diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000..bcfdefcdd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,17 @@
+# actionlint configuration
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+
+self-hosted-runner:
+  labels:
+    # Blacksmith CI runners
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-4vcpu-windows-2025
+
+# Ignore patterns for known issues
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # Ignore shellcheck warnings (we run shellcheck separately)
+      - 'shellcheck reported issue.+'
+      # Ignore intentional if: false for disabled jobs
+      - 'constant expression "false" in condition'
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..c0e1d465b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,113 @@
+# Dependabot configuration
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+
+registries:
+  npm-npmjs:
+    type: npm-registry
+    url: https://registry.npmjs.org
+    replaces-base: true
+
+updates:
+  # npm dependencies (root)
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      production:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      development:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 10
+    registries:
+      - npm-npmjs
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Swift Package Manager - macOS app
+  - package-ecosystem: swift
+    directory: /apps/macos
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      swift-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Swift Package Manager - shared ClawdbotKit
+  - package-ecosystem: swift
+    directory: /apps/shared/ClawdbotKit
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      swift-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Swift Package Manager - Swabble
+  - package-ecosystem: swift
+    directory: /Swabble
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      swift-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Gradle - Android app
+  - package-ecosystem: gradle
+    directory: /apps/android
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      android-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..4be40f8a8
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,85 @@
+# Pre-commit hooks for clawdbot
+# Install: prek install
+# Run manually: prek run --all-files
+#
+# See https://pre-commit.com for more information
+
+repos:
+  # Basic file hygiene
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: '^(docs/|dist/|vendor/|.*\.snap$)'
+      - id: end-of-file-fixer
+        exclude: '^(docs/|dist/|vendor/|.*\.snap$)'
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-added-large-files
+        args: [--maxkb=500]
+      - id: check-merge-conflict
+
+  # Secret detection (same as CI)
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: [--baseline, .secrets.baseline]
+
+  # Shell script linting
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.11.0
+    hooks:
+      - id: shellcheck
+        args: [--severity=error]  # Only fail on errors, not warnings/info
+        # Exclude vendor and scripts with embedded code or known issues
+        exclude: '^(vendor/|scripts/e2e/)'
+
+  # GitHub Actions linting
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint
+
+  # GitHub Actions security audit
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.22.0
+    hooks:
+      - id: zizmor
+        args: [--persona=regular, --min-severity=medium, --min-confidence=medium]
+        exclude: '^(vendor/|Swabble/)'
+
+  # Project checks (same commands as CI)
+  - repo: local
+    hooks:
+      # oxlint --type-aware src test
+      - id: oxlint
+        name: oxlint
+        entry: npx oxlint --type-aware src test
+        language: system
+        pass_filenames: false
+        types_or: [javascript, jsx, ts, tsx]
+
+      # oxfmt --check src test
+      - id: oxfmt
+        name: oxfmt
+        entry: npx oxfmt --check src test
+        language: system
+        pass_filenames: false
+        types_or: [javascript, jsx, ts, tsx]
+
+      # swiftlint (same as CI)
+      - id: swiftlint
+        name: swiftlint
+        entry: swiftlint --config .swiftlint.yml
+        language: system
+        pass_filenames: false
+        types: [swift]
+
+      # swiftformat --lint (same as CI)
+      - id: swiftformat
+        name: swiftformat
+        entry: swiftformat --lint apps/macos/Sources --config .swiftformat
+        language: system
+        pass_filenames: false
+        types: [swift]
diff --git a/.secrets.baseline b/.secrets.baseline
index 4c0ca50a4..f02613353 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -146,6 +146,22 @@
     }
   ],
   "results": {
+    ".detect-secrets.cfg": [
+      {
+        "type": "Private Key",
+        "filename": ".detect-secrets.cfg",
+        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
+        "is_verified": false,
+        "line_number": 13
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": ".detect-secrets.cfg",
+        "hashed_secret": "fe88fceb47e040ba1bfafa4ac639366188df2f6d",
+        "is_verified": false,
+        "line_number": 15
+      }
+    ],
     ".env.example": [
       {
         "type": "Twilio API Key",
@@ -159,23 +175,23 @@
       {
         "type": "Base64 High Entropy String",
         "filename": "appcast.xml",
-        "hashed_secret": "1b1c2b73eca84e441a823c37a06c71c9fadcfe24",
+        "hashed_secret": "4e5f0a148d9ef42afeb73b1c77643e2ef2dee0b9",
         "is_verified": false,
-        "line_number": 19
+        "line_number": 90
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "appcast.xml",
-        "hashed_secret": "5c47736fee5151b26b3bb61bb38955da0e8937c6",
+        "hashed_secret": "f1ccdaf78c308ec2cf608818da13f5f1e4809ed1",
         "is_verified": false,
-        "line_number": 35
+        "line_number": 138
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "appcast.xml",
-        "hashed_secret": "bbbca47179268f154c63affa0ca441c6e49e650f",
+        "hashed_secret": "2691dc9c9ded92ba62a2d8ee589e2d78e2aa0479",
         "is_verified": false,
-        "line_number": 52
+        "line_number": 212
       }
     ],
     "apps/macos/Tests/ClawdbotIPCTests/AnthropicAuthResolverTests.swift": [
@@ -194,13 +210,22 @@
         "line_number": 42
       }
     ],
-    "apps/macos/Tests/ClawdbotIPCTests/ConnectionsSettingsSmokeTests.swift": [
+    "apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift": [
       {
         "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/ConnectionsSettingsSmokeTests.swift",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "filename": "apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift",
+        "hashed_secret": "19dad5cecb110281417d1db56b60e1b006d55bb4",
         "is_verified": false,
-        "line_number": 83
+        "line_number": 61
+      }
+    ],
+    "apps/macos/Tests/ClawdbotIPCTests/GatewayLaunchAgentManagerTests.swift": [
+      {
+        "type": "Secret Keyword",
+        "filename": "apps/macos/Tests/ClawdbotIPCTests/GatewayLaunchAgentManagerTests.swift",
+        "hashed_secret": "1a91d62f7ca67399625a4368a6ab5d4a3baa6073",
+        "is_verified": false,
+        "line_number": 13
       }
     ],
     "apps/macos/Tests/ClawdbotIPCTests/TailscaleIntegrationSectionTests.swift": [
@@ -212,109 +237,928 @@
         "line_number": 27
       }
     ],
-    "docs/configuration.md": [
+    "apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "filename": "apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift",
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 268
-      },
+        "line_number": 100
+      }
+    ],
+    "dist/control-ui/assets/index-DsXRcnEw.js": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
+        "filename": "dist/control-ui/assets/index-DsXRcnEw.js",
+        "hashed_secret": "ecb252044b5ea0f679ee78ec1a12904739e2904d",
         "is_verified": false,
-        "line_number": 465
-      },
+        "line_number": 16
+      }
+    ],
+    "docs/brave-search.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
+        "filename": "docs/brave-search.md",
+        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
         "is_verified": false,
-        "line_number": 718
-      },
+        "line_number": 26
+      }
+    ],
+    "docs/channels/bluebubbles.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "filename": "docs/channels/bluebubbles.md",
+        "hashed_secret": "555da20df20d4172e00f1b73d7c3943802055270",
         "is_verified": false,
-        "line_number": 760
-      },
+        "line_number": 32
+      }
+    ],
+    "docs/channels/matrix.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
-        "is_verified": false,
-        "line_number": 859
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
+        "filename": "docs/channels/matrix.md",
         "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
         "is_verified": false,
-        "line_number": 982
+        "line_number": 58
       }
     ],
-    "docs/faq.md": [
+    "docs/channels/nextcloud-talk.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/faq.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "filename": "docs/channels/nextcloud-talk.md",
+        "hashed_secret": "76ed0a056aa77060de25754586440cff390791d0",
         "is_verified": false,
-        "line_number": 593
+        "line_number": 47
+      }
+    ],
+    "docs/channels/nostr.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/channels/nostr.md",
+        "hashed_secret": "edeb23e25a619c434d22bb7f1c3ca4841166b4e8",
+        "is_verified": false,
+        "line_number": 65
+      }
+    ],
+    "docs/channels/slack.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/channels/slack.md",
+        "hashed_secret": "3f4800fb7c1fb79a9a48bfd562d90bc6b2e2b718",
+        "is_verified": false,
+        "line_number": 141
+      }
+    ],
+    "docs/concepts/memory.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/concepts/memory.md",
+        "hashed_secret": "39d711243bfcee9fec8299b204e1aa9c3430fa12",
+        "is_verified": false,
+        "line_number": 108
       },
       {
         "type": "Secret Keyword",
-        "filename": "docs/faq.md",
+        "filename": "docs/concepts/memory.md",
+        "hashed_secret": "1a8abbf465c52363ab4c9c6ad945b8e857cbea55",
+        "is_verified": false,
+        "line_number": 131
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/concepts/memory.md",
+        "hashed_secret": "b9f640d6095b9f6b5a65983f7b76dbbb254e0044",
+        "is_verified": false,
+        "line_number": 373
+      }
+    ],
+    "docs/concepts/model-providers.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/concepts/model-providers.md",
         "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
         "is_verified": false,
-        "line_number": 650
-      }
-    ],
-    "docs/skills-config.md": [
+        "line_number": 168
+      },
       {
         "type": "Secret Keyword",
-        "filename": "docs/skills-config.md",
+        "filename": "docs/concepts/model-providers.md",
+        "hashed_secret": "ef83ad68b9b66e008727b7c417c6a8f618b5177e",
+        "is_verified": false,
+        "line_number": 255
+      }
+    ],
+    "docs/environment.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/environment.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 29
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/environment.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "docs/gateway/configuration-examples.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 53
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 55
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
+        "is_verified": false,
+        "line_number": 319
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
         "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
         "is_verified": false,
-        "line_number": 28
-      }
-    ],
-    "docs/skills.md": [
+        "line_number": 414
+      },
       {
         "type": "Secret Keyword",
-        "filename": "docs/skills.md",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 548
+      }
+    ],
