diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000000..bcfdefcddb1
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,17 @@
+# actionlint configuration
+# https://github.com/rhysd/actionlint/blob/main/docs/config.md
+
+self-hosted-runner:
+  labels:
+    # Blacksmith CI runners
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-4vcpu-windows-2025
+
+# Ignore patterns for known issues
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # Ignore shellcheck warnings (we run shellcheck separately)
+      - 'shellcheck reported issue.+'
+      # Ignore intentional if: false for disabled jobs
+      - 'constant expression "false" in condition'
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..c0e1d465b60
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,113 @@
+# Dependabot configuration
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+
+registries:
+  npm-npmjs:
+    type: npm-registry
+    url: https://registry.npmjs.org
+    replaces-base: true
+
+updates:
+  # npm dependencies (root)
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      production:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      development:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 10
+    registries:
+      - npm-npmjs
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Swift Package Manager - macOS app
+  - package-ecosystem: swift
+    directory: /apps/macos
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      swift-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Swift Package Manager - shared ClawdbotKit
+  - package-ecosystem: swift
+    directory: /apps/shared/ClawdbotKit
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      swift-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Swift Package Manager - Swabble
+  - package-ecosystem: swift
+    directory: /Swabble
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      swift-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  # Gradle - Android app
+  - package-ecosystem: gradle
+    directory: /apps/android
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      android-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000000..4be40f8a886
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,85 @@
+# Pre-commit hooks for clawdbot
+# Install: prek install
+# Run manually: prek run --all-files
+#
+# See https://pre-commit.com for more information
+
+repos:
+  # Basic file hygiene
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: '^(docs/|dist/|vendor/|.*\.snap$)'
+      - id: end-of-file-fixer
+        exclude: '^(docs/|dist/|vendor/|.*\.snap$)'
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+      - id: check-added-large-files
+        args: [--maxkb=500]
+      - id: check-merge-conflict
+
+  # Secret detection (same as CI)
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: [--baseline, .secrets.baseline]
+
+  # Shell script linting
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.11.0
+    hooks:
+      - id: shellcheck
+        args: [--severity=error]  # Only fail on errors, not warnings/info
+        # Exclude vendor and scripts with embedded code or known issues
+        exclude: '^(vendor/|scripts/e2e/)'
+
+  # GitHub Actions linting
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint
+
+  # GitHub Actions security audit
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.22.0
+    hooks:
+      - id: zizmor
+        args: [--persona=regular, --min-severity=medium, --min-confidence=medium]
+        exclude: '^(vendor/|Swabble/)'
+
+  # Project checks (same commands as CI)
+  - repo: local
+    hooks:
+      # oxlint --type-aware src test
+      - id: oxlint
+        name: oxlint
+        entry: npx oxlint --type-aware src test
+        language: system
+        pass_filenames: false
+        types_or: [javascript, jsx, ts, tsx]
+
+      # oxfmt --check src test
+      - id: oxfmt
+        name: oxfmt
+        entry: npx oxfmt --check src test
+        language: system
+        pass_filenames: false
+        types_or: [javascript, jsx, ts, tsx]
+
+      # swiftlint (same as CI)
+      - id: swiftlint
+        name: swiftlint
+        entry: swiftlint --config .swiftlint.yml
+        language: system
+        pass_filenames: false
+        types: [swift]
+
+      # swiftformat --lint (same as CI)
+      - id: swiftformat
+        name: swiftformat
+        entry: swiftformat --lint apps/macos/Sources --config .swiftformat
+        language: system
+        pass_filenames: false
+        types: [swift]
diff --git a/.secrets.baseline b/.secrets.baseline
index 4c0ca50a495..f02613353d4 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -146,6 +146,22 @@
     }
   ],
   "results": {
+    ".detect-secrets.cfg": [
+      {
+        "type": "Private Key",
+        "filename": ".detect-secrets.cfg",
+        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
+        "is_verified": false,
+        "line_number": 13
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": ".detect-secrets.cfg",
+        "hashed_secret": "fe88fceb47e040ba1bfafa4ac639366188df2f6d",
+        "is_verified": false,
+        "line_number": 15
+      }
+    ],
     ".env.example": [
       {
         "type": "Twilio API Key",
@@ -159,23 +175,23 @@
       {
         "type": "Base64 High Entropy String",
         "filename": "appcast.xml",
-        "hashed_secret": "1b1c2b73eca84e441a823c37a06c71c9fadcfe24",
+        "hashed_secret": "4e5f0a148d9ef42afeb73b1c77643e2ef2dee0b9",
         "is_verified": false,
-        "line_number": 19
+        "line_number": 90
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "appcast.xml",
-        "hashed_secret": "5c47736fee5151b26b3bb61bb38955da0e8937c6",
+        "hashed_secret": "f1ccdaf78c308ec2cf608818da13f5f1e4809ed1",
         "is_verified": false,
-        "line_number": 35
+        "line_number": 138
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "appcast.xml",
-        "hashed_secret": "bbbca47179268f154c63affa0ca441c6e49e650f",
+        "hashed_secret": "2691dc9c9ded92ba62a2d8ee589e2d78e2aa0479",
         "is_verified": false,
-        "line_number": 52
+        "line_number": 212
       }
     ],
     "apps/macos/Tests/ClawdbotIPCTests/AnthropicAuthResolverTests.swift": [
@@ -194,13 +210,22 @@
         "line_number": 42
       }
     ],
-    "apps/macos/Tests/ClawdbotIPCTests/ConnectionsSettingsSmokeTests.swift": [
+    "apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift": [
       {
         "type": "Secret Keyword",
-        "filename": "apps/macos/Tests/ClawdbotIPCTests/ConnectionsSettingsSmokeTests.swift",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "filename": "apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift",
+        "hashed_secret": "19dad5cecb110281417d1db56b60e1b006d55bb4",
         "is_verified": false,
-        "line_number": 83
+        "line_number": 61
+      }
+    ],
+    "apps/macos/Tests/ClawdbotIPCTests/GatewayLaunchAgentManagerTests.swift": [
+      {
+        "type": "Secret Keyword",
+        "filename": "apps/macos/Tests/ClawdbotIPCTests/GatewayLaunchAgentManagerTests.swift",
+        "hashed_secret": "1a91d62f7ca67399625a4368a6ab5d4a3baa6073",
+        "is_verified": false,
+        "line_number": 13
       }
     ],
     "apps/macos/Tests/ClawdbotIPCTests/TailscaleIntegrationSectionTests.swift": [
@@ -212,109 +237,928 @@
         "line_number": 27
       }
     ],
-    "docs/configuration.md": [
+    "apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "filename": "apps/shared/ClawdbotKit/Sources/ClawdbotKit/GatewayChannel.swift",
+        "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 268
-      },
+        "line_number": 100
+      }
+    ],
+    "dist/control-ui/assets/index-DsXRcnEw.js": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
+        "filename": "dist/control-ui/assets/index-DsXRcnEw.js",
+        "hashed_secret": "ecb252044b5ea0f679ee78ec1a12904739e2904d",
         "is_verified": false,
-        "line_number": 465
-      },
+        "line_number": 16
+      }
+    ],
+    "docs/brave-search.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
+        "filename": "docs/brave-search.md",
+        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
         "is_verified": false,
-        "line_number": 718
-      },
+        "line_number": 26
+      }
+    ],
+    "docs/channels/bluebubbles.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "filename": "docs/channels/bluebubbles.md",
+        "hashed_secret": "555da20df20d4172e00f1b73d7c3943802055270",
         "is_verified": false,
-        "line_number": 760
-      },
+        "line_number": 32
+      }
+    ],
+    "docs/channels/matrix.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
-        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
-        "is_verified": false,
-        "line_number": 859
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "docs/configuration.md",
+        "filename": "docs/channels/matrix.md",
         "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
         "is_verified": false,
-        "line_number": 982
+        "line_number": 58
       }
     ],
-    "docs/faq.md": [
+    "docs/channels/nextcloud-talk.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/faq.md",
-        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "filename": "docs/channels/nextcloud-talk.md",
+        "hashed_secret": "76ed0a056aa77060de25754586440cff390791d0",
         "is_verified": false,
-        "line_number": 593
+        "line_number": 47
+      }
+    ],
+    "docs/channels/nostr.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/channels/nostr.md",
+        "hashed_secret": "edeb23e25a619c434d22bb7f1c3ca4841166b4e8",
+        "is_verified": false,
+        "line_number": 65
+      }
+    ],
+    "docs/channels/slack.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/channels/slack.md",
+        "hashed_secret": "3f4800fb7c1fb79a9a48bfd562d90bc6b2e2b718",
+        "is_verified": false,
+        "line_number": 141
+      }
+    ],
+    "docs/concepts/memory.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/concepts/memory.md",
+        "hashed_secret": "39d711243bfcee9fec8299b204e1aa9c3430fa12",
+        "is_verified": false,
+        "line_number": 108
       },
       {
         "type": "Secret Keyword",
-        "filename": "docs/faq.md",
+        "filename": "docs/concepts/memory.md",
+        "hashed_secret": "1a8abbf465c52363ab4c9c6ad945b8e857cbea55",
+        "is_verified": false,
+        "line_number": 131
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/concepts/memory.md",
+        "hashed_secret": "b9f640d6095b9f6b5a65983f7b76dbbb254e0044",
+        "is_verified": false,
+        "line_number": 373
+      }
+    ],
+    "docs/concepts/model-providers.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/concepts/model-providers.md",
         "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
         "is_verified": false,
-        "line_number": 650
-      }
-    ],
-    "docs/skills-config.md": [
+        "line_number": 168
+      },
       {
         "type": "Secret Keyword",
-        "filename": "docs/skills-config.md",
+        "filename": "docs/concepts/model-providers.md",
+        "hashed_secret": "ef83ad68b9b66e008727b7c417c6a8f618b5177e",
+        "is_verified": false,
+        "line_number": 255
+      }
+    ],
+    "docs/environment.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/environment.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 29
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/environment.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "docs/gateway/configuration-examples.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 53
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 55
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
+        "is_verified": false,
+        "line_number": 319
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration-examples.md",
         "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
         "is_verified": false,
-        "line_number": 28
-      }
-    ],
-    "docs/skills.md": [
+        "line_number": 414
+      },
       {
         "type": "Secret Keyword",
-        "filename": "docs/skills.md",
+        "filename": "docs/gateway/configuration-examples.md",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 548
+      }
+    ],
+    "docs/gateway/configuration.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 272
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 274
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 1029
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
+        "is_verified": false,
+        "line_number": 1470
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "bde4db9b4c3be4049adc3b9a69851d7c35119770",
+        "is_verified": false,
+        "line_number": 1486
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "22af290a1a3d5e941193a41a3d3a9e4ca8da5e27",
+        "is_verified": false,
