Bash(git commit:*), Bash(gh pr create:*)
+description: Commit, push, and open a PR
+---
+
+## Context
+
+- Current git status: !`git status`
+- Current git diff (staged and unstaged changes): !`git diff HEAD`
+- Current branch: !`git branch --show-current`
+
+## Your task
+
+Based on the above changes:
+
+1. Create a new branch if on main
+2. Create a single commit with an appropriate message
+3. Push the branch to origin
+4. Create a pull request using `gh pr create`
+5. You have the capability to call multiple tools in a single response. You MUST do all of the above in a single message. Do not use any other tools or do anything else. Do not send any other text or messages besides these tool calls.
@@ -0,0 +1,17 @@
+---
+allowed-tools: Bash(git add:*), Bash(git status:*), Bash(git commit:*)
+description: Create a git commit
+---
+
+## Context
+
+- Current git status: !`git status`
+- Current git diff (staged and unstaged changes): !`git diff HEAD`
+- Current branch: !`git branch --show-current`
+- Recent commits: !`git log --oneline -10`
+
+## Your task
+
+Based on the above changes, create a single git commit.
+
+You have the capability to call multiple tools in a single response. Stage and create the commit using a single message. Do not use any other tools or do anything else. Do not send any other text or messages besides these tool calls.
@@ -0,0 +1,9 @@
+{
+  "name": "explanatory-output-style",
+  "version": "1.0.0",
+  "description": "Adds educational insights about implementation choices and codebase patterns (mimics the deprecated Explanatory output style)",
+  "author": {
+    "name": "Dickson Tsai",
+    "email": "dickson@anthropic.com"
+  }
+}
@@ -0,0 +1,72 @@
+# Explanatory Output Style Plugin
+
+This plugin recreates the deprecated Explanatory output style as a SessionStart
+hook.
+
+WARNING: Do not install this plugin unless you are fine with incurring the token
+cost of this plugin's additional instructions and output.
+
+## What it does
+
+When enabled, this plugin automatically adds instructions at the start of each
+session that encourage Claude to:
+
+1. Provide educational insights about implementation choices
+2. Explain codebase patterns and decisions
+3. Balance task completion with learning opportunities
+
+## How it works
+
+The plugin uses a SessionStart hook to inject additional context into every
+session. This context instructs Claude to provide brief educational explanations
+before and after writing code, formatted as:
+
+```
+`★ Insight ─────────────────────────────────────`
+[2-3 key educational points]
+`─────────────────────────────────────────────────`
+```
+
+## Usage
+
+Once installed, the plugin activates automatically at the start of every
+session. No additional configuration is needed.
+
+The insights focus on:
+
+- Specific implementation choices for your codebase
+- Patterns and conventions in your code
+- Trade-offs and design decisions
+- Codebase-specific details rather than general programming concepts
+
+## Migration from Output Styles
+
+This plugin replaces the deprecated "Explanatory" output style setting. If you
+previously used:
+
+```json
+{
+  "outputStyle": "Explanatory"
+}
+```
+
+You can now achieve the same behavior by installing this plugin instead.
+
+More generally, this SessionStart hook pattern is roughly equivalent to
+CLAUDE.md, but it is more flexible and allows for distribution through plugins.
+
+Note: Output styles that involve tasks besides software development, are better
+expressed as
+[subagents](https://docs.claude.com/en/docs/claude-code/sub-agents), not as
+SessionStart hooks. Subagents change the system prompt while SessionStart hooks
+add to the default system prompt.
+
+## Managing changes
+
+- Disable the plugin - keep the code installed on your device
+- Uninstall the plugin - remove the code from your device
+- Update the plugin - create a local copy of this plugin to personalize this
+  plugin
+  - Hint: Ask Claude to read
+    https://docs.claude.com/en/docs/claude-code/plugins.md and set it up for
+    you!
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+# Output the explanatory mode instructions as additionalContext
+# This mimics the deprecated Explanatory output style
+
+cat << 'EOF'
+{
+  "hookSpecificOutput": {
+    "hookEventName": "SessionStart",
+    "additionalContext": "You are in 'explanatory' output style mode, where you should provide educational insights about the codebase as you help with the user's task.\n\nYou should be clear and educational, providing helpful explanations while remaining focused on the task. Balance educational content with task completion. When providing insights, you may exceed typical length constraints, but remain focused and relevant.\n\n## Insights\nIn order to encourage learning, before and after writing code, always provide brief educational explanations about implementation choices using (with backticks):\n\"`★ Insight ─────────────────────────────────────`\n[2-3 key educational points]\n`─────────────────────────────────────────────────`\"\n\nThese insights should be included in the conversation, not in the codebase. You should generally focus on interesting insights that are specific to the codebase or the code you just wrote, rather than general programming concepts. Do not wait until the end to provide insights. Provide them as you write code."
+  }
+}
+EOF
+
+exit 0
@@ -0,0 +1,15 @@
+{
+  "description": "Explanatory mode hook that adds educational insights instructions",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks-handlers/session-start.sh"
+          }
+        ]
+      }
+    ]
+  }
+}
@@ -0,0 +1,9 @@
+{
+  "name": "feature-dev",
+  "version": "1.0.0",
+  "description": "Comprehensive feature development workflow with specialized agents for codebase exploration, architecture design, and quality review",
+  "author": {
+    "name": "Sid Bidasaria",
+    "email": "sbidasaria@anthropic.com"
+  }
+}
@@ -0,0 +1,412 @@
+# Feature Development Plugin
+
+A comprehensive, structured workflow for feature development with specialized agents for codebase exploration, architecture design, and quality review.
+
+## Overview
+
+The Feature Development Plugin provides a systematic 7-phase approach to building new features. Instead of jumping straight into code, it guides you through understanding the codebase, asking clarifying questions, designing architecture, and ensuring quality—resulting in better-designed features that integrate seamlessly with your existing code.
+
+## Philosophy
+
+Building features requires more than just writing code. You need to:
+- **Understand the codebase** before making changes
+- **Ask questions** to clarify ambiguous requirements
+- **Design thoughtfully** before implementing
+- **Review for quality** after building
+
+This plugin embeds these practices into a structured workflow that runs automatically when you use the `/feature-dev` command.
+
+## Command: `/feature-dev`
+
+Launches a guided feature development workflow with 7 distinct phases.
+
+**Usage:**
+```bash
+/feature-dev Add user authentication with OAuth
+```
+
+Or simply:
+```bash
+/feature-dev
+```
+
+The command will guide you through the entire process interactively.
+
+## The 7-Phase Workflow
+
+### Phase 1: Discovery
+
+**Goal**: Understand what needs to be built
+
+**What happens:**
+- Clarifies the feature request if it's unclear
+- Asks what problem you're solving
+- Identifies constraints and requirements
+- Summarizes understanding and confirms with you
+
+**Example:**
+```
+You: /feature-dev Add caching
+Claude: Let me understand what you need...
+        - What should be cached? (API responses, computed values, etc.)
+        - What are your performance requirements?
+        - Do you have a preferred caching solution?
+```
+
+### Phase 2: Codebase Exploration
+
+**Goal**: Understand relevant existing code and patterns
+
+**What happens:**
+- Launches 2-3 `code-explorer` agents in parallel
+- Each agent explores different aspects (similar features, architecture, UI patterns)
+- Agents return comprehensive analyses with key files to read
+- Claude reads all identified files to build deep understanding
+- Presents comprehensive summary of findings
+
+**Agents launched:**
+- "Find features similar to [feature] and trace implementation"
+- "Map the architecture and abstractions for [area]"
+- "Analyze current implementation of [related feature]"
+
+**Example output:**
+```
+Found similar features:
+- User authentication (src/auth/): Uses JWT tokens, middleware pattern
+- Session management (src/session/): Redis-backed, 24hr expiry
+- API security (src/api/middleware/): Rate limiting, CORS
+
+Key files to understand:
+- src/auth/AuthService.ts:45 - Core authentication logic
+- src/middleware/authMiddleware.ts:12 - Request authentication
+- src/config/security.ts:8 - Security configuration
+```
+
+### Phase 3: Clarifying Questions
+
+**Goal**: Fill in gaps and resolve all ambiguities
+
+**What happens:**
+- Reviews codebase findings and feature request
+- Identifies underspecified aspects:
+  - Edge cases
+  - Error handling
+  - Integration points
+  - Backward compatibility
+  - Performance needs
+- Presents all questions in an organized list
+- **Waits for your answers before proceeding**
+
+**Example:**
+```
+Before designing the architecture, I need to clarify:
+
+1. OAuth provider: Which OAuth providers? (Google, GitHub, custom?)
+2. User data: Store OAuth tokens or just user profile?
+3. Existing auth: Replace current auth or add alongside?
+4. Sessions: Integrate with existing session management?
+5. Error handling: How to handle OAuth failures?
+```
+
+**Critical**: This phase ensures nothing is ambiguous before design begins.
+
+### Phase 4: Architecture Design
+
+**Goal**: Design multiple implementation approaches
+
+**What happens:**
+- Launches 2-3 `code-architect` agents with different focuses:
+  - **Minimal changes**: Smallest change, maximum reuse
+  - **Clean architecture**: Maintainability, elegant abstractions
+  - **Pragmatic balance**: Speed + quality
+- Reviews all approaches
+- Forms opinion on which fits best for this task
+- Presents comparison with trade-offs and recommendation
+- **Asks which approach you prefer**
+
+**Example output:**
+```
+I've designed 3 approaches:
+
+Approach 1: Minimal Changes
+- Extend existing AuthService with OAuth methods
+- Add new OAuth routes to existing auth router
+- Minimal refactoring required
+Pros: Fast, low risk
+Cons: Couples OAuth to existing auth, harder to test
+
+Approach 2: Clean Architecture
+- New OAuthService with dedicated interface
+- Separate OAuth router and middleware
+- Refactor AuthService to use common interface
+Pros: Clean separation, testable, maintainable
+Cons: More files, more refactoring
+
+Approach 3: Pragmatic Balance
+- New OAuthProvider abstraction
+- Integrate into existing AuthService
+- Minimal refactoring, good boundaries
+Pros: Balanced complexity and cleanliness
+Cons: Some coupling remains
+
+Recommendation: Approach 3 - gives you clean boundaries without
+excessive refactoring, and fits your existing architecture well.
+
+Which approach would you like to use?