+    "docs/gateway/configuration.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 272
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 274
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 1029
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
+        "is_verified": false,
+        "line_number": 1470
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "bde4db9b4c3be4049adc3b9a69851d7c35119770",
+        "is_verified": false,
+        "line_number": 1486
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
+        "is_verified": false,
+        "line_number": 2268
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 2344
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
         "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
         "is_verified": false,
-        "line_number": 97
-      }
-    ],
-    "docs/tailscale.md": [
+        "line_number": 2658
+      },
       {
         "type": "Secret Keyword",
-        "filename": "docs/tailscale.md",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
+        "is_verified": false,
+        "line_number": 2844
+      }
+    ],
+    "docs/gateway/local-models.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/local-models.md",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 32
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/local-models.md",
+        "hashed_secret": "49fd535e63175a827aab3eff9ac58a9e82460ac9",
+        "is_verified": false,
+        "line_number": 121
+      }
+    ],
+    "docs/gateway/tailscale.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/tailscale.md",
         "hashed_secret": "9cb0dc5383312aa15b9dc6745645bde18ff5ade9",
         "is_verified": false,
-        "line_number": 52
+        "line_number": 75
       }
     ],
-    "docs/talk.md": [
+    "docs/help/faq.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/talk.md",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
+        "is_verified": false,
+        "line_number": 925
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 1113
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 1114
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 1439
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
+        "is_verified": false,
+        "line_number": 1715
+      }
+    ],
+    "docs/nodes/talk.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/nodes/talk.md",
         "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
         "is_verified": false,
         "line_number": 50
       }
     ],
-    "docs/telegram.md": [
+    "docs/perplexity.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/telegram.md",
-        "hashed_secret": "e9fe51f94eadabf54dbf2fbbd57188b9abee436e",
+        "filename": "docs/perplexity.md",
+        "hashed_secret": "6b26c117c66a0c030e239eef595c1e18865132a8",
         "is_verified": false,
-        "line_number": 57
+        "line_number": 35
+      }
+    ],
+    "docs/providers/anthropic.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/anthropic.md",
+        "hashed_secret": "c7a8c334eef5d1749fface7d42c66f9ae5e8cf36",
+        "is_verified": false,
+        "line_number": 32
+      }
+    ],
+    "docs/providers/glm.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/glm.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "docs/providers/minimax.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/minimax.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 49
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/minimax.md",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 118
+      }
+    ],
+    "docs/providers/moonshot.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/moonshot.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 39
+      }
+    ],
+    "docs/providers/openai.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/openai.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "docs/providers/opencode.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/opencode.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 25
+      }
+    ],
+    "docs/providers/openrouter.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/openrouter.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "docs/providers/synthetic.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/synthetic.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "docs/providers/zai.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/zai.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 25
+      }
+    ],
+    "docs/tools/browser.md": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "docs/tools/browser.md",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 163
+      }
+    ],
+    "docs/tools/firecrawl.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/firecrawl.md",
+        "hashed_secret": "674397e2c0c2faaa85961c708d2a96a7cc7af217",
+        "is_verified": false,
+        "line_number": 28
+      }
+    ],
+    "docs/tools/skills-config.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/skills-config.md",
+        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
+        "is_verified": false,
+        "line_number": 30
+      }
+    ],
+    "docs/tools/skills.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/skills.md",
+        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
+        "is_verified": false,
+        "line_number": 160
+      }
+    ],
+    "docs/tools/web.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "6b26c117c66a0c030e239eef595c1e18865132a8",
+        "is_verified": false,
+        "line_number": 61
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "96c682c88ed551f22fe76d206c2dfb7df9221ad9",
+        "is_verified": false,
+        "line_number": 112
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
+        "is_verified": false,
+        "line_number": 160
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "674397e2c0c2faaa85961c708d2a96a7cc7af217",
+        "is_verified": false,
+        "line_number": 223
+      }
+    ],
+    "docs/tts.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tts.md",
+        "hashed_secret": "bde4db9b4c3be4049adc3b9a69851d7c35119770",
+        "is_verified": false,
+        "line_number": 72
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tts.md",
+        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
+        "is_verified": false,
+        "line_number": 77
+      }
+    ],
+    "extensions/bluebubbles/src/actions.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/actions.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 73
+      }
+    ],
+    "extensions/bluebubbles/src/attachments.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 35
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "db1530e1ea43af094d3d75b8dbaf19a4a182a318",
+        "is_verified": false,
+        "line_number": 99
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 117
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "052f076c732648ab32d2fcde9fe255319bfa0c7b",
+        "is_verified": false,
+        "line_number": 229
+      }
+    ],
+    "extensions/bluebubbles/src/chat.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 33
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 68
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "5c5a15a8b0b3e154d77746945e563ba40100681b",
+        "is_verified": false,
+        "line_number": 85
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "faacad0ce4ea1c19b46e128fd79679d37d3d331d",
+        "is_verified": false,
+        "line_number": 134
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "4dcc26a1d99532846fedf1265df4f40f4e0005b8",
+        "is_verified": false,
+        "line_number": 219
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "fd2a721f7be1ee3d691a011affcdb11d0ca365a8",
+        "is_verified": false,
+        "line_number": 282
+      }
+    ],
+    "extensions/bluebubbles/src/monitor.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/monitor.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 187
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/monitor.test.ts",
+        "hashed_secret": "1ae0af3fe72b3ba394f9fa95a6cffc090d726c23",
+        "is_verified": false,
+        "line_number": 394
+      }
+    ],
+    "extensions/bluebubbles/src/reactions.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 179
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "a4a05c9a6449eb9d6cdac81dd7edc49230e327e6",
+        "is_verified": false,
+        "line_number": 210
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "a2833da9f0a16f09994754d0a31749cecf8c8c77",
+        "is_verified": false,
+        "line_number": 316
+      }
+    ],
+    "extensions/bluebubbles/src/send.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/send.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/send.test.ts",
+        "hashed_secret": "faacad0ce4ea1c19b46e128fd79679d37d3d331d",
+        "is_verified": false,
+        "line_number": 675
+      }
+    ],
+    "extensions/bluebubbles/src/targets.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/bluebubbles/src/targets.test.ts",
+        "hashed_secret": "a3af2fb0c1e2a30bb038049e1e4b401593af6225",
+        "is_verified": false,
+        "line_number": 62
+      }
+    ],
+    "extensions/bluebubbles/src/targets.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/bluebubbles/src/targets.ts",
+        "hashed_secret": "a3af2fb0c1e2a30bb038049e1e4b401593af6225",
+        "is_verified": false,
+        "line_number": 214
+      }
+    ],
+    "extensions/copilot-proxy/index.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/copilot-proxy/index.ts",
+        "hashed_secret": "50f013532a9770a2c2cfdc38b7581dd01df69b70",
+        "is_verified": false,
+        "line_number": 4
+      }
+    ],
+    "extensions/google-antigravity-auth/index.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "extensions/google-antigravity-auth/index.ts",
+        "hashed_secret": "709d0f232b6ac4f8d24dec3e4fabfdb14257174f",
+        "is_verified": false,
+        "line_number": 9
+      }
+    ],
+    "extensions/matrix/src/matrix/accounts.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/accounts.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 75
+      }
+    ],
+    "extensions/matrix/src/matrix/client.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/client.test.ts",
+        "hashed_secret": "fe7fcdaea49ece14677acd32374d2f1225819d5c",
+        "is_verified": false,
+        "line_number": 14
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/client.test.ts",
+        "hashed_secret": "3dc927d80543dc0f643940b70d066bd4b4c4b78e",
+        "is_verified": false,
+        "line_number": 24
+      }
+    ],
+    "extensions/matrix/src/matrix/client/storage.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/client/storage.ts",
+        "hashed_secret": "7505d64a54e061b7acd54ccd58b49dc43500b635",
+        "is_verified": false,
+        "line_number": 9
+      }
+    ],
+    "extensions/memory-lancedb/config.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/memory-lancedb/config.ts",
+        "hashed_secret": "ecb252044b5ea0f679ee78ec1a12904739e2904d",
+        "is_verified": false,
+        "line_number": 70
+      }
+    ],
+    "extensions/memory-lancedb/index.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/memory-lancedb/index.test.ts",
+        "hashed_secret": "ed65c049bb2f78ee4f703b2158ba9cc6ea31fb7e",
+        "is_verified": false,
+        "line_number": 70
+      }
+    ],
+    "extensions/msteams/src/probe.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/msteams/src/probe.test.ts",
+        "hashed_secret": "1a91d62f7ca67399625a4368a6ab5d4a3baa6073",
+        "is_verified": false,
+        "line_number": 34
+      }
+    ],
+    "extensions/nextcloud-talk/src/accounts.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nextcloud-talk/src/accounts.ts",
+        "hashed_secret": "920f8f5815b381ea692e9e7c2f7119f2b1aa620a",
+        "is_verified": false,
+        "line_number": 26
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nextcloud-talk/src/accounts.ts",
+        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
