chore: stage pre-existing staging WIP

Work that was already uncommitted on the staging branch when the proxy
bootstrap began. Committing faithfully — no behavior changes from me.

Buckets:

hermes-agent devcontainer feature (new)
- container/.devcontainer/features/hermes-agent/
  - devcontainer-feature.json, install.sh, README.md

settings profile generation (new)
- container/.devcontainer/scripts/generate-settings-profiles.js
- container/.devcontainer/defaults/codeforge/config/settings.base.json
- container/.devcontainer/defaults/codeforge/config/settings-profiles/
  (opus-45-200k, opus-46-200k, opus-46-1m-400k, opus-47-200k, opus-47-1m-400k)
- container/.devcontainer/defaults/codeforge/config/settings-opus-*.json
  (generated outputs for the above profiles)

oh-my-claude feature tweaks (modified)
- README.md, devcontainer-feature.json, install.sh, poststart-hook.sh

container plumbing (modified)
- .secrets.example, AGENTS.md, CHANGELOG.md, README.md
- devcontainer.json, file-manifest.json, settings.json
- scripts/{check-setup.sh, setup-aliases.sh, setup-config.sh}
- test.js

docs site (modified)
- package.json
- src/content/docs/customize/optional-components.md
- src/content/docs/reference/{changelog,cli-tools,commands}.md

Grouped by package per CLAUDE.md cross-package rules. None of this is
related to the proxy work landed in the previous commit.

Author: AnExiledDev

container/.devcontainer/.secrets.example

@@ -27,5 +27,14 @@ OPENROUTER_API_KEY=
 # oh-my-claude — Chinese LLM provider API keys
 KIMI_API_KEY=
 ZHIPU_API_KEY=
+ZAI_API_KEY=
 ALIYUN_API_KEY=
 MINIMAX_API_KEY=
+MINIMAX_CN_API_KEY=
+
+# oh-my-claude — optional local/embedding providers
+OLLAMA_HOST=
+EMBEDDING_API_BASE=
+EMBEDDING_MODEL=
+EMBEDDING_API_KEY=
+EMBEDDING_DIMENSIONS=

container/.devcontainer/AGENTS.md

@@ -6,7 +6,9 @@ CodeForge devcontainer for AI-assisted development with Claude Code.
 
 | File | Purpose |
 |------|---------|
-| `defaults/codeforge/config/settings.json` | Model, tokens, permissions, plugins, env vars |
+| `defaults/codeforge/config/settings.base.json` | Shared Claude Code settings: permissions, plugins, env vars |
+| `defaults/codeforge/config/settings-profiles/*.json` | Model/context/thinking overlays used to generate deployed settings profiles |
+| `defaults/codeforge/config/settings*.json` | Generated Claude Code settings profiles deployed to `~/.claude/` |
 | `defaults/codeforge/config/main-system-prompt.md` | System prompt defining assistant behavior |
 | `defaults/codeforge/config/orchestrator-system-prompt.md` | Orchestrator mode prompt (delegation-first) |
 | `defaults/codeforge/config/ccstatusline-settings.json` | Status bar widget layout (deployed to ~/.config/ccstatusline/) |
@@ -22,13 +24,14 @@ Config files deploy via `defaults/codeforge/file-manifest.json` on every contain
 