+```
+
+### Phase 5: Implementation
+
+**Goal**: Build the feature
+
+**What happens:**
+- **Waits for explicit approval** before starting
+- Reads all relevant files identified in previous phases
+- Implements following chosen architecture
+- Follows codebase conventions strictly
+- Writes clean, well-documented code
+- Updates todos as progress is made
+
+**Notes:**
+- Implementation only starts after you approve
+- Follows patterns discovered in Phase 2
+- Uses architecture designed in Phase 4
+- Continuously tracks progress
+
+### Phase 6: Quality Review
+
+**Goal**: Ensure code is simple, DRY, elegant, and functionally correct
+
+**What happens:**
+- Launches 3 `code-reviewer` agents in parallel with different focuses:
+  - **Simplicity/DRY/Elegance**: Code quality and maintainability
+  - **Bugs/Correctness**: Functional correctness and logic errors
+  - **Conventions/Abstractions**: Project standards and patterns
+- Consolidates findings
+- Identifies highest severity issues
+- **Presents findings and asks what you want to do**:
+  - Fix now
+  - Fix later
+  - Proceed as-is
+- Addresses issues based on your decision
+
+**Example output:**
+```
+Code Review Results:
+
+High Priority Issues:
+1. Missing error handling in OAuth callback (src/auth/oauth.ts:67)
+2. Memory leak: OAuth state not cleaned up (src/auth/oauth.ts:89)
+
+Medium Priority:
+1. Could simplify token refresh logic (src/auth/oauth.ts:120)
+2. Consider extracting OAuth config validation
+
+All tests pass. Code follows project conventions.
+
+What would you like to do?
+```
+
+### Phase 7: Summary
+
+**Goal**: Document what was accomplished
+
+**What happens:**
+- Marks all todos complete
+- Summarizes:
+  - What was built
+  - Key decisions made
+  - Files modified
+  - Suggested next steps
+
+**Example:**
+```
+Feature Complete: OAuth Authentication
+
+What was built:
+- OAuth provider abstraction supporting Google and GitHub
+- OAuth routes and middleware integrated with existing auth
+- Token refresh and session integration
+- Error handling for all OAuth flows
+
+Key decisions:
+- Used pragmatic approach with OAuthProvider abstraction
+- Integrated with existing session management
+- Added OAuth state to prevent CSRF
+
+Files modified:
+- src/auth/OAuthProvider.ts (new)
+- src/auth/AuthService.ts
+- src/routes/auth.ts
+- src/middleware/authMiddleware.ts
+
+Suggested next steps:
+- Add tests for OAuth flows
+- Add more OAuth providers (Microsoft, Apple)
+- Update documentation
+```
+
+## Agents
+
+### `code-explorer`
+
+**Purpose**: Deeply analyzes existing codebase features by tracing execution paths
+
+**Focus areas:**
+- Entry points and call chains
+- Data flow and transformations
+- Architecture layers and patterns
+- Dependencies and integrations
+- Implementation details
+
+**When triggered:**
+- Automatically in Phase 2
+- Can be invoked manually when exploring code
+
+**Output:**
+- Entry points with file:line references
+- Step-by-step execution flow
+- Key components and responsibilities
+- Architecture insights
+- List of essential files to read
+
+### `code-architect`
+
+**Purpose**: Designs feature architectures and implementation blueprints
+
+**Focus areas:**
+- Codebase pattern analysis
+- Architecture decisions
+- Component design
+- Implementation roadmap
+- Data flow and build sequence
+
+**When triggered:**
+- Automatically in Phase 4
+- Can be invoked manually for architecture design
+
+**Output:**
+- Patterns and conventions found
+- Architecture decision with rationale
+- Complete component design
+- Implementation map with specific files
+- Build sequence with phases
+
+### `code-reviewer`
+
+**Purpose**: Reviews code for bugs, quality issues, and project conventions
+
+**Focus areas:**
+- Project guideline compliance (CLAUDE.md)
+- Bug detection
+- Code quality issues
+- Confidence-based filtering (only reports high-confidence issues ≥80)
+
+**When triggered:**
+- Automatically in Phase 6
+- Can be invoked manually after writing code
+
+**Output:**
+- Critical issues (confidence 75-100)
+- Important issues (confidence 50-74)
+- Specific fixes with file:line references
+- Project guideline references
+
+## Usage Patterns
+
+### Full workflow (recommended for new features):
+```bash
+/feature-dev Add rate limiting to API endpoints
+```
+
+Let the workflow guide you through all 7 phases.
+
+### Manual agent invocation:
+
+**Explore a feature:**
+```
+"Launch code-explorer to trace how authentication works"
+```
+
+**Design architecture:**
+```
+"Launch code-architect to design the caching layer"
+```
+
+**Review code:**
+```
+"Launch code-reviewer to check my recent changes"
+```
+
+## Best Practices
+
+1. **Use the full workflow for complex features**: The 7 phases ensure thorough planning
+2. **Answer clarifying questions thoughtfully**: Phase 3 prevents future confusion
+3. **Choose architecture deliberately**: Phase 4 gives you options for a reason
+4. **Don't skip code review**: Phase 6 catches issues before they reach production
+5. **Read the suggested files**: Phase 2 identifies key files—read them to understand context
+
+## When to Use This Plugin
+
+**Use for:**
+- New features that touch multiple files
+- Features requiring architectural decisions
+- Complex integrations with existing code
+- Features where requirements are somewhat unclear
+
+**Don't use for:**
+- Single-line bug fixes
+- Trivial changes
+- Well-defined, simple tasks
+- Urgent hotfixes
+
+## Requirements
+
+- Claude Code installed
+- Git repository (for code review)
+- Project with existing codebase (workflow assumes existing code to learn from)
+
+## Troubleshooting
+
+### Agents take too long
+
+**Issue**: Code exploration or architecture agents are slow
+
+**Solution**:
+- This is normal for large codebases
+- Agents run in parallel when possible
+- The thoroughness pays off in better understanding
+
+### Too many clarifying questions
+
+**Issue**: Phase 3 asks too many questions
+
+**Solution**:
+- Be more specific in your initial feature request
+- Provide context about constraints upfront
+- Say "whatever you think is best" if truly no preference
+
+### Architecture options overwhelming
+
+**Issue**: Too many architecture options in Phase 4
+
+**Solution**:
+- Trust the recommendation—it's based on codebase analysis
+- If still unsure, ask for more explanation
+- Pick the pragmatic option when in doubt
+
+## Tips
+
+- **Be specific in your feature request**: More detail = fewer clarifying questions
+- **Trust the process**: Each phase builds on the previous one
+- **Review agent outputs**: Agents provide valuable insights about your codebase
+- **Don't skip phases**: Each phase serves a purpose
+- **Use for learning**: The exploration phase teaches you about your own codebase
+
+## Author
+
+Sid Bidasaria (sbidasaria@anthropic.com)
+
+## Version
+
+1.0.0
@@ -0,0 +1,34 @@
+---
+name: code-architect
+description: Designs feature architectures by analyzing existing codebase patterns and conventions, then providing comprehensive implementation blueprints with specific files to create/modify, component designs, data flows, and build sequences
+tools: Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput
+model: sonnet
+color: green
+---
+
+You are a senior software architect who delivers comprehensive, actionable architecture blueprints by deeply understanding codebases and making confident architectural decisions.
+
+## Core Process
+
+**1. Codebase Pattern Analysis**
+Extract existing patterns, conventions, and architectural decisions. Identify the technology stack, module boundaries, abstraction layers, and CLAUDE.md guidelines. Find similar features to understand established approaches.
+
+**2. Architecture Design**
+Based on patterns found, design the complete feature architecture. Make decisive choices - pick one approach and commit. Ensure seamless integration with existing code. Design for testability, performance, and maintainability.
+
+**3. Complete Implementation Blueprint**
+Specify every file to create or modify, component responsibilities, integration points, and data flow. Break implementation into clear phases with specific tasks.
+
+## Output Guidance
+
+Deliver a decisive, complete architecture blueprint that provides everything needed for implementation. Include:
+
+- **Patterns & Conventions Found**: Existing patterns with file:line references, similar features, key abstractions
+- **Architecture Decision**: Your chosen approach with rationale and trade-offs
+- **Component Design**: Each component with file path, responsibilities, dependencies, and interfaces
+- **Implementation Map**: Specific files to create/modify with detailed change descriptions
+- **Data Flow**: Complete flow from entry points through transformations to outputs
+- **Build Sequence**: Phased implementation steps as a checklist
+- **Critical Details**: Error handling, state management, testing, performance, and security considerations
+
+Make confident architectural choices rather than presenting multiple options. Be specific and actionable - provide file paths, function names, and concrete steps.
@@ -0,0 +1,51 @@
+---
+name: code-explorer
+description: Deeply analyzes existing codebase features by tracing execution paths, mapping architecture layers, understanding patterns and abstractions, and documenting dependencies to inform new development
+tools: Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput
+model: sonnet
+color: yellow
+---
+
+You are an expert code analyst specializing in tracing and understanding feature implementations across codebases.
+
+## Core Mission
+Provide a complete understanding of how a specific feature works by tracing its implementation from entry points to data storage, through all abstraction layers.
+
+## Analysis Approach
+
+**1. Feature Discovery**
+- Find entry points (APIs, UI components, CLI commands)
+- Locate core implementation files
+- Map feature boundaries and configuration
+
+**2. Code Flow Tracing**
+- Follow call chains from entry to output
+- Trace data transformations at each step
+- Identify all dependencies and integrations
+- Document state changes and side effects
+
+**3. Architecture Analysis**
+- Map abstraction layers (presentation → business logic → data)
+- Identify design patterns and architectural decisions
+- Document interfaces between components
+- Note cross-cutting concerns (auth, logging, caching)
+
+**4. Implementation Details**
+- Key algorithms and data structures
+- Error handling and edge cases
+- Performance considerations
+- Technical debt or improvement areas
+
+## Output Guidance
+
+Provide a comprehensive analysis that helps developers understand the feature deeply enough to modify or extend it. Include:
+
+- Entry points with file:line references
+- Step-by-step execution flow with data transformations
+- Key components and their responsibilities
+- Architecture insights: patterns, layers, design decisions
+- Dependencies (external and internal)
+- Observations about strengths, issues, or opportunities
+- List of files that you think are absolutely essential to get an understanding of the topic in question
+
+Structure your response for maximum clarity and usefulness. Always include specific file paths and line numbers.
@@ -0,0 +1,46 @@
+---
+name: code-reviewer
+description: Reviews code for bugs, logic errors, security vulnerabilities, code quality issues, and adherence to project conventions, using confidence-based filtering to report only high-priority issues that truly matter
+tools: Glob, Grep, LS, Read, NotebookRead, WebFetch, TodoWrite, WebSearch, KillShell, BashOutput
+model: sonnet
+color: red
+---
+
+You are an expert code reviewer specializing in modern software development across multiple languages and frameworks. Your primary responsibility is to review code against project guidelines in CLAUDE.md with high precision to minimize false positives.
+
+## Review Scope
+
+By default, review unstaged changes from `git diff`. The user may specify different files or scope to review.
+
+## Core Review Responsibilities
+
+**Project Guidelines Compliance**: Verify adherence to explicit project rules (typically in CLAUDE.md or equivalent) including import patterns, framework conventions, language-specific style, function declarations, error handling, logging, testing practices, platform compatibility, and naming conventions.
+
+**Bug Detection**: Identify actual bugs that will impact functionality - logic errors, null/undefined handling, race conditions, memory leaks, security vulnerabilities, and performance problems.
+
+**Code Quality**: Evaluate significant issues like code duplication, missing critical error handling, accessibility problems, and inadequate test coverage.