+        "line_number": 2268
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 2344
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/configuration.md",
         "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
         "is_verified": false,
-        "line_number": 97
-      }
-    ],
-    "docs/tailscale.md": [
+        "line_number": 2658
+      },
       {
         "type": "Secret Keyword",
-        "filename": "docs/tailscale.md",
+        "filename": "docs/gateway/configuration.md",
+        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
+        "is_verified": false,
+        "line_number": 2844
+      }
+    ],
+    "docs/gateway/local-models.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/local-models.md",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 32
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/local-models.md",
+        "hashed_secret": "49fd535e63175a827aab3eff9ac58a9e82460ac9",
+        "is_verified": false,
+        "line_number": 121
+      }
+    ],
+    "docs/gateway/tailscale.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/gateway/tailscale.md",
         "hashed_secret": "9cb0dc5383312aa15b9dc6745645bde18ff5ade9",
         "is_verified": false,
-        "line_number": 52
+        "line_number": 75
       }
     ],
-    "docs/talk.md": [
+    "docs/help/faq.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/talk.md",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
+        "is_verified": false,
+        "line_number": 925
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 1113
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "b6f56e5e92078ed7c078c46fbfeedcbe5719bc25",
+        "is_verified": false,
+        "line_number": 1114
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 1439
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/help/faq.md",
+        "hashed_secret": "45d676e7c6ab44cf4b8fa366ef2d8fccd3e6d6e6",
+        "is_verified": false,
+        "line_number": 1715
+      }
+    ],
+    "docs/nodes/talk.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/nodes/talk.md",
         "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
         "is_verified": false,
         "line_number": 50
       }
     ],
-    "docs/telegram.md": [
+    "docs/perplexity.md": [
       {
         "type": "Secret Keyword",
-        "filename": "docs/telegram.md",
-        "hashed_secret": "e9fe51f94eadabf54dbf2fbbd57188b9abee436e",
+        "filename": "docs/perplexity.md",
+        "hashed_secret": "6b26c117c66a0c030e239eef595c1e18865132a8",
         "is_verified": false,
-        "line_number": 57
+        "line_number": 35
+      }
+    ],
+    "docs/providers/anthropic.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/anthropic.md",
+        "hashed_secret": "c7a8c334eef5d1749fface7d42c66f9ae5e8cf36",
+        "is_verified": false,
+        "line_number": 32
+      }
+    ],
+    "docs/providers/glm.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/glm.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "docs/providers/minimax.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/minimax.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 49
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/minimax.md",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 118
+      }
+    ],
+    "docs/providers/moonshot.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/moonshot.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 39
+      }
+    ],
+    "docs/providers/openai.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/openai.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "docs/providers/opencode.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/opencode.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 25
+      }
+    ],
+    "docs/providers/openrouter.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/openrouter.md",
+        "hashed_secret": "a219d7693c25cd2d93313512e200ff3eb374d281",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "docs/providers/synthetic.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/synthetic.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "docs/providers/zai.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/providers/zai.md",
+        "hashed_secret": "ec3810e10fb78db55ce38b9c18d1c3eb1db739e0",
+        "is_verified": false,
+        "line_number": 25
+      }
+    ],
+    "docs/tools/browser.md": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "docs/tools/browser.md",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 163
+      }
+    ],
+    "docs/tools/firecrawl.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/firecrawl.md",
+        "hashed_secret": "674397e2c0c2faaa85961c708d2a96a7cc7af217",
+        "is_verified": false,
+        "line_number": 28
+      }
+    ],
+    "docs/tools/skills-config.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/skills-config.md",
+        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
+        "is_verified": false,
+        "line_number": 30
+      }
+    ],
+    "docs/tools/skills.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/skills.md",
+        "hashed_secret": "c1e6ee547fd492df1441ac492e8bb294974712bd",
+        "is_verified": false,
+        "line_number": 160
+      }
+    ],
+    "docs/tools/web.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "6b26c117c66a0c030e239eef595c1e18865132a8",
+        "is_verified": false,
+        "line_number": 61
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "96c682c88ed551f22fe76d206c2dfb7df9221ad9",
+        "is_verified": false,
+        "line_number": 112
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "491d458f895b9213facb2ee9375b1b044eaea3ac",
+        "is_verified": false,
+        "line_number": 160
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tools/web.md",
+        "hashed_secret": "674397e2c0c2faaa85961c708d2a96a7cc7af217",
+        "is_verified": false,
+        "line_number": 223
+      }
+    ],
+    "docs/tts.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tts.md",
+        "hashed_secret": "bde4db9b4c3be4049adc3b9a69851d7c35119770",
+        "is_verified": false,
+        "line_number": 72
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "docs/tts.md",
+        "hashed_secret": "1188d5a8ed7edcff5144a9472af960243eacf12e",
+        "is_verified": false,
+        "line_number": 77
+      }
+    ],
+    "extensions/bluebubbles/src/actions.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/actions.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 73
+      }
+    ],
+    "extensions/bluebubbles/src/attachments.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 35
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "db1530e1ea43af094d3d75b8dbaf19a4a182a318",
+        "is_verified": false,
+        "line_number": 99
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 117
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/attachments.test.ts",
+        "hashed_secret": "052f076c732648ab32d2fcde9fe255319bfa0c7b",
+        "is_verified": false,
+        "line_number": 229
+      }
+    ],
+    "extensions/bluebubbles/src/chat.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 33
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 68
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "5c5a15a8b0b3e154d77746945e563ba40100681b",
+        "is_verified": false,
+        "line_number": 85
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "faacad0ce4ea1c19b46e128fd79679d37d3d331d",
+        "is_verified": false,
+        "line_number": 134
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "4dcc26a1d99532846fedf1265df4f40f4e0005b8",
+        "is_verified": false,
+        "line_number": 219
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/chat.test.ts",
+        "hashed_secret": "fd2a721f7be1ee3d691a011affcdb11d0ca365a8",
+        "is_verified": false,
+        "line_number": 282
+      }
+    ],
+    "extensions/bluebubbles/src/monitor.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/monitor.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 187
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/monitor.test.ts",
+        "hashed_secret": "1ae0af3fe72b3ba394f9fa95a6cffc090d726c23",
+        "is_verified": false,
+        "line_number": 394
+      }
+    ],
+    "extensions/bluebubbles/src/reactions.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 179
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "a4a05c9a6449eb9d6cdac81dd7edc49230e327e6",
+        "is_verified": false,
+        "line_number": 210
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/reactions.test.ts",
+        "hashed_secret": "a2833da9f0a16f09994754d0a31749cecf8c8c77",
+        "is_verified": false,
+        "line_number": 316
+      }
+    ],
+    "extensions/bluebubbles/src/send.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/send.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/bluebubbles/src/send.test.ts",
+        "hashed_secret": "faacad0ce4ea1c19b46e128fd79679d37d3d331d",
+        "is_verified": false,
+        "line_number": 675
+      }
+    ],
+    "extensions/bluebubbles/src/targets.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/bluebubbles/src/targets.test.ts",
+        "hashed_secret": "a3af2fb0c1e2a30bb038049e1e4b401593af6225",
+        "is_verified": false,
+        "line_number": 62
+      }
+    ],
+    "extensions/bluebubbles/src/targets.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/bluebubbles/src/targets.ts",
+        "hashed_secret": "a3af2fb0c1e2a30bb038049e1e4b401593af6225",
+        "is_verified": false,
+        "line_number": 214
+      }
+    ],
+    "extensions/copilot-proxy/index.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/copilot-proxy/index.ts",
+        "hashed_secret": "50f013532a9770a2c2cfdc38b7581dd01df69b70",
+        "is_verified": false,
+        "line_number": 4
+      }
+    ],
+    "extensions/google-antigravity-auth/index.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "extensions/google-antigravity-auth/index.ts",
+        "hashed_secret": "709d0f232b6ac4f8d24dec3e4fabfdb14257174f",
+        "is_verified": false,
+        "line_number": 9
+      }
+    ],
+    "extensions/matrix/src/matrix/accounts.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/accounts.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 75
+      }
+    ],
+    "extensions/matrix/src/matrix/client.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/client.test.ts",
+        "hashed_secret": "fe7fcdaea49ece14677acd32374d2f1225819d5c",
+        "is_verified": false,
+        "line_number": 14
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/client.test.ts",
+        "hashed_secret": "3dc927d80543dc0f643940b70d066bd4b4c4b78e",
+        "is_verified": false,
+        "line_number": 24
+      }
+    ],
+    "extensions/matrix/src/matrix/client/storage.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/matrix/src/matrix/client/storage.ts",
+        "hashed_secret": "7505d64a54e061b7acd54ccd58b49dc43500b635",
+        "is_verified": false,
+        "line_number": 9
+      }
+    ],
+    "extensions/memory-lancedb/config.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/memory-lancedb/config.ts",
+        "hashed_secret": "ecb252044b5ea0f679ee78ec1a12904739e2904d",
+        "is_verified": false,
+        "line_number": 70
+      }
+    ],
+    "extensions/memory-lancedb/index.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/memory-lancedb/index.test.ts",
+        "hashed_secret": "ed65c049bb2f78ee4f703b2158ba9cc6ea31fb7e",
+        "is_verified": false,
+        "line_number": 70
+      }
+    ],
+    "extensions/msteams/src/probe.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/msteams/src/probe.test.ts",
+        "hashed_secret": "1a91d62f7ca67399625a4368a6ab5d4a3baa6073",
+        "is_verified": false,
+        "line_number": 34
+      }
+    ],
+    "extensions/nextcloud-talk/src/accounts.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nextcloud-talk/src/accounts.ts",
+        "hashed_secret": "920f8f5815b381ea692e9e7c2f7119f2b1aa620a",
+        "is_verified": false,
+        "line_number": 26
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nextcloud-talk/src/accounts.ts",
+        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
+        "is_verified": false,
+        "line_number": 139
+      }
+    ],
+    "extensions/nextcloud-talk/src/channel.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nextcloud-talk/src/channel.ts",
+        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
+        "is_verified": false,
+        "line_number": 390
+      }
+    ],
+    "extensions/nostr/README.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/README.md",
+        "hashed_secret": "edeb23e25a619c434d22bb7f1c3ca4841166b4e8",
+        "is_verified": false,
+        "line_number": 43
+      }
+    ],
+    "extensions/nostr/src/channel.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/channel.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 48
