8syncdev · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "8sync",
+  "description": "8 Sync plugins for Claude Code",
+  "owner": { "name": "8 Sync", "url": "https://8syncdev.com" },
+  "plugins": [
+    {
+      "name": "8sync-kit",
+      "description": "Role-routed subagents (explore, task, quick-task, reviewer, designer, researcher, verifier) and the /ship skill from the 8 Sync kit.",
+      "source": "./assets/claude",
+      "category": "development"
+    }
+  ]
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,33 @@ Mọi thay đổi đáng kể của `8sync` ghi vào đây. Format theo [Keep a
 versioning theo [SemVer](https://semver.org). **8sync rule:** mỗi PR cập nhật mục `Unreleased`.
 
 ## [Unreleased]
+### Security
+- **`8sync harness claude-code` only accepts endpoints Anthropic sanctions.** Allowed: `https://api.anthropic.com`, Amazon Bedrock, Google Vertex, Microsoft Foundry, and localhost or one exact host you run yourself (`EIGHTSYNC_SELF_HOSTED_GATEWAY=<host>`). Any other gateway is refused before anything is written: gateways that resell Claude break the Usage Policy ("Do Not Abuse Our Platform"), and your code would go to an undisclosed third party. The official-endpoint check is an exact host match now (`api.anthropic.com.evil.io` used to pass as a substring); plain `http://` is refused except on localhost.
+- **Only Console API keys leave Claude Code.** `harness claude-code` writes a token into `~/.omp/agent/models.yml` (and Windows User env) only when it starts with `sk-ant-api`; `harness add-model` refuses non-Console Anthropic tokens and Claude-protocol providers outside the allowlist; `forge key` takes only a Console key for `anthropic` and refuses ForgeCode's `claude_code` provider; the Feynman bridge skips every Claude/Anthropic model. A subscription/OAuth token stays in Claude Code and is not used for the endpoint probe. Tokens are printed as `…` + the last 4 characters (`harness claude-code`, `harness gateway`, `forge`) and kept out of `curl`'s argv. `scripts/setup-claude-key.ps1` and `.sh` now only forward to `8sync harness claude-code` on stdin (the `.ps1` used to write any token for any endpoint into settings.json and the Windows User env first; the `.sh` overwrote settings.json when 8sync was missing). A subscription/OAuth token is accepted only for `api.anthropic.com`, never for localhost or a self-hosted gateway.
+- **`8sync harness gateway` no longer routes Claude through the 9router proxy**: the `cc/` provider (which made omp pose as Claude Code) is gone and `apply` removes an already-deployed one. The remaining non-Claude routes need `EIGHTSYNC_GATEWAY_ACCEPT=1`, `gateway key` rewrites only its own provider block, `gateway apply` re-deploys the template but keeps your other providers (backup in `models.yml.bak`), and both refuse Anthropic keys (`sk-ant-…`).
+- **`8sync codex-web` is opt-in** (`EIGHTSYNC_CODEX_WEB_ACCEPT=1`): it automates a ChatGPT Web subscription into omp, the same pattern 8 Sync's rules forbid for Claude, and OpenAI's terms for it are not verified. Without the opt-in only `status`/`off` run.
+- `8sync forge` writes `~/.forge/.credentials.json` with mode 0600 (and tightens an existing file).
+
+### Fixed
+- `8sync feynman` works with Feynman ≥ 0.5.35: the bridge finds Pi's packages under `@earendil-works/*` (then `@mariozechner/*`), in the launcher and the extension (was `Cannot find module '@mariozechner/pi-ai'`).