+        "is_verified": false,
+        "line_number": 139
+      }
+    ],
+    "extensions/nextcloud-talk/src/channel.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nextcloud-talk/src/channel.ts",
+        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
+        "is_verified": false,
+        "line_number": 390
+      }
+    ],
+    "extensions/nostr/README.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/README.md",
+        "hashed_secret": "edeb23e25a619c434d22bb7f1c3ca4841166b4e8",
+        "is_verified": false,
+        "line_number": 43
+      }
+    ],
+    "extensions/nostr/src/channel.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/channel.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 48
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/src/channel.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 48
+      }
+    ],
+    "extensions/nostr/src/nostr-bus.fuzz.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
+        "hashed_secret": "2b4489606a23fb31fcdc849fa7e577ba90f6d39a",
+        "is_verified": false,
+        "line_number": 202
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 203
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
+        "hashed_secret": "b84cb0c3925d34496e6c8b0e55b8c1664a438035",
+        "is_verified": false,
+        "line_number": 208
+      }
+    ],
+    "extensions/nostr/src/nostr-bus.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 11
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "7258e28563f03fb4c5994e8402e6f610d1f0f110",
+        "is_verified": false,
+        "line_number": 33
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "2b4489606a23fb31fcdc849fa7e577ba90f6d39a",
+        "is_verified": false,
+        "line_number": 101
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "ef717286343f6da3f4e6f68c6de02a5148a801c4",
+        "is_verified": false,
+        "line_number": 106
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "98b35fe4c45011220f509ebb5546d3889b55a891",
+        "is_verified": false,
+        "line_number": 111
+      }
+    ],
+    "extensions/nostr/src/nostr-profile.fuzz.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-profile.fuzz.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 12
+      }
+    ],
+    "extensions/nostr/src/nostr-profile.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-profile.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "extensions/nostr/src/types.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/types.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 8
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/src/types.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 8
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/src/types.test.ts",
+        "hashed_secret": "3bee216ebc256d692260fc3adc765050508fef5e",
+        "is_verified": false,
+        "line_number": 127
+      }
+    ],
+    "extensions/open-prose/skills/prose/SKILL.md": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "extensions/open-prose/skills/prose/SKILL.md",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 200
+      }
+    ],
+    "extensions/open-prose/skills/prose/state/postgres.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/open-prose/skills/prose/state/postgres.md",
+        "hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
+        "is_verified": false,
+        "line_number": 75
+      },
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "extensions/open-prose/skills/prose/state/postgres.md",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 198
+      }
+    ],
+    "extensions/zalo/README.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/zalo/README.md",
+        "hashed_secret": "f51aaee16a4a756d287f126b99c081b73cba7f15",
+        "is_verified": false,
+        "line_number": 41
+      }
+    ],
+    "extensions/zalo/src/monitor.webhook.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/zalo/src/monitor.webhook.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 43
+      }
+    ],
+    "skills/1password/references/cli-examples.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "skills/1password/references/cli-examples.md",
+        "hashed_secret": "9dda0987cc3054773a2df97e352d4f64d233ef10",
+        "is_verified": false,
+        "line_number": 17
       }
     ],
     "skills/local-places/SERVER_README.md": [
@@ -344,50 +1188,395 @@
         "line_number": 18
       }
     ],
-    "src/agents/models-config.test.ts": [
+    "src/agents/memory-search.test.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/models-config.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "filename": "src/agents/memory-search.test.ts",
+        "hashed_secret": "a1b49d68a91fdf9c9217773f3fac988d77fa0f50",
         "is_verified": false,
-        "line_number": 25
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.test.ts",
-        "hashed_secret": "3a81eb091f80c845232225be5663d270e90dacb7",
-        "is_verified": false,
-        "line_number": 90
+        "line_number": 164
       }
     ],
-    "src/agents/skills.test.ts": [
+    "src/agents/model-auth.test.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "07a6b9cec637c806195e8aa7e5c0851ab03dc35e",
         "is_verified": false,
-        "line_number": 158
+        "line_number": 211
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
-        "hashed_secret": "7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "21f296583ccd80c5ab9b3330a8b0d47e4a409fb9",
         "is_verified": false,
-        "line_number": 265
+        "line_number": 240
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
+        "is_verified": false,
+        "line_number": 264
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "dff6d4ff5dc357cf451d1855ab9cbda562645c9f",
+        "is_verified": false,
+        "line_number": 295
+      }
+    ],
+    "src/agents/model-auth.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/model-auth.ts",
+        "hashed_secret": "8956265d216d474a080edaa97880d37fc1386f33",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "src/agents/models-config.falls-back-default-baseurl-token-exchange-fails.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.falls-back-default-baseurl-token-exchange-fails.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
+        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
+        "is_verified": false,
+        "line_number": 50
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
+        "hashed_secret": "3a81eb091f80c845232225be5663d270e90dacb7",
+        "is_verified": false,
+        "line_number": 108
+      }
+    ],
+    "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts",
+        "hashed_secret": "980d02eb9335ae7c9e9984f6c8ad432352a0d2ac",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
+        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
+        "is_verified": false,
+        "line_number": 112
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
+        "hashed_secret": "94c4be5a1976115e8152960c21e04400a4fccdf6",
+        "is_verified": false,
+        "line_number": 146
+      }
+    ],
+    "src/agents/models-config.uses-first-github-copilot-profile-env-tokens.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.uses-first-github-copilot-profile-env-tokens.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "src/agents/openai-responses.reasoning-replay.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/openai-responses.reasoning-replay.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 124
+      }
+    ],
+    "src/agents/pi-embedded-runner.applygoogleturnorderingfix.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.applygoogleturnorderingfix.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 58
+      }
+    ],
+    "src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/pi-embedded-runner.createsystempromptoverride.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.createsystempromptoverride.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.falls-back-provider-default-per-dm-not.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.falls-back-provider-default-per-dm-not.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.returns-undefined-sessionkey-is-undefined.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.returns-undefined-sessionkey-is-undefined.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.limithistoryturns.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.limithistoryturns.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/pi-embedded-runner.resolvesessionagentids.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.resolvesessionagentids.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.splitsdktools.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.splitsdktools.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/pi-embedded-runner.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 117
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.test.ts",
+        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
+        "is_verified": false,
+        "line_number": 178
+      }
+    ],
+    "src/agents/skills.applyskillenvoverrides.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/skills.applyskillenvoverrides.test.ts",
         "hashed_secret": "5df3a673d724e8a1eb673a8baf623e183940804d",
         "is_verified": false,
-        "line_number": 462
+        "line_number": 54
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
+        "filename": "src/agents/skills.applyskillenvoverrides.test.ts",
         "hashed_secret": "8921daaa546693e52bc1f9c40bdcf15e816e0448",
         "is_verified": false,
-        "line_number": 490
+        "line_number": 80
+      }
+    ],
+    "src/agents/skills.build-workspace-skills-prompt.prefers-workspace-skills-managed-skills.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/skills.build-workspace-skills-prompt.prefers-workspace-skills-managed-skills.test.ts",
+        "hashed_secret": "7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb",
+        "is_verified": false,
+        "line_number": 124
+      }
+    ],
+    "src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 102
+      }
+    ],
+    "src/agents/tools/web-fetch.ssrf.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-fetch.ssrf.test.ts",
+        "hashed_secret": "5ce8e9d54c77266fff990194d2219a708c59b76c",
+        "is_verified": false,
+        "line_number": 55
+      }
+    ],
+    "src/agents/tools/web-search.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "dfba7aade0868074c2861c98e2a9a92f3178a51b",
+        "is_verified": false,
+        "line_number": 85
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
+        "is_verified": false,
+        "line_number": 190
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "c4865ff9250aca23b0d98eb079dad70ebec1cced",
+        "is_verified": false,
+        "line_number": 198
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "527ee41f36386e85fa932ef09471ca017f3c95c8",
+        "is_verified": false,
+        "line_number": 199
+      }
+    ],
+    "src/agents/tools/web-tools.enabled-defaults.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-tools.enabled-defaults.test.ts",
+        "hashed_secret": "47b249a75ca78fdb578d0f28c33685e27ea82684",
+        "is_verified": false,
+        "line_number": 213
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-tools.enabled-defaults.test.ts",
+        "hashed_secret": "d0ffd81d6d7ad1bc3c365660fe8882480c9a986e",
+        "is_verified": false,
+        "line_number": 242
+      }
+    ],
+    "src/agents/tools/web-tools.fetch.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-tools.fetch.test.ts",
+        "hashed_secret": "5ce8e9d54c77266fff990194d2219a708c59b76c",
+        "is_verified": false,
+        "line_number": 101
+      }
+    ],
+    "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 90
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 96
+      }
+    ],
+    "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 87
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 228
+      }
+    ],