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/src/channel.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 48
+      }
+    ],
+    "extensions/nostr/src/nostr-bus.fuzz.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
+        "hashed_secret": "2b4489606a23fb31fcdc849fa7e577ba90f6d39a",
+        "is_verified": false,
+        "line_number": 202
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 203
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.fuzz.test.ts",
+        "hashed_secret": "b84cb0c3925d34496e6c8b0e55b8c1664a438035",
+        "is_verified": false,
+        "line_number": 208
+      }
+    ],
+    "extensions/nostr/src/nostr-bus.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 11
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "7258e28563f03fb4c5994e8402e6f610d1f0f110",
+        "is_verified": false,
+        "line_number": 33
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "2b4489606a23fb31fcdc849fa7e577ba90f6d39a",
+        "is_verified": false,
+        "line_number": 101
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "ef717286343f6da3f4e6f68c6de02a5148a801c4",
+        "is_verified": false,
+        "line_number": 106
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-bus.test.ts",
+        "hashed_secret": "98b35fe4c45011220f509ebb5546d3889b55a891",
+        "is_verified": false,
+        "line_number": 111
+      }
+    ],
+    "extensions/nostr/src/nostr-profile.fuzz.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-profile.fuzz.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 12
+      }
+    ],
+    "extensions/nostr/src/nostr-profile.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/nostr-profile.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "extensions/nostr/src/types.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "extensions/nostr/src/types.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 8
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/src/types.test.ts",
+        "hashed_secret": "ce4303f6b22257d9c9cf314ef1dee4707c6e1c13",
+        "is_verified": false,
+        "line_number": 8
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/nostr/src/types.test.ts",
+        "hashed_secret": "3bee216ebc256d692260fc3adc765050508fef5e",
+        "is_verified": false,
+        "line_number": 127
+      }
+    ],
+    "extensions/open-prose/skills/prose/SKILL.md": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "extensions/open-prose/skills/prose/SKILL.md",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 200
+      }
+    ],
+    "extensions/open-prose/skills/prose/state/postgres.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/open-prose/skills/prose/state/postgres.md",
+        "hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
+        "is_verified": false,
+        "line_number": 75
+      },
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "extensions/open-prose/skills/prose/state/postgres.md",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 198
+      }
+    ],
+    "extensions/zalo/README.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/zalo/README.md",
+        "hashed_secret": "f51aaee16a4a756d287f126b99c081b73cba7f15",
+        "is_verified": false,
+        "line_number": 41
+      }
+    ],
+    "extensions/zalo/src/monitor.webhook.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "extensions/zalo/src/monitor.webhook.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 43
+      }
+    ],
+    "skills/1password/references/cli-examples.md": [
+      {
+        "type": "Secret Keyword",
+        "filename": "skills/1password/references/cli-examples.md",
+        "hashed_secret": "9dda0987cc3054773a2df97e352d4f64d233ef10",
+        "is_verified": false,
+        "line_number": 17
       }
     ],
     "skills/local-places/SERVER_README.md": [
@@ -344,50 +1188,395 @@
         "line_number": 18
       }
     ],
-    "src/agents/models-config.test.ts": [
+    "src/agents/memory-search.test.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/models-config.test.ts",
-        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "filename": "src/agents/memory-search.test.ts",
+        "hashed_secret": "a1b49d68a91fdf9c9217773f3fac988d77fa0f50",
         "is_verified": false,
-        "line_number": 25
-      },
-      {
-        "type": "Secret Keyword",
-        "filename": "src/agents/models-config.test.ts",
-        "hashed_secret": "3a81eb091f80c845232225be5663d270e90dacb7",
-        "is_verified": false,
-        "line_number": 90
+        "line_number": 164
       }
     ],
-    "src/agents/skills.test.ts": [
+    "src/agents/model-auth.test.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
-        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "07a6b9cec637c806195e8aa7e5c0851ab03dc35e",
         "is_verified": false,
-        "line_number": 158
+        "line_number": 211
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
-        "hashed_secret": "7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "21f296583ccd80c5ab9b3330a8b0d47e4a409fb9",
         "is_verified": false,
-        "line_number": 265
+        "line_number": 240
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
+        "is_verified": false,
+        "line_number": 264
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/model-auth.test.ts",
+        "hashed_secret": "dff6d4ff5dc357cf451d1855ab9cbda562645c9f",
+        "is_verified": false,
+        "line_number": 295
+      }
+    ],
+    "src/agents/model-auth.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/model-auth.ts",
+        "hashed_secret": "8956265d216d474a080edaa97880d37fc1386f33",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.auto-injects-github-copilot-provider-token-is.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "src/agents/models-config.falls-back-default-baseurl-token-exchange-fails.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.falls-back-default-baseurl-token-exchange-fails.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
+        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
+        "is_verified": false,
+        "line_number": 50
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.fills-missing-provider-apikey-from-env-var.test.ts",
+        "hashed_secret": "3a81eb091f80c845232225be5663d270e90dacb7",
+        "is_verified": false,
+        "line_number": 108
+      }
+    ],
+    "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.normalizes-gemini-3-ids-preview-google-providers.test.ts",
+        "hashed_secret": "980d02eb9335ae7c9e9984f6c8ad432352a0d2ac",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
+        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
+        "is_verified": false,
+        "line_number": 112
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.skips-writing-models-json-no-env-token.test.ts",
+        "hashed_secret": "94c4be5a1976115e8152960c21e04400a4fccdf6",
+        "is_verified": false,
+        "line_number": 146
+      }
+    ],
+    "src/agents/models-config.uses-first-github-copilot-profile-env-tokens.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/models-config.uses-first-github-copilot-profile-env-tokens.test.ts",
+        "hashed_secret": "7cf31e8b6cda49f70c31f1f25af05d46f924142d",
+        "is_verified": false,
+        "line_number": 16
+      }
+    ],
+    "src/agents/openai-responses.reasoning-replay.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/openai-responses.reasoning-replay.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 124
+      }
+    ],
+    "src/agents/pi-embedded-runner.applygoogleturnorderingfix.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.applygoogleturnorderingfix.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 58
+      }
+    ],
+    "src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.buildembeddedsandboxinfo.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/pi-embedded-runner.createsystempromptoverride.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.createsystempromptoverride.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.falls-back-provider-default-per-dm-not.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.falls-back-provider-default-per-dm-not.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.returns-undefined-sessionkey-is-undefined.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.get-dm-history-limit-from-session-key.returns-undefined-sessionkey-is-undefined.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.limithistoryturns.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.limithistoryturns.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/pi-embedded-runner.resolvesessionagentids.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.resolvesessionagentids.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/agents/pi-embedded-runner.splitsdktools.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.splitsdktools.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 57
+      }
+    ],
+    "src/agents/pi-embedded-runner.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 117
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/pi-embedded-runner.test.ts",
+        "hashed_secret": "fcdd655b11f33ba4327695084a347b2ba192976c",
+        "is_verified": false,
+        "line_number": 178
+      }
+    ],
+    "src/agents/skills.applyskillenvoverrides.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/skills.applyskillenvoverrides.test.ts",
         "hashed_secret": "5df3a673d724e8a1eb673a8baf623e183940804d",
         "is_verified": false,
-        "line_number": 462
+        "line_number": 54
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/agents/skills.test.ts",
+        "filename": "src/agents/skills.applyskillenvoverrides.test.ts",
         "hashed_secret": "8921daaa546693e52bc1f9c40bdcf15e816e0448",
         "is_verified": false,
-        "line_number": 490
+        "line_number": 80
+      }
+    ],
+    "src/agents/skills.build-workspace-skills-prompt.prefers-workspace-skills-managed-skills.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/skills.build-workspace-skills-prompt.prefers-workspace-skills-managed-skills.test.ts",
+        "hashed_secret": "7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb",
+        "is_verified": false,
+        "line_number": 124
+      }
+    ],
+    "src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/skills.build-workspace-skills-prompt.syncs-merged-skills-into-target-workspace.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 102
+      }
+    ],
+    "src/agents/tools/web-fetch.ssrf.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-fetch.ssrf.test.ts",
+        "hashed_secret": "5ce8e9d54c77266fff990194d2219a708c59b76c",
+        "is_verified": false,
+        "line_number": 55
+      }
+    ],
+    "src/agents/tools/web-search.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "dfba7aade0868074c2861c98e2a9a92f3178a51b",
+        "is_verified": false,
+        "line_number": 85
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "71f8e7976e4cbc4561c9d62fb283e7f788202acb",
+        "is_verified": false,
+        "line_number": 190
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "c4865ff9250aca23b0d98eb079dad70ebec1cced",
+        "is_verified": false,
+        "line_number": 198
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-search.ts",
+        "hashed_secret": "527ee41f36386e85fa932ef09471ca017f3c95c8",
+        "is_verified": false,
+        "line_number": 199
+      }
+    ],
+    "src/agents/tools/web-tools.enabled-defaults.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-tools.enabled-defaults.test.ts",
+        "hashed_secret": "47b249a75ca78fdb578d0f28c33685e27ea82684",
+        "is_verified": false,
+        "line_number": 213
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-tools.enabled-defaults.test.ts",
+        "hashed_secret": "d0ffd81d6d7ad1bc3c365660fe8882480c9a986e",
+        "is_verified": false,
+        "line_number": 242
+      }
+    ],
+    "src/agents/tools/web-tools.fetch.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/agents/tools/web-tools.fetch.test.ts",
+        "hashed_secret": "5ce8e9d54c77266fff990194d2219a708c59b76c",
+        "is_verified": false,
+        "line_number": 101
+      }
+    ],
+    "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 90
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.prefers-alias-matches-fuzzy-selection-is-ambiguous.e2e.test.ts",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 96
+      }
+    ],
+    "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts",
+        "hashed_secret": "e9a5f12a8ecbb3eb46eca5096b5c52aa5e7c9fdd",
+        "is_verified": false,
+        "line_number": 87
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/reply.directive.directive-behavior.supports-fuzzy-model-matches-model-directive.e2e.test.ts",