 | Command | Purpose |
 |---------|---------|
-| `cc` / `claude` | Run Claude Code with auto-configuration (opus-4-5, 200k context) |
+| `cc` / `claude` / `cc7` | Run Claude Code with auto-configuration (opus-4-7, 200k context) |
 | `codeforge config apply` | Deploy config files to `~/.claude/` (same as container start) |
 | `ccraw` | Vanilla Claude Code (bypasses config) |
-| `ccw` | Claude Code with writing system prompt (opus-4-5, 200k context) |
-| `cc-orc` | Claude Code in orchestrator mode, delegation-first (opus-4-5, 200k context) |
-| `cc7` / `ccw7` / `cc-orc7` | Claude Code on opus-4-7 with 400k context (main / writing / orchestrator modes) |
+| `cc5` / `cc6` / `cc61` / `cc71` | Main prompt profiles for opus-4-5 200k, opus-4-6 200k, opus-4-6 1M bounded to 400k, opus-4-7 1M bounded to 400k |
+| `ccw*` | Same profile matrix with the writing system prompt |
+| `cc-orc*` | Same profile matrix in orchestrator mode, delegation-first |
 | `codex` | OpenAI Codex CLI terminal coding agent |
+| `hermes` | Nous Research Hermes Agent CLI (run `hermes setup` on first use) |
 | `ccms` | Session history search _(disabled — requires Rust toolchain; uncomment in devcontainer.json to enable)_ |
 | `codeforge proxy` | Launch Claude Code through mitmproxy — inspect API traffic in browser (port 8081) |
 | `ccr start` / `ccr stop` | Claude Code Router daemon control |
@@ -79,9 +82,11 @@ Codex CLI credentials (`~/.codex/`) are backed by a separate Docker named volume
 
 **Claude Code Router:** Set provider API keys (`ANTHROPIC_API_KEY`, `DEEPSEEK_API_KEY`, `GEMINI_API_KEY`, `OPENROUTER_API_KEY`) in `.devcontainer/.secrets`. Keys are exported as env vars on container start and read at runtime by the router's `$ENV_VAR` interpolation in `~/.claude-code-router/config.json`. Edit routing rules in `defaults/codeforge/config/claude-code-router.json` and run `ccr-apply` to redeploy.
 
+**oh-my-claude:** The local `features/oh-my-claude` feature is opt-in. It installs the OMC CLI and generated agents, skips OMC hooks/MCP/statusline, and preserves CodeForge-managed `~/.claude/settings.json`. OMC proxy sessions are launched per session with `omc cc` or the `omc-cc` helper; do not add a post-start OMC daemon.
+
 ## Modifying Behavior
 
-1. **Change model**: Edit `defaults/codeforge/config/settings.json` → `"model"` field
+1. **Change shared Claude settings**: Edit `defaults/codeforge/config/settings.base.json`, then run `node scripts/generate-settings-profiles.js`
 2. **Change system prompt**: Edit `defaults/codeforge/config/main-system-prompt.md`
 3. **Add config file**: Place in `defaults/codeforge/config/`, add entry to `defaults/codeforge/file-manifest.json`
 4. **Add features**: Add to `"features"` in `devcontainer.json`