+    "src/auto-reply/status.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/status.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 20
+      }
+    ],
+    "src/browser/cdp.helpers.test.ts": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "src/browser/cdp.helpers.test.ts",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "src/browser/cdp.test.ts": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "src/browser/cdp.test.ts",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 172
       }
     ],
     "src/browser/target-id.test.ts": [
@@ -396,57 +1585,386 @@
         "filename": "src/browser/target-id.test.ts",
         "hashed_secret": "4e126c049580d66ca1549fa534d95a7263f27f46",
         "is_verified": false,
-        "line_number": 16
+        "line_number": 13
       }
     ],
-    "src/commands/antigravity-oauth.ts": [
+    "src/cli/update-cli.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/cli/update-cli.test.ts",
+        "hashed_secret": "e4f91dd323bac5bfc4f60a6e433787671dc2421d",
+        "is_verified": false,
+        "line_number": 112
+      }
+    ],
+    "src/commands/auth-choice.preferred-provider.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.preferred-provider.ts",
+        "hashed_secret": "c03a8d10174dd7eb2b3288b570a5a74fdd9ae05d",
+        "is_verified": false,
+        "line_number": 8
+      }
+    ],
+    "src/commands/auth-choice.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.test.ts",
+        "hashed_secret": "2480500ff391183070fe22ba8665a8be19350833",
+        "is_verified": false,
+        "line_number": 289
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.test.ts",
+        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
+        "is_verified": false,
+        "line_number": 350
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.test.ts",
+        "hashed_secret": "1b4d8423b11d32dd0c466428ac81de84a4a9442b",
+        "is_verified": false,
+        "line_number": 528
+      }
+    ],
+    "src/commands/configure.gateway-auth.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/configure.gateway-auth.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 8
+      }
+    ],
+    "src/commands/models/list.status.test.ts": [
       {
         "type": "Base64 High Entropy String",
-        "filename": "src/commands/antigravity-oauth.ts",
-        "hashed_secret": "709d0f232b6ac4f8d24dec3e4fabfdb14257174f",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "d6ae2508a78a232d5378ef24b85ce40cbb4d7ff0",
         "is_verified": false,
-        "line_number": 17
+        "line_number": 11
       },
       {
         "type": "Base64 High Entropy String",
-        "filename": "src/commands/antigravity-oauth.ts",
-        "hashed_secret": "3848603b8e866f62d07c206ff622279b9dcb0238",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "2d8012102440ea97852b3152239218f00579bafa",
         "is_verified": false,
-        "line_number": 20
-      }
-    ],
-    "src/commands/onboard-auth.ts": [
+        "line_number": 18
+      },
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "51848e2be4b461a549218d3167f19c01be6b98b8",
+        "is_verified": false,
+        "line_number": 46
+      },
       {
         "type": "Secret Keyword",
-        "filename": "src/commands/onboard-auth.ts",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "51848e2be4b461a549218d3167f19c01be6b98b8",
+        "is_verified": false,
+        "line_number": 46
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "1c1e381bfb72d3b7bfca9437053d9875356680f0",
+        "is_verified": false,
+        "line_number": 52
+      }
+    ],
+    "src/commands/onboard-auth.config-minimax.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.config-minimax.ts",
         "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
         "is_verified": false,
+        "line_number": 30
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.config-minimax.ts",
+        "hashed_secret": "ddcb713196b974770575a9bea5a4e7d46361f8e9",
+        "is_verified": false,
+        "line_number": 85
+      }
+    ],
+    "src/commands/onboard-auth.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.test.ts",
+        "hashed_secret": "666c100dab549a6f56da7da546bd848ed5086541",
+        "is_verified": false,
+        "line_number": 230
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.test.ts",
+        "hashed_secret": "e184b402822abc549b37689c84e8e0e33c39a1f1",
+        "is_verified": false,
+        "line_number": 262
+      }
+    ],
+    "src/commands/onboard-non-interactive.ai-gateway.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-non-interactive.ai-gateway.test.ts",
+        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
+        "is_verified": false,
         "line_number": 50
       }
     ],
-    "src/config/config.test.ts": [
+    "src/commands/onboard-non-interactive/api-keys.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/config/config.test.ts",
-        "hashed_secret": "bea2f7b64fab8d1d414d0449530b1e088d36d5b1",
+        "filename": "src/commands/onboard-non-interactive/api-keys.ts",
+        "hashed_secret": "112f3a99b283a4e1788dedd8e0e5d35375c33747",
         "is_verified": false,
-        "line_number": 520
+        "line_number": 10
       }
     ],
-    "src/gateway/server.auth.test.ts": [
+    "src/config/config.env-vars.test.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/gateway/server.auth.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "filename": "src/config/config.env-vars.test.ts",
+        "hashed_secret": "a24ef9c1a27cac44823571ceef2e8262718eee36",
         "is_verified": false,
-        "line_number": 89
+        "line_number": 15
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/gateway/server.auth.test.ts",
+        "filename": "src/config/config.env-vars.test.ts",
+        "hashed_secret": "29d5f92e9ee44d4854d6dfaeefc3dc27d779fdf3",
+        "is_verified": false,
+        "line_number": 47
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/config.env-vars.test.ts",
+        "hashed_secret": "1672b6a1e7956c6a70f45d699aa42a351b1f8b80",
+        "is_verified": false,
+        "line_number": 63
+      }
+    ],
+    "src/config/config.talk-api-key-fallback.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/config.talk-api-key-fallback.test.ts",
+        "hashed_secret": "bea2f7b64fab8d1d414d0449530b1e088d36d5b1",
+        "is_verified": false,
+        "line_number": 42
+      }
+    ],
+    "src/config/config.web-search-provider.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/config.web-search-provider.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "src/config/env-substitution.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "ec417f567082612f8fd6afafe1abcab831fca840",
+        "is_verified": false,
+        "line_number": 69
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "520bd69c3eb1646d9a78181ecb4c90c51fdf428d",
+        "is_verified": false,
+        "line_number": 70
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "f136444bf9b3d01a9f9b772b80ac6bf7b6a43ef0",
+        "is_verified": false,
+        "line_number": 228
+      }
+    ],
+    "src/config/schema.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "e73c9fcad85cd4eecc74181ec4bdb31064d68439",
+        "is_verified": false,
+        "line_number": 184
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "2eda7cd978f39eebec3bf03e4410a40e14167fff",
+        "is_verified": false,
+        "line_number": 220
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "9f4cda226d3868676ac7f86f59e4190eb94bd208",
+        "is_verified": false,
+        "line_number": 418
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "01822c8bbf6a8b136944b14182cb885100ec2eae",
+        "is_verified": false,
+        "line_number": 437
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "bb7dfd9746e660e4a4374951ec5938ef0e343255",
+        "is_verified": false,
+        "line_number": 487
+      }
+    ],
+    "src/config/slack-http-config.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/slack-http-config.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 11
+      }
+    ],
+    "src/gateway/auth.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/auth.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 43
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/auth.test.ts",
         "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_verified": false,
-        "line_number": 109
+        "line_number": 51
+      }
+    ],
+    "src/gateway/call.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 285
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "e493f561d90c6638c1f51c5a8a069c3b129b79ed",
+        "is_verified": false,
+        "line_number": 295
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "2e07956ffc9bc4fd624064c40b7495c85d5f1467",
+        "is_verified": false,
+        "line_number": 300
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "bddc29032de580fb53b3a9a0357dd409086db800",
+        "is_verified": false,
+        "line_number": 313
+      }
+    ],
+    "src/gateway/client.test.ts": [
+      {
+        "type": "Private Key",
+        "filename": "src/gateway/client.test.ts",
+        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
+        "is_verified": false,
+        "line_number": 83
+      }
+    ],
+    "src/gateway/gateway-cli-backend.live.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/gateway/gateway-cli-backend.live.test.ts",
+        "hashed_secret": "3e2fd4a90d5afbd27974730c4d6a9592fe300825",
+        "is_verified": false,
+        "line_number": 38
+      }
+    ],
+    "src/gateway/gateway-models.profiles.live.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/gateway/gateway-models.profiles.live.test.ts",
+        "hashed_secret": "3e2fd4a90d5afbd27974730c4d6a9592fe300825",
+        "is_verified": false,
+        "line_number": 219
+      }
+    ],
+    "src/gateway/gateway.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/gateway.e2e.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 73
+      }
+    ],
+    "src/gateway/server.auth.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/server.auth.e2e.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 179
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/server.auth.e2e.test.ts",
+        "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
+        "is_verified": false,
+        "line_number": 197
+      }
+    ],
+    "src/gateway/session-utils.test.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/gateway/session-utils.test.ts",
+        "hashed_secret": "bb9a5d9483409d2c60b28268a0efcb93324d4cda",
+        "is_verified": false,
+        "line_number": 156
+      }
+    ],
+    "src/gateway/tools-invoke-http.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/tools-invoke-http.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/gateway/ws-log.test.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/gateway/ws-log.test.ts",
+        "hashed_secret": "edd2e7ac4f61d0c606e80a0919d727540842a307",
+        "is_verified": false,
+        "line_number": 22
       }
     ],
     "src/infra/env.test.ts": [
@@ -465,34 +1983,214 @@
         "line_number": 25
       }
     ],
+    "src/infra/outbound/message-action-runner.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/infra/outbound/message-action-runner.test.ts",
+        "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
+        "is_verified": false,
+        "line_number": 88
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/infra/outbound/message-action-runner.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 385
+      }
+    ],
+    "src/infra/outbound/outbound-policy.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/infra/outbound/outbound-policy.test.ts",
+        "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
+        "is_verified": false,
+        "line_number": 33
+      }
+    ],
     "src/infra/shell-env.test.ts": [
       {
         "type": "Secret Keyword",
         "filename": "src/infra/shell-env.test.ts",
         "hashed_secret": "65c10dc3549fe07424148a8a4790a3341ecbc253",