+        "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
+        "is_verified": false,
+        "line_number": 228
+      }
+    ],
+    "src/auto-reply/status.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/auto-reply/status.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 20
+      }
+    ],
+    "src/browser/cdp.helpers.test.ts": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "src/browser/cdp.helpers.test.ts",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 22
+      }
+    ],
+    "src/browser/cdp.test.ts": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "src/browser/cdp.test.ts",
+        "hashed_secret": "9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684",
+        "is_verified": false,
+        "line_number": 172
       }
     ],
     "src/browser/target-id.test.ts": [
@@ -396,57 +1585,386 @@
         "filename": "src/browser/target-id.test.ts",
         "hashed_secret": "4e126c049580d66ca1549fa534d95a7263f27f46",
         "is_verified": false,
-        "line_number": 16
+        "line_number": 13
       }
     ],
-    "src/commands/antigravity-oauth.ts": [
+    "src/cli/update-cli.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/cli/update-cli.test.ts",
+        "hashed_secret": "e4f91dd323bac5bfc4f60a6e433787671dc2421d",
+        "is_verified": false,
+        "line_number": 112
+      }
+    ],
+    "src/commands/auth-choice.preferred-provider.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.preferred-provider.ts",
+        "hashed_secret": "c03a8d10174dd7eb2b3288b570a5a74fdd9ae05d",
+        "is_verified": false,
+        "line_number": 8
+      }
+    ],
+    "src/commands/auth-choice.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.test.ts",
+        "hashed_secret": "2480500ff391183070fe22ba8665a8be19350833",
+        "is_verified": false,
+        "line_number": 289
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.test.ts",
+        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
+        "is_verified": false,
+        "line_number": 350
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/auth-choice.test.ts",
+        "hashed_secret": "1b4d8423b11d32dd0c466428ac81de84a4a9442b",
+        "is_verified": false,
+        "line_number": 528
+      }
+    ],
+    "src/commands/configure.gateway-auth.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/configure.gateway-auth.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 8
+      }
+    ],
+    "src/commands/models/list.status.test.ts": [
       {
         "type": "Base64 High Entropy String",
-        "filename": "src/commands/antigravity-oauth.ts",
-        "hashed_secret": "709d0f232b6ac4f8d24dec3e4fabfdb14257174f",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "d6ae2508a78a232d5378ef24b85ce40cbb4d7ff0",
         "is_verified": false,
-        "line_number": 17
+        "line_number": 11
       },
       {
         "type": "Base64 High Entropy String",
-        "filename": "src/commands/antigravity-oauth.ts",
-        "hashed_secret": "3848603b8e866f62d07c206ff622279b9dcb0238",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "2d8012102440ea97852b3152239218f00579bafa",
         "is_verified": false,
-        "line_number": 20
-      }
-    ],
-    "src/commands/onboard-auth.ts": [
+        "line_number": 18
+      },
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "51848e2be4b461a549218d3167f19c01be6b98b8",
+        "is_verified": false,
+        "line_number": 46
+      },
       {
         "type": "Secret Keyword",
-        "filename": "src/commands/onboard-auth.ts",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "51848e2be4b461a549218d3167f19c01be6b98b8",
+        "is_verified": false,
+        "line_number": 46
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/models/list.status.test.ts",
+        "hashed_secret": "1c1e381bfb72d3b7bfca9437053d9875356680f0",
+        "is_verified": false,
+        "line_number": 52
+      }
+    ],
+    "src/commands/onboard-auth.config-minimax.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.config-minimax.ts",
         "hashed_secret": "16c249e04e2be318050cb883c40137361c0c7209",
         "is_verified": false,
+        "line_number": 30
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.config-minimax.ts",
+        "hashed_secret": "ddcb713196b974770575a9bea5a4e7d46361f8e9",
+        "is_verified": false,
+        "line_number": 85
+      }
+    ],
+    "src/commands/onboard-auth.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.test.ts",
+        "hashed_secret": "666c100dab549a6f56da7da546bd848ed5086541",
+        "is_verified": false,
+        "line_number": 230
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-auth.test.ts",
+        "hashed_secret": "e184b402822abc549b37689c84e8e0e33c39a1f1",
+        "is_verified": false,
+        "line_number": 262
+      }
+    ],
+    "src/commands/onboard-non-interactive.ai-gateway.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/commands/onboard-non-interactive.ai-gateway.test.ts",
+        "hashed_secret": "77e991e9f56e6fa4ed1a908208048421f1214c07",
+        "is_verified": false,
         "line_number": 50
       }
     ],
-    "src/config/config.test.ts": [
+    "src/commands/onboard-non-interactive/api-keys.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/config/config.test.ts",
-        "hashed_secret": "bea2f7b64fab8d1d414d0449530b1e088d36d5b1",
+        "filename": "src/commands/onboard-non-interactive/api-keys.ts",
+        "hashed_secret": "112f3a99b283a4e1788dedd8e0e5d35375c33747",
         "is_verified": false,
-        "line_number": 520
+        "line_number": 10
       }
     ],
-    "src/gateway/server.auth.test.ts": [
+    "src/config/config.env-vars.test.ts": [
       {
         "type": "Secret Keyword",
-        "filename": "src/gateway/server.auth.test.ts",
-        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "filename": "src/config/config.env-vars.test.ts",
+        "hashed_secret": "a24ef9c1a27cac44823571ceef2e8262718eee36",
         "is_verified": false,
-        "line_number": 89
+        "line_number": 15
       },
       {
         "type": "Secret Keyword",
-        "filename": "src/gateway/server.auth.test.ts",
+        "filename": "src/config/config.env-vars.test.ts",
+        "hashed_secret": "29d5f92e9ee44d4854d6dfaeefc3dc27d779fdf3",
+        "is_verified": false,
+        "line_number": 47
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/config.env-vars.test.ts",
+        "hashed_secret": "1672b6a1e7956c6a70f45d699aa42a351b1f8b80",
+        "is_verified": false,
+        "line_number": 63
+      }
+    ],
+    "src/config/config.talk-api-key-fallback.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/config.talk-api-key-fallback.test.ts",
+        "hashed_secret": "bea2f7b64fab8d1d414d0449530b1e088d36d5b1",
+        "is_verified": false,
+        "line_number": 42
+      }
+    ],
+    "src/config/config.web-search-provider.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/config.web-search-provider.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "src/config/env-substitution.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "f2b14f68eb995facb3a1c35287b778d5bd785511",
+        "is_verified": false,
+        "line_number": 38
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "ec417f567082612f8fd6afafe1abcab831fca840",
+        "is_verified": false,
+        "line_number": 69
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "520bd69c3eb1646d9a78181ecb4c90c51fdf428d",
+        "is_verified": false,
+        "line_number": 70
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/env-substitution.test.ts",
+        "hashed_secret": "f136444bf9b3d01a9f9b772b80ac6bf7b6a43ef0",
+        "is_verified": false,
+        "line_number": 228
+      }
+    ],
+    "src/config/schema.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "e73c9fcad85cd4eecc74181ec4bdb31064d68439",
+        "is_verified": false,
+        "line_number": 184
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "2eda7cd978f39eebec3bf03e4410a40e14167fff",
+        "is_verified": false,
+        "line_number": 220
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "9f4cda226d3868676ac7f86f59e4190eb94bd208",
+        "is_verified": false,
+        "line_number": 418
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "01822c8bbf6a8b136944b14182cb885100ec2eae",
+        "is_verified": false,
+        "line_number": 437
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/schema.ts",
+        "hashed_secret": "bb7dfd9746e660e4a4374951ec5938ef0e343255",
+        "is_verified": false,
+        "line_number": 487
+      }
+    ],
+    "src/config/slack-http-config.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/config/slack-http-config.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 11
+      }
+    ],
+    "src/gateway/auth.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/auth.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 43
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/auth.test.ts",
         "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_verified": false,
-        "line_number": 109
+        "line_number": 51
+      }
+    ],
+    "src/gateway/call.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 285
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "e493f561d90c6638c1f51c5a8a069c3b129b79ed",
+        "is_verified": false,
+        "line_number": 295
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "2e07956ffc9bc4fd624064c40b7495c85d5f1467",
+        "is_verified": false,
+        "line_number": 300
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/call.test.ts",
+        "hashed_secret": "bddc29032de580fb53b3a9a0357dd409086db800",
+        "is_verified": false,
+        "line_number": 313
+      }
+    ],
+    "src/gateway/client.test.ts": [
+      {
+        "type": "Private Key",
+        "filename": "src/gateway/client.test.ts",
+        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
+        "is_verified": false,
+        "line_number": 83
+      }
+    ],
+    "src/gateway/gateway-cli-backend.live.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/gateway/gateway-cli-backend.live.test.ts",
+        "hashed_secret": "3e2fd4a90d5afbd27974730c4d6a9592fe300825",
+        "is_verified": false,
+        "line_number": 38
+      }
+    ],
+    "src/gateway/gateway-models.profiles.live.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/gateway/gateway-models.profiles.live.test.ts",
+        "hashed_secret": "3e2fd4a90d5afbd27974730c4d6a9592fe300825",
+        "is_verified": false,
+        "line_number": 219
+      }
+    ],
+    "src/gateway/gateway.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/gateway.e2e.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 73
+      }
+    ],
+    "src/gateway/server.auth.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/server.auth.e2e.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 179
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/server.auth.e2e.test.ts",
+        "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
+        "is_verified": false,
+        "line_number": 197
+      }
+    ],
+    "src/gateway/session-utils.test.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/gateway/session-utils.test.ts",
+        "hashed_secret": "bb9a5d9483409d2c60b28268a0efcb93324d4cda",
+        "is_verified": false,
+        "line_number": 156
+      }
+    ],
+    "src/gateway/tools-invoke-http.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/gateway/tools-invoke-http.test.ts",
+        "hashed_secret": "e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4",
+        "is_verified": false,
+        "line_number": 56
+      }
+    ],
+    "src/gateway/ws-log.test.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/gateway/ws-log.test.ts",
+        "hashed_secret": "edd2e7ac4f61d0c606e80a0919d727540842a307",
+        "is_verified": false,
+        "line_number": 22
       }
     ],
     "src/infra/env.test.ts": [
@@ -465,34 +1983,214 @@
         "line_number": 25
       }
     ],
+    "src/infra/outbound/message-action-runner.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/infra/outbound/message-action-runner.test.ts",
+        "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
+        "is_verified": false,
+        "line_number": 88
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/infra/outbound/message-action-runner.test.ts",
+        "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc",
+        "is_verified": false,
+        "line_number": 385
+      }
+    ],
+    "src/infra/outbound/outbound-policy.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/infra/outbound/outbound-policy.test.ts",
+        "hashed_secret": "804ec071803318791b835cffd6e509c8d32239db",
+        "is_verified": false,
+        "line_number": 33
+      }
+    ],
     "src/infra/shell-env.test.ts": [
       {
         "type": "Secret Keyword",
         "filename": "src/infra/shell-env.test.ts",