+
+## Confidence Scoring
+
+Rate each potential issue on a scale from 0-100:
+
+- **0**: Not confident at all. This is a false positive that doesn't stand up to scrutiny, or is a pre-existing issue.
+- **25**: Somewhat confident. This might be a real issue, but may also be a false positive. If stylistic, it wasn't explicitly called out in project guidelines.
+- **50**: Moderately confident. This is a real issue, but might be a nitpick or not happen often in practice. Not very important relative to the rest of the changes.
+- **75**: Highly confident. Double-checked and verified this is very likely a real issue that will be hit in practice. The existing approach is insufficient. Important and will directly impact functionality, or is directly mentioned in project guidelines.
+- **100**: Absolutely certain. Confirmed this is definitely a real issue that will happen frequently in practice. The evidence directly confirms this.
+
+**Only report issues with confidence ≥ 80.** Focus on issues that truly matter - quality over quantity.
+
+## Output Guidance
+
+Start by clearly stating what you're reviewing. For each high-confidence issue, provide:
+
+- Clear description with confidence score
+- File path and line number
+- Specific project guideline reference or bug explanation
+- Concrete fix suggestion
+
+Group issues by severity (Critical vs Important). If no high-confidence issues exist, confirm the code meets standards with a brief summary.
+
+Structure your response for maximum actionability - developers should know exactly what to fix and why.
@@ -0,0 +1,125 @@
+---
+description: Guided feature development with codebase understanding and architecture focus
+argument-hint: Optional feature description
+---
+
+# Feature Development
+
+You are helping a developer implement a new feature. Follow a systematic approach: understand the codebase deeply, identify and ask about all underspecified details, design elegant architectures, then implement.
+
+## Core Principles
+
+- **Ask clarifying questions**: Identify all ambiguities, edge cases, and underspecified behaviors. Ask specific, concrete questions rather than making assumptions. Wait for user answers before proceeding with implementation. Ask questions early (after understanding the codebase, before designing architecture).
+- **Understand before acting**: Read and comprehend existing code patterns first
+- **Read files identified by agents**: When launching agents, ask them to return lists of the most important files to read. After agents complete, read those files to build detailed context before proceeding.
+- **Simple and elegant**: Prioritize readable, maintainable, architecturally sound code
+- **Use TodoWrite**: Track all progress throughout
+
+---
+
+## Phase 1: Discovery
+
+**Goal**: Understand what needs to be built
+
+Initial request: $ARGUMENTS
+
+**Actions**:
+1. Create todo list with all phases
+2. If feature unclear, ask user for:
+   - What problem are they solving?
+   - What should the feature do?
+   - Any constraints or requirements?
+3. Summarize understanding and confirm with user
+
+---
+
+## Phase 2: Codebase Exploration
+
+**Goal**: Understand relevant existing code and patterns at both high and low levels
+
+**Actions**:
+1. Launch 2-3 code-explorer agents in parallel. Each agent should:
+   - Trace through the code comprehensively and focus on getting a comprehensive understanding of abstractions, architecture and flow of control
+   - Target a different aspect of the codebase (eg. similar features, high level understanding, architectural understanding, user experience, etc)
+   - Include a list of 5-10 key files to read
+
+   **Example agent prompts**:
+   - "Find features similar to [feature] and trace through their implementation comprehensively"
+   - "Map the architecture and abstractions for [feature area], tracing through the code comprehensively"
+   - "Analyze the current implementation of [existing feature/area], tracing through the code comprehensively"
+   - "Identify UI patterns, testing approaches, or extension points relevant to [feature]"
+
+2. Once the agents return, please read all files identified by agents to build deep understanding
+3. Present comprehensive summary of findings and patterns discovered
+
+---
+
+## Phase 3: Clarifying Questions
+
+**Goal**: Fill in gaps and resolve all ambiguities before designing
+
+**CRITICAL**: This is one of the most important phases. DO NOT SKIP.
+
+**Actions**:
+1. Review the codebase findings and original feature request
+2. Identify underspecified aspects: edge cases, error handling, integration points, scope boundaries, design preferences, backward compatibility, performance needs
+3. **Present all questions to the user in a clear, organized list**
+4. **Wait for answers before proceeding to architecture design**
+
+If the user says "whatever you think is best", provide your recommendation and get explicit confirmation.
+
+---
+
+## Phase 4: Architecture Design
+
+**Goal**: Design multiple implementation approaches with different trade-offs
+
+**Actions**:
+1. Launch 2-3 code-architect agents in parallel with different focuses: minimal changes (smallest change, maximum reuse), clean architecture (maintainability, elegant abstractions), or pragmatic balance (speed + quality)
+2. Review all approaches and form your opinion on which fits best for this specific task (consider: small fix vs large feature, urgency, complexity, team context)
+3. Present to user: brief summary of each approach, trade-offs comparison, **your recommendation with reasoning**, concrete implementation differences
+4. **Ask user which approach they prefer**
+
+---
+
+## Phase 5: Implementation
+
+**Goal**: Build the feature
+
+**DO NOT START WITHOUT USER APPROVAL**
+
+**Actions**:
+1. Wait for explicit user approval
+2. Read all relevant files identified in previous phases
+3. Implement following chosen architecture
+4. Follow codebase conventions strictly
+5. Write clean, well-documented code
+6. Update todos as you progress
+
+---
+
+## Phase 6: Quality Review
+
+**Goal**: Ensure code is simple, DRY, elegant, easy to read, and functionally correct
+
+**Actions**:
+1. Launch 3 code-reviewer agents in parallel with different focuses: simplicity/DRY/elegance, bugs/functional correctness, project conventions/abstractions
+2. Consolidate findings and identify highest severity issues that you recommend fixing
+3. **Present findings to user and ask what they want to do** (fix now, fix later, or proceed as-is)
+4. Address issues based on user decision
+
+---
+
+## Phase 7: Summary
+
+**Goal**: Document what was accomplished
+
+**Actions**:
+1. Mark all todos complete
+2. Summarize:
+   - What was built
+   - Key decisions made
+   - Files modified
+   - Suggested next steps
+
+---
@@ -0,0 +1,9 @@
+{
+  "name": "frontend-design",
+  "version": "1.1.0",
+  "description": "Frontend design skill for UI/UX implementation",
+  "author": {
+    "name": "Prithvi Rajasekaran, Alexander Bricken",
+    "email": "prithvi@anthropic.com, alexander@anthropic.com"
+  }
+}
@@ -0,0 +1,31 @@
+# Frontend Design Plugin
+
+Generates distinctive, production-grade frontend interfaces that avoid generic AI aesthetics.
+
+## What It Does
+
+Claude automatically uses this skill for frontend work. Creates production-ready code with:
+
+- Bold aesthetic choices
+- Distinctive typography and color palettes
+- High-impact animations and visual details
+- Context-aware implementation
+
+## Usage
+
+```
+"Create a dashboard for a music streaming app"
+"Build a landing page for an AI security startup"
+"Design a settings panel with dark mode"
+```
+
+Claude will choose a clear aesthetic direction and implement production code with meticulous attention to detail.
+
+## Learn More
+
+See the [Frontend Aesthetics Cookbook](https://github.com/anthropics/claude-cookbooks/blob/main/coding/prompting_for_frontend_aesthetics.ipynb) for detailed guidance on prompting for high-quality frontend design.
+
+## Authors
+
+Prithvi Rajasekaran (prithvi@anthropic.com)
+Alexander Bricken (alexander@anthropic.com)
@@ -0,0 +1,55 @@
+---
+name: frontend-design
+description: Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
+license: Complete terms in LICENSE.txt
+---
+
+# Frontend Design
+
+Approach this as the design lead at a small studio known for giving every client a visual identity that could not be mistaken for anyone else's. This client has already rejected proposals that felt templated, and is paying for a distinctive point of view: make deliberate, opinionated choices about palette, typography, and layout that are specific to this brief, and take one real aesthetic risk you can justify.
+
+## Ground it in the subject
+
+If the brief does not pin down what the product or subject is, pin it yourself before designing: name one concrete subject, its audience, and the page's single job, and state your choice. If there's any information in your memory about the human's preferences, context about what they're building, or designs you've made before – use that as a hint. The subject's own world, its materials, instruments, artifacts, and vernacular, is where distinctive choices come from. Build with the brief's real content and subject matter throughout.
+
+## Design principles
+
+For web designs, the hero is a thesis. Open with the most characteristic thing in the subject's world, in whatever form makes sense for it: a headline, an image, an animation, a live demo, an interactive moment. Be deliberate with your choice: a big number with a small label, supporting stats, and a gradient accent is the template answer, only use if that's truly the best option.
+
+Typography carries the personality of the page. Pair the display and body faces deliberately, not the same families you would reach for on any other project, and set a clear type scale with intentional weights, widths, and spacing. Make the type treatment itself a memorable part of the design, not a neutral delivery vehicle for the content.
+
+Structure is information. Structural devices, numbering, eyebrows, dividers, labels, should encode something true about the content, not decorate it. Many generic designs use numbered markers (01 / 02 / 03), but that's only appropriate if the content actually is a sequence - like a real process or a typed timeline where order carries information the reader needs. Question if choices like numbered markers actually make sense before incorporating them.
+
+Leverage motion deliberately. Think about where and if animation can serve the subject: a page-load sequence, a scroll-triggered reveal, hover micro-interactions, ambient atmosphere. An orchestrated moment usually lands harder than scattered effects; choose what the direction calls for. However, sometimes less is more, and extra animation contributes to the feeling that the design is AI-generated.
+
+Match complexity to the vision. Maximalist directions need elaborate execution; minimal directions need precision in spacing, type, and detail. Elegance is executing the chosen vision well.
+
+Consider written content carefully. Often a design brief may not contain real content, and it's up to you to come up with copy. Copy can make a design feel as templated as the design itself. See the below section on writing for more guidance.
+
+## Process: brainstorm, explore, plan, critique, build, critique again
+
+For calibration: AI-generated design right now clusters around three looks: (1) a warm cream background (near #F4F1EA) with a high-contrast serif display and a terracotta accent; (2) a near-black background with a single bright acid-green or vermilion accent; (3) a broadsheet-style layout with hairline rules, zero border-radius, and dense newspaper-like columns. All three are legitimate for some briefs, but they are defaults rather than choices, and they appear regardless of subject. Where the brief pins down a visual direction, follow it exactly — the brief's own words always win, including when it asks for one of these looks. Where it leaves an axis free, don't spend that freedom on one of these defaults. Just like a human designer who's hired, there's often a careful balance between doing what you're good at and taking each project as a chance to experiment and learn.
+
+Work in two passes. First, brainstorm a short design plan based on the human's design brief: create a compact token system with color, type, layout, and signature. Color: describe the palette as 4–6 named hex values. Type: the typefaces for 2+ roles (a characterful display face that's used with restraint, a complementary body face, and a utility face for captions or data if needed). Layout: a layout concept, using one-sentence prose descriptions and ASCII wireframes to ideate and compare. Signature: the single unique element this page will be remembered by that embodies the brief in an appropriate way.
