fix(practs): bump to latest best

.agent/readme.md

@@ -0,0 +1,23 @@
+this dir hosts the .skills and .briefs useful to any agent, human or robot, when at work in this repo
+
+repo=.this specifies the docs that are scoped to this specific @gitroot repo
+
+repo=$repo specifies the docs that are scoped to any rhachet repo
+
+---
+
+glossary
+
+agents = actors w/ delegated authority
+actors = roles w/ repl
+roles = coherent collections of skills and briefs
+skills = mechanisms that can be executed to produce curated effects
+briefs = resources that externalize knowledge of curated concepts
+brain = a human or robot imagination machine
+  - e.g., robot:llama:openai.o4
+  - e.g., robot:agent:claude.sonnet.v4_5
+  - e.g., human:agent:you
+
+---
+
+written by rhachet 🦾

.agent/repo=.this/readme.md

@@ -0,0 +1,3 @@
+this directory contains the .skills and .briefs scoped to this specific @gitroot repository
+
+these are resources that are specific to the current project and may not be reusable across other repositories

.agent/repo=.this/role=any/skills/use.apikeys.json

@@ -0,0 +1,5 @@
+{
+  "apikeys": {
+    "required": []
+  }
+}

.agent/repo=.this/role=any/skills/use.apikeys.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+######################################################################
+# .what = export api keys for integration tests
+# .why = enables tests that require api keys to run
+#
+# usage:
+#   . .agent/repo=.this/role=any/skills/use.apikeys.sh
+#
+# note:
+#   - must be called with `.` or `source` to export vars to current shell
+#   - loads from ~/.config/rhachet/apikeys.env if available
+#   - falls back to .env.local (gitignored) in repo root
+######################################################################
+
+# fail if not sourced (check if $0 matches this file)
+case "$0" in
+  *use.apikeys.sh)
+    echo "error: this file must be sourced, not executed"
+    echo "usage: source $0"
+    exit 1
+    ;;
+esac
+
+# alias source to `.` for posix compat
+source() { . "$@"; }
+
+# try to load from user config first
+if [ -f ~/.config/rhachet/apikeys.env ]; then
+  source ~/.config/rhachet/apikeys.env
+  echo "✓ loaded api keys from ~/.config/rhachet/apikeys.env"
+
+# fallback to local gitignored file
+elif [ -f .env.local ]; then
+  source .env.local
+  echo "✓ loaded api keys from .env.local"
+
+else
+  echo "⚠ no api keys file found"
+  echo ""
+  echo "create one of:"
+  echo "  ~/.config/rhachet/apikeys.env"
+  echo "  .env.local (in repo root)"
+  echo ""
+  echo "with contents like:"
+  echo "  export OPENAI_API_KEY=sk-..."
+  echo "  export ANTHROPIC_API_KEY=sk-..."
+  return 1 2>/dev/null || exit 1
+fi
+
+# read required keys from json config if present
+APIKEYS_CONFIG=".agent/repo=.this/role=any/skills/use.apikeys.json"
+if [ -f "$APIKEYS_CONFIG" ]; then
+  # extract required keys via jq
+  REQUIRED_KEYS=$(jq -r '.apikeys.required[]?' "$APIKEYS_CONFIG" 2>/dev/null)
+
+  # verify each required key is set
+  for KEY in $REQUIRED_KEYS; do
+    VALUE=$(eval "echo \"\$$KEY\"")
+    if [ -z "$VALUE" ]; then
+      echo "⚠ $KEY not set (required by $APIKEYS_CONFIG)"
+      return 1 2>/dev/null || exit 1
+    fi
+    echo "✓ $KEY set"
+  done
+fi