         "hashed_secret": "65c10dc3549fe07424148a8a4790a3341ecbc253",
         "is_verified": false,
-        "line_number": 35
-      },
-      {
-        "type": "Base64 High Entropy String",
-        "filename": "src/infra/shell-env.test.ts",
-        "hashed_secret": "64db6bf7f0e5a0491df4419f0eb1bbcc402989e8",
-        "is_verified": false,
-        "line_number": 56
+        "line_number": 27
       },
       {
         "type": "Secret Keyword",
         "filename": "src/infra/shell-env.test.ts",
         "hashed_secret": "e013ffda590d2178607c16d11b1ea42f75ceb0e7",
         "is_verified": false,
-        "line_number": 73
+        "line_number": 59
       },
       {
         "type": "Base64 High Entropy String",
         "filename": "src/infra/shell-env.test.ts",
         "hashed_secret": "be6ee9a6bf9f2dad84a5a67d6c0576a5bacc391e",
         "is_verified": false,
-        "line_number": 75
+        "line_number": 61
+      }
+    ],
+    "src/logging/redact.test.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "dd7754662b89333191ff45e8257a3e6d3fcd3990",
+        "is_verified": false,
+        "line_number": 9
+      },
+      {
+        "type": "Private Key",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "1348b145fa1a555461c1b790a2f66614781091e9",
+        "is_verified": false,
+        "line_number": 64
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "7992945213f7d76889fa83ff0f2be352409c837e",
+        "is_verified": false,
+        "line_number": 65
+      },
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/logging/redact.test.ts",
+        "hashed_secret": "063995ecb4fa5afe2460397d322925cd867b7d74",
+        "is_verified": false,
+        "line_number": 79
+      }
+    ],
+    "src/media-understanding/apply.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/apply.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 14
+      }
+    ],
+    "src/media-understanding/providers/deepgram/audio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/providers/deepgram/audio.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 31
+      }
+    ],
+    "src/media-understanding/providers/google/video.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/providers/google/video.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 28
+      }
+    ],
+    "src/media-understanding/providers/openai/audio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/providers/openai/audio.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 26
+      }
+    ],
+    "src/media-understanding/runner.auto-audio.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/runner.auto-audio.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 42
+      }
+    ],
+    "src/media-understanding/runner.deepgram.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/media-understanding/runner.deepgram.test.ts",
+        "hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
+        "is_verified": false,
+        "line_number": 46
+      }
+    ],
+    "src/memory/embeddings.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/memory/embeddings.test.ts",
+        "hashed_secret": "a47110e348a3063541fb1f1f640d635d457181a0",
+        "is_verified": false,
+        "line_number": 32
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/memory/embeddings.test.ts",
+        "hashed_secret": "c734e47630dda71619c696d88381f06f7511bd78",
+        "is_verified": false,
+        "line_number": 149
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/memory/embeddings.test.ts",
+        "hashed_secret": "56e1d57b8db262b08bc73c60ed08d8c92e59503f",
+        "is_verified": false,
+        "line_number": 179
+      }
+    ],
+    "src/pairing/pairing-store.ts": [
+      {
+        "type": "Base64 High Entropy String",
+        "filename": "src/pairing/pairing-store.ts",
+        "hashed_secret": "f8c6f1ff98c5ee78c27d34a3ca68f35ad79847af",
+        "is_verified": false,
+        "line_number": 12
+      }
+    ],
+    "src/security/audit.test.ts": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "b1775a785f09a6ebaf2dc33d6eaeb98974d9cdb8",
+        "is_verified": false,
+        "line_number": 180
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "fa8da98a5bdb77b4902cbb4338e6e94ea825300e",
+        "is_verified": false,
+        "line_number": 209
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "21f688ab56f76a99e5c6ed342291422f4e57e47f",
+        "is_verified": false,
+        "line_number": 1046
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "src/security/audit.test.ts",
+        "hashed_secret": "3dc927d80543dc0f643940b70d066bd4b4c4b78e",
+        "is_verified": false,
+        "line_number": 1077
+      }
+    ],
+    "src/tts/tts.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "src/tts/tts.test.ts",
+        "hashed_secret": "2e7a7ee14caebf378fc32d6cf6f557f347c96773",
+        "is_verified": false,
+        "line_number": 33
+      },
+      {
+        "type": "Hex High Entropy String",
+        "filename": "src/tts/tts.test.ts",
+        "hashed_secret": "b214f706bb602c1cc2adc5c6165e73622305f4bb",
+        "is_verified": false,
+        "line_number": 68
       }
     ],
     "src/web/qr-image.test.ts": [
@@ -504,6 +2202,15 @@
         "line_number": 12
       }
     ],
+    "test/provider-timeout.e2e.test.ts": [
+      {
+        "type": "Secret Keyword",
+        "filename": "test/provider-timeout.e2e.test.ts",
+        "hashed_secret": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
+        "is_verified": false,
+        "line_number": 182
+      }
+    ],
     "vendor/a2ui/README.md": [
       {
         "type": "Secret Keyword",
@@ -514,5 +2221,5 @@
       }
     ]
   },
-  "generated_at": "2026-01-05T13:01:00Z"
+  "generated_at": "2026-01-25T06:57:20Z"
 }
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000000..515f25a5f1e
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,25 @@
+# ShellCheck configuration
+# https://www.shellcheck.net/wiki/
+
+# Disable common false positives and style suggestions
+
+# SC2034: Variable appears unused (often exported or used indirectly)
+disable=SC2034
+
+# SC2155: Declare and assign separately (common idiom, rarely causes issues)
+disable=SC2155
+
+# SC2295: Expansions inside ${..} need quoting (info-level, rarely causes issues)
+disable=SC2295
+
+# SC1012: \r is literal (tr -d '\r' works as intended on most systems)
+disable=SC1012
+
+# SC2026: Word outside quotes (info-level, often intentional)
+disable=SC2026
+
+# SC2016: Expressions don't expand in single quotes (often intentional in sed/awk)
+disable=SC2016
+
+# SC2129: Consider using { cmd1; cmd2; } >> file (style preference)
+disable=SC2129
diff --git a/.swiftformat b/.swiftformat
index e0d3bc8b658..6622d0b01cc 100644
--- a/.swiftformat
+++ b/.swiftformat
@@ -23,7 +23,7 @@
 # Whitespace
 --trimwhitespace always
 --emptybraces no-space
---nospaceoperators ...,..< 
+--nospaceoperators ...,..<
 --ranges no-space
 --someAny true
 --voidtype void
diff --git a/AGENTS.md b/AGENTS.md
index 3751208c8cc..deed6d9bd26 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -37,6 +37,7 @@
 ## Build, Test, and Development Commands
 - Runtime baseline: Node **22+** (keep Node + Bun paths working).
 - Install deps: `pnpm install`
+- Pre-commit hooks: `prek install` (runs same checks as CI)
 - Also supported: `bun install` (keep `pnpm-lock.yaml` + Bun patching in sync when touching deps/patches).
 - Prefer Bun for TypeScript execution (scripts, dev, tests): `bun <file.ts>` / `bunx <tool>`.
 - Run CLI in dev: `pnpm clawdbot ...` (bun) or `pnpm dev`.
diff --git a/README.md b/README.md
index 2c2093b951a..1329c5e2b7b 100644
--- a/README.md
+++ b/README.md
@@ -459,7 +459,7 @@ Use these when you’re past the onboarding flow and want the deeper reference.
 
 ## Clawd
 
-Clawdbot was built for **Clawd**, a space lobster AI assistant. 🦞  
+Clawdbot was built for **Clawd**, a space lobster AI assistant. 🦞
 by Peter Steinberger and the community.
 
 - [clawd.me](https://clawd.me)
@@ -468,7 +468,7 @@ by Peter Steinberger and the community.
 
 ## Community
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, maintainers, and how to submit PRs.  
+See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, maintainers, and how to submit PRs.
 AI/vibe-coded PRs welcome! 🤖
 
 Special thanks to [Mario Zechner](https://mariozechner.at/) for his support and for
diff --git a/SECURITY.md b/SECURITY.md
index d2af462baeb..43d49399632 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -12,4 +12,3 @@ If you believe you’ve found a security issue in Clawdbot, please report it pri
 For threat model + hardening guidance (including `clawdbot security audit --deep` and `--fix`), see:
 
 - `https://docs.clawd.bot/gateway/security`
-
diff --git a/appcast.xml b/appcast.xml
index bed929dfbad..a589863aeb6 100644
--- a/appcast.xml
+++ b/appcast.xml
@@ -212,4 +212,4 @@
             <enclosure url="https://github.com/clawdbot/clawdbot/releases/download/v2026.1.21/Clawdbot-2026.1.21.zip" length="22284796" type="application/octet-stream" sparkle:edSignature="pXji4NMA/cu35iMxln385d6LnsT4yIZtFtFiR7sIimKeSC2CsyeWzzSD0EhJsN98PdSoy69iEFZt4I2ZtNCECg=="/>
         </item>
     </channel>
-</rss>
\ No newline at end of file
+</rss>
diff --git a/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt b/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt
index 1d876903a3e..1c9b3986f64 100644
--- a/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt
+++ b/apps/android/app/src/main/java/com/clawdbot/android/CameraHudState.kt
@@ -12,4 +12,3 @@ data class CameraHudState(
   val kind: CameraHudKind,
   val message: String,
 )
-
diff --git a/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt b/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt
index e8a6eff1586..6c3e2c20115 100644
--- a/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt
+++ b/apps/android/app/src/main/java/com/clawdbot/android/VoiceWakeMode.kt
@@ -12,4 +12,3 @@ enum class VoiceWakeMode(val rawValue: String) {
     }
   }
 }
-
diff --git a/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt b/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt
index e449993d281..3e12a56dfbd 100644
--- a/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt
+++ b/apps/android/app/src/main/java/com/clawdbot/android/node/SmsManager.kt
@@ -135,7 +135,7 @@ class SmsManager(private val context: Context) {
 
     /**
      * Send an SMS message.
-     * 
+     *
      * @param paramsJson JSON with "to" (phone number) and "message" (text) fields
      * @return SendResult indicating success or failure
      */
diff --git a/apps/android/app/src/main/res/values/colors.xml b/apps/android/app/src/main/res/values/colors.xml
index 6e79939c6c9..dfadc94cf03 100644
--- a/apps/android/app/src/main/res/values/colors.xml
+++ b/apps/android/app/src/main/res/values/colors.xml
@@ -1,4 +1,3 @@
 <resources>
     <color name="ic_launcher_background">#0A0A0A</color>
 </resources>
-
diff --git a/apps/android/app/src/main/res/values/strings.xml b/apps/android/app/src/main/res/values/strings.xml
index 5e4d8a77d15..3665960c20d 100644
--- a/apps/android/app/src/main/res/values/strings.xml
+++ b/apps/android/app/src/main/res/values/strings.xml
@@ -1,4 +1,3 @@
 <resources>
     <string name="app_name">Clawdbot Node</string>
 </resources>
-
diff --git a/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt b/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt
index bdcee32848a..f6e512fa324 100644
--- a/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt
+++ b/apps/android/app/src/test/java/com/clawdbot/android/voice/VoiceWakeCommandExtractorTest.kt
@@ -23,4 +23,3 @@ class VoiceWakeCommandExtractorTest {
     assertNull(VoiceWakeCommandExtractor.extractCommand("hey claude!", listOf("claude")))
   }
 }
-
diff --git a/apps/android/settings.gradle.kts b/apps/android/settings.gradle.kts
index 05466f48f0f..d9d0158c9c2 100644
--- a/apps/android/settings.gradle.kts
+++ b/apps/android/settings.gradle.kts
@@ -16,4 +16,3 @@ dependencyResolutionManagement {
 
 rootProject.name = "ClawdbotNodeAndroid"
 include(":app")
-
diff --git a/apps/ios/.swiftlint.yml b/apps/ios/.swiftlint.yml
index 7b64147b5e0..fc8509c8385 100644
--- a/apps/ios/.swiftlint.yml
+++ b/apps/ios/.swiftlint.yml
@@ -3,4 +3,3 @@ parent_config: ../../.swiftlint.yml
 included:
   - Sources
   - ../shared/ClawdisNodeKit/Sources
-
diff --git a/apps/macos/Icon.icon/icon.json b/apps/macos/Icon.icon/icon.json
index 32754bd1882..33ba22b1c92 100644
--- a/apps/macos/Icon.icon/icon.json
+++ b/apps/macos/Icon.icon/icon.json
@@ -33,4 +33,4 @@
     ],
     "squares" : "shared"
   }
-}
\ No newline at end of file
+}
diff --git a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt
index 4592f65f552..d1b9e4b3ce5 100644
--- a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt
+++ b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/LICENSE.apple-device-identifiers.txt
@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
\ No newline at end of file
+SOFTWARE.