container/.devcontainer/CHANGELOG.md

@@ -1,5 +1,32 @@
 # CodeForge Devcontainer Changelog
 
+## Unreleased
+
+### Hermes Agent
+
+- **New feature: `hermes-agent`** — installs [Nous Research's Hermes Agent](https://hermes-agent.nousresearch.com/) CLI via the upstream `curl | bash` installer with `--skip-setup`. Hermes uses the plain `anthropic` / `openai` Python SDKs directly and supports any compatible provider (Anthropic, OpenAI, MiniMax, local models). Enabled by default; set `"version": "none"` in `devcontainer.json` to disable.
+- **Hermes persistence** — dedicated Docker named volume (`codeforge-hermes-config-${devcontainerId}`) for `~/.hermes/`, surviving container rebuilds so `hermes setup` is a one-time cost per devcontainer instance.
+- **No credential seeding** — the interactive `hermes setup` wizard is intentionally skipped during image build. Run `hermes setup` on first use to pick a provider and paste an API key (e.g. from `$MINIMAX_API_KEY`, which already has a slot in `.secrets.example`). Claude OAuth / Codex ChatGPT OAuth cannot be reused — Hermes needs its own provider auth.
+
+### Configuration
+
+- **Claude settings profiles** — replaced the single hand-edited default with `settings.base.json` plus model overlays that generate five deployed settings files: opus-4-7 200k default, opus-4-7 1M bounded to 400k, opus-4-6 200k, opus-4-6 1M bounded to 400k, and opus-4-5 200k.
+- **Profile aliases** — `cc`, `claude`, `cc7`, `ccw`, `ccw7`, `cc-orc`, and `cc-orc7` now use the opus-4-7 200k settings profile. Added `cc5`, `cc6`, `cc61`, `cc71` plus matching `ccw*` and `cc-orc*` variants.
+- **Settings-based context bounds** — Claude launchers now pass `--settings` profile files instead of inline context env vars or `--model`, so model, context, and thinking controls stay in settings JSON.
+- **Router features disabled by default** — `claude-code-router` and `oh-my-claude` are both present but configured with `version: "none"` in `devcontainer.json`; CCR autostart is also false.
+
+### oh-my-claude
+
+- **StatusLine protection hardened** — install.sh now explicitly resets `statusLine` to ccstatusline after `omc install` completes, since OMC lacks a `--skip-statusline` flag. This prevents OMC from overwriting CodeForge's statusline config.
+- **Feature completed as opt-in** — `features/oh-my-claude` now installs the OMC CLI with hooks/MCP skipped, preserves CodeForge-managed `settings.json`, and keeps OMC proxy lifecycle per-session via `omc cc` instead of a post-start daemon.
+- **Alias cleanup** — default CodeForge `cc` aliases no longer pass OMC MCP `--disallowedTools`; OMC helpers are exposed separately (`omc-cc`, `omc-doctor`, provider shortcuts) when OMC is installed.
+- **Provider env coverage** — added Z.AI, MiniMax CN, Ollama, and embedding provider env placeholders to `.secrets.example`.
+- **Robust agent generation** — `omc install` now retries up to 3 times with 2-second backoff if the initial install fails during container build.
+- **Post-start agent cleanup** — role agents (sisyphus, prometheus, etc.) are now filtered on every container start, ensuring provider-only mode even when `omc install` is run manually.
+- **Shell helpers ownership clarified** — install.sh no longer writes shell aliases; CodeForge's `setup-aliases.sh` owns all OMC helper aliases (`omc-cc`, `omc-deepseek`, etc.). Legacy OMC shell blocks are cleaned up on install.
+- **Install order guaranteed** — oh-my-claude added to `overrideFeatureInstallOrder` in devcontainer.json.
+- **Documentation** — added Known Limitations section covering expected `omc doctor` failures, missing slash commands (upstream issue), and role agent filtering.
+
 ## v2.2.1 — 2026-04-16
 
 ### Configuration

container/.devcontainer/README.md

@@ -216,6 +216,7 @@ claude --resume               # Resume previous session
 | `hadolint` | Dockerfile linter |
 | `agent-browser` | Headless browser automation for AI agents |
 | `codex` | OpenAI Codex CLI terminal coding agent |
+| `hermes` | Nous Research Hermes Agent CLI (run `hermes setup` on first use) |
 
 ### Code Intelligence
 | Tool | Description |
@@ -320,6 +321,7 @@ CodeForge includes custom devcontainer features. Any feature can be disabled by
 | `ccms` | Claude Code session history search |
 | `claude-session-dashboard` | Local session analytics dashboard with web UI |
 | `codex-cli` | OpenAI Codex CLI terminal coding agent |
+| `hermes-agent` | Nous Research Hermes Agent CLI (interactive `hermes setup` on first use) |
 | `notify-hook` | Desktop notifications on Claude completion |
 | `mcp-qdrant` | Qdrant vector database MCP server (optional) |
 