         "is_verified": false,
-        "line_number": 35
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/infra/shell-env.test.ts",
-        "hashed_secret": "64db6bf7f0e5a0491df4419f0eb1bbcc402989e8",
-        "is_verified": false,
-        "line_number": 56
+        "line_number": 27
       },
       {
         "type": "Secret Keyword",
         "filename": "src/infra/shell-env.test.ts",
         "hashed_secret": "e013ffda590d2178607c16d11b1ea42f75ceb0e7",
         "is_verified": false,
-        "line_number": 73
+        "line_number": 59
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "src/infra/shell-env.test.ts",
         "hashed_secret": "be6ee9a6bf9f2dad84a5a67d6c0576a5bacc391e",
         "is_verified": false,
-        "line_number": 75
+        "line_number": 61
+      }
+    ],
+    "src/logging/redact.test.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "dd7754662b89333191ff45e8257a3e6d3fcd3990",
+        "is_verified": false,
+        "line_number": 9
+      },
+      {
+        "type": "Private Key",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
+        "is_verified": false,
+        "line_number": 64
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "7992945213f7d76889fa83ff0f2be352409c837e",
+        "is_verified": false,
+        "line_number": 65
+      },
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "063995ecb4fa5afe2460397d322925cd867b7d74",
+        "is_verified": false,
+        "line_number": 79
+      }
+    ],
+    "src/media-understanding/apply.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/apply.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "src/media-understanding/providers/deepgram/audio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/providers/deepgram/audio.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "src/media-understanding/providers/google/video.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/providers/google/video.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 28
+      }
+    ],
+    "src/media-understanding/providers/openai/audio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/providers/openai/audio.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 26
+      }
+    ],
+    "src/media-understanding/runner.auto-audio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/runner.auto-audio.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 42
+      }
+    ],
+    "src/media-understanding/runner.deepgram.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/runner.deepgram.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 46
+      }
+    ],
+    "src/memory/embeddings.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/memory/embeddings.test.ts",
+        "hashed_secret": "a47110e348a3063541fb1f1f640d635d457181a0",
+        "is_verified": false,
+        "line_number": 32
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/memory/embeddings.test.ts",
+        "hashed_secret": "c734e47630dda71619c696d88381f06f7511bd78",
+        "is_verified": false,
+        "line_number": 149
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/memory/embeddings.test.ts",
+        "hashed_secret": "56e1d57b8db262b08bc73c60ed08d8c92e59503f",
+        "is_verified": false,
+        "line_number": 179
+      }
+    ],
+    "src/pairing/pairing-store.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/pairing/pairing-store.ts",
+        "hashed_secret": "f8c6f1ff98c5ee78c27d34a3ca68f35ad79847af",
+        "is_verified": false,
+        "line_number": 12
+      }
+    ],
+    "src/security/audit.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "b1775a785f09a6ebaf2dc33d6eaeb98974d9cdb8",
+        "is_verified": false,
+        "line_number": 180
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "fa8da98a5bdb77b4902cbb4338e6e94ea825300e",
+        "is_verified": false,
+        "line_number": 209
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "21f688ab56f76a99e5c6ed342291422f4e57e47f",
+        "is_verified": false,
+        "line_number": 1046
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "3dc927d80543dc0f643940b70d066bd4b4c4b78e",
+        "is_verified": false,
+        "line_number": 1077
+      }
+    ],
+    "src/tts/tts.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/tts/tts.test.ts",
+        "hashed_secret": "2e7a7ee14caebf378fc32d6cf6f557f347c96773",
+        "is_verified": false,
+        "line_number": 33
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/tts/tts.test.ts",
+        "hashed_secret": "b214f706bb602c1cc2adc5c6165e73622305f4bb",
+        "is_verified": false,
+        "line_number": 68
       }
     ],
     "src/web/qr-image.test.ts": [
@@ -504,6 +2202,15 @@
         "line_number": 12
       }
     ],
+    "test/provider-timeout.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "test/provider-timeout.e2e.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 182
+      }
+    ],
     "vendor/a2ui/README.md": [
       {
         "type": "Secret Keyword",
@@ -514,5 +2221,5 @@
       }
     ]
   },
-  "generated_at": "2026-01-05T13:01:00Z"
+  "generated_at": "2026-01-25T06:57:20Z"
 }
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 000000000..515f25a5f
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,25 @@
+# ShellCheck configuration
+# https://www.shellcheck.net/wiki/
+
+# Disable common false positives and style suggestions
+
+# SC2034: Variable appears unused (often exported or used indirectly)
+disable=SC2034
+
+# SC2155: Declare and assign separately (common idiom, rarely causes issues)
+disable=SC2155
+
+# SC2295: Expansions inside ${..} need quoting (info-level, rarely causes issues)
+disable=SC2295
+
+# SC1012: \r is literal (tr -d '\r' works as intended on most systems)
+disable=SC1012
+
+# SC2026: Word outside quotes (info-level, often intentional)
+disable=SC2026
+
+# SC2016: Expressions don't expand in single quotes (often intentional in sed/awk)
+disable=SC2016
+
+# SC2129: Consider using { cmd1; cmd2; } >> file (style preference)
+disable=SC2129
diff --git a/.swiftformat b/.swiftformat
index e0d3bc8b6..6622d0b01 100644
--- a/.swiftformat
+++ b/.swiftformat
@@ -23,7 +23,7 @@
 # Whitespace
 --trimwhitespace always
 --emptybraces no-space
---nospaceoperators ...,..< 
+--nospaceoperators ...,..<
 --ranges no-space
 --someAny true
 --voidtype void
diff --git a/AGENTS.md b/AGENTS.md
index 3751208c8..deed6d9bd 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,6 +37,7 @@
 ## Build, Test, and Development Commands
 - Runtime baseline: Node **22+** (keep Node + Bun paths working).
 - Install deps: `pnpm install`
+- Pre-commit hooks: `prek install` (runs same checks as CI)
 - Also supported: `bun install` (keep `pnpm-lock.yaml` + Bun patching in sync when touching deps/patches).
 - Prefer Bun for TypeScript execution (scripts, dev, tests): `bun <file.ts>` / `bunx <tool>`.
 - Run CLI in dev: `pnpm clawdbot ...` (bun) or `pnpm dev`.
diff --git a/README.md b/README.md
index 2c2093b95..1329c5e2b 100644
--- a/README.md
+++ b/README.md
@@ -459,7 +459,7 @@ Use these when you’re past the onboarding flow and want the deeper reference.
 
 ## Clawd
 
-Clawdbot was built for **Clawd**, a space lobster AI assistant. 🦞  
+Clawdbot was built for **Clawd**, a space lobster AI assistant. 🦞
 by Peter Steinberger and the community.
 
 - [clawd.me](https://clawd.me)
@@ -468,7 +468,7 @@ by Peter Steinberger and the community.
 
 ## Community
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, maintainers, and how to submit PRs.  
+See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, maintainers, and how to submit PRs.
 AI/vibe-coded PRs welcome! 🤖
 
 Special thanks to [Mario Zechner](https://mariozechner.at/) for his support and for
diff --git a/SECURITY.md b/SECURITY.md
index d2af462ba..43d493996 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -12,4 +12,3 @@ If you believe you’ve found a security issue in Clawdbot, please report it pri
 For threat model + hardening guidance (including `clawdbot security audit --deep` and `--fix`), see:
 
 - `https://docs.clawd.bot/gateway/security`
-
diff --git a/appcast.xml b/appcast.xml
index bed929dfb..a589863ae 100644
--- a/appcast.xml
+++ b/appcast.xml
@@ -212,4 +212,4 @@
             <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.21/Clawdbot-2026.1.21.zip" length="22284796" type="application/octet-stream" sparkle:edSignature="pXji4NMA/cu35iMxln385d6LnsT4yIZtFtFiR7sIimKeSC2CsyeWzzSD0EhJsN98PdSoy69iEFZt4I2ZtNCECg=="/>
         </item>
     </channel>
-</rss>
\ No newline at end of file
+</rss>
diff --git a/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt b/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt
index 1d876903a..1c9b3986f 100644
--- a/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt
+++ b/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt
@@ -12,4 +12,3 @@ data class CameraHudState(
   val kind: CameraHudKind,
   val message: String,
 )
-
diff --git a/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt b/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt
index e8a6eff15..6c3e2c201 100644
--- a/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt
+++ b/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt
@@ -12,4 +12,3 @@ enum class VoiceWakeMode(val rawValue: String) {
     }
   }
 }
-
diff --git a/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt b/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt
index e449993d2..3e12a56df 100644
--- a/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt
+++ b/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt
@@ -135,7 +135,7 @@ class SmsManager(private val context: Context) {
 
     /**
      * Send an SMS message.
-     * 
+     *
      * @param paramsJson JSON with "to" (phone number) and "message" (text) fields
      * @return SendResult indicating success or failure
      */
diff --git a/apps/android/app/src/main/res/values/colors.xml b/apps/android/app/src/main/res/values/colors.xml
index 6e79939c6..dfadc94cf 100644
--- a/apps/android/app/src/main/res/values/colors.xml
+++ b/apps/android/app/src/main/res/values/colors.xml
@@ -1,4 +1,3 @@
 <resources>
     <color name="ic_launcher_background">#0A0A0A</color>
 </resources>
-
diff --git a/apps/android/app/src/main/res/values/strings.xml b/apps/android/app/src/main/res/values/strings.xml
index 5e4d8a77d..3665960c2 100644
--- a/apps/android/app/src/main/res/values/strings.xml
+++ b/apps/android/app/src/main/res/values/strings.xml
@@ -1,4 +1,3 @@
 <resources>
     <string name="app_name">Clawdbot Node</string>
 </resources>
-
diff --git a/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt b/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt
index bdcee3284..f6e512fa3 100644
--- a/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt
+++ b/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt
@@ -23,4 +23,3 @@ class VoiceWakeCommandExtractorTest {
     assertNull(VoiceWakeCommandExtractor.extractCommand("hey claude!", listOf("claude")))
   }
 }
-
diff --git a/apps/android/settings.gradle.kts b/apps/android/settings.gradle.kts
index 05466f48f..d9d0158c9 100644
--- a/apps/android/settings.gradle.kts
+++ b/apps/android/settings.gradle.kts
@@ -16,4 +16,3 @@ dependencyResolutionManagement {
 
 rootProject.name = "ClawdbotNodeAndroid"
 include(":app")
-
diff --git a/apps/ios/.swiftlint.yml b/apps/ios/.swiftlint.yml
index 7b64147b5..fc8509c83 100644
--- a/apps/ios/.swiftlint.yml
+++ b/apps/ios/.swiftlint.yml
@@ -3,4 +3,3 @@ parent_config: ../../.swiftlint.yml
 included:
   - Sources
   - ../shared/ClawdisNodeKit/Sources
-
diff --git a/apps/macos/Icon.icon/icon.json b/apps/macos/Icon.icon/icon.json
index 32754bd18..33ba22b1c 100644
--- a/apps/macos/Icon.icon/icon.json
+++ b/apps/macos/Icon.icon/icon.json
@@ -33,4 +33,4 @@
     ],
     "squares" : "shared"
   }
-}
\ No newline at end of file
+}
diff --git a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt
index 4592f65f5..d1b9e4b3c 100644
--- a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt
+++ b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt
@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
\ No newline at end of file
+SOFTWARE.