diff --git a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json
index 236ac2f0ed2..76caa5452ea 100644
--- a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json
+++ b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/ios-device-identifiers.json
@@ -173,4 +173,4 @@
   "iPod5,1": "iPod touch (5th generation)",
   "iPod7,1": "iPod touch (6th generation)",
   "iPod9,1": "iPod touch (7th generation)"
-}
\ No newline at end of file
+}
diff --git a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json
index 2b7483581c1..03d5a5eccb1 100644
--- a/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json
+++ b/apps/macos/Sources/Clawdbot/Resources/DeviceModels/mac-device-identifiers.json
@@ -211,4 +211,4 @@
     "Mac Pro (2019)",
     "Mac Pro (Rack, 2019)"
   ]
-}
\ No newline at end of file
+}
diff --git a/extensions/matrix/src/matrix/monitor/auto-join.ts b/extensions/matrix/src/matrix/monitor/auto-join.ts
index 90b05202a1d..564c7899598 100644
--- a/extensions/matrix/src/matrix/monitor/auto-join.ts
+++ b/extensions/matrix/src/matrix/monitor/auto-join.ts
@@ -33,7 +33,7 @@ export function registerMatrixAutoJoin(params: {
   // For "allowlist" mode, handle invites manually
   client.on("room.invite", async (roomId: string, _inviteEvent: unknown) => {
     if (autoJoin !== "allowlist") return;
-    
+
     // Get room alias if available
     let alias: string | undefined;
     let altAliases: string[] = [];
diff --git a/extensions/matrix/src/matrix/monitor/media.ts b/extensions/matrix/src/matrix/monitor/media.ts
index dc49e7c4585..b60320e41f6 100644
--- a/extensions/matrix/src/matrix/monitor/media.ts
+++ b/extensions/matrix/src/matrix/monitor/media.ts
@@ -25,7 +25,7 @@ async function fetchMatrixMediaBuffer(params: {
   // matrix-bot-sdk provides mxcToHttp helper
   const url = params.client.mxcToHttp(params.mxcUrl);
   if (!url) return null;
-  
+
   // Use the client's download method which handles auth
   try {
     const buffer = await params.client.downloadContent(params.mxcUrl);
@@ -61,7 +61,7 @@ async function fetchEncryptedMediaBuffer(params: {
     Buffer.from(encryptedBuffer),
     params.file,
   );
-  
+
   return { buffer: decrypted };
 }
 
@@ -77,7 +77,7 @@ export async function downloadMatrixMedia(params: {
   placeholder: string;
 } | null> {
   let fetched: { buffer: Buffer; headerType?: string } | null;
-  
+
   if (params.file) {
     // Encrypted media
     fetched = await fetchEncryptedMediaBuffer({
@@ -93,7 +93,7 @@ export async function downloadMatrixMedia(params: {
       maxBytes: params.maxBytes,
     });
   }
-  
+
   if (!fetched) return null;
   const headerType = fetched.headerType ?? params.contentType ?? undefined;
   const saved = await getMatrixRuntime().channel.media.saveMediaBuffer(
diff --git a/extensions/mattermost/src/group-mentions.ts b/extensions/mattermost/src/group-mentions.ts
index b3fbc7e4f87..773e655ffef 100644
--- a/extensions/mattermost/src/group-mentions.ts
+++ b/extensions/mattermost/src/group-mentions.ts
@@ -11,4 +11,4 @@ export function resolveMattermostGroupRequireMention(
   });
   if (typeof account.requireMention === "boolean") return account.requireMention;
   return true;
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/accounts.ts b/extensions/mattermost/src/mattermost/accounts.ts
index 6af1b3e4c0f..e75f345938c 100644
--- a/extensions/mattermost/src/mattermost/accounts.ts
+++ b/extensions/mattermost/src/mattermost/accounts.ts
@@ -112,4 +112,4 @@ export function listEnabledMattermostAccounts(cfg: ClawdbotConfig): ResolvedMatt
   return listMattermostAccountIds(cfg)
     .map((accountId) => resolveMattermostAccount({ cfg, accountId }))
     .filter((account) => account.enabled);
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/client.ts b/extensions/mattermost/src/mattermost/client.ts
index 277139d5df5..6b63f830fa6 100644
--- a/extensions/mattermost/src/mattermost/client.ts
+++ b/extensions/mattermost/src/mattermost/client.ts
@@ -205,4 +205,4 @@ export async function uploadMattermostFile(
     throw new Error("Mattermost file upload failed");
   }
   return info;
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/monitor-helpers.ts b/extensions/mattermost/src/mattermost/monitor-helpers.ts
index 2aa00f1586a..8c68a4f255d 100644
--- a/extensions/mattermost/src/mattermost/monitor-helpers.ts
+++ b/extensions/mattermost/src/mattermost/monitor-helpers.ts
@@ -147,4 +147,4 @@ export function resolveThreadSessionKeys(params: {
     ? `${params.baseSessionKey}:thread:${threadId}`
     : params.baseSessionKey;
   return { sessionKey, parentSessionKey: params.parentSessionKey };
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/mattermost/probe.ts b/extensions/mattermost/src/mattermost/probe.ts
index 0286979f6f0..c0fa8ae633c 100644
--- a/extensions/mattermost/src/mattermost/probe.ts
+++ b/extensions/mattermost/src/mattermost/probe.ts
@@ -67,4 +67,4 @@ export async function probeMattermost(
   } finally {
     if (timer) clearTimeout(timer);
   }
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/onboarding-helpers.ts b/extensions/mattermost/src/onboarding-helpers.ts
index f442992226d..8a5d1f58524 100644
--- a/extensions/mattermost/src/onboarding-helpers.ts
+++ b/extensions/mattermost/src/onboarding-helpers.ts
@@ -39,4 +39,4 @@ export async function promptAccountId(params: PromptAccountIdParams): Promise<st
     );
   }
   return normalized;
-}
\ No newline at end of file
+}
diff --git a/extensions/mattermost/src/onboarding.ts b/extensions/mattermost/src/onboarding.ts
index 495128d5b9e..431c648aedd 100644
--- a/extensions/mattermost/src/onboarding.ts
+++ b/extensions/mattermost/src/onboarding.ts
@@ -184,4 +184,4 @@ export const mattermostOnboardingAdapter: ChannelOnboardingAdapter = {
       mattermost: { ...cfg.channels?.mattermost, enabled: false },
     },
   }),
-};
\ No newline at end of file
+};
diff --git a/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose b/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose
index 05354416965..7e3d6921dbc 100644
--- a/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose
+++ b/extensions/open-prose/skills/prose/examples/28-automated-pr-review.prose
@@ -22,11 +22,11 @@ parallel:
   security = session: security_expert
     prompt: "Perform a deep security audit of the changes. Look for OWASP top 10 issues."
     context: overview
-  
+
   perf = session: performance_expert
     prompt: "Analyze the performance implications. Identify potential bottlenecks or regressions."
     context: overview
-  
+
   style = session: reviewer
     prompt: "Review for code style, maintainability, and adherence to best practices."