+
+Then review that plan against the brief before building: if any part of it reads like the generic default you would produce for any similar page (work through a similar prompt to see if you arrive somewhere similar) rather than a choice made for this specific brief — revise that part, say what you changed and why. Only after you've confirmed the relative uniqueness of your design plan should you start to write the code, following the revised plan exactly and deriving every color and type decision from it.
+
+When writing the code, be careful of structuring your CSS selector specificities. It's easy to generate CSS classes that cancel each other out (especially with a type-based selector like .section and a element-based selector like .cta). This can happen often with paddings/margins between sections.
+
+Try to do a lot of this planning and iteration in your thinking, and only show ideas to the user when you have higher confidence it'll delight them.
+
+## Restraint and self-critique
+
+Spend your boldness in one place. Let the signature element be the one memorable thing, keep everything around it quiet and disciplined, and cut any decoration that does not serve the brief. Not taking a risk can be a risk itself! Build to a quality floor without announcing it: responsive down to mobile, visible keyboard focus, reduced motion respected. Critique your own work as you build, taking screenshots if your environment supports it – a picture is worth 1000 tokens. Consider Chanel's advice: before leaving the house, take a look in the mirror and remove one accessory. Human creators have memory and always try to do something new, so if you have a space to quickly jot down notes about what you've tried, it can help you in future passes.
+
+## More on writing in design
+
+Words appear in a design for one reason: to make it easier to understand, and therefore easier to use. They are design material, not decoration. Bring the same intentionality to copy that you would bring to spacing and color. Before writing anything, ask what the design needs to say, and how it can best be said to help the person navigate the experience.
+
+Write from the end user's side of the screen. Name things by what people control and recognize, never by how the system is built. A person manages notifications, not webhook config. Describe what something does in plain terms rather than selling it. Being specific is always better than being clever.
+
+Use active voice as default. A control should say exactly what happens when it's used: "Save changes," not "Submit." An action keeps the same name through the whole flow, so the button that says "Publish" produces a toast that says "Published." The vocabulary of an interface is the signposting for someone navigating the product. Cohesion and consistency are how people learn their way around.
+
+Treat failure and emptiness as moments for direction, not mood. Explain what went wrong and how to fix it, in the interface's voice rather than a person's. Errors don't apologize, and they are never vague about what happened. An empty screen is an invitation to act.
+
+Keep the register conversational and tuned: plain verbs, sentence case, no filler, with tone matched to the brand and the audience. Let each element do exactly one job. A label labels, an example demonstrates, and nothing quietly does double duty.
@@ -0,0 +1,9 @@
+{
+  "name": "hookify",
+  "version": "0.1.0",
+  "description": "Easily create hooks to prevent unwanted behaviors by analyzing conversation patterns",
+  "author": {
+    "name": "Daisy Hollman",
+    "email": "daisy@anthropic.com"
+  }
+}
@@ -0,0 +1,30 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+
+# Virtual environments
+venv/
+env/
+ENV/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Local configuration (should not be committed)
+.claude/*.local.md
+.claude/*.local.json
@@ -0,0 +1,340 @@
+# Hookify Plugin
+
+Easily create custom hooks to prevent unwanted behaviors by analyzing conversation patterns or from explicit instructions.
+
+## Overview
+
+The hookify plugin makes it simple to create hooks without editing complex `hooks.json` files. Instead, you create lightweight markdown configuration files that define patterns to watch for and messages to show when those patterns match.
+
+**Key features:**
+- 🎯 Analyze conversations to find unwanted behaviors automatically
+- 📝 Simple markdown configuration files with YAML frontmatter
+- 🔍 Regex pattern matching for powerful rules
+- 🚀 No coding required - just describe the behavior
+- 🔄 Easy enable/disable without restarting
+
+## Quick Start
+
+### 1. Create Your First Rule
+
+```bash
+/hookify Warn me when I use rm -rf commands
+```
+
+This analyzes your request and creates `.claude/hookify.warn-rm.local.md`.
+
+### 2. Test It Immediately
+
+**No restart needed!** Rules take effect on the very next tool use.
+
+Ask Claude to run a command that should trigger the rule:
+```
+Run rm -rf /tmp/test
+```
+
+You should see the warning message immediately!
+
+## Usage
+
+### Main Command: /hookify
+
+**With arguments:**
+```
+/hookify Don't use console.log in TypeScript files
+```
+Creates a rule from your explicit instructions.
+
+**Without arguments:**
+```
+/hookify
+```
+Analyzes recent conversation to find behaviors you've corrected or been frustrated by.
+
+### Helper Commands
+
+**List all rules:**
+```
+/hookify:list
+```
+
+**Configure rules interactively:**
+```
+/hookify:configure
+```
+Enable/disable existing rules through an interactive interface.
+
+**Get help:**
+```
+/hookify:help
+```
+
+## Rule Configuration Format
+
+### Simple Rule (Single Pattern)
+
+`.claude/hookify.dangerous-rm.local.md`:
+```markdown
+---
+name: block-dangerous-rm
+enabled: true
+event: bash
+pattern: rm\s+-rf
+action: block
+---
+
+⚠️ **Dangerous rm command detected!**
+
+This command could delete important files. Please:
+- Verify the path is correct
+- Consider using a safer approach
+- Make sure you have backups
+```
+
+**Action field:**
+- `warn`: Shows warning but allows operation (default)
+- `block`: Prevents operation from executing (PreToolUse) or stops session (Stop events)
+
+### Advanced Rule (Multiple Conditions)
+
+`.claude/hookify.sensitive-files.local.md`:
+```markdown
+---
+name: warn-sensitive-files
+enabled: true
+event: file
+action: warn
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.env$|credentials|secrets
+  - field: new_text
+    operator: contains
+    pattern: KEY
+---
+
+🔐 **Sensitive file edit detected!**
+
+Ensure credentials are not hardcoded and file is in .gitignore.
+```
+
+**All conditions must match** for the rule to trigger.
+
+## Event Types
+
+- **`bash`**: Triggers on Bash tool commands
+- **`file`**: Triggers on Edit, Write, MultiEdit tools
+- **`stop`**: Triggers when Claude wants to stop (for completion checks)
+- **`prompt`**: Triggers on user prompt submission
+- **`all`**: Triggers on all events
+
+## Pattern Syntax
+
+Use Python regex syntax:
+
+| Pattern | Matches | Example |
+|---------|---------|---------|
+| `rm\s+-rf` | rm -rf | rm -rf /tmp |
+| `console\.log\(` | console.log( | console.log("test") |
+| `(eval\|exec)\(` | eval( or exec( | eval("code") |
+| `\.env$` | files ending in .env | .env, .env.local |
+| `chmod\s+777` | chmod 777 | chmod 777 file.txt |
+
+**Tips:**
+- Use `\s` for whitespace
+- Escape special chars: `\.` for literal dot
+- Use `|` for OR: `(foo|bar)`
+- Use `.*` to match anything
+- Set `action: block` for dangerous operations
+- Set `action: warn` (or omit) for informational warnings
+
+## Examples
+
+### Example 1: Block Dangerous Commands
+
+```markdown
+---
+name: block-destructive-ops
+enabled: true
+event: bash
+pattern: rm\s+-rf|dd\s+if=|mkfs|format
+action: block
+---
+
+🛑 **Destructive operation detected!**
+
+This command can cause data loss. Operation blocked for safety.
+Please verify the exact path and use a safer approach.
+```
+
+**This rule blocks the operation** - Claude will not be allowed to execute these commands.
+
+### Example 2: Warn About Debug Code
+
+```markdown
+---
+name: warn-debug-code
+enabled: true
+event: file
+pattern: console\.log\(|debugger;|print\(
+action: warn
+---
+
+🐛 **Debug code detected**
+
+Remember to remove debugging statements before committing.
+```
+
+**This rule warns but allows** - Claude sees the message but can still proceed.
+
+### Example 3: Require Tests Before Stopping
+
+```markdown
+---
+name: require-tests-run
+enabled: false
+event: stop
+action: block
+conditions:
+  - field: transcript
+    operator: not_contains
+    pattern: npm test|pytest|cargo test
+---
+
+**Tests not detected in transcript!**
+
+Before stopping, please run tests to verify your changes work correctly.
+```
+
+**This blocks Claude from stopping** if no test commands appear in the session transcript. Enable only when you want strict enforcement.
+
+## Advanced Usage
+
+### Multiple Conditions
+
+Check multiple fields simultaneously:
+
+```markdown
+---
+name: api-key-in-typescript
+enabled: true
+event: file
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.tsx?$
+  - field: new_text
+    operator: regex_match
+    pattern: (API_KEY|SECRET|TOKEN)\s*=\s*["']
+---
+
+🔐 **Hardcoded credential in TypeScript!**
+
+Use environment variables instead of hardcoded values.
+```
+
+### Operators Reference
+
+- `regex_match`: Pattern must match (most common)
+- `contains`: String must contain pattern
+- `equals`: Exact string match
+- `not_contains`: String must NOT contain pattern
+- `starts_with`: String starts with pattern
+- `ends_with`: String ends with pattern
+
+### Field Reference
+
+**For bash events:**
+- `command`: The bash command string
+
+**For file events:**
+- `file_path`: Path to file being edited
+- `new_text`: New content being added (Edit, Write)
+- `old_text`: Old content being replaced (Edit only)
+- `content`: File content (Write only)
+
+**For prompt events:**
+- `user_prompt`: The user's submitted prompt text
+
+**For stop events:**
+- Use general matching on session state
+
+## Management
+
+### Enable/Disable Rules
+
+**Temporarily disable:**
+Edit the `.local.md` file and set `enabled: false`
+
+**Re-enable:**
+Set `enabled: true`
+
+**Or use interactive tool:**
+```
+/hookify:configure
+```
+
+### Delete Rules
+
+Simply delete the `.local.md` file:
+```bash
+rm .claude/hookify.my-rule.local.md
+```
+
+### View All Rules
+
+```
+/hookify:list
+```
+
+## Installation
+
+This plugin is part of the Claude Code Marketplace. It should be auto-discovered when the marketplace is installed.
+
+**Manual testing:**
+```bash
+cc --plugin-dir /path/to/hookify
+```
+
+## Requirements
+
+- Python 3.7+
+- No external dependencies (uses stdlib only)
+
+## Troubleshooting
+
+**Rule not triggering:**
+1. Check rule file exists in `.claude/` directory (in project root, not plugin directory)
+2. Verify `enabled: true` in frontmatter
+3. Test regex pattern separately
+4. Rules should work immediately - no restart needed
+5. Try `/hookify:list` to see if rule is loaded
+
+**Import errors:**
+- Ensure Python 3 is available: `python3 --version`
+- Check hookify plugin is installed
+
+**Pattern not matching:**
+- Test regex: `python3 -c "import re; print(re.search(r'pattern', 'text'))"`
+- Use unquoted patterns in YAML to avoid escaping issues
+- Start simple, then add complexity
+
+**Hook seems slow:**
+- Keep patterns simple (avoid complex regex)
+- Use specific event types (bash, file) instead of "all"
+- Limit number of active rules
+
+## Contributing
+
+Found a useful rule pattern? Consider sharing example files via PR!