diff --git a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json
index 236ac2f0e..76caa5452 100644
--- a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json
+++ b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json
@@ -173,4 +173,4 @@
   "iPod5,1": "iPod touch (5th generation)",
   "iPod7,1": "iPod touch (6th generation)",
   "iPod9,1": "iPod touch (7th generation)"
-}
\ No newline at end of file
+}
diff --git a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json
index 2b7483581..03d5a5ecc 100644
--- a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json
+++ b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json
@@ -211,4 +211,4 @@
     "Mac Pro (2019)",
     "Mac Pro (Rack, 2019)"
   ]
-}
\ No newline at end of file
+}
diff --git a/extensions/matrix/src/matrix/monitor/auto-join.ts b/extensions/matrix/src/matrix/monitor/auto-join.ts
index 90b05202a..564c78995 100644
--- a/extensions/matrix/src/matrix/monitor/auto-join.ts
+++ b/extensions/matrix/src/matrix/monitor/auto-join.ts
@@ -33,7 +33,7 @@ export function registerMatrixAutoJoin(params: {
   // For "allowlist" mode, handle invites manually
   client.on("room.invite", async (roomId: string, _inviteEvent: unknown) => {
     if (autoJoin !== "allowlist") return;
-    
+
     // Get room alias if available
     let alias: string | undefined;
     let altAliases: string[] = [];
diff --git a/extensions/matrix/src/matrix/monitor/media.ts b/extensions/matrix/src/matrix/monitor/media.ts
index dc49e7c45..b60320e41 100644
--- a/extensions/matrix/src/matrix/monitor/media.ts
+++ b/extensions/matrix/src/matrix/monitor/media.ts
@@ -25,7 +25,7 @@ async function fetchMatrixMediaBuffer(params: {
   // matrix-bot-sdk provides mxcToHttp helper
   const url = params.client.mxcToHttp(params.mxcUrl);
   if (!url) return null;
-  
+
   // Use the client's download method which handles auth
   try {
     const buffer = await params.client.downloadContent(params.mxcUrl);
@@ -61,7 +61,7 @@ async function fetchEncryptedMediaBuffer(params: {
     Buffer.from(encryptedBuffer),
     params.file,
   );
-  
+
   return { buffer: decrypted };
 }
 
@@ -77,7 +77,7 @@ export async function downloadMatrixMedia(params: {
   placeholder: string;
 } | null> {
   let fetched: { buffer: Buffer; headerType?: string } | null;
-  
+
   if (params.file) {
     // Encrypted media
     fetched = await fetchEncryptedMediaBuffer({
@@ -93,7 +93,7 @@ export async function downloadMatrixMedia(params: {
       maxBytes: params.maxBytes,
     });
   }
-  
+
   if (!fetched) return null;
   const headerType = fetched.headerType ?? params.contentType ?? undefined;
   const saved = await getMatrixRuntime().channel.media.saveMediaBuffer(
diff --git a/extensions/mattermost/src/group-mentions.ts b/extensions/mattermost/src/group-mentions.ts
index b3fbc7e4f..773e655ff 100644
--- a/extensions/mattermost/src/group-mentions.ts
+++ b/extensions/mattermost/src/group-mentions.ts
@@ -11,4 +11,4 @@ export function resolveMattermostGroupRequireMention(
   });
   if (typeof account.requireMention === "boolean") return account.requireMention;
   return true;
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/accounts.ts b/extensions/mattermost/src/mattermost/accounts.ts
index 6af1b3e4c..e75f34593 100644
--- a/extensions/mattermost/src/mattermost/accounts.ts
+++ b/extensions/mattermost/src/mattermost/accounts.ts
@@ -112,4 +112,4 @@ export function listEnabledMattermostAccounts(cfg: ClawdbotConfig): ResolvedMatt
   return listMattermostAccountIds(cfg)
     .map((accountId) => resolveMattermostAccount({ cfg, accountId }))
     .filter((account) => account.enabled);
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/client.ts b/extensions/mattermost/src/mattermost/client.ts
index 277139d5d..6b63f830f 100644
--- a/extensions/mattermost/src/mattermost/client.ts
+++ b/extensions/mattermost/src/mattermost/client.ts
@@ -205,4 +205,4 @@ export async function uploadMattermostFile(
     throw new Error("Mattermost file upload failed");
   }
   return info;
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/monitor-helpers.ts b/extensions/mattermost/src/mattermost/monitor-helpers.ts
index 2aa00f158..8c68a4f25 100644
--- a/extensions/mattermost/src/mattermost/monitor-helpers.ts
+++ b/extensions/mattermost/src/mattermost/monitor-helpers.ts
@@ -147,4 +147,4 @@ export function resolveThreadSessionKeys(params: {
     ? `${params.baseSessionKey}:thread:${threadId}`
     : params.baseSessionKey;
   return { sessionKey, parentSessionKey: params.parentSessionKey };
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/probe.ts b/extensions/mattermost/src/mattermost/probe.ts
index 0286979f6..c0fa8ae63 100644
--- a/extensions/mattermost/src/mattermost/probe.ts
+++ b/extensions/mattermost/src/mattermost/probe.ts
@@ -67,4 +67,4 @@ export async function probeMattermost(
   } finally {
     if (timer) clearTimeout(timer);
   }
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/onboarding-helpers.ts b/extensions/mattermost/src/onboarding-helpers.ts
index f44299222..8a5d1f585 100644
--- a/extensions/mattermost/src/onboarding-helpers.ts
+++ b/extensions/mattermost/src/onboarding-helpers.ts
@@ -39,4 +39,4 @@ export async function promptAccountId(params: PromptAccountIdParams): Promise<st
     );
   }
   return normalized;
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/onboarding.ts b/extensions/mattermost/src/onboarding.ts
index 495128d5b..431c648ae 100644
--- a/extensions/mattermost/src/onboarding.ts
+++ b/extensions/mattermost/src/onboarding.ts
@@ -184,4 +184,4 @@ export const mattermostOnboardingAdapter: ChannelOnboardingAdapter = {
       mattermost: { ...cfg.channels?.mattermost, enabled: false },
     },
   }),
-};
\ No newline at end of file
+};
diff --git a/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose b/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose
index 053544169..7e3d6921d 100644
--- a/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose
+++ b/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose
@@ -22,11 +22,11 @@ parallel:
   security = session: security_expert
     prompt: "Perform a deep security audit of the changes. Look for OWASP top 10 issues."
     context: overview
-  
+
   perf = session: performance_expert
     prompt: "Analyze the performance implications. Identify potential bottlenecks or regressions."
     context: overview
-  
+
   style = session: reviewer
     prompt: "Review for code style, maintainability, and adherence to best practices."
     context: overview
diff --git a/extensions/voice-call/src/manager/context.ts b/extensions/voice-call/src/manager/context.ts
index 38fc7aa1b..846dd7450 100644
--- a/extensions/voice-call/src/manager/context.ts
+++ b/extensions/voice-call/src/manager/context.ts
@@ -19,4 +19,3 @@ export type CallManagerContext = {
   transcriptWaiters: Map<CallId, TranscriptWaiter>;
   maxDurationTimers: Map<CallId, NodeJS.Timeout>;
 };
-
diff --git a/extensions/voice-call/src/manager/events.ts b/extensions/voice-call/src/manager/events.ts
index 8cf7ad5b4..b9da95ea2 100644
--- a/extensions/voice-call/src/manager/events.ts
+++ b/extensions/voice-call/src/manager/events.ts
@@ -175,4 +175,3 @@ export function processEvent(ctx: CallManagerContext, event: NormalizedEvent): v
 
   persistCallRecord(ctx.storePath, call);
 }
-
diff --git a/extensions/voice-call/src/manager/lookup.ts b/extensions/voice-call/src/manager/lookup.ts
index bc0b5f8ee..99ac246b1 100644
--- a/extensions/voice-call/src/manager/lookup.ts
+++ b/extensions/voice-call/src/manager/lookup.ts
@@ -31,4 +31,3 @@ export function findCall(params: {
     providerCallId: params.callIdOrProviderCallId,
   });
 }
-
diff --git a/extensions/voice-call/src/manager/state.ts b/extensions/voice-call/src/manager/state.ts
index 7131d6b7d..37d460a1d 100644
--- a/extensions/voice-call/src/manager/state.ts
+++ b/extensions/voice-call/src/manager/state.ts
@@ -48,4 +48,3 @@ export function addTranscriptEntry(
   };
   call.transcript.push(entry);
 }
-
diff --git a/extensions/voice-call/src/manager/store.ts b/extensions/voice-call/src/manager/store.ts
index 96525479a..9200b684d 100644
--- a/extensions/voice-call/src/manager/store.ts
+++ b/extensions/voice-call/src/manager/store.ts
@@ -86,4 +86,3 @@ export async function getCallHistoryFromStore(
 
   return calls;
 }
-
diff --git a/extensions/voice-call/src/manager/timers.ts b/extensions/voice-call/src/manager/timers.ts
index d56a26fc7..2effcdf0f 100644
--- a/extensions/voice-call/src/manager/timers.ts
+++ b/extensions/voice-call/src/manager/timers.ts
@@ -84,4 +84,3 @@ export function waitForFinalTranscript(
     ctx.transcriptWaiters.set(callId, { resolve, reject, timeout });
   });
 }
-
diff --git a/extensions/voice-call/src/manager/twiml.ts b/extensions/voice-call/src/manager/twiml.ts
index d6c1dd038..588df5590 100644
--- a/extensions/voice-call/src/manager/twiml.ts
+++ b/extensions/voice-call/src/manager/twiml.ts
@@ -7,4 +7,3 @@ export function generateNotifyTwiml(message: string, voice: string): string {
   <Hangup/>