     context: overview
diff --git a/extensions/voice-call/src/manager/context.ts b/extensions/voice-call/src/manager/context.ts
index 38fc7aa1b90..846dd745030 100644
--- a/extensions/voice-call/src/manager/context.ts
+++ b/extensions/voice-call/src/manager/context.ts
@@ -19,4 +19,3 @@ export type CallManagerContext = {
   transcriptWaiters: Map<CallId, TranscriptWaiter>;
   maxDurationTimers: Map<CallId, NodeJS.Timeout>;
 };
-
diff --git a/extensions/voice-call/src/manager/events.ts b/extensions/voice-call/src/manager/events.ts
index 8cf7ad5b482..b9da95ea222 100644
--- a/extensions/voice-call/src/manager/events.ts
+++ b/extensions/voice-call/src/manager/events.ts
@@ -175,4 +175,3 @@ export function processEvent(ctx: CallManagerContext, event: NormalizedEvent): v
 
   persistCallRecord(ctx.storePath, call);
 }
-
diff --git a/extensions/voice-call/src/manager/lookup.ts b/extensions/voice-call/src/manager/lookup.ts
index bc0b5f8eedd..99ac246b199 100644
--- a/extensions/voice-call/src/manager/lookup.ts
+++ b/extensions/voice-call/src/manager/lookup.ts
@@ -31,4 +31,3 @@ export function findCall(params: {
     providerCallId: params.callIdOrProviderCallId,
   });
 }
-
diff --git a/extensions/voice-call/src/manager/state.ts b/extensions/voice-call/src/manager/state.ts
index 7131d6b7d24..37d460a1df5 100644
--- a/extensions/voice-call/src/manager/state.ts
+++ b/extensions/voice-call/src/manager/state.ts
@@ -48,4 +48,3 @@ export function addTranscriptEntry(
   };
   call.transcript.push(entry);
 }
-
diff --git a/extensions/voice-call/src/manager/store.ts b/extensions/voice-call/src/manager/store.ts
index 96525479a67..9200b684ddd 100644
--- a/extensions/voice-call/src/manager/store.ts
+++ b/extensions/voice-call/src/manager/store.ts
@@ -86,4 +86,3 @@ export async function getCallHistoryFromStore(
 
   return calls;
 }
-
diff --git a/extensions/voice-call/src/manager/timers.ts b/extensions/voice-call/src/manager/timers.ts
index d56a26fc7f3..2effcdf0f1a 100644
--- a/extensions/voice-call/src/manager/timers.ts
+++ b/extensions/voice-call/src/manager/timers.ts
@@ -84,4 +84,3 @@ export function waitForFinalTranscript(
     ctx.transcriptWaiters.set(callId, { resolve, reject, timeout });
   });
 }
-
diff --git a/extensions/voice-call/src/manager/twiml.ts b/extensions/voice-call/src/manager/twiml.ts
index d6c1dd038ce..588df559057 100644
--- a/extensions/voice-call/src/manager/twiml.ts
+++ b/extensions/voice-call/src/manager/twiml.ts
@@ -7,4 +7,3 @@ export function generateNotifyTwiml(message: string, voice: string): string {
   <Hangup/>
 </Response>`;
 }
-
diff --git a/extensions/voice-call/src/providers/plivo.test.ts b/extensions/voice-call/src/providers/plivo.test.ts
index 0674a7dd245..e2aa6289bc4 100644
--- a/extensions/voice-call/src/providers/plivo.test.ts
+++ b/extensions/voice-call/src/providers/plivo.test.ts
@@ -26,4 +26,3 @@ describe("PlivoProvider", () => {
     expect(result.providerResponseBody).toContain('length="300"');
   });
 });
-
diff --git a/extensions/voice-call/src/providers/twilio/webhook.ts b/extensions/voice-call/src/providers/twilio/webhook.ts
index f59342f1432..28f445c88a4 100644
--- a/extensions/voice-call/src/providers/twilio/webhook.ts
+++ b/extensions/voice-call/src/providers/twilio/webhook.ts
@@ -27,4 +27,3 @@ export function verifyTwilioProviderWebhook(params: {
     reason: result.reason,
   };
 }
-
diff --git a/extensions/zalouser/src/channel.test.ts b/extensions/zalouser/src/channel.test.ts
index 45487edd0bd..123cf358d09 100644
--- a/extensions/zalouser/src/channel.test.ts
+++ b/extensions/zalouser/src/channel.test.ts
@@ -15,4 +15,3 @@ describe("zalouser outbound chunker", () => {
     expect(chunks.every((c) => c.length <= limit)).toBe(true);
   });
 });
-
diff --git a/scripts/clawlog.sh b/scripts/clawlog.sh
index 49e87709011..2320e2e7d7b 100755
--- a/scripts/clawlog.sh
+++ b/scripts/clawlog.sh
@@ -124,7 +124,7 @@ EOF
 # Function to list categories
 list_categories() {
     echo -e "${BLUE}Fetching VibeTunnel log categories from the last hour...${NC}\n"
-    
+
     # Get unique categories from recent logs
     log show --predicate "subsystem == \"$SUBSYSTEM\"" --last 1h 2>/dev/null | \
         grep -E "category: \"[^\"]+\"" | \
@@ -133,7 +133,7 @@ list_categories() {
         while read -r cat; do
             echo "  • $cat"
         done
-    
+
     echo -e "\n${YELLOW}Note: Only categories with recent activity are shown${NC}"
 }
 
@@ -230,29 +230,29 @@ fi
 if [[ "$STREAM_MODE" == true ]]; then
     # Streaming mode
     CMD="sudo log stream --predicate '$PREDICATE' --level $LOG_LEVEL --info"
-    
+
     echo -e "${GREEN}Streaming VibeTunnel logs continuously...${NC}"
     echo -e "${YELLOW}Press Ctrl+C to stop${NC}\n"
 else
     # Show mode
     CMD="sudo log show --predicate '$PREDICATE'"
-    
+
     # Add log level for show command
     if [[ "$LOG_LEVEL" == "debug" ]]; then
         CMD="$CMD --debug"
     else
         CMD="$CMD --info"
     fi
-    
+
     # Add time range
     CMD="$CMD --last $TIME_RANGE"
-    
+
     if [[ "$SHOW_TAIL" == true ]]; then
         echo -e "${GREEN}Showing last $TAIL_LINES log lines from the past $TIME_RANGE${NC}"
     else
         echo -e "${GREEN}Showing all logs from the past $TIME_RANGE${NC}"
     fi
-    
+
     # Show applied filters
     if [[ "$ERRORS_ONLY" == true ]]; then
         echo -e "${RED}Filter: Errors only${NC}"
@@ -277,14 +277,14 @@ if [[ -n "$OUTPUT_FILE" ]]; then
     if sudo -n /usr/bin/log show --last 1s 2>&1 | grep -q "password"; then
         handle_sudo_error
     fi
-    
+
     echo -e "${BLUE}Exporting logs to: $OUTPUT_FILE${NC}\n"
     if [[ "$SHOW_TAIL" == true ]] && [[ "$STREAM_MODE" == false ]]; then
         eval "$CMD" 2>&1 | tail -n "$TAIL_LINES" > "$OUTPUT_FILE"
     else
         eval "$CMD" > "$OUTPUT_FILE" 2>&1
     fi
-    
+
     # Check if file was created and has content
     if [[ -s "$OUTPUT_FILE" ]]; then
         LINE_COUNT=$(wc -l < "$OUTPUT_FILE" | tr -d ' ')
@@ -298,7 +298,7 @@ else
     if sudo -n /usr/bin/log show --last 1s 2>&1 | grep -q "password"; then
         handle_sudo_error
     fi
-    
+
     if [[ "$SHOW_TAIL" == true ]] && [[ "$STREAM_MODE" == false ]]; then
         # Apply tail for non-streaming mode
         eval "$CMD" 2>&1 | tail -n "$TAIL_LINES"
diff --git a/scripts/e2e/gateway-network-docker.sh b/scripts/e2e/gateway-network-docker.sh
index 8b971d3b33c..0989e764deb 100644
--- a/scripts/e2e/gateway-network-docker.sh
+++ b/scripts/e2e/gateway-network-docker.sh
@@ -102,12 +102,12 @@ ws.send(
 	);
 	const connectRes = await onceFrame((o) => o?.type === \"res\" && o?.id === \"c1\");
 	if (!connectRes.ok) throw new Error(\"connect failed: \" + (connectRes.error?.message ?? \"unknown\"));
-	
+
 	ws.send(JSON.stringify({ type: \"req\", id: \"h1\", method: \"health\" }));
 	const healthRes = await onceFrame((o) => o?.type === \"res\" && o?.id === \"h1\", 10000);
 	if (!healthRes.ok) throw new Error(\"health failed: \" + (healthRes.error?.message ?? \"unknown\"));
 	if (healthRes.payload?.ok !== true) throw new Error(\"unexpected health payload\");
-	
+
 	ws.close();
 	console.log(\"ok\");
 NODE"
diff --git a/scripts/update-clawtributors.types.ts b/scripts/update-clawtributors.types.ts
index 17b57652360..98526bc8a41 100644
--- a/scripts/update-clawtributors.types.ts
+++ b/scripts/update-clawtributors.types.ts
@@ -30,4 +30,3 @@ export type Entry = {
   avatar_url: string;
   lines: number;
 };
-
diff --git a/skills/local-places/SKILL.md b/skills/local-places/SKILL.md
index a002081f618..5b0fdc3a865 100644
--- a/skills/local-places/SKILL.md
+++ b/skills/local-places/SKILL.md
@@ -84,7 +84,7 @@ curl http://127.0.0.1:8000/places/{place_id}
       "open_now": true
     }
   ],
-  "next_page_token": "..." 
+  "next_page_token": "..."
 }
 ```
 
diff --git a/ui/src/main.ts b/ui/src/main.ts
index 31d493921b1..9374bb20ec4 100644
--- a/ui/src/main.ts
+++ b/ui/src/main.ts
@@ -1,3 +1,2 @@
 import "./styles.css";
 import "./ui/app.ts";
-
diff --git a/ui/src/styles/chat/layout.css b/ui/src/styles/chat/layout.css
index 96e321bb015..e137cb8c84d 100644
--- a/ui/src/styles/chat/layout.css
+++ b/ui/src/styles/chat/layout.css
@@ -279,4 +279,3 @@
     min-width: 120px;
   }
 }
-
diff --git a/ui/src/styles/chat/text.css b/ui/src/styles/chat/text.css
index ce5ce4af97c..13e245de251 100644
--- a/ui/src/styles/chat/text.css
+++ b/ui/src/styles/chat/text.css
@@ -122,4 +122,3 @@
   border-top: 1px solid var(--border);
   margin: 1em 0;
 }
-
diff --git a/ui/src/styles/chat/tool-cards.css b/ui/src/styles/chat/tool-cards.css
index fd6291a3ec4..052e63dbb9d 100644
--- a/ui/src/styles/chat/tool-cards.css
+++ b/ui/src/styles/chat/tool-cards.css
@@ -196,4 +196,3 @@
     transform: scale(1);
   }
 }
-
diff --git a/ui/src/ui/app-events.ts b/ui/src/ui/app-events.ts
index c058cf73e5a..eda3a8e1634 100644
--- a/ui/src/ui/app-events.ts
+++ b/ui/src/ui/app-events.ts
@@ -3,4 +3,3 @@ export type EventLogEntry = {
   event: string;
   payload?: unknown;
 };
-
diff --git a/ui/src/ui/app-tool-stream.ts b/ui/src/ui/app-tool-stream.ts
index 5c83c3a793a..2fbe12b7a89 100644
--- a/ui/src/ui/app-tool-stream.ts
+++ b/ui/src/ui/app-tool-stream.ts
@@ -154,13 +154,13 @@ const COMPACTION_TOAST_DURATION_MS = 5000;
 export function handleCompactionEvent(host: CompactionHost, payload: AgentEventPayload) {
   const data = payload.data ?? {};
   const phase = typeof data.phase === "string" ? data.phase : "";
-  
+
   // Clear any existing timer
   if (host.compactionClearTimer != null) {
     window.clearTimeout(host.compactionClearTimer);
     host.compactionClearTimer = null;
   }
-  
+
   if (phase === "start") {
     host.compactionStatus = {
       active: true,
@@ -183,13 +183,13 @@ export function handleCompactionEvent(host: CompactionHost, payload: AgentEventP
 
 export function handleAgentEvent(host: ToolStreamHost, payload?: AgentEventPayload) {
   if (!payload) return;
-  
+
   // Handle compaction events
   if (payload.stream === "compaction") {
     handleCompactionEvent(host as CompactionHost, payload);
     return;
   }
-  
+
   if (payload.stream !== "tool") return;
   const sessionKey =
     typeof payload.sessionKey === "string" ? payload.sessionKey : undefined;
diff --git a/ui/src/ui/controllers/config/form-utils.ts b/ui/src/ui/controllers/config/form-utils.ts
index dea4d7f61f4..fd40bb5aca2 100644
--- a/ui/src/ui/controllers/config/form-utils.ts