+
+## Future Enhancements
+
+- Severity levels (error/warning/info distinctions)
+- Rule templates library
+- Interactive pattern builder
+- Hook testing utilities
+- JSON format support (in addition to markdown)
+
+## License
+
+MIT License
@@ -0,0 +1,176 @@
+---
+name: conversation-analyzer
+description: Use this agent when analyzing conversation transcripts to find behaviors worth preventing with hooks. Examples: <example>Context: User is running /hookify command without arguments\nuser: "/hookify"\nassistant: "I'll analyze the conversation to find behaviors you want to prevent"\n<commentary>The /hookify command without arguments triggers conversation analysis to find unwanted behaviors.</commentary></example><example>Context: User wants to create hooks from recent frustrations\nuser: "Can you look back at this conversation and help me create hooks for the mistakes you made?"\nassistant: "I'll use the conversation-analyzer agent to identify the issues and suggest hooks."\n<commentary>User explicitly asks to analyze conversation for mistakes that should be prevented.</commentary></example>
+model: inherit
+color: yellow
+tools: ["Read", "Grep"]
+---
+
+You are a conversation analysis specialist that identifies problematic behaviors in Claude Code sessions that could be prevented with hooks.
+
+**Your Core Responsibilities:**
+1. Read and analyze user messages to find frustration signals
+2. Identify specific tool usage patterns that caused issues
+3. Extract actionable patterns that can be matched with regex
+4. Categorize issues by severity and type
+5. Provide structured findings for hook rule generation
+
+**Analysis Process:**
+
+### 1. Search for User Messages Indicating Issues
+
+Read through user messages in reverse chronological order (most recent first). Look for:
+
+**Explicit correction requests:**
+- "Don't use X"
+- "Stop doing Y"
+- "Please don't Z"
+- "Avoid..."
+- "Never..."
+
+**Frustrated reactions:**
+- "Why did you do X?"
+- "I didn't ask for that"
+- "That's not what I meant"
+- "That was wrong"
+
+**Corrections and reversions:**
+- User reverting changes Claude made
+- User fixing issues Claude created
+- User providing step-by-step corrections
+
+**Repeated issues:**
+- Same type of mistake multiple times
+- User having to remind multiple times
+- Pattern of similar problems
+
+### 2. Identify Tool Usage Patterns
+
+For each issue, determine:
+- **Which tool**: Bash, Edit, Write, MultiEdit
+- **What action**: Specific command or code pattern
+- **When it happened**: During what task/phase
+- **Why problematic**: User's stated reason or implicit concern
+
+**Extract concrete examples:**
+- For Bash: Actual command that was problematic
+- For Edit/Write: Code pattern that was added
+- For Stop: What was missing before stopping
+
+### 3. Create Regex Patterns
+
+Convert behaviors into matchable patterns:
+
+**Bash command patterns:**
+- `rm\s+-rf` for dangerous deletes
+- `sudo\s+` for privilege escalation
+- `chmod\s+777` for permission issues
+
+**Code patterns (Edit/Write):**
+- `console\.log\(` for debug logging
+- `eval\(|new Function\(` for dangerous eval
+- `innerHTML\s*=` for XSS risks
+
+**File path patterns:**
+- `\.env$` for environment files
+- `/node_modules/` for dependency files
+- `dist/|build/` for generated files
+
+### 4. Categorize Severity
+
+**High severity (should block in future):**
+- Dangerous commands (rm -rf, chmod 777)
+- Security issues (hardcoded secrets, eval)
+- Data loss risks
+
+**Medium severity (warn):**
+- Style violations (console.log in production)
+- Wrong file types (editing generated files)
+- Missing best practices
+
+**Low severity (optional):**
+- Preferences (coding style)
+- Non-critical patterns
+
+### 5. Output Format
+
+Return your findings as structured text in this format:
+
+```
+## Hookify Analysis Results
+
+### Issue 1: Dangerous rm Commands
+**Severity**: High
+**Tool**: Bash
+**Pattern**: `rm\s+-rf`
+**Occurrences**: 3 times
+**Context**: Used rm -rf on /tmp directories without verification
+**User Reaction**: "Please be more careful with rm commands"
+
+**Suggested Rule:**
+- Name: warn-dangerous-rm
+- Event: bash
+- Pattern: rm\s+-rf
+- Message: "Dangerous rm command detected. Verify path before proceeding."
+
+---
+
+### Issue 2: Console.log in TypeScript
+**Severity**: Medium
+**Tool**: Edit/Write
+**Pattern**: `console\.log\(`
+**Occurrences**: 2 times
+**Context**: Added console.log statements to production TypeScript files
+**User Reaction**: "Don't use console.log in production code"
+
+**Suggested Rule:**
+- Name: warn-console-log
+- Event: file
+- Pattern: console\.log\(
+- Message: "Console.log detected. Use proper logging library instead."
+
+---
+
+[Continue for each issue found...]
+
+## Summary
+
+Found {N} behaviors worth preventing:
+- {N} high severity
+- {N} medium severity
+- {N} low severity
+
+Recommend creating rules for high and medium severity issues.
+```
+
+**Quality Standards:**
+- Be specific about patterns (don't be overly broad)
+- Include actual examples from conversation
+- Explain why each issue matters
+- Provide ready-to-use regex patterns
+- Don't false-positive on discussions about what NOT to do
+
+**Edge Cases:**
+
+**User discussing hypotheticals:**
+- "What would happen if I used rm -rf?"
+- Don't treat as problematic behavior
+
+**Teaching moments:**
+- "Here's what you shouldn't do: ..."
+- Context indicates explanation, not actual problem
+
+**One-time accidents:**
+- Single occurrence, already fixed
+- Mention but mark as low priority
+
+**Subjective preferences:**
+- "I prefer X over Y"
+- Mark as low severity, let user decide
+
+**Return Results:**
+Provide your analysis in the structured format above. The /hookify command will use this to:
+1. Present findings to user
+2. Ask which rules to create
+3. Generate .local.md configuration files
+4. Save rules to .claude directory
@@ -0,0 +1,128 @@
+---
+description: Enable or disable hookify rules interactively
+allowed-tools: ["Glob", "Read", "Edit", "AskUserQuestion", "Skill"]
+---
+
+# Configure Hookify Rules
+
+**Load hookify:writing-rules skill first** to understand rule format.
+
+Enable or disable existing hookify rules using an interactive interface.
+
+## Steps
+
+### 1. Find Existing Rules
+
+Use Glob tool to find all hookify rule files:
+```
+pattern: ".claude/hookify.*.local.md"
+```
+
+If no rules found, inform user:
+```
+No hookify rules configured yet. Use `/hookify` to create your first rule.
+```
+
+### 2. Read Current State
+
+For each rule file:
+- Read the file
+- Extract `name` and `enabled` fields from frontmatter
+- Build list of rules with current state
+
+### 3. Ask User Which Rules to Toggle
+
+Use AskUserQuestion to let user select rules:
+
+```json
+{
+  "questions": [
+    {
+      "question": "Which rules would you like to enable or disable?",
+      "header": "Configure",
+      "multiSelect": true,
+      "options": [
+        {
+          "label": "warn-dangerous-rm (currently enabled)",
+          "description": "Warns about rm -rf commands"
+        },
+        {
+          "label": "warn-console-log (currently disabled)",
+          "description": "Warns about console.log in code"
+        },
+        {
+          "label": "require-tests (currently enabled)",
+          "description": "Requires tests before stopping"
+        }
+      ]
+    }
+  ]
+}
+```
+
+**Option format:**
+- Label: `{rule-name} (currently {enabled|disabled})`
+- Description: Brief description from rule's message or pattern
+
+### 4. Parse User Selection
+
+For each selected rule:
+- Determine current state from label (enabled/disabled)
+- Toggle state: enabled → disabled, disabled → enabled
+
+### 5. Update Rule Files
+
+For each rule to toggle:
+- Use Read tool to read current content
+- Use Edit tool to change `enabled: true` to `enabled: false` (or vice versa)
+- Handle both with and without quotes
+
+**Edit pattern for enabling:**
+```
+old_string: "enabled: false"
+new_string: "enabled: true"
+```
+
+**Edit pattern for disabling:**
+```
+old_string: "enabled: true"
+new_string: "enabled: false"
+```
+
+### 6. Confirm Changes
+
+Show user what was changed:
+
+```
+## Hookify Rules Updated
+
+**Enabled:**
+- warn-console-log
+
+**Disabled:**
+- warn-dangerous-rm
+
+**Unchanged:**
+- require-tests
+
+Changes apply immediately - no restart needed
+```
+
+## Important Notes
+
+- Changes take effect immediately on next tool use
+- You can also manually edit .claude/hookify.*.local.md files
+- To permanently remove a rule, delete its .local.md file
+- Use `/hookify:list` to see all configured rules
+
+## Edge Cases
+
+**No rules to configure:**
+- Show message about using `/hookify` to create rules first
+
+**User selects no rules:**
+- Inform that no changes were made
+
+**File read/write errors:**
+- Inform user of specific error
+- Suggest manual editing as fallback
@@ -0,0 +1,175 @@
+---
+description: Get help with the hookify plugin
+allowed-tools: ["Read"]
+---
+
+# Hookify Plugin Help
+
+Explain how the hookify plugin works and how to use it.
+
+## Overview
+
+The hookify plugin makes it easy to create custom hooks that prevent unwanted behaviors. Instead of editing `hooks.json` files, users create simple markdown configuration files that define patterns to watch for.
+
+## How It Works
+
+### 1. Hook System
+
+Hookify installs generic hooks that run on these events:
+- **PreToolUse**: Before any tool executes (Bash, Edit, Write, etc.)
+- **PostToolUse**: After a tool executes
+- **Stop**: When Claude wants to stop working
+- **UserPromptSubmit**: When user submits a prompt
+
+These hooks read configuration files from `.claude/hookify.*.local.md` and check if any rules match the current operation.
+
+### 2. Configuration Files
+
+Users create rules in `.claude/hookify.{rule-name}.local.md` files:
+
+```markdown
+---
+name: warn-dangerous-rm
+enabled: true
+event: bash
+pattern: rm\s+-rf
+---
+
+⚠️ **Dangerous rm command detected!**
+
+This command could delete important files. Please verify the path.
+```
+
+**Key fields:**
+- `name`: Unique identifier for the rule
+- `enabled`: true/false to activate/deactivate
+- `event`: bash, file, stop, prompt, or all
+- `pattern`: Regex pattern to match
+
+The message body is what Claude sees when the rule triggers.
+
+### 3. Creating Rules
+
+**Option A: Use /hookify command**
+```
+/hookify Don't use console.log in production files
+```
+
+This analyzes your request and creates the appropriate rule file.
+
+**Option B: Create manually**
+Create `.claude/hookify.my-rule.local.md` with the format above.
