- pre-push: send skip diagnostic to stderr (not stdout) so consumers
relying on stderr for warnings receive the message
- pre-push: move ECC_PREPUSH_AUDIT outside RUN_CHECKS gate so audit-only
configurations still check dependencies
- mcp-health-check: classify home config paths as trusted before applying
workspace opt-in gate; when cwd == home, ~/.claude.json was incorrectly
blocked as untrusted workspace config
- install-global-git-hooks: check conflicting global core.hooksPath in
dry-run mode too, so dry-run accurately reflects what apply would do
- orchestrate-codex-worker: pass approval policy via --ask-for-approval,
not -p profile
- codex global hooks: validate conflicting global hooksPath before backup/copy,
so refused install is side-effect free
- claw: reject percent-delimited Windows paths in cmd.exe fallback to avoid
%NAME% expansion
- codex-hooks: opt into ECC_PREPUSH_RUN_CHECKS=1 in existing verification
fixtures and add default-skip coverage
Geronimo