chore(release): 26.11.3

.github/workflows/ci.yml

@@ -1,9 +1,13 @@
 # devkit CI: the confirmation of a local run, not the test runner (AGENTS.md §7).
-# Run the same thing locally first: python3 -m unittest discover -s tests && /usr/bin/python3 -m unittest discover -s tests
+# Run the same thing locally first: python3 -m unittest discover -s tests -t . && /usr/bin/python3 -m unittest discover -s tests -t .
+# (-t . runs tests/ as a package, so tests/__init__.py gives the run a temporary home: tests/_hermetic.py)
+# A draft pull request runs no job: the one run starts when it is marked ready for review (ready_for_review), and
+# every push after that runs again. On a push to main, github.event.pull_request is null, which equals false.
 name: ci
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
   push:
     branches: [main]
 
@@ -17,6 +21,7 @@ concurrency:
 jobs:
   test:
     name: tests (Python ${{ matrix.python }})
+    if: github.event.pull_request.draft == false # drafts wait for ready_for_review
     runs-on: macos-latest
     timeout-minutes: 15
     strategy:
@@ -33,12 +38,13 @@ jobs:
       - name: Compile
         run: python -m compileall -q lib bin
       - name: Unit tests
-        run: python -m unittest discover -s tests
+        run: python -m unittest discover -s tests -t .
         env:
           DEVKIT_NO_NOTIFY: "1"
 
   security:
     name: Security scans
+    if: github.event.pull_request.draft == false # drafts wait for ready_for_review
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:

CONTRIBUTING.md

@@ -20,11 +20,15 @@ installing it:
 ```bash
 git clone https://github.com/fireflysoftwaresolutions/devkit.git
 cd devkit
-python3 -m unittest discover -s tests
-/usr/bin/python3 -m unittest discover -s tests   # Python 3.9, the macOS system Python
+python3 -m unittest discover -s tests -t .
+/usr/bin/python3 -m unittest discover -s tests -t .   # Python 3.9, the macOS system Python
 bin/dev --help
 ```
 
+The `-t .` runs `tests/` as a package, so `tests/__init__.py` gives the whole run a temporary home and your own
+devkit state, configuration and handoff repository stay out of reach (`tests/_hermetic.py`). Without it, unittest
+skips `tests/__init__.py`, and `tests/test_hermetic.py` fails to say so.
+
 Installing devkit (`./install.sh`) changes your agents' global settings, hooks, and instructions under `~/.claude`
 and `~/.codex`. Do it only when you want devkit to manage your machine; see [Getting started](docs/getting-started.md).
 
@@ -49,7 +53,7 @@ Every check must pass before you open the pull request. CI runs the tests on Pyt
 
 | Check | Command |
 | --- | --- |
-| The tests, on both Pythons | `python3 -m unittest discover -s tests` and `/usr/bin/python3 -m unittest discover -s tests` |
+| The tests, on both Pythons | `python3 -m unittest discover -s tests -t .` and `/usr/bin/python3 -m unittest discover -s tests -t .` |
 | The code compiles | `python3 -m compileall -q lib bin` |
 | No test that cannot fail | `bin/dev test audit tests/` |
 | No unfinished work (stubs, placeholders, TODOs without a task) | `bin/dev stubs` |

VERSION

@@ -1 +1 @@
-26.11.2
+26.11.3

bin/dev

@@ -1,7 +1,9 @@
-#!/usr/bin/env python3
+#!/usr/bin/env -S python3 -I -S
 # Copyright (c) 2026 Firefly Software Solutions Inc.
 # SPDX-License-Identifier: Apache-2.0
 """devkit command-line entry point. See `dev help` and docs/."""
+# -I -S: devkit's own process (the guard included) loads only the standard library and lib/ below: no PYTHON*
+# variable, current folder, user or site-packages folder or .pth file can put code into it (RT4).
 import os
 import sys
 