+
+**Option C: Analyze conversation**
+```
+/hookify
+```
+
+Without arguments, hookify analyzes recent conversation to find behaviors you want to prevent.
+
+## Available Commands
+
+- **`/hookify`** - Create hooks from conversation analysis or explicit instructions
+- **`/hookify:help`** - Show this help (what you're reading now)
+- **`/hookify:list`** - List all configured hooks
+- **`/hookify:configure`** - Enable/disable existing hooks interactively
+
+## Example Use Cases
+
+**Prevent dangerous commands:**
+```markdown
+---
+name: block-chmod-777
+enabled: true
+event: bash
+pattern: chmod\s+777
+---
+
+Don't use chmod 777 - it's a security risk. Use specific permissions instead.
+```
+
+**Warn about debugging code:**
+```markdown
+---
+name: warn-console-log
+enabled: true
+event: file
+pattern: console\.log\(
+---
+
+Console.log detected. Remember to remove debug logging before committing.
+```
+
+**Require tests before stopping:**
+```markdown
+---
+name: require-tests
+enabled: true
+event: stop
+pattern: .*
+---
+
+Did you run tests before finishing? Make sure `npm test` or equivalent was executed.
+```
+
+## Pattern Syntax
+
+Use Python regex syntax:
+- `\s` - whitespace
+- `\.` - literal dot
+- `|` - OR
+- `+` - one or more
+- `*` - zero or more
+- `\d` - digit
+- `[abc]` - character class
+
+**Examples:**
+- `rm\s+-rf` - matches "rm -rf"
+- `console\.log\(` - matches "console.log("
+- `(eval|exec)\(` - matches "eval(" or "exec("
+- `\.env$` - matches files ending in .env
+
+## Important Notes
+
+**No Restart Needed**: Hookify rules (`.local.md` files) take effect immediately on the next tool use. The hookify hooks are already loaded and read your rules dynamically.
+
+**Block or Warn**: Rules can either `block` operations (prevent execution) or `warn` (show message but allow). Set `action: block` or `action: warn` in the rule's frontmatter.
+
+**Rule Files**: Keep rules in `.claude/hookify.*.local.md` - they should be git-ignored (add to .gitignore if needed).
+
+**Disable Rules**: Set `enabled: false` in frontmatter or delete the file.
+
+## Troubleshooting
+
+**Hook not triggering:**
+- Check rule file is in `.claude/` directory
+- Verify `enabled: true` in frontmatter
+- Confirm pattern is valid regex
+- Test pattern: `python3 -c "import re; print(re.search('your_pattern', 'test_text'))"`
+- Rules take effect immediately - no restart needed
+
+**Import errors:**
+- Check Python 3 is available: `python3 --version`
+- Verify hookify plugin is installed correctly
+
+**Pattern not matching:**
+- Test regex separately
+- Check for escaping issues (use unquoted patterns in YAML)
+- Try simpler pattern first, then refine
+
+## Getting Started
+
+1. Create your first rule:
+   ```
+   /hookify Warn me when I try to use rm -rf
+   ```
+
+2. Try to trigger it:
+   - Ask Claude to run `rm -rf /tmp/test`
+   - You should see the warning
+
+4. Refine the rule by editing `.claude/hookify.warn-rm.local.md`
+
+5. Create more rules as you encounter unwanted behaviors
+
+For more examples, check the `${CLAUDE_PLUGIN_ROOT}/examples/` directory.
@@ -0,0 +1,231 @@
+---
+description: Create hooks to prevent unwanted behaviors from conversation analysis or explicit instructions
+argument-hint: Optional specific behavior to address
+allowed-tools: ["Read", "Write", "AskUserQuestion", "Task", "Grep", "TodoWrite", "Skill"]
+---
+
+# Hookify - Create Hooks from Unwanted Behaviors
+
+**FIRST: Load the hookify:writing-rules skill** using the Skill tool to understand rule file format and syntax.
+
+Create hook rules to prevent problematic behaviors by analyzing the conversation or from explicit user instructions.
+
+## Your Task
+
+You will help the user create hookify rules to prevent unwanted behaviors. Follow these steps:
+
+### Step 1: Gather Behavior Information
+
+**If $ARGUMENTS is provided:**
+- User has given specific instructions: `$ARGUMENTS`
+- Still analyze recent conversation (last 10-15 user messages) for additional context
+- Look for examples of the behavior happening
+
+**If $ARGUMENTS is empty:**
+- Launch the conversation-analyzer agent to find problematic behaviors
+- Agent will scan user prompts for frustration signals
+- Agent will return structured findings
+
+**To analyze conversation:**
+Use the Task tool to launch conversation-analyzer agent:
+```
+{
+  "subagent_type": "general-purpose",
+  "description": "Analyze conversation for unwanted behaviors",
+  "prompt": "You are analyzing a Claude Code conversation to find behaviors the user wants to prevent.
+
+Read user messages in the current conversation and identify:
+1. Explicit requests to avoid something (\"don't do X\", \"stop doing Y\")
+2. Corrections or reversions (user fixing Claude's actions)
+3. Frustrated reactions (\"why did you do X?\", \"I didn't ask for that\")
+4. Repeated issues (same problem multiple times)
+
+For each issue found, extract:
+- What tool was used (Bash, Edit, Write, etc.)
+- Specific pattern or command
+- Why it was problematic
+- User's stated reason
+
+Return findings as a structured list with:
+- category: Type of issue
+- tool: Which tool was involved
+- pattern: Regex or literal pattern to match
+- context: What happened
+- severity: high/medium/low
+
+Focus on the most recent issues (last 20-30 messages). Don't go back further unless explicitly asked."
+}
+```
+
+### Step 2: Present Findings to User
+
+After gathering behaviors (from arguments or agent), present to user using AskUserQuestion:
+
+**Question 1: Which behaviors to hookify?**
+- Header: "Create Rules"
+- multiSelect: true
+- Options: List each detected behavior (max 4)
+  - Label: Short description (e.g., "Block rm -rf")
+  - Description: Why it's problematic
+
+**Question 2: For each selected behavior, ask about action:**
+- "Should this block the operation or just warn?"
+- Options:
+  - "Just warn" (action: warn - shows message but allows)
+  - "Block operation" (action: block - prevents execution)
+
+**Question 3: Ask for example patterns:**
+- "What patterns should trigger this rule?"
+- Show detected patterns
+- Allow user to refine or add more
+
+### Step 3: Generate Rule Files
+
+For each confirmed behavior, create a `.claude/hookify.{rule-name}.local.md` file:
+
+**Rule naming convention:**
+- Use kebab-case
+- Be descriptive: `block-dangerous-rm`, `warn-console-log`, `require-tests-before-stop`
+- Start with action verb: block, warn, prevent, require
+
+**File format:**
+```markdown
+---
+name: {rule-name}
+enabled: true
+event: {bash|file|stop|prompt|all}
+pattern: {regex pattern}
+action: {warn|block}
+---
+
+{Message to show Claude when rule triggers}
+```
+
+**Action values:**
+- `warn`: Show message but allow operation (default)
+- `block`: Prevent operation or stop session
+
+**For more complex rules (multiple conditions):**
+```markdown
+---
+name: {rule-name}
+enabled: true
+event: file
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.env$
+  - field: new_text
+    operator: contains
+    pattern: API_KEY
+---
+
+{Warning message}
+```
+
+### Step 4: Create Files and Confirm
+
+**IMPORTANT**: Rule files must be created in the current working directory's `.claude/` folder, NOT the plugin directory.
+
+Use the current working directory (where Claude Code was started) as the base path.
+
+1. Check if `.claude/` directory exists in current working directory
+   - If not, create it first with: `mkdir -p .claude`
+
+2. Use Write tool to create each `.claude/hookify.{name}.local.md` file
+   - Use relative path from current working directory: `.claude/hookify.{name}.local.md`
+   - The path should resolve to the project's .claude directory, not the plugin's
+
+3. Show user what was created:
+   ```
+   Created 3 hookify rules:
+   - .claude/hookify.dangerous-rm.local.md
+   - .claude/hookify.console-log.local.md
+   - .claude/hookify.sensitive-files.local.md
+
+   These rules will trigger on:
+   - dangerous-rm: Bash commands matching "rm -rf"
+   - console-log: Edits adding console.log statements
+   - sensitive-files: Edits to .env or credentials files
+   ```
+
+4. Verify files were created in the correct location by listing them
+
+5. Inform user: **"Rules are active immediately - no restart needed!"**
+
+   The hookify hooks are already loaded and will read your new rules on the next tool use.
+
+## Event Types Reference
+
+- **bash**: Matches Bash tool commands
+- **file**: Matches Edit, Write, MultiEdit tools
+- **stop**: Matches when agent wants to stop (use for completion checks)
+- **prompt**: Matches when user submits prompts
+- **all**: Matches all events
+
+## Pattern Writing Tips
+
+**Bash patterns:**
+- Match dangerous commands: `rm\s+-rf|chmod\s+777|dd\s+if=`
+- Match specific tools: `npm\s+install\s+|pip\s+install`
+
+**File patterns:**
+- Match code patterns: `console\.log\(|eval\(|innerHTML\s*=`
+- Match file paths: `\.env$|\.git/|node_modules/`
+
+**Stop patterns:**
+- Check for missing steps: (check transcript or completion criteria)
+
+## Example Workflow
+
+**User says**: "/hookify Don't use rm -rf without asking me first"
+
+**Your response**:
+1. Analyze: User wants to prevent rm -rf commands
+2. Ask: "Should I block this command or just warn you?"
+3. User selects: "Just warn"
+4. Create `.claude/hookify.dangerous-rm.local.md`:
+   ```markdown
+   ---
+   name: warn-dangerous-rm
+   enabled: true
+   event: bash
+   pattern: rm\s+-rf
+   ---
+
+   ⚠️ **Dangerous rm command detected**
+
+   You requested to be warned before using rm -rf.
+   Please verify the path is correct.
+   ```
+5. Confirm: "Created hookify rule. It's active immediately - try triggering it!"
+
+## Important Notes
+
+- **No restart needed**: Rules take effect immediately on the next tool use
+- **File location**: Create files in project's `.claude/` directory (current working directory), NOT the plugin's .claude/
+- **Regex syntax**: Use Python regex syntax (raw strings, no need to escape in YAML)
+- **Action types**: Rules can `warn` (default) or `block` operations
+- **Testing**: Test rules immediately after creating them
+
+## Troubleshooting
+
+**If rule file creation fails:**
+1. Check current working directory with pwd
+2. Ensure `.claude/` directory exists (create with mkdir if needed)
+3. Use absolute path if needed: `{cwd}/.claude/hookify.{name}.local.md`
+4. Verify file was created with Glob or ls
+
+**If rule doesn't trigger after creation:**
+1. Verify file is in project `.claude/` not plugin `.claude/`
+2. Check file with Read tool to ensure pattern is correct
+3. Test pattern with: `python3 -c "import re; print(re.search(r'pattern', 'test text'))"`
+4. Verify `enabled: true` in frontmatter
+5. Remember: Rules work immediately, no restart needed
+
+**If blocking seems too strict:**
+1. Change `action: block` to `action: warn` in the rule file
+2. Or adjust the pattern to be more specific
+3. Changes take effect on next tool use
+
+Use TodoWrite to track your progress through the steps.