 </Response>`;
 }
-
diff --git a/extensions/voice-call/src/providers/plivo.test.ts b/extensions/voice-call/src/providers/plivo.test.ts
index 0674a7dd2..e2aa6289b 100644
--- a/extensions/voice-call/src/providers/plivo.test.ts
+++ b/extensions/voice-call/src/providers/plivo.test.ts
@@ -26,4 +26,3 @@ describe("PlivoProvider", () => {
     expect(result.providerResponseBody).toContain('length="300"');
   });
 });
-
diff --git a/extensions/voice-call/src/providers/twilio/webhook.ts b/extensions/voice-call/src/providers/twilio/webhook.ts
index f59342f14..28f445c88 100644
--- a/extensions/voice-call/src/providers/twilio/webhook.ts
+++ b/extensions/voice-call/src/providers/twilio/webhook.ts
@@ -27,4 +27,3 @@ export function verifyTwilioProviderWebhook(params: {
     reason: result.reason,
   };
 }
-
diff --git a/extensions/zalouser/src/channel.test.ts b/extensions/zalouser/src/channel.test.ts
index 45487edd0..123cf358d 100644
--- a/extensions/zalouser/src/channel.test.ts
+++ b/extensions/zalouser/src/channel.test.ts
@@ -15,4 +15,3 @@ describe("zalouser outbound chunker", () => {
     expect(chunks.every((c) => c.length <= limit)).toBe(true);
   });
 });
-
diff --git a/scripts/clawlog.sh b/scripts/clawlog.sh
index 49e877090..2320e2e7d 100755
--- a/scripts/clawlog.sh
+++ b/scripts/clawlog.sh
@@ -124,7 +124,7 @@ EOF
 # Function to list categories
 list_categories() {
     echo -e "${BLUE}Fetching VibeTunnel log categories from the last hour...${NC}\n"
-    
+
     # Get unique categories from recent logs
     log show --predicate "subsystem == \"$SUBSYSTEM\"" --last 1h 2>/dev/null | \
         grep -E "category: \"[^\"]+\"" | \
@@ -133,7 +133,7 @@ list_categories() {
         while read -r cat; do
             echo "  • $cat"
         done
-    
+
     echo -e "\n${YELLOW}Note: Only categories with recent activity are shown${NC}"
 }
 
@@ -230,29 +230,29 @@ fi
 if [[ "$STREAM_MODE" == true ]]; then
     # Streaming mode
     CMD="sudo log stream --predicate '$PREDICATE' --level $LOG_LEVEL --info"
-    
+
     echo -e "${GREEN}Streaming VibeTunnel logs continuously...${NC}"
     echo -e "${YELLOW}Press Ctrl+C to stop${NC}\n"
 else
     # Show mode
     CMD="sudo log show --predicate '$PREDICATE'"
-    
+
     # Add log level for show command
     if [[ "$LOG_LEVEL" == "debug" ]]; then
         CMD="$CMD --debug"
     else
         CMD="$CMD --info"
     fi
-    
+
     # Add time range
     CMD="$CMD --last $TIME_RANGE"
-    
+
     if [[ "$SHOW_TAIL" == true ]]; then
         echo -e "${GREEN}Showing last $TAIL_LINES log lines from the past $TIME_RANGE${NC}"
     else
         echo -e "${GREEN}Showing all logs from the past $TIME_RANGE${NC}"
     fi
-    
+
     # Show applied filters
     if [[ "$ERRORS_ONLY" == true ]]; then
         echo -e "${RED}Filter: Errors only${NC}"
@@ -277,14 +277,14 @@ if [[ -n "$OUTPUT_FILE" ]]; then
     if sudo -n /usr/bin/log show --last 1s 2>&1 | grep -q "password"; then
         handle_sudo_error
     fi
-    
+
     echo -e "${BLUE}Exporting logs to: $OUTPUT_FILE${NC}\n"
     if [[ "$SHOW_TAIL" == true ]] && [[ "$STREAM_MODE" == false ]]; then
         eval "$CMD" 2>&1 | tail -n "$TAIL_LINES" > "$OUTPUT_FILE"
     else
         eval "$CMD" > "$OUTPUT_FILE" 2>&1
     fi
-    
+
     # Check if file was created and has content
     if [[ -s "$OUTPUT_FILE" ]]; then
         LINE_COUNT=$(wc -l < "$OUTPUT_FILE" | tr -d ' ')
@@ -298,7 +298,7 @@ else
     if sudo -n /usr/bin/log show --last 1s 2>&1 | grep -q "password"; then
         handle_sudo_error
     fi
-    
+
     if [[ "$SHOW_TAIL" == true ]] && [[ "$STREAM_MODE" == false ]]; then
         # Apply tail for non-streaming mode
         eval "$CMD" 2>&1 | tail -n "$TAIL_LINES"
diff --git a/scripts/e2e/gateway-network-docker.sh b/scripts/e2e/gateway-network-docker.sh
index 8b971d3b3..0989e764d 100644
--- a/scripts/e2e/gateway-network-docker.sh
+++ b/scripts/e2e/gateway-network-docker.sh
@@ -102,12 +102,12 @@ ws.send(
 	);
 	const connectRes = await onceFrame((o) => o?.type === \"res\" && o?.id === \"c1\");
 	if (!connectRes.ok) throw new Error(\"connect failed: \" + (connectRes.error?.message ?? \"unknown\"));
-	
+
 	ws.send(JSON.stringify({ type: \"req\", id: \"h1\", method: \"health\" }));
 	const healthRes = await onceFrame((o) => o?.type === \"res\" && o?.id === \"h1\", 10000);
 	if (!healthRes.ok) throw new Error(\"health failed: \" + (healthRes.error?.message ?? \"unknown\"));
 	if (healthRes.payload?.ok !== true) throw new Error(\"unexpected health payload\");
-	
+
 	ws.close();
 	console.log(\"ok\");
 NODE"
diff --git a/scripts/update-clawtributors.types.ts b/scripts/update-clawtributors.types.ts
index 17b576523..98526bc8a 100644
--- a/scripts/update-clawtributors.types.ts
+++ b/scripts/update-clawtributors.types.ts
@@ -30,4 +30,3 @@ export type Entry = {
   avatar_url: string;
   lines: number;
 };
-
diff --git a/skills/local-places/SKILL.md b/skills/local-places/SKILL.md
index a002081f6..5b0fdc3a8 100644
--- a/skills/local-places/SKILL.md
+++ b/skills/local-places/SKILL.md
@@ -84,7 +84,7 @@ curl http://127.0.0.1:8000/places/{place_id}
       "open_now": true
     }
   ],
-  "next_page_token": "..." 
+  "next_page_token": "..."
 }
 ```
 
diff --git a/ui/src/main.ts b/ui/src/main.ts
index 31d493921..9374bb20e 100644
--- a/ui/src/main.ts
+++ b/ui/src/main.ts
@@ -1,3 +1,2 @@
 import "./styles.css";
 import "./ui/app.ts";
-
diff --git a/ui/src/styles/chat/layout.css b/ui/src/styles/chat/layout.css
index 96e321bb0..e137cb8c8 100644
--- a/ui/src/styles/chat/layout.css
+++ b/ui/src/styles/chat/layout.css
@@ -279,4 +279,3 @@
     min-width: 120px;
   }
 }
-
diff --git a/ui/src/styles/chat/text.css b/ui/src/styles/chat/text.css
index ce5ce4af9..13e245de2 100644
--- a/ui/src/styles/chat/text.css
+++ b/ui/src/styles/chat/text.css
@@ -122,4 +122,3 @@
   border-top: 1px solid var(--border);
   margin: 1em 0;
 }
-
diff --git a/ui/src/styles/chat/tool-cards.css b/ui/src/styles/chat/tool-cards.css
index fd6291a3e..052e63dbb 100644
--- a/ui/src/styles/chat/tool-cards.css
+++ b/ui/src/styles/chat/tool-cards.css
@@ -196,4 +196,3 @@
     transform: scale(1);
   }
 }
-
diff --git a/ui/src/ui/app-events.ts b/ui/src/ui/app-events.ts
index c058cf73e..eda3a8e16 100644
--- a/ui/src/ui/app-events.ts
+++ b/ui/src/ui/app-events.ts
@@ -3,4 +3,3 @@ export type EventLogEntry = {
   event: string;
   payload?: unknown;
 };
-
diff --git a/ui/src/ui/app-tool-stream.ts b/ui/src/ui/app-tool-stream.ts
index 5c83c3a79..2fbe12b7a 100644
--- a/ui/src/ui/app-tool-stream.ts
+++ b/ui/src/ui/app-tool-stream.ts
@@ -154,13 +154,13 @@ const COMPACTION_TOAST_DURATION_MS = 5000;
 export function handleCompactionEvent(host: CompactionHost, payload: AgentEventPayload) {
   const data = payload.data ?? {};
   const phase = typeof data.phase === "string" ? data.phase : "";
-  
+
   // Clear any existing timer
   if (host.compactionClearTimer != null) {
     window.clearTimeout(host.compactionClearTimer);
     host.compactionClearTimer = null;
   }
-  
+
   if (phase === "start") {
     host.compactionStatus = {
       active: true,
@@ -183,13 +183,13 @@ export function handleCompactionEvent(host: CompactionHost, payload: AgentEventP
 
 export function handleAgentEvent(host: ToolStreamHost, payload?: AgentEventPayload) {
   if (!payload) return;
-  
+
   // Handle compaction events
   if (payload.stream === "compaction") {
     handleCompactionEvent(host as CompactionHost, payload);
     return;
   }
-  
+
   if (payload.stream !== "tool") return;
   const sessionKey =
     typeof payload.sessionKey === "string" ? payload.sessionKey : undefined;
diff --git a/ui/src/ui/controllers/config/form-utils.ts b/ui/src/ui/controllers/config/form-utils.ts
index dea4d7f61..fd40bb5ac 100644
--- a/ui/src/ui/controllers/config/form-utils.ts
+++ b/ui/src/ui/controllers/config/form-utils.ts
@@ -74,4 +74,3 @@ export function removePathValue(
     delete (current as Record<string, unknown>)[lastKey];
   }
 }
-
diff --git a/ui/src/ui/controllers/debug.ts b/ui/src/ui/controllers/debug.ts
index 78993a3af..5aa1eec43 100644
--- a/ui/src/ui/controllers/debug.ts
+++ b/ui/src/ui/controllers/debug.ts
@@ -54,4 +54,3 @@ export async function callDebugMethod(state: DebugState) {
     state.debugCallError = String(err);
   }
 }
-
diff --git a/ui/src/ui/controllers/presence.ts b/ui/src/ui/controllers/presence.ts
index 4154307b1..67ac2761d 100644
--- a/ui/src/ui/controllers/presence.ts
+++ b/ui/src/ui/controllers/presence.ts
@@ -33,4 +33,3 @@ export async function loadPresence(state: PresenceState) {
     state.presenceLoading = false;
   }
 }
-
diff --git a/ui/src/ui/format.test.ts b/ui/src/ui/format.test.ts
index d7acecebb..f8b1e8e56 100644
--- a/ui/src/ui/format.test.ts
+++ b/ui/src/ui/format.test.ts
@@ -39,4 +39,3 @@ describe("stripThinkingTags", () => {
     expect(stripThinkingTags("Hello</final>")).toBe("Hello");
   });
 });
-
diff --git a/ui/src/ui/markdown.test.ts b/ui/src/ui/markdown.test.ts
index da2c4aca0..396ff0fa5 100644
--- a/ui/src/ui/markdown.test.ts
+++ b/ui/src/ui/markdown.test.ts
