[Sync] Lua Hyprland chain, licence cleanup

common/.config/claude/README.md

@@ -7,15 +7,20 @@ back into this repo.
 
 ## What's tracked here
 
-- `settings.json` — global settings: permissions (deny git commit/push, `gh pr` write ops, and
-  reads of secret files), default `model`, `enabledPlugins`, vim mode, dark theme, `effortLevel`,
+- `settings.json` — global settings: permissions (deny git push, `gh pr merge` / `close`,
+  and reads of secret files; ask before `gh pr create` and `git rebase`; allow `gh` reads, `gh pr edit`, `gh workflow run`
+  and `gh run rerun`; `git commit` is left to `hooks/git-guard.py`, which exempts listed repos), default `model`, `enabledPlugins`, vim mode, dark theme, `effortLevel`,
   fullscreen TUI, `statusLine`, `hooks`, `worktree` defaults, a generic `autoMode.environment`, …
   Nothing in here may name a specific project, path or remote: this file is published by the
   public mirror, and the auto-mode classifier only reads `autoMode` from user/managed settings
   anyway (never from a project's `.claude/settings*.json`).
-- `statusline.py` — rich status line (dir, git, model, context %, cost, disk — system metrics live in the tmux bar).
+- `statusline.py` — rich status line (dir, git, unresolved PR review threads, model, context %, cost, disk — system
+  metrics live in the tmux bar).
   See [StatusBar.md](StatusBar.md) for what each segment and colour means.
-- `keybindings.json` — custom keybindings: vim-style scroll/navigation, plus `ctrl+x v` for the
+- `keybindings.json` — custom keybindings: vim-style scroll/navigation (`alt+j/k` and
+  `ctrl+shift+j/k` scroll by line — kitty's own `kitty_mod+j/k` scroll only its main-screen
+  scrollback and pass the key through to the fullscreen TUI's alternate screen, so they do not
+  shadow these; dropped once by mistake on 2026-09-15), plus `ctrl+x v` for the
   verbose transcript view (`app:toggleTranscript`, same keystroke as opencode's `<leader>v`; the
   default `ctrl+o` still works, and `ctrl+e` inside the view expands everything).
 - `CLAUDE.md` — global user preferences applied to every project.
@@ -29,17 +34,32 @@ back into this repo.
   installed, and always exits 0.
 - `hooks/git-guard.py` — PreToolUse hook on `Bash`: structurally blocks anything that commits,
   rewrites history or discards working-tree changes — `git commit` / `push` / `revert` /
-  `cherry-pick` / `rebase` / `merge` (not `--abort`), `clean` / `reset` in any form that moves HEAD
+  `cherry-pick` / `rebase -i|--autostash` / `merge` (not `--abort`), `clean` / `reset` in any form that moves HEAD
   or unstages everything (`reset -- <paths>`, `reset HEAD <path>` stay allowed) / `restore <paths>`
   (`--staged <path>` is fine, `--staged .` is not) / `checkout --` / `checkout .` / `stash drop|pop|clear` /
-  `branch -D|-f|-M`, and `gh pr merge` / `create` / `close` / `edit` — wherever the flags sit
+  `branch -D|-f|-M`, and `gh pr merge` / `close`, `gh pr create` without `--head` (gh would push
+  the branch itself) and `gh pr edit` beyond `--title` / `--body` — wherever the flags sit
   (`git -C . push`, `/usr/bin/git push`, `sh -c 'git push'`), which the prefix-matched deny rules
-  can't. The discard group is what protects parallel sessions sharing one checkout. Exit 2 + a
+  can't. A plain `rebase` and its `--continue` / `--abort` pass: Claude rebases and fixes
+  conflicts when asked (`CLAUDE.md`), and settings.json asks before each `git rebase`. The
+  discard group is what protects parallel sessions sharing one checkout. Exit 2 + a
   one-line reason. Heredoc bodies are skipped on purpose (file contents). Regression matrix:
   `bash ~/.claude/hooks/git-guard-test.sh` (a file on purpose — typed inline, the commands under
-  test would trip the live hook).
+  test would trip the live hook). Repos listed in `~/.claude/git-guard-exempt` (host-local, not in
+  this repo — it names projects; one main checkout per line, worktrees included): `commit` and
+  `merge` pass there — judged from the hook input's
+  `cwd`, every `cd` before the call and `git -C` — except `commit --amend` / `-a`. A user-scope deny
+  cannot be lifted for one repo, so `git commit` is off the deny list: the hook is its only
+  structural block.
 - `hooks/notify.py` — Notification hook (`idle_prompt|permission_prompt`): `notify-send` desktop
   notification when Claude is waiting on you; no-op on a headless host.
+- `../tmux/scripts/agent-state.sh` — UserPromptSubmit (busy) / Notification (input) / Stop (done) /
+  StopFailure (error) / SessionEnd (off) hooks, all async: marks the tmux pane this session runs in
+  (`@agent` pane option, drawn as ✓ ? ! after the window name by tmux.conf; visiting the pane
+  greys it out, the next prompt removes it) and buzzes the phone for a new mark on a pane not in
+  view (termux-notification, else a bell). Claude sessions run in daemon-spawned workers with no
+  tmux env, so the script finds the pane by the session name Claude puts in the pane title. Shared with codex
+  (`~/.codex/hooks.json`, untracked), pi and opencode. No-op outside tmux.
 - `hooks/drift-check.sh` — SessionStart + UserPromptSubmit hook, read-only: fails loudly when a
   `~/.config/claude/*` file has broken out of the repo into a plain file, or `~/.claude/*` no longer
   resolves into the dots repo. That is what Claude Code's atomic settings rewrite does through the
@@ -55,14 +75,16 @@ back into this repo.
 - `skills/` — custom [Agent Skills](https://code.claude.com/docs/en/skills). See **Skills** below.
 - `link.sh` — idempotent bootstrap that creates the `~/.claude` symlinks below.
 - `../git/claude-commit-msg` + `../git/hooks/prepare-commit-msg` — the commit-message handoff.
-  A session pipes its suggestion into `claude-commit-msg save`, which stores it as its own file under
-  `$(git rev-parse --git-path CLAUDE_COMMIT_MSG.d)/` **with the paths it staged**; on the next
-  `git commit` / lazygit `C` the hook prefills the editor with the message(s) whose paths are part of
-  that commit and consumes them (`used/`). Parallel sessions therefore never overwrite each other,
-  and committing one session's files gets that session's message. `claude-commit-msg list` shows
-  what is pending. The old single `CLAUDE_COMMIT_MSG` file is still honoured. Both tracked here
-  (deployed to `~/.config/git/`); the hook is installed **per repo** — see setup step 4 — and
-  deliberately not via a global `core.hooksPath`, which would override a project's own hooks.
+  A session pipes its suggestion into `claude-commit-msg save` (run inside the target repo), which
+  stores it as its own file under `$(git rev-parse --git-path CLAUDE_COMMIT_MSG.d)/` **with the paths
+  it staged**; on the next `git commit` / lazygit `C` the hook prefills the editor with the message(s)
+  whose paths are part of that commit and consumes them (`used/`). Parallel sessions therefore never
+  overwrite each other, and committing one session's files gets that session's message.
+  `claude-commit-msg list` shows what is pending. The old single `CLAUDE_COMMIT_MSG` file is still
+  honoured. Both tracked here (deployed to `~/.config/git/`); the hook is installed **per repo** — see
+  setup step 4 — and deliberately not via a global `core.hooksPath`, which would override a project's
+  own hooks. The prefill only runs for an editor commit: lazygit's `c` panel passes the message to git
+  directly, so the hook skips and the suggestion stays pending.
 