@@ -0,0 +1,82 @@
+---
+description: List all configured hookify rules
+allowed-tools: ["Glob", "Read", "Skill"]
+---
+
+# List Hookify Rules
+
+**Load hookify:writing-rules skill first** to understand rule format.
+
+Show all configured hookify rules in the project.
+
+## Steps
+
+1. Use Glob tool to find all hookify rule files:
+   ```
+   pattern: ".claude/hookify.*.local.md"
+   ```
+
+2. For each file found:
+   - Use Read tool to read the file
+   - Extract frontmatter fields: name, enabled, event, pattern
+   - Extract message preview (first 100 chars)
+
+3. Present results in a table:
+
+```
+## Configured Hookify Rules
+
+| Name | Enabled | Event | Pattern | File |
+|------|---------|-------|---------|------|
+| warn-dangerous-rm | ✅ Yes | bash | rm\s+-rf | hookify.dangerous-rm.local.md |
+| warn-console-log | ✅ Yes | file | console\.log\( | hookify.console-log.local.md |
+| check-tests | ❌ No | stop | .* | hookify.require-tests.local.md |
+
+**Total**: 3 rules (2 enabled, 1 disabled)
+```
+
+4. For each rule, show a brief preview:
+```
+### warn-dangerous-rm
+**Event**: bash
+**Pattern**: `rm\s+-rf`
+**Message**: "⚠️ **Dangerous rm command detected!** This command could delete..."
+
+**Status**: ✅ Active
+**File**: .claude/hookify.dangerous-rm.local.md
+```
+
+5. Add helpful footer:
+```
+---
+
+To modify a rule: Edit the .local.md file directly
+To disable a rule: Set `enabled: false` in frontmatter
+To enable a rule: Set `enabled: true` in frontmatter
+To delete a rule: Remove the .local.md file
+To create a rule: Use `/hookify` command
+
+**Remember**: Changes take effect immediately - no restart needed
+```
+
+## If No Rules Found
+
+If no hookify rules exist:
+
+```
+## No Hookify Rules Configured
+
+You haven't created any hookify rules yet.
+
+To get started:
+1. Use `/hookify` to analyze conversation and create rules
+2. Or manually create `.claude/hookify.my-rule.local.md` files
+3. See `/hookify:help` for documentation
+
+Example:
+```
+/hookify Warn me when I use console.log
+```
+
+Check `${CLAUDE_PLUGIN_ROOT}/examples/` for example rule files.
+```
@@ -0,0 +1,297 @@
+#!/usr/bin/env python3
+"""Configuration loader for hookify plugin.
+
+Loads and parses .claude/hookify.*.local.md files.
+"""
+
+import os
+import sys
+import glob
+import re
+from typing import List, Optional, Dict, Any
+from dataclasses import dataclass, field
+
+
+@dataclass
+class Condition:
+    """A single condition for matching."""
+    field: str  # "command", "new_text", "old_text", "file_path", etc.
+    operator: str  # "regex_match", "contains", "equals", etc.
+    pattern: str  # Pattern to match
+
+    @classmethod
+    def from_dict(cls, data: Dict[str, Any]) -> 'Condition':
+        """Create Condition from dict."""
+        return cls(
+            field=data.get('field', ''),
+            operator=data.get('operator', 'regex_match'),
+            pattern=data.get('pattern', '')
+        )
+
+
+@dataclass
+class Rule:
+    """A hookify rule."""
+    name: str
+    enabled: bool
+    event: str  # "bash", "file", "stop", "all", etc.
+    pattern: Optional[str] = None  # Simple pattern (legacy)
+    conditions: List[Condition] = field(default_factory=list)
+    action: str = "warn"  # "warn" or "block" (future)
+    tool_matcher: Optional[str] = None  # Override tool matching
+    message: str = ""  # Message body from markdown
+
+    @classmethod
+    def from_dict(cls, frontmatter: Dict[str, Any], message: str) -> 'Rule':
+        """Create Rule from frontmatter dict and message body."""
+        # Handle both simple pattern and complex conditions
+        conditions = []
+
+        # New style: explicit conditions list
+        if 'conditions' in frontmatter:
+            cond_list = frontmatter['conditions']
+            if isinstance(cond_list, list):
+                conditions = [Condition.from_dict(c) for c in cond_list]
+
+        # Legacy style: simple pattern field
+        simple_pattern = frontmatter.get('pattern')
+        if simple_pattern and not conditions:
+            # Convert simple pattern to condition
+            # Infer field from event
+            event = frontmatter.get('event', 'all')
+            if event == 'bash':
+                field = 'command'
+            elif event == 'file':
+                field = 'new_text'
+            else:
+                field = 'content'
+
+            conditions = [Condition(
+                field=field,
+                operator='regex_match',
+                pattern=simple_pattern
+            )]
+
+        return cls(
+            name=frontmatter.get('name', 'unnamed'),
+            enabled=frontmatter.get('enabled', True),
+            event=frontmatter.get('event', 'all'),
+            pattern=simple_pattern,
+            conditions=conditions,
+            action=frontmatter.get('action', 'warn'),
+            tool_matcher=frontmatter.get('tool_matcher'),
+            message=message.strip()
+        )
+
+
+def extract_frontmatter(content: str) -> tuple[Dict[str, Any], str]:
+    """Extract YAML frontmatter and message body from markdown.
+
+    Returns (frontmatter_dict, message_body).
+
+    Supports multi-line dictionary items in lists by preserving indentation.
+    """
+    if not content.startswith('---'):
+        return {}, content
+
+    # Split on --- markers
+    parts = content.split('---', 2)
+    if len(parts) < 3:
+        return {}, content
+
+    frontmatter_text = parts[1]
+    message = parts[2].strip()
+
+    # Simple YAML parser that handles indented list items
+    frontmatter = {}
+    lines = frontmatter_text.split('\n')
+
+    current_key = None
+    current_list = []
+    current_dict = {}
+    in_list = False
+    in_dict_item = False
+
+    for line in lines:
+        # Skip empty lines and comments
+        stripped = line.strip()
+        if not stripped or stripped.startswith('#'):
+            continue
+
+        # Check indentation level
+        indent = len(line) - len(line.lstrip())
+
+        # Top-level key (no indentation or minimal)
+        if indent == 0 and ':' in line and not line.strip().startswith('-'):
+            # Save previous list/dict if any
+            if in_list and current_key:
+                if in_dict_item and current_dict:
+                    current_list.append(current_dict)
+                    current_dict = {}
+                frontmatter[current_key] = current_list
+                in_list = False
+                in_dict_item = False
+                current_list = []
+
+            key, value = line.split(':', 1)
+            key = key.strip()
+            value = value.strip()
+
+            if not value:
+                # Empty value - list or nested structure follows
+                current_key = key
+                in_list = True
+                current_list = []
+            else:
+                # Simple key-value pair
+                value = value.strip('"').strip("'")
+                if value.lower() == 'true':
+                    value = True
+                elif value.lower() == 'false':
+                    value = False
+                frontmatter[key] = value
+
+        # List item (starts with -)
+        elif stripped.startswith('-') and in_list:
+            # Save previous dict item if any
+            if in_dict_item and current_dict:
+                current_list.append(current_dict)
+                current_dict = {}
+
+            item_text = stripped[1:].strip()
+
+            # Check if this is an inline dict (key: value on same line)
+            if ':' in item_text and ',' in item_text:
+                # Inline comma-separated dict: "- field: command, operator: regex_match"
+                item_dict = {}
+                for part in item_text.split(','):
+                    if ':' in part:
+                        k, v = part.split(':', 1)
+                        item_dict[k.strip()] = v.strip().strip('"').strip("'")
+                current_list.append(item_dict)
+                in_dict_item = False
+            elif ':' in item_text:
+                # Start of multi-line dict item: "- field: command"
+                in_dict_item = True
+                k, v = item_text.split(':', 1)
+                current_dict = {k.strip(): v.strip().strip('"').strip("'")}
+            else:
+                # Simple list item
+                current_list.append(item_text.strip('"').strip("'"))
+                in_dict_item = False
+
+        # Continuation of dict item (indented under list item)
+        elif indent > 2 and in_dict_item and ':' in line:
+            # This is a field of the current dict item
+            k, v = stripped.split(':', 1)
+            current_dict[k.strip()] = v.strip().strip('"').strip("'")
+
+    # Save final list/dict if any
+    if in_list and current_key:
+        if in_dict_item and current_dict:
+            current_list.append(current_dict)
+        frontmatter[current_key] = current_list
+
+    return frontmatter, message
+
+
+def load_rules(event: Optional[str] = None) -> List[Rule]:
+    """Load all hookify rules from .claude directory.
+
+    Args:
+        event: Optional event filter ("bash", "file", "stop", etc.)
+
+    Returns:
+        List of enabled Rule objects matching the event.
+    """
+    rules = []
+
+    # Find all hookify.*.local.md files
+    pattern = os.path.join('.claude', 'hookify.*.local.md')
+    files = glob.glob(pattern)
+
+    for file_path in files:
+        try:
+            rule = load_rule_file(file_path)
+            if not rule:
+                continue
+
+            # Filter by event if specified
+            if event:
+                if rule.event != 'all' and rule.event != event:
+                    continue
+
+            # Only include enabled rules
+            if rule.enabled:
+                rules.append(rule)
+
+        except (IOError, OSError, PermissionError) as e:
+            # File I/O errors - log and continue
+            print(f"Warning: Failed to read {file_path}: {e}", file=sys.stderr)
+            continue
+        except (ValueError, KeyError, AttributeError, TypeError) as e:
+            # Parsing errors - log and continue
+            print(f"Warning: Failed to parse {file_path}: {e}", file=sys.stderr)
+            continue
+        except Exception as e:
+            # Unexpected errors - log with type details
+            print(f"Warning: Unexpected error loading {file_path} ({type(e).__name__}): {e}", file=sys.stderr)
+            continue
+
+    return rules
+
+
+def load_rule_file(file_path: str) -> Optional[Rule]:
+    """Load a single rule file.
+
+    Returns:
+        Rule object or None if file is invalid.
+    """
+    try:
+        with open(file_path, 'r') as f:
+            content = f.read()
+
+        frontmatter, message = extract_frontmatter(content)
+
+        if not frontmatter:
+            print(f"Warning: {file_path} missing YAML frontmatter (must start with ---)", file=sys.stderr)
+            return None
+
+        rule = Rule.from_dict(frontmatter, message)
+        return rule
+
+    except (IOError, OSError, PermissionError) as e:
+        print(f"Error: Cannot read {file_path}: {e}", file=sys.stderr)
+        return None
+    except (ValueError, KeyError, AttributeError, TypeError) as e:
+        print(f"Error: Malformed rule file {file_path}: {e}", file=sys.stderr)
+        return None
+    except UnicodeDecodeError as e:
+        print(f"Error: Invalid encoding in {file_path}: {e}", file=sys.stderr)
+        return None
+    except Exception as e:
+        print(f"Error: Unexpected error parsing {file_path} ({type(e).__name__}): {e}", file=sys.stderr)
+        return None
+
+
+# For testing
+if __name__ == '__main__':
+    import sys
+
+    # Test frontmatter parsing
+    test_content = """---
+name: test-rule
+enabled: true
+event: bash
+pattern: "rm -rf"
+---
+
+⚠️ Dangerous command detected!