+- Claude 5.5 model IDs (`claude-opus-5-5`, `claude-sonnet-5-5`, `claude-haiku-5-5`) in `harness claude-code`, the `harness model` aliases (`opus`/`sonnet`/`haiku`), the endpoint probe (now `x-api-key` + `anthropic-version`, official endpoint and localhost only) and the kit's gates.
+- `8sync ccc kit` says why codebase-memory-mcp / serena were not registered in Claude Code (missing from omp's `mcp.json`, not on PATH, or the `claude mcp add-json` error) instead of skipping silently; serena is registered with `alwaysLoad: false`.
+
+### Added
+- **Public plugin marketplace**: the kit's subagents and `/ship` install as a Claude Code plugin — `/plugin marketplace add 8-Sync-Dev/su-code` then `/plugin install 8sync-kit@8sync` (~630 tokens always-on per `claude plugin details`); hooks, rules and the full skill set still come from `8sync ccc kit`.
+- `8sync ccc kit` enables Anthropic's official LSP plugins (rust-analyzer, TypeScript, gopls, pyright from `claude-plugins-official`) for the language servers found on PATH — code intelligence without MCP schemas in the prompt; values you set are kept.
+
+### Changed
+- **Leaner Claude Code sessions.** Measured on one machine (2026-10-12; `wc -c` of every always-loaded layer, and `message.usage` of the first request in 2 Claude Code transcripts), the kit + repo layers came to 55,663 B (≈13.9k tokens at 4 B/token) of a ~58k-token first request; most of it is gone:
+  - the repo `CLAUDE.md` block is compact (≤1.1 KB), no longer orders reading 4 SKILL.md bodies (15.4 KB) before the first tool call, and no longer claims MCP tools are always present;
+  - no block in a `su-code/` memory dir, and no new block in a child repo when an ancestor `CLAUDE.md` already has it (Claude Code loads both; they were byte-identical 8.6 KB copies); an existing child block is kept and refreshed to the compact one;
+  - the kit's `CLAUDE.md` summarises the 8 Sync / Anthropic rules instead of importing the 6.7 KB rules doc into every session (full text: `/aup-audit`, `skills/aup-audit/8sync-anthropic-rules.md`);
+  - on-demand bundled skills are `name-only` in user-scope `skillOverrides` (values you set are kept; core skills keep their descriptions).
+- **Kit agents are routed by role**: explore and quick-task on Haiku (`effort: low`), task on Sonnet, reviewer on Sonnet (`effort: high`), with `maxTurns`, read-only `disallowedTools` where they only read, and a short return envelope (reviewer keeps its BLOCKER/SHOULD/NIT + verdict format).
+- New kit agents `researcher` and `verifier`, and `deep-research` v2: plan → scale gate → lead drafts → verifier checks every citation → reviewer grades FATAL/MAJOR/MINOR → provenance file, `Verification: BLOCKED` when it cannot finish. Adapted from Feynman (MIT, see `THIRD_PARTY_NOTICES.md`). Private repo source is researched locally, not sent to third-party models.
+- The Stop gate (Haiku 5.5) lets a turn end while Claude waits on background agents it launched (it blocked 4 times in a row in a real session); the ask gate stays on Sonnet (5.5). `/ship` requires every "done/verified" claim to cite the command output.
+- New `8sync ccc hook session-start` (startup/clear/compact, found from any subdirectory): a byte-stable digest of `su-code/STATE.md` plus recent `failure:`/`validated:` lessons, at most 6,000 B.
+- `docs/legal/anthropic/index.md` records the snapshot date; `legal-sync.py` refreshes it only when a page changed.
 