 The `settings.json` hook commands for the newer scripts are wrapped in `[ -f … ]`, so a host that
 has pulled the repo but not yet re-stowed just skips them instead of blocking every Bash call.
@@ -93,7 +115,8 @@ claude
 ```
 
 ```fish
-# 4. In every repo you commit in: install the one-shot commit-message prefill hook
+# 4. In every repo you commit in: install the commit-message prefill hook. New clones/inits get it
+#    from ~/.config/git/template (init.templateDir) once that template hook is a symlink to it too.
 ln -sf ~/.config/git/hooks/prepare-commit-msg (git rev-parse --git-path hooks)/prepare-commit-msg
 ```
 
@@ -101,6 +124,12 @@ ln -sf ~/.config/git/hooks/prepare-commit-msg (git rev-parse --git-path hooks)/p
 need to run `link.sh` by hand (`bash ~/.config/claude/link.sh`) if a link later gets clobbered
 (e.g. Claude's `/config` replaces one with a plain file) — it's idempotent and self-healing.
 
+Tracked *files* in `~/.claude` link straight at the repo copy, not through `~/.config/claude`:
+Claude Code follows one symlink hop and then replaces the file atomically (temp + rename), so the
+old two-hop chain lost its middle link to a plain file on every settings write (`/model`, effort,
+plugins, `/config`) and the repo stopped seeing changes. With one hop the rename lands in the
+checkout. Dirs (`hooks`, `skills`) still go through `~/.config/claude`.
+
 A **new skill/hook** added to the repo shows up after a re-stow — `./install.sh` (or `dotsync`) links
 the new file into `~/.config/claude`, which `link.sh` then surfaces into `~/.claude`.
 
@@ -122,8 +151,9 @@ so Claude never auto-triggers them. Run them inside the repo whose branch you're
   copy-paste markdown block, and copies it to the clipboard with `wl-copy`. Leaves verification
   checkboxes for you; never creates/pushes the PR.
 - **`/commit-msg [hint]`** — reads the **staged** diff, infers the repo's commit style from recent
-  `git log` (e.g. this repo's `[Scope] summary`), drafts a matching message, prints it, and copies
-  it to the clipboard with `wl-copy`. Never stages or commits — draft only.
+  `git log` (e.g. this repo's `[Scope] summary`), drafts a matching message, prints it, and saves
+  it for the `prepare-commit-msg` hook (lazygit `C` prefills it). Never stages or commits — draft
+  only.
 - **`/verbose [on|off|status]`** — flips the *persisted* verbose view for the current project:
   `viewMode` (`verbose` / `default` — the key that actually decides the view and beats a sticky
   `/focus` choice for new sessions) plus `verbose` and `showThinkingSummaries`, written to the