+"""
+
+    fm, msg = extract_frontmatter(test_content)
+    print("Frontmatter:", fm)
+    print("Message:", msg)
+
+    rule = Rule.from_dict(fm, msg)
+    print("Rule:", rule)
@@ -0,0 +1,313 @@
+#!/usr/bin/env python3
+"""Rule evaluation engine for hookify plugin."""
+
+import re
+import sys
+from functools import lru_cache
+from typing import List, Dict, Any, Optional
+
+# Import from local module
+from hookify.core.config_loader import Rule, Condition
+
+
+# Cache compiled regexes (max 128 patterns)
+@lru_cache(maxsize=128)
+def compile_regex(pattern: str) -> re.Pattern:
+    """Compile regex pattern with caching.
+
+    Args:
+        pattern: Regex pattern string
+
+    Returns:
+        Compiled regex pattern
+    """
+    return re.compile(pattern, re.IGNORECASE)
+
+
+class RuleEngine:
+    """Evaluates rules against hook input data."""
+
+    def __init__(self):
+        """Initialize rule engine."""
+        # No need for instance cache anymore - using global lru_cache
+        pass
+
+    def evaluate_rules(self, rules: List[Rule], input_data: Dict[str, Any]) -> Dict[str, Any]:
+        """Evaluate all rules and return combined results.
+
+        Checks all rules and accumulates matches. Blocking rules take priority
+        over warning rules. All matching rule messages are combined.
+
+        Args:
+            rules: List of Rule objects to evaluate
+            input_data: Hook input JSON (tool_name, tool_input, etc.)
+
+        Returns:
+            Response dict with systemMessage, hookSpecificOutput, etc.
+            Empty dict {} if no rules match.
+        """
+        hook_event = input_data.get('hook_event_name', '')
+        blocking_rules = []
+        warning_rules = []
+
+        for rule in rules:
+            if self._rule_matches(rule, input_data):
+                if rule.action == 'block':
+                    blocking_rules.append(rule)
+                else:
+                    warning_rules.append(rule)
+
+        # If any blocking rules matched, block the operation
+        if blocking_rules:
+            messages = [f"**[{r.name}]**\n{r.message}" for r in blocking_rules]
+            combined_message = "\n\n".join(messages)
+
+            # Use appropriate blocking format based on event type
+            if hook_event == 'Stop':
+                return {
+                    "decision": "block",
+                    "reason": combined_message,
+                    "systemMessage": combined_message
+                }
+            elif hook_event in ['PreToolUse', 'PostToolUse']:
+                return {
+                    "hookSpecificOutput": {
+                        "hookEventName": hook_event,
+                        "permissionDecision": "deny"
+                    },
+                    "systemMessage": combined_message
+                }
+            else:
+                # For other events, just show message
+                return {
+                    "systemMessage": combined_message
+                }
+
+        # If only warnings, show them but allow operation
+        if warning_rules:
+            messages = [f"**[{r.name}]**\n{r.message}" for r in warning_rules]
+            return {
+                "systemMessage": "\n\n".join(messages)
+            }
+
+        # No matches - allow operation
+        return {}
+
+    def _rule_matches(self, rule: Rule, input_data: Dict[str, Any]) -> bool:
+        """Check if rule matches input data.
+
+        Args:
+            rule: Rule to evaluate
+            input_data: Hook input data
+
+        Returns:
+            True if rule matches, False otherwise
+        """
+        # Extract tool information
+        tool_name = input_data.get('tool_name', '')
+        tool_input = input_data.get('tool_input', {})
+
+        # Check tool matcher if specified
+        if rule.tool_matcher:
+            if not self._matches_tool(rule.tool_matcher, tool_name):
+                return False
+
+        # If no conditions, don't match
+        # (Rules must have at least one condition to be valid)
+        if not rule.conditions:
+            return False
+
+        # All conditions must match
+        for condition in rule.conditions:
+            if not self._check_condition(condition, tool_name, tool_input, input_data):
+                return False
+
+        return True
+
+    def _matches_tool(self, matcher: str, tool_name: str) -> bool:
+        """Check if tool_name matches the matcher pattern.
+
+        Args:
+            matcher: Pattern like "Bash", "Edit|Write", "*"
+            tool_name: Actual tool name
+
+        Returns:
+            True if matches
+        """
+        if matcher == '*':
+            return True
+
+        # Split on | for OR matching
+        patterns = matcher.split('|')
+        return tool_name in patterns
+
+    def _check_condition(self, condition: Condition, tool_name: str,
+                        tool_input: Dict[str, Any], input_data: Dict[str, Any] = None) -> bool:
+        """Check if a single condition matches.
+
+        Args:
+            condition: Condition to check
+            tool_name: Tool being used
+            tool_input: Tool input dict
+            input_data: Full hook input data (for Stop events, etc.)
+
+        Returns:
+            True if condition matches
+        """
+        # Extract the field value to check
+        field_value = self._extract_field(condition.field, tool_name, tool_input, input_data)
+        if field_value is None:
+            return False
+
+        # Apply operator
+        operator = condition.operator
+        pattern = condition.pattern
+
+        if operator == 'regex_match':
+            return self._regex_match(pattern, field_value)
+        elif operator == 'contains':
+            return pattern in field_value
+        elif operator == 'equals':
+            return pattern == field_value
+        elif operator == 'not_contains':
+            return pattern not in field_value
+        elif operator == 'starts_with':
+            return field_value.startswith(pattern)
+        elif operator == 'ends_with':
+            return field_value.endswith(pattern)
+        else:
+            # Unknown operator
+            return False
+
+    def _extract_field(self, field: str, tool_name: str,
+                      tool_input: Dict[str, Any], input_data: Dict[str, Any] = None) -> Optional[str]:
+        """Extract field value from tool input or hook input data.
+
+        Args:
+            field: Field name like "command", "new_text", "file_path", "reason", "transcript"
+            tool_name: Tool being used (may be empty for Stop events)
+            tool_input: Tool input dict
+            input_data: Full hook input (for accessing transcript_path, reason, etc.)
+
+        Returns:
+            Field value as string, or None if not found
+        """
+        # Direct tool_input fields
+        if field in tool_input:
+            value = tool_input[field]
+            if isinstance(value, str):
+                return value
+            return str(value)
+
+        # For Stop events and other non-tool events, check input_data
+        if input_data:
+            # Stop event specific fields
+            if field == 'reason':
+                return input_data.get('reason', '')
+            elif field == 'transcript':
+                # Read transcript file if path provided
+                transcript_path = input_data.get('transcript_path')
+                if transcript_path:
+                    try:
+                        with open(transcript_path, 'r') as f:
+                            return f.read()
+                    except FileNotFoundError:
+                        print(f"Warning: Transcript file not found: {transcript_path}", file=sys.stderr)
+                        return ''
+                    except PermissionError:
+                        print(f"Warning: Permission denied reading transcript: {transcript_path}", file=sys.stderr)
+                        return ''
+                    except (IOError, OSError) as e:
+                        print(f"Warning: Error reading transcript {transcript_path}: {e}", file=sys.stderr)
+                        return ''
+                    except UnicodeDecodeError as e:
+                        print(f"Warning: Encoding error in transcript {transcript_path}: {e}", file=sys.stderr)
+                        return ''
+            elif field == 'user_prompt':
+                # For UserPromptSubmit events
+                return input_data.get('user_prompt', '')
+
+        # Handle special cases by tool type
+        if tool_name == 'Bash':
+            if field == 'command':
+                return tool_input.get('command', '')
+
+        elif tool_name in ['Write', 'Edit']:
+            if field == 'content':
+                # Write uses 'content', Edit has 'new_string'
+                return tool_input.get('content') or tool_input.get('new_string', '')
+            elif field == 'new_text' or field == 'new_string':
+                return tool_input.get('new_string', '')
+            elif field == 'old_text' or field == 'old_string':
+                return tool_input.get('old_string', '')
+            elif field == 'file_path':
+                return tool_input.get('file_path', '')
+
+        elif tool_name == 'MultiEdit':
+            if field == 'file_path':
+                return tool_input.get('file_path', '')
+            elif field in ['new_text', 'content']:
+                # Concatenate all edits
+                edits = tool_input.get('edits', [])
+                return ' '.join(e.get('new_string', '') for e in edits)
+
+        return None
+
+    def _regex_match(self, pattern: str, text: str) -> bool:
+        """Check if pattern matches text using regex.
+
+        Args:
+            pattern: Regex pattern
+            text: Text to match against
+
+        Returns:
+            True if pattern matches
+        """
+        try:
+            # Use cached compiled regex (LRU cache with max 128 patterns)
+            regex = compile_regex(pattern)
+            return bool(regex.search(text))
+
+        except re.error as e:
+            print(f"Invalid regex pattern '{pattern}': {e}", file=sys.stderr)
+            return False
+
+
+# For testing
+if __name__ == '__main__':
+    from hookify.core.config_loader import Condition, Rule
+
+    # Test rule evaluation
+    rule = Rule(
+        name="test-rm",
+        enabled=True,
+        event="bash",
+        conditions=[
+            Condition(field="command", operator="regex_match", pattern=r"rm\s+-rf")
+        ],
+        message="Dangerous rm command!"
+    )
+
+    engine = RuleEngine()
+
+    # Test matching input
+    test_input = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "rm -rf /tmp/test"
+        }
+    }
+
+    result = engine.evaluate_rules([rule], test_input)
+    print("Match result:", result)
+
+    # Test non-matching input
+    test_input2 = {
+        "tool_name": "Bash",
+        "tool_input": {
+            "command": "ls -la"
+        }
+    }
+
+    result2 = engine.evaluate_rules([rule], test_input2)
+    print("Non-match result:", result2)
@@ -0,0 +1,14 @@
+---
+name: warn-console-log
+enabled: true
+event: file
+pattern: console\.log\(
+action: warn
+---
+
+🔍 **Console.log detected**
+
+You're adding a console.log statement. Please consider:
+- Is this for debugging or should it be proper logging?
+- Will this ship to production?
+- Should this use a logging library instead?
@@ -0,0 +1,14 @@
+---
+name: block-dangerous-rm
+enabled: true
+event: bash
+pattern: rm\s+-rf
+action: block
+---
+
+⚠️ **Dangerous rm command detected!**
+
+This command could delete important files. Please:
+- Verify the path is correct
+- Consider using a safer approach
+- Make sure you have backups
--- a/Show More
+++ b/Show More