config/claude/settings.json

@@ -5,10 +5,12 @@
   "skipDangerousModePermissionPrompt": true,
   "attribution": {
     "commit": "",
-    "pr": ""
+    "pr": "",
+    "sessionUrl": false
   },
   "cleanupPeriodDays": 14,
   "env": {
+    "BASH_DEFAULT_TIMEOUT_MS": "300000",
     "DOCKER_HOST": "unix://{{HOME}}/.colima/default/docker.sock",
     "TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE": "/var/run/docker.sock",
     "NG_CLI_ANALYTICS": "false",
@@ -26,6 +28,7 @@
   "hooks": {
     "SessionStart": [
       {
+        "matcher": "startup|resume|clear|compact",
         "hooks": [
           {
             "type": "command",
@@ -37,7 +40,7 @@
     ],
     "PreToolUse": [
       {
-        "matcher": "Bash|Write|Edit|MultiEdit|NotebookEdit|Agent|Task",
+        "matcher": "Bash|Write|Edit|MultiEdit|NotebookEdit|Agent|Task|WebFetch|mcp__.*",
         "hooks": [
           {
             "type": "command",
@@ -71,7 +74,7 @@
     ],
     "ConfigChange": [
       {
-        "matcher": "user_settings",
+        "matcher": "user_settings|project_settings|local_settings",
         "hooks": [
           {
             "type": "command",
@@ -105,7 +108,7 @@
     ],
     "PostToolUse": [
       {
-        "matcher": "Bash|Agent|Task|Write|Edit|MultiEdit|WebFetch|WebSearch",
+        "matcher": "Bash|Agent|Task|Monitor|Write|Edit|MultiEdit|WebFetch|WebSearch|AskUserQuestion",
         "hooks": [
           {
             "type": "command",
@@ -115,6 +118,18 @@
         ]
       }
     ],
+    "PostToolUseFailure": [
+      {
+        "matcher": "Agent|Task|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "'{{DEVKIT}}/bin/dev' hook post-tool-failure --agent claude",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
     "SubagentStart": [
       {
         "hooks": [
@@ -136,6 +151,30 @@
           }
         ]
       }
+    ],
+    "PreCompact": [
+      {
+        "matcher": "manual|auto",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "'{{DEVKIT}}/bin/dev' hook pre-compact --agent claude",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "matcher": "manual|auto",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "'{{DEVKIT}}/bin/dev' hook post-compact --agent claude",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   },
   "fastModePerSessionOptIn": true

config/codex/config.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Written into ~/.codex/config.toml through Codex's own config API (codex app-server config/batchWrite). Projects under dev_root are marked trusted by `dev install`. `profiles` become ~/.codex/<name>.config.toml (`codex --profile deep`); Agent roles come from config/crew.json (dev crew). The main model and effort stay the user's choice (/model): devkit never sets them. review_model makes /review use the strongest model, and project_doc_max_bytes reads a project's AGENTS.md whole (Codex's default stops at 32 KiB; Claude Code reads CLAUDE.md whole).",
+  "_comment": "Written into ~/.codex/config.toml through Codex's own config API (codex app-server config/batchWrite). Projects under dev_root are marked trusted by `dev install`. `profiles` become ~/.codex/<name>.config.toml (`codex --profile deep`); Agent roles come from config/crew.json (dev crew). The main model and effort stay the user's choice (/model): devkit never sets them. review_model makes /review use the strongest model, and project_doc_max_bytes reads a project's AGENTS.md whole (Codex's default stops at 32 KiB; Claude Code reads CLAUDE.md whole). analytics.enabled=false stops OpenAI's usage analytics, like the other telemetry opt-outs. Commit and PR attribution is an account setting on OpenAI's side, not a config.toml key: `dev doctor` reads it from the sessions.",
   "settings": {
     "approval_policy": "never",
     "sandbox_mode": "danger-full-access",
@@ -18,6 +18,9 @@
     },
     "agents": {
       "max_concurrent_threads_per_session": 4
+    },
+    "analytics": {
+      "enabled": false
     }
   },
   "profiles": {

config/codex/hooks.json

@@ -91,6 +91,28 @@
           }
         ]
       }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "'{{DEVKIT}}/bin/dev' hook pre-compact --agent codex",
+            "timeout": 15
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "'{{DEVKIT}}/bin/dev' hook post-compact --agent codex",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   }
 }