@@ -30,4 +30,3 @@ describe("toSanitizedMarkdownHtml", () => {
     expect(html).toContain("console.log(1)");
   });
 });
-
diff --git a/ui/src/ui/presenter.ts b/ui/src/ui/presenter.ts
index 9f3df3dcb..ddb99d9c5 100644
--- a/ui/src/ui/presenter.ts
+++ b/ui/src/ui/presenter.ts
@@ -55,4 +55,3 @@ export function formatCronPayload(job: CronJob) {
   if (p.kind === "systemEvent") return `System: ${p.text}`;
   return `Agent: ${p.message}`;
 }
-
diff --git a/ui/src/ui/uuid.test.ts b/ui/src/ui/uuid.test.ts
index 62856f1b6..9f7ccbf81 100644
--- a/ui/src/ui/uuid.test.ts
+++ b/ui/src/ui/uuid.test.ts
@@ -30,4 +30,3 @@ describe("generateUUID", () => {
     expect(id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
   });
 });
-
diff --git a/ui/src/ui/uuid.ts b/ui/src/ui/uuid.ts
index 7124dbb8f..f231d0f7f 100644
--- a/ui/src/ui/uuid.ts
+++ b/ui/src/ui/uuid.ts
@@ -40,4 +40,3 @@ export function generateUUID(cryptoLike: CryptoLike | null = globalThis.crypto):
 
   return uuidFromBytes(weakRandomBytes());
 }
-
diff --git a/ui/src/ui/views/channels.shared.ts b/ui/src/ui/views/channels.shared.ts
index 6238a1e1c..9af0c2ea1 100644
--- a/ui/src/ui/views/channels.shared.ts
+++ b/ui/src/ui/views/channels.shared.ts
@@ -43,4 +43,3 @@ export function renderChannelAccountCount(
   if (count < 2) return nothing;
   return html`<div class="account-count">Accounts (${count})</div>`;
 }
-
diff --git a/ui/src/ui/views/channels.whatsapp.ts b/ui/src/ui/views/channels.whatsapp.ts
index b40a533c6..eae3be695 100644
--- a/ui/src/ui/views/channels.whatsapp.ts
+++ b/ui/src/ui/views/channels.whatsapp.ts
@@ -116,4 +116,3 @@ export function renderWhatsAppCard(params: {
     </div>
   `;
 }
-
diff --git a/ui/src/ui/views/chat.ts b/ui/src/ui/views/chat.ts
index 86a6771f2..dd61ca0ec 100644
--- a/ui/src/ui/views/chat.ts
+++ b/ui/src/ui/views/chat.ts
@@ -70,7 +70,7 @@ const COMPACTION_TOAST_DURATION_MS = 5000;
 
 function renderCompactionIndicator(status: CompactionIndicatorStatus | null | undefined) {
   if (!status) return nothing;
-  
+
   // Show "compacting..." while active
   if (status.active) {
     return html`
@@ -91,7 +91,7 @@ function renderCompactionIndicator(status: CompactionIndicatorStatus | null | un
       `;
     }
   }
-  
+
   return nothing;
 }
 
diff --git a/ui/src/ui/views/config-form.node.ts b/ui/src/ui/views/config-form.node.ts
index 07cb9f239..9d121d7f1 100644
--- a/ui/src/ui/views/config-form.node.ts
+++ b/ui/src/ui/views/config-form.node.ts
@@ -120,7 +120,7 @@ export function renderNode(params: {
       const hasString = normalizedTypes.has("string");
       const hasNumber = normalizedTypes.has("number");
       const hasBoolean = normalizedTypes.has("boolean");
-      
+
       if (hasBoolean && normalizedTypes.size === 1) {
         return renderNode({
           ...params,
@@ -383,14 +383,14 @@ function renderObject(params: {
   const hint = hintForPath(path, hints);
   const label = hint?.label ?? schema.title ?? humanize(String(path.at(-1)));
   const help = hint?.help ?? schema.description;
-  
+
   const fallback = value ?? schema.default;
   const obj = fallback && typeof fallback === "object" && !Array.isArray(fallback)
     ? (fallback as Record<string, unknown>)
     : {};
   const props = schema.properties ?? {};
   const entries = Object.entries(props);
-  
+
   // Sort by hint order
   const sorted = entries.sort((a, b) => {
     const orderA = hintForPath([...path, a[0]], hints)?.order ?? 0;
@@ -514,7 +514,7 @@ function renderArray(params: {
         </button>
       </div>
       ${help ? html`<div class="cfg-array__help">${help}</div>` : nothing}
-      
+
       ${arr.length === 0 ? html`
         <div class="cfg-array__empty">
           No items yet. Click "Add" to create one.
@@ -597,7 +597,7 @@ function renderMapField(params: {
           Add Entry
         </button>
       </div>
-      
+
       ${entries.length === 0 ? html`
         <div class="cfg-map__empty">No custom entries.</div>
       ` : html`
diff --git a/ui/src/ui/views/config-form.render.ts b/ui/src/ui/views/config-form.render.ts
index e0985c93b..2e7dc5f4e 100644
--- a/ui/src/ui/views/config-form.render.ts
+++ b/ui/src/ui/views/config-form.render.ts
@@ -94,16 +94,16 @@ function matchesSearch(key: string, schema: JsonSchema, query: string): boolean
   if (!query) return true;
   const q = query.toLowerCase();
   const meta = SECTION_META[key];
-  
+
   // Check key name
   if (key.toLowerCase().includes(q)) return true;
-  
+
   // Check label and description
   if (meta) {
     if (meta.label.toLowerCase().includes(q)) return true;
     if (meta.description.toLowerCase().includes(q)) return true;
   }
-  
+
   return schemaMatches(schema, q);
 }
 
@@ -192,8 +192,8 @@ export function renderConfigForm(props: ConfigFormProps) {
       <div class="config-empty">
         <div class="config-empty__icon">${icons.search}</div>
         <div class="config-empty__text">
-          ${searchQuery 
-            ? `No settings match "${searchQuery}"` 
+          ${searchQuery
+            ? `No settings match "${searchQuery}"`
             : "No settings in this section"}
         </div>
       </div>
diff --git a/ui/src/ui/views/config-form.shared.ts b/ui/src/ui/views/config-form.shared.ts
index b37969a93..a6a8e2416 100644
--- a/ui/src/ui/views/config-form.shared.ts
+++ b/ui/src/ui/views/config-form.shared.ts
@@ -89,4 +89,3 @@ export function isSensitivePath(path: Array<string | number>): boolean {
     key.endsWith("key")
   );
 }
-
diff --git a/ui/src/ui/views/config-form.ts b/ui/src/ui/views/config-form.ts
index 0bcfe0a9c..146436ea6 100644
--- a/ui/src/ui/views/config-form.ts
+++ b/ui/src/ui/views/config-form.ts
@@ -5,4 +5,3 @@ export {
 } from "./config-form.analyze";
 export { renderNode } from "./config-form.node";
 export { schemaType, type JsonSchema } from "./config-form.shared";
-
diff --git a/ui/src/ui/views/config.ts b/ui/src/ui/views/config.ts
index c45849d56..ff6f57f32 100644
--- a/ui/src/ui/views/config.ts
+++ b/ui/src/ui/views/config.ts
@@ -138,7 +138,7 @@ function computeDiff(
 ): Array<{ path: string; from: unknown; to: unknown }> {
   if (!original || !current) return [];
   const changes: Array<{ path: string; from: unknown; to: unknown }> = [];
-  
+
   function compare(orig: unknown, curr: unknown, path: string) {
     if (orig === curr) return;
     if (typeof orig !== typeof curr) {
@@ -164,7 +164,7 @@ function computeDiff(
       compare(origObj[key], currObj[key], path ? `${path}.${key}` : key);
     }
   }
-  
+
   compare(original, current, "");
   return changes;
 }
@@ -258,7 +258,7 @@ export function renderConfig(props: ConfigProps) {
           <div class="config-sidebar__title">Settings</div>
           <span class="pill pill--sm ${validity === "valid" ? "pill--ok" : validity === "invalid" ? "pill--danger" : ""}">${validity}</span>
         </div>
-        
+
         <!-- Search -->
         <div class="config-search">
           <svg class="config-search__icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
@@ -273,13 +273,13 @@ export function renderConfig(props: ConfigProps) {
             @input=${(e: Event) => props.onSearchChange((e.target as HTMLInputElement).value)}
           />
           ${props.searchQuery ? html`
-            <button 
+            <button
               class="config-search__clear"
               @click=${() => props.onSearchChange("")}
             >×</button>
           ` : nothing}
         </div>
-        
+
         <!-- Section nav -->
         <nav class="config-nav">
           <button
@@ -299,7 +299,7 @@ export function renderConfig(props: ConfigProps) {
             </button>
           `)}
         </nav>
-        
+
         <!-- Mode toggle at bottom -->
         <div class="config-sidebar__footer">
           <div class="config-mode-toggle">
@@ -319,7 +319,7 @@ export function renderConfig(props: ConfigProps) {
           </div>
         </div>
       </aside>
-      
+
       <!-- Main content -->
       <main class="config-main">
         <!-- Action bar -->
@@ -358,7 +358,7 @@ export function renderConfig(props: ConfigProps) {
             </button>
           </div>
         </div>
-        
+
         <!-- Diff panel (form mode only - raw mode doesn't have granular diff) -->
         ${hasChanges && props.formMode === "form" ? html`
           <details class="config-diff">
diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 000000000..d864cbb6d
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1,17 @@
+# zizmor configuration
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  # Disable unpinned-uses - pinning to SHA hashes is a significant change
+  # that should be done deliberately, not enforced by pre-commit
+  unpinned-uses:
+    disable: true
+
+  # Disable excessive-permissions for now - adding explicit permissions
+  # blocks requires careful review of each workflow's needs
+  excessive-permissions:
+    disable: true
+
+  # Disable artipacked (persist-credentials) - low confidence finding
+  artipacked:
+    disable: true