.claude/settings.json

@@ -0,0 +1,267 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/sessionstart.notify-permissions",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet roles boot --repo .this --role any --if-present",
+            "timeout": 60,
+            "author": "repo=ehmpathy/role=mechanic"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet roles boot --repo ehmpathy --role mechanic",
+            "timeout": 60,
+            "author": "repo=ehmpathy/role=mechanic"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.forbid-stderr-redirect",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.check-permissions",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.forbid-terms.gerunds",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.forbid-terms.blocklist",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.forbid-terms.gerunds",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          },
+          {
+            "type": "command",
+            "command": "./node_modules/.bin/rhachet run --repo ehmpathy --role mechanic --init claude.hooks/pretooluse.forbid-terms.blocklist",
+            "timeout": 5,
+            "author": "repo=ehmpathy/role=mechanic"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "allow": [
+      "mcp__ide__getDiagnostics",
+      "WebSearch",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:www.npmjs.com)",
+      "WebFetch(domain:hub.docker.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:biomejs.dev)",
+      "Bash(ls:*)",
+      "Bash(tree:*)",
+      "Bash(cat:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(grep:*)",
+      "Bash(wc:*)",
+      "Bash(diff:*)",
+      "Bash(which:*)",
+      "Bash(file:*)",
+      "Bash(mkdir:*)",
+      "Bash(pwd)",
+      "Bash(jq)",
+      "Bash(echo:*)",
+      "Bash(printf:*)",
+      "Bash(git mv:*)",
+      "Bash(git rm:*)",
+      "Bash(git log:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git show:*)",
+      "Bash(git check-ignore:*)",
+      "Bash(git blame:*)",
+      "Bash(git describe:*)",
+      "Bash(git ls-files:*)",
+      "Bash(git ls-tree:*)",
+      "Bash(git cat-file:*)",
+      "Bash(git release --watch)",
+      "Bash(npx rhachet run --skill sedreplace:*)",
+      "Bash(npx rhachet run --skill cpsafe:*)",
+      "Bash(npx rhachet run --skill mvsafe:*)",
+      "Bash(npx rhachet run --skill rmsafe:*)",
+      "Bash(npx rhachet run --skill show.gh.action.logs:*)",
+      "Bash(npx rhachet run --skill show.gh.test.errors:*)",
+      "Bash(npx rhachet run --skill show.gh.test.errors --scope test-integration)",
+      "Bash(npx rhachet run:*)",
+      "Bash(npx rhachet:*)",
+      "Bash(npm view:*)",
+      "Bash(npm list:*)",
+      "Bash(npm remove:*)",
+      "Bash(npm help:*)",
+      "Bash(pnpm help:*)",
+      "Bash(npx tsx ./bin/run:*)",
+      "Bash(npm run build:*)",
+      "Bash(npm run build:compile)",
+      "Bash(npm run start:testdb:*)",
+      "Bash(npm run test:*)",
+      "Bash(npm run test:types:*)",
+      "Bash(npm run test:format:*)",
+      "Bash(npm run test:lint:*)",
+      "Bash(npm run test:unit:*)",
+      "Bash(npm run test:integration:*)",
+      "Bash(npm run test:acceptance:*)",
+      "Bash(npm run test:acceptance:locally:*)",
+      "Bash(npm run test:unit -- path/to/file/example.ts)",
+      "Bash(npm run test:integration -- path/to/file/example.ts)",
+      "Bash(npm run test:acceptance -- path/to/file/example.ts)",
+      "Bash(npm run test:acceptance:locally -- path/to/file/example.ts)",
+      "Bash(THOROUGH=true npm run test:*)",
+      "Bash(THOROUGH=true npm run test:types:*)",
+      "Bash(THOROUGH=true npm run test:format:*)",
+      "Bash(THOROUGH=true npm run test:lint:*)",
+      "Bash(THOROUGH=true npm run test:unit:*)",
+      "Bash(THOROUGH=true npm run test:integration:*)",
+      "Bash(THOROUGH=true npm run test:acceptance:*)",
+      "Bash(THOROUGH=true npm run test:acceptance:locally:*)",
+      "Bash(RESNAP=true npm run test:unit:*)",
+      "Bash(RESNAP=true npm run test:integration:*)",
+      "Bash(RESNAP=true npm run test:acceptance:*)",