+++ b/ui/src/ui/controllers/config/form-utils.ts
@@ -74,4 +74,3 @@ export function removePathValue(
     delete (current as Record<string, unknown>)[lastKey];
   }
 }
-
diff --git a/ui/src/ui/controllers/debug.ts b/ui/src/ui/controllers/debug.ts
index 78993a3aff6..5aa1eec437f 100644
--- a/ui/src/ui/controllers/debug.ts
+++ b/ui/src/ui/controllers/debug.ts
@@ -54,4 +54,3 @@ export async function callDebugMethod(state: DebugState) {
     state.debugCallError = String(err);
   }
 }
-
diff --git a/ui/src/ui/controllers/presence.ts b/ui/src/ui/controllers/presence.ts
index 4154307b177..67ac2761d34 100644
--- a/ui/src/ui/controllers/presence.ts
+++ b/ui/src/ui/controllers/presence.ts
@@ -33,4 +33,3 @@ export async function loadPresence(state: PresenceState) {
     state.presenceLoading = false;
   }
 }
-
diff --git a/ui/src/ui/format.test.ts b/ui/src/ui/format.test.ts
index d7acecebb12..f8b1e8e5627 100644
--- a/ui/src/ui/format.test.ts
+++ b/ui/src/ui/format.test.ts
@@ -39,4 +39,3 @@ describe("stripThinkingTags", () => {
     expect(stripThinkingTags("Hello</final>")).toBe("Hello");
   });
 });
-
diff --git a/ui/src/ui/markdown.test.ts b/ui/src/ui/markdown.test.ts
index da2c4aca0c1..396ff0fa51d 100644
--- a/ui/src/ui/markdown.test.ts
+++ b/ui/src/ui/markdown.test.ts
@@ -30,4 +30,3 @@ describe("toSanitizedMarkdownHtml", () => {
     expect(html).toContain("console.log(1)");
   });
 });
-
diff --git a/ui/src/ui/presenter.ts b/ui/src/ui/presenter.ts
index 9f3df3dcb96..ddb99d9c53c 100644
--- a/ui/src/ui/presenter.ts
+++ b/ui/src/ui/presenter.ts
@@ -55,4 +55,3 @@ export function formatCronPayload(job: CronJob) {
   if (p.kind === "systemEvent") return `System: ${p.text}`;
   return `Agent: ${p.message}`;
 }
-
diff --git a/ui/src/ui/uuid.test.ts b/ui/src/ui/uuid.test.ts
index 62856f1b688..9f7ccbf815e 100644
--- a/ui/src/ui/uuid.test.ts
+++ b/ui/src/ui/uuid.test.ts
@@ -30,4 +30,3 @@ describe("generateUUID", () => {
     expect(id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
   });
 });
-
diff --git a/ui/src/ui/uuid.ts b/ui/src/ui/uuid.ts
index 7124dbb8f41..f231d0f7fbe 100644
--- a/ui/src/ui/uuid.ts
+++ b/ui/src/ui/uuid.ts
@@ -40,4 +40,3 @@ export function generateUUID(cryptoLike: CryptoLike | null = globalThis.crypto):
 
   return uuidFromBytes(weakRandomBytes());
 }
-
diff --git a/ui/src/ui/views/channels.shared.ts b/ui/src/ui/views/channels.shared.ts
index 6238a1e1c03..9af0c2ea143 100644
--- a/ui/src/ui/views/channels.shared.ts
+++ b/ui/src/ui/views/channels.shared.ts
@@ -43,4 +43,3 @@ export function renderChannelAccountCount(
   if (count < 2) return nothing;
   return html`<div class="account-count">Accounts (${count})</div>`;
 }
-
diff --git a/ui/src/ui/views/channels.whatsapp.ts b/ui/src/ui/views/channels.whatsapp.ts
index b40a533c65d..eae3be69570 100644
--- a/ui/src/ui/views/channels.whatsapp.ts
+++ b/ui/src/ui/views/channels.whatsapp.ts
@@ -116,4 +116,3 @@ export function renderWhatsAppCard(params: {
     </div>
   `;
 }
-
diff --git a/ui/src/ui/views/chat.ts b/ui/src/ui/views/chat.ts
index 86a6771f263..dd61ca0ecff 100644
--- a/ui/src/ui/views/chat.ts
+++ b/ui/src/ui/views/chat.ts
@@ -70,7 +70,7 @@ const COMPACTION_TOAST_DURATION_MS = 5000;
 
 function renderCompactionIndicator(status: CompactionIndicatorStatus | null | undefined) {
   if (!status) return nothing;
-  
+
   // Show "compacting..." while active
   if (status.active) {
     return html`
@@ -91,7 +91,7 @@ function renderCompactionIndicator(status: CompactionIndicatorStatus | null | un
       `;
     }
   }
-  
+
   return nothing;
 }
 
diff --git a/ui/src/ui/views/config-form.node.ts b/ui/src/ui/views/config-form.node.ts
index 07cb9f23931..9d121d7f17f 100644
--- a/ui/src/ui/views/config-form.node.ts
+++ b/ui/src/ui/views/config-form.node.ts
@@ -120,7 +120,7 @@ export function renderNode(params: {
       const hasString = normalizedTypes.has("string");
       const hasNumber = normalizedTypes.has("number");
       const hasBoolean = normalizedTypes.has("boolean");
-      
+
       if (hasBoolean && normalizedTypes.size === 1) {
         return renderNode({
           ...params,
@@ -383,14 +383,14 @@ function renderObject(params: {
   const hint = hintForPath(path, hints);
   const label = hint?.label ?? schema.title ?? humanize(String(path.at(-1)));
   const help = hint?.help ?? schema.description;
-  
+
   const fallback = value ?? schema.default;
   const obj = fallback && typeof fallback === "object" && !Array.isArray(fallback)
     ? (fallback as Record<string, unknown>)
     : {};
   const props = schema.properties ?? {};
   const entries = Object.entries(props);
-  
+
   // Sort by hint order
   const sorted = entries.sort((a, b) => {
     const orderA = hintForPath([...path, a[0]], hints)?.order ?? 0;
@@ -514,7 +514,7 @@ function renderArray(params: {
         </button>
       </div>
       ${help ? html`<div class="cfg-array__help">${help}</div>` : nothing}
-      
+
       ${arr.length === 0 ? html`
         <div class="cfg-array__empty">
           No items yet. Click "Add" to create one.
@@ -597,7 +597,7 @@ function renderMapField(params: {
           Add Entry
         </button>
       </div>
-      
+
       ${entries.length === 0 ? html`
         <div class="cfg-map__empty">No custom entries.</div>
       ` : html`
diff --git a/ui/src/ui/views/config-form.render.ts b/ui/src/ui/views/config-form.render.ts
index e0985c93b59..2e7dc5f4e99 100644
--- a/ui/src/ui/views/config-form.render.ts
+++ b/ui/src/ui/views/config-form.render.ts
@@ -94,16 +94,16 @@ function matchesSearch(key: string, schema: JsonSchema, query: string): boolean
   if (!query) return true;
   const q = query.toLowerCase();
   const meta = SECTION_META[key];
-  
+
   // Check key name
   if (key.toLowerCase().includes(q)) return true;
-  
+
   // Check label and description
   if (meta) {
     if (meta.label.toLowerCase().includes(q)) return true;
     if (meta.description.toLowerCase().includes(q)) return true;
   }
-  
+
   return schemaMatches(schema, q);
 }
 
@@ -192,8 +192,8 @@ export function renderConfigForm(props: ConfigFormProps) {
       <div class="config-empty">
         <div class="config-empty__icon">${icons.search}</div>
         <div class="config-empty__text">
-          ${searchQuery 
-            ? `No settings match "${searchQuery}"` 
+          ${searchQuery
+            ? `No settings match "${searchQuery}"`
             : "No settings in this section"}
         </div>
       </div>
diff --git a/ui/src/ui/views/config-form.shared.ts b/ui/src/ui/views/config-form.shared.ts
index b37969a9352..a6a8e241608 100644
--- a/ui/src/ui/views/config-form.shared.ts
+++ b/ui/src/ui/views/config-form.shared.ts
@@ -89,4 +89,3 @@ export function isSensitivePath(path: Array<string | number>): boolean {
     key.endsWith("key")
   );
 }
-
diff --git a/ui/src/ui/views/config-form.ts b/ui/src/ui/views/config-form.ts
index 0bcfe0a9ce9..146436ea6e3 100644
--- a/ui/src/ui/views/config-form.ts
+++ b/ui/src/ui/views/config-form.ts
@@ -5,4 +5,3 @@ export {
 } from "./config-form.analyze";
 export { renderNode } from "./config-form.node";
 export { schemaType, type JsonSchema } from "./config-form.shared";
-
diff --git a/ui/src/ui/views/config.ts b/ui/src/ui/views/config.ts
index c45849d56bc..ff6f57f3208 100644
--- a/ui/src/ui/views/config.ts
+++ b/ui/src/ui/views/config.ts
@@ -138,7 +138,7 @@ function computeDiff(
 ): Array<{ path: string; from: unknown; to: unknown }> {
   if (!original || !current) return [];
   const changes: Array<{ path: string; from: unknown; to: unknown }> = [];
-  
+
   function compare(orig: unknown, curr: unknown, path: string) {
     if (orig === curr) return;
     if (typeof orig !== typeof curr) {
@@ -164,7 +164,7 @@ function computeDiff(
       compare(origObj[key], currObj[key], path ? `${path}.${key}` : key);
     }
   }
-  
+
   compare(original, current, "");
   return changes;
 }
@@ -258,7 +258,7 @@ export function renderConfig(props: ConfigProps) {
           <div class="config-sidebar__title">Settings</div>
           <span class="pill pill--sm ${validity === "valid" ? "pill--ok" : validity === "invalid" ? "pill--danger" : ""}">${validity}</span>
         </div>
-        
+
         <!-- Search -->
         <div class="config-search">
           <svg class="config-search__icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
@@ -273,13 +273,13 @@ export function renderConfig(props: ConfigProps) {
             @input=${(e: Event) => props.onSearchChange((e.target as HTMLInputElement).value)}
           />
           ${props.searchQuery ? html`
-            <button 
+            <button
               class="config-search__clear"
               @click=${() => props.onSearchChange("")}
             >×</button>
           ` : nothing}
         </div>
-        
+
         <!-- Section nav -->
         <nav class="config-nav">
           <button
@@ -299,7 +299,7 @@ export function renderConfig(props: ConfigProps) {
             </button>
           `)}
         </nav>
-        
+
         <!-- Mode toggle at bottom -->
         <div class="config-sidebar__footer">
           <div class="config-mode-toggle">
@@ -319,7 +319,7 @@ export function renderConfig(props: ConfigProps) {
           </div>
         </div>
       </aside>
-      
+
       <!-- Main content -->
       <main class="config-main">
         <!-- Action bar -->
@@ -358,7 +358,7 @@ export function renderConfig(props: ConfigProps) {
             </button>
           </div>
         </div>
-        
+
         <!-- Diff panel (form mode only - raw mode doesn't have granular diff) -->
         ${hasChanges && props.formMode === "form" ? html`
           <details class="config-diff">
diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 00000000000..d864cbb6d59
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1,17 @@
+# zizmor configuration
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  # Disable unpinned-uses - pinning to SHA hashes is a significant change
+  # that should be done deliberately, not enforced by pre-commit
+  unpinned-uses:
+    disable: true
+
+  # Disable excessive-permissions for now - adding explicit permissions
+  # blocks requires careful review of each workflow's needs
+  excessive-permissions:
+    disable: true
+
+  # Disable artipacked (persist-credentials) - low confidence finding
+  artipacked:
+    disable: true