 ## [0.65.0] — 2026-10-11
 ### Added

diff --git a/README.md b/README.md
@@ -102,18 +102,25 @@ Each name maps to a fixed conversation id per repo, so `8sync ccc . core` tomorr
 
 ![8sync ccc kit and a named session](docs/assets/ccc-kit.png)
 
+Only want the subagents and `/ship`? They are also a Claude Code plugin in this repo's public marketplace (hooks, rules and the full skill set still come from `8sync ccc kit`):
+
+```
+/plugin marketplace add 8-Sync-Dev/su-code
+/plugin install 8sync-kit@8sync
+```
+
 The kit lives in `~/.claude`, so it works in every repo and for plain `claude` too. Every `8sync ccc` launch also keeps things current, without network on the launch path: a newer 8sync release is installed and the command re-runs on it, the kit and bundled skills refresh after an update, and the repo gets the 8sync harness (memory, `AGENTS.md`/`CLAUDE.md` blocks, `.claude/skills` → `su-code/skills`). `SUSYNC_NO_AUTO_UPDATE=1` keeps the installed binary.
 
 | Part | What it does |
 |---|---|
-| Org rules | The 8 Sync rules for Anthropic's Usage Policy and terms ([`8sync-anthropic-rules.md`](assets/skills/aup-audit/8sync-anthropic-rules.md)) are imported into every session ahead of other instructions. |
-| Subagents | `explore` (Haiku) · `task` · `quick-task` · `reviewer` · `designer`. Reviewer and designer use your session model; the read-only ones keep the code-graph MCP tools. |
+| Org rules | A short summary of the 8 Sync rules for Anthropic's Usage Policy and terms loads in every session ahead of other instructions; the full text ([`8sync-anthropic-rules.md`](assets/skills/aup-audit/8sync-anthropic-rules.md)) opens on demand and in `/aup-audit`. |
+| Subagents | Routed by role: `explore` and `quick-task` on Haiku (low effort), `task` and `reviewer` on Sonnet, `designer` on your session model, plus `researcher` and `verifier` for `deep-research`. Each has `maxTurns`; the read-only ones cannot edit; all return a short summary with details in a file. |
 | Skills | `/ship <task>`: explore → task list → implement with build/test → `reviewer` → CHANGELOG + commit, never pushes. `/aup-audit`: Usage Policy + secret check before you publish. `deep-research`: cited research brief. Plus every 8sync skill: bundled ones linked to the current `~/.omp/skills` copy, project ones through `.claude/skills`; on-demand skills are listed by name only to keep the prefix small. |
 | Verify hook | After every Edit/Write, runs `cargo check`, the package's `typecheck` script (or `tsc --noEmit`) or `go vet` from the edited file's nearest manifest **in the background**; only a failure comes back to Claude. The latest edit wins, so a burst of edits costs one check. Before a turn ends, the build must pass (blocked once per broken state). Native Rust, works on Windows. |
 | Guard hook | Before Bash/Edit/Write: no writing `.env`/keys/`*.session`/`*.pkl`, no real-looking API key in code or commands, no `git add -A` that would sweep up a secret, no code routing a Claude subscription into another client. About 23 ms per call. |
-| Stop gate | When Claude tries to end a turn, Haiku reads its last message. Planned steps not done, edits not verified, failing checks, `NOT MERGEABLE`, or a question it could answer itself: the turn goes on. |
+| Stop gate | When Claude tries to end a turn, Haiku reads its last message. Planned steps not done, edits not verified, failing checks, `NOT MERGEABLE`, or a question it could answer itself: the turn goes on. Waiting on background agents it launched is fine. |
 | Ask gate | Before Claude interrupts you with a question, Sonnet checks it. Only credentials, destructive or paid actions, and product decisions reach you; everything else goes back with "pick the conventional option and continue". |
-| Defaults | Only where you haven't set them: auto permission mode, `medium` effort, a task list on every model. Build/test/lint commands and `git add` skip the auto-mode classifier. Deny rules for reading/editing `.env`, keys, `*.session`, `*.pkl` and for force-push; omp's `codebase-memory-mcp` + `serena` registered. |
+| Defaults | Only where you haven't set them: auto permission mode, `medium` effort, a task list on every model. Build/test/lint commands and `git add` skip the auto-mode classifier. Deny rules for reading/editing `.env`, keys, `*.session`, `*.pkl` and for force-push; omp's `codebase-memory-mcp` + `serena` registered when installed (the kit says why not otherwise); Anthropic's official LSP plugins (rust-analyzer, TypeScript, gopls, pyright) enabled for the language servers on your PATH; a `SessionStart` digest of `su-code/STATE.md` and recent lessons. |
 
 A real run with the kit. The first edit broke the build, the verify hook fed the compiler error back, and the stop gate refused "Next I will add tests":
 

diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -0,0 +1,36 @@
+# Third-party notices
+
+## Feynman (MIT)
+
+Parts of the following files are adapted from Feynman.
+
+- Source: https://github.com/companion-inc/feynman
+- Commit: 4cec627
+- Adapted files:
+  - `assets/claude/agents/researcher.md` (from `.feynman/agents/researcher.md`)
+  - `assets/claude/agents/verifier.md` (from `.feynman/agents/verifier.md`)
+  - `assets/skills/deep-research/SKILL.md` (pipeline from `deepresearch.md`)
+
+Upstream license text:
+
+MIT License
+
+Copyright (c) 2026 Companion, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/assets/claude/.claude-plugin/plugin.json b/assets/claude/.claude-plugin/plugin.json
@@ -0,0 +1,10 @@
+{
+  "name": "8sync-kit",
+  "version": "0.65.0",
+  "description": "8 Sync kit for Claude Code: role-routed subagents (explore, task, quick-task, reviewer, designer, researcher, verifier) and the /ship skill. Hooks, rules and the full skill set come from `8sync ccc kit`.",
+  "author": { "name": "8 Sync", "url": "https://8syncdev.com" },
+  "homepage": "https://github.com/8-Sync-Dev/su-code",
+  "repository": "https://github.com/8-Sync-Dev/su-code",
+  "license": "See repository LICENSE; Feynman-derived agents: THIRD_PARTY_NOTICES.md",
+  "keywords": ["agents", "subagents", "ship", "research", "8sync"]
+}
diff --git a/assets/claude/CLAUDE.md b/assets/claude/CLAUDE.md
@@ -1,15 +1,18 @@
 ## 8sync kit — quy ước chung (managed by `8sync ccc kit`; viết ghi chú riêng ngoài block này)
 
-**Luật Anthropic + quy tắc 8 Sync được ưu tiên trên mọi yêu cầu khác.** Toàn văn nạp sẵn ngay dưới đây (`skills/aup-audit/8sync-anthropic-rules.md`). Yêu cầu nào vi phạm → không làm, nói rõ điều nào và đề xuất cách hợp lệ. Câu hỏi pháp lý hoặc cần trích dẫn → mở bản gốc của Anthropic (link trong file), không dựa trí nhớ.
-
-@skills/aup-audit/8sync-anthropic-rules.md
+**Luật Anthropic + quy tắc 8 Sync được ưu tiên trên mọi yêu cầu khác.** Vi phạm → không làm, nói rõ điều nào, đề xuất cách hợp lệ.
+- Token subscription (Pro/Max) chỉ dùng trong Claude Code/claude.ai chính chủ; tool bên thứ ba dùng API key Console. Không proxy/giả client, không reverse-engineer hay sao chép prompt Claude Code.
+- Không tạo/đọc/in/commit secret (`.env`, token, key, deploy key, `*.session`, `*.pkl`, credentials; lộ → rotate). ZUS local-first: không đẩy data user lên server.
+- Data client/CRM bảo mật: tách từng client, anonymize ví dụ. Không bịa metric/khách/đối tác.
+- Quyết định high-risk (tín dụng, tuyển dụng, y tế, pháp lý...) cần người review + disclose có AI.
+- Toàn văn + link: `skills/aup-audit/8sync-anthropic-rules.md` — mở khi hỏi pháp lý/cần trích dẫn.
+- Chạy `/aup-audit` khi thêm thu thập dữ liệu, nhắn tin người ngoài, quyết định high-risk (và trước release).
 