+      "Bash(RESNAP=true npm run test:acceptance:locally:*)",
+      "Bash(RESNAP=true THOROUGH=true npm run test:unit:*)",
+      "Bash(RESNAP=true THOROUGH=true npm run test:integration:*)",
+      "Bash(RESNAP=true THOROUGH=true npm run test:acceptance:*)",
+      "Bash(RESNAP=true THOROUGH=true npm run test:acceptance:locally:*)",
+      "Bash(npx jest --listTests:*)",
+      "Bash(npm run fix:*)",
+      "Bash(npm run fix:format:*)",
+      "Bash(npm run fix:lint:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr view:*)",
+      "Bash(gh pr status:*)",
+      "Bash(gh pr checks:*)",
+      "Bash(gh pr diff:*)",
+      "Bash(gh issue list:*)",
+      "Bash(gh issue view:*)",
+      "Bash(gh issue status:*)",
+      "Bash(gh repo list:*)",
+      "Bash(gh repo view:*)",
+      "Bash(gh run list:*)",
+      "Bash(gh run view:*)",
+      "Bash(gh run watch:*)",
+      "Bash(gh workflow list:*)",
+      "Bash(gh workflow view:*)",
+      "Bash(gh release list:*)",
+      "Bash(gh release view:*)",
+      "Bash(gh search code:*)",
+      "Bash(gh search repos:*)",
+      "Bash(gh search issues:*)",
+      "Bash(gh search prs:*)",
+      "Bash(gh search commits:*)",
+      "Bash(gh api -X GET:*)",
+      "Bash(gh api --method GET:*)",
+      "Bash(source .agent/repo=.this/role=any/skills/use.apikeys.sh)"
+    ],
+    "deny": [
+      "Bash(bash:*)",
+      "Bash(find:*)",
+      "Bash(gh api --method DELETE:*)",
+      "Bash(gh api --method PATCH:*)",
+      "Bash(gh api --method POST:*)",
+      "Bash(gh api --method PUT:*)",
+      "Bash(gh api -X DELETE:*)",
+      "Bash(gh api -X PATCH:*)",
+      "Bash(gh api -X POST:*)",
+      "Bash(gh api -X PUT:*)",
+      "Bash(gh gist create:*)",
+      "Bash(gh gist delete:*)",
+      "Bash(gh gist edit:*)",
+      "Bash(gh issue close:*)",
+      "Bash(gh issue comment:*)",
+      "Bash(gh issue create:*)",
+      "Bash(gh issue edit:*)",
+      "Bash(gh issue reopen:*)",
+      "Bash(gh label create:*)",
+      "Bash(gh label delete:*)",
+      "Bash(gh label edit:*)",
+      "Bash(gh pr close:*)",
+      "Bash(gh pr comment:*)",
+      "Bash(gh pr create:*)",
+      "Bash(gh pr edit:*)",
+      "Bash(gh pr merge:*)",
+      "Bash(gh pr reopen:*)",
+      "Bash(gh pr review:*)",
+      "Bash(gh project create:*)",
+      "Bash(gh project delete:*)",
+      "Bash(gh project edit:*)",
+      "Bash(gh release create:*)",
+      "Bash(gh release delete:*)",
+      "Bash(gh release edit:*)",
+      "Bash(gh repo create:*)",
+      "Bash(gh repo delete:*)",
+      "Bash(gh repo edit:*)",
+      "Bash(gh repo fork:*)",
+      "Bash(gh run cancel:*)",
+      "Bash(gh run rerun:*)",
+      "Bash(gh workflow disable:*)",
+      "Bash(gh workflow enable:*)",
+      "Bash(gh workflow run:*)",
+      "Bash(git add --all:*)",
+      "Bash(git add -A:*)",
+      "Bash(git add .)",
+      "Bash(git branch -D:*)",
+      "Bash(git branch -d:*)",
+      "Bash(git checkout:*)",
+      "Bash(git commit:*)",
+      "Bash(git config:*)",
+      "Bash(git reflog delete:*)",
+      "Bash(git reflog expire:*)",
+      "Bash(git remote add:*)",
+      "Bash(git remote remove:*)",
+      "Bash(git remote set-url:*)",
+      "Bash(git stash:*)",
+      "Bash(git tag -d:*)",
+      "Bash(mv:*)",
+      "Bash(npx biome:*)",
+      "Bash(npx jest:*)",
+      "Bash(sed:*)",
+      "Bash(tee:*)"
+    ],
+    "ask": [
+      "Bash(chmod:*)",
+      "Bash(npm install:*)",
+      "Bash(pnpm add:*)",
+      "Bash(pnpm install:*)"
+    ]
+  }
+}

.depcheckrc.yml

@@ -3,10 +3,19 @@ ignores:
   - declapract
   - declapract-typescript-ehmpathy
   - '@commitlint/config-conventional'
-  - '@trivago/prettier-plugin-sort-imports'
-  - '@tsconfig/node-lts-strictest'
-  - core-js
-  - ts-jest
-  - ts-node
-  - date-fns
   - husky
+  - "@src/*"
+  - "@src/.*"
+  - rhachet
+  - rhachet-roles-bhrain
+  - rhachet-roles-bhuild
+  - rhachet-roles-ehmpathy
+  - "@tsconfig/node20"
+  - "@tsconfig/strictest"
+  - "@biomejs/biome"
+  - esbuild-register
+  - "@swc/core"
+  - "@swc/jest"
+  - tsx
+  - tsc-alias
+  - yalc