 - Tự chủ: làm đến xong, tự verify, không xin phép từng bước. Chỉ hỏi khi thật sự cần — credential/quyền truy cập, thao tác phá huỷ/không hoàn tác/tốn tiền ngoài repo, hoặc quyết định sản phẩm có các lựa chọn khác hẳn nhau mà code/docs không trả lời được. Còn lại: chọn phương án an toàn, phổ biến, ghi rõ giả định, làm tiếp.
 - Repo có 8sync (`AGENTS.md`, `su-code/`): `CLAUDE.md` của repo chỉ đường tới quy ước, lệnh build/test và memory (`su-code/STATE.md` đọc đầu phiên). Skill của 8sync/omp có sẵn dạng `/<tên>` (vd `/8sync-cli` cho lệnh `8sync`, `/impeccable` cho UI) — mở skill khi task khớp mô tả.
 - Correctness trước, rồi design đơn giản, dễ maintain. Không thêm abstraction chưa cần.
 - Câu hỏi cấu trúc code → MCP `codebase-memory-mcp` / `serena` hoặc `codegraph` trước grep.
-- Chạy build/test/lint của repo trước khi báo "xong". Code mới phải có test. Không sửa test cho pass. Không bịa số liệu, kết quả hay nguồn.
+- Chạy build/test/lint của repo trước khi báo "xong". Code mới phải có test. Không sửa test cho pass. Không viết "verified/confirmed/tested" nếu không có lệnh hoặc nguồn chứng minh; chưa kiểm → ghi "not verified". Không bịa số liệu, kết quả hay nguồn.
 - Conventional commits; thay đổi user-facing → cập nhật `CHANGELOG.md`.
-- Secret: không tạo, đọc, in hay commit `.env`, token, key, deploy key, `*.session`, `*.pkl`, file credentials. Thấy secret trong code → báo user rotate.
-- Trước khi public repo hay release, hoặc khi thêm tính năng thu thập dữ liệu / nhắn tin người ngoài / quyết định high-risk: `/aup-audit`.
 - Task lớn: `explore` → task list → làm từng task + build/test → `reviewer` → commit. Gói sẵn: `/ship <task>`.
+- Subagent trả ≤10 bullet (`claim — file:line/URL`); chi tiết dài ghi vào file, trả path.
diff --git a/assets/claude/agents/designer.md b/assets/claude/agents/designer.md
@@ -2,10 +2,14 @@
 name: designer
 description: Thiết kế UI/UX cho web/desktop (Next.js, Tauri) — layout, component, accessibility, responsive. Dùng khi task có màn hình mới hoặc sửa giao diện.
 model: inherit
+effort: medium
 color: pink
 ---
 Bạn là frontend designer. Tuân thủ design system có sẵn trong repo (tailwind config, components/ui, tokens).
 Không đổi màu/font toàn cục trừ khi được yêu cầu. Mỗi component: responsive, dùng được bằng bàn phím,
 có trạng thái loading / empty / error.
 Tránh "template default": có chủ đích về hierarchy, spacing, typography. Giải thích ngắn lý do chọn.
 Xong thì mở trang thật (dev server + browser/screenshot) để xác nhận — không báo xong khi chưa nhìn thấy.
+
+## Return format
+≤10 bullet `claim — file:line/URL`. Output dài → ghi vào file, chỉ trả path + 1 dòng tóm tắt.
diff --git a/assets/claude/agents/explore.md b/assets/claude/agents/explore.md
@@ -3,6 +3,8 @@ name: explore
 description: Đọc và map codebase cho một task — dùng TRƯỚC khi plan hay sửa code ở repo lớn. Trả về file liên quan, entry point, pattern đang dùng, chỗ dễ vỡ. Chỉ đọc, không sửa.
 disallowedTools: Edit, Write, NotebookEdit
 model: haiku
+effort: low
+maxTurns: 30
 color: cyan
 ---
 Bạn là agent khám phá codebase, chỉ đọc, KHÔNG sửa file.
@@ -14,3 +16,6 @@ find_referencing_symbols), hoặc `codegraph query|explore` qua Bash. Grep chỉ
 Với task được giao: tìm tối đa 15 file liên quan nhất, mỗi file 1 dòng vai trò; chỉ ra pattern đang
 dùng (cách gọi API, cách test, cách đặt tên) và những chỗ dễ vỡ khi sửa.
 Output: markdown ngắn, path tuyệt đối kèm số dòng. Không đoán — chỉ báo cáo thứ đã đọc.
+
+## Return format
+≤10 bullet `claim — file:line/URL`. Output dài → ghi vào file, chỉ trả path + 1 dòng tóm tắt.
diff --git a/assets/claude/agents/quick-task.md b/assets/claude/agents/quick-task.md
@@ -2,6 +2,11 @@
 name: quick-task
 description: Việc nhỏ dưới 5 phút (đổi tên, sửa typo, thêm log, chỉnh config). Nhanh, rẻ, không cần plan.
 model: haiku
+effort: low
+maxTurns: 25
 color: green
 ---
 Làm ngay, không giải thích dài. Chỉ chạy test liên quan trực tiếp. Báo cáo 2–3 dòng.
+
+## Return format
+≤10 bullet `claim — file:line/URL`. Output dài → ghi vào file, chỉ trả path + 1 dòng tóm tắt.