container/.devcontainer/defaults/codeforge/config/settings-opus-45-200k.json

@@ -0,0 +1,130 @@
+{
+	"cleanupPeriodDays": 60,
+	"autoCompact": true,
+	"alwaysThinkingEnabled": true,
+	"env": {
+		"ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-4-6",
+		"ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5-20251001",
+		"BASH_DEFAULT_TIMEOUT_MS": "120000",
+		"BASH_MAX_TIMEOUT_MS": "300000",
+		"CLAUDE_CODE_MAX_OUTPUT_TOKENS": "64000",
+		"MAX_MCP_OUTPUT_TOKENS": "10000",
+		"CLAUDE_CODE_EFFORT_LEVEL": "high",
+		"MCP_TIMEOUT": "120000",
+		"MCP_TOOL_TIMEOUT": "30000",
+		"CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "80",
+		"FORCE_AUTOUPDATE_PLUGINS": "1",
+		"CLAUDE_CODE_SCROLL_SPEED": "3",
+		"ENABLE_TOOL_SEARCH": "auto:5",
+		"CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "0",
+		"CLAUDE_CODE_ENABLE_TASKS": "1",
+		"CLAUDE_CODE_DISABLE_AUTO_MEMORY": "0",
+		"ENABLE_CLAUDE_CODE_SM_COMPACT": "1",
+		"CLAUDE_CODE_FORCE_GLOBAL_CACHE": "1",
+		"CLAUDE_CODE_PLAN_MODE_INTERVIEW_PHASE": "true",
+		"CLAUDE_CODE_PLAN_V2_AGENT_COUNT": "5",
+		"CLAUDE_CODE_PLAN_MODE_REQUIRED": "true",
+		"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR": "true",
+		"CLAUDE_AUTO_BACKGROUND_TASKS": "1",
+		"CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION": "false",
+		"CLAUDE_CODE_NO_FLICKER": "1",
+		"CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY": "10",
+		"CLAUDE_CODE_MAX_RETRIES": "1",
+		"BASH_MAX_OUTPUT_LENGTH": "15000",
+		"TASK_MAX_OUTPUT_LENGTH": "64000",
+		"DISABLE_AUTOUPDATER": "1",
+		"ANTHROPIC_MODEL": "claude-opus-4-5",
+		"ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-4-5",
+		"CLAUDE_CODE_MAX_CONTEXT_TOKENS": "200000",
+		"CLAUDE_CODE_AUTO_COMPACT_WINDOW": "200000",
+		"MAX_THINKING_TOKENS": "31999",
+		"CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING": "1"
+	},
+	"teammateMode": "auto",
+	"showClearContextOnPlanAccept": true,
+	"showThinkingSummaries": true,
+	"attribution": {
+		"commit": "",
+		"pr": ""
+	},
+	"autoMemoryDirectory": "./.claude/memory",
+	"plansDirectory": "./.claude/plans",
+	"viewMode": "focus",
+	"spinnerVerbs": {
+		"mode": "replace",
+		"verbs": [
+			"Butchering",
+			"Mangling",
+			"Wrecking",
+			"Botching",
+			"Misreading",
+			"Derailing",
+			"Overcomplicating",
+			"Hallucinating",
+			"Breaking",
+			"Fumbling",
+			"Sabotaging",
+			"Shredding",
+			"Confusing",
+			"Corrupting",
+			"Ruining",
+			"Winging",
+			"Guessing",
+			"Misinterpreting",
+			"Overengineering",
+			"Improvising Poorly",
+			"Making It Worse",
+			"Massacring",
+			"Mutilating",
+			"Annihilating",
+			"Trashing",
+			"Destroying",
+			"Misfiring",
+			"Ignoring",
+			"Unthinking",
+			"Wondering",
+			"Draining",
+			"Exhausting",
+			"Petering Out"
+		]
+	},
+	"permissions": {
+		"allow": [
+			"Read(/workspaces/*)",
+			"WebFetch(domain:*)"
+		],
+		"deny": [],
+		"ask": [],
+		"defaultMode": "plan",
+		"additionalDirectories": []
+	},
+	"enabledMcpjsonServers": [],
+	"disabledMcpjsonServers": [],
+	"hooks": {},
+	"statusLine": {
+		"type": "command",
+		"command": "/usr/local/bin/ccstatusline-wrapper"
+	},
+	"enabledPlugins": {
+		"frontend-design@anthropics/claude-code": true,
+		"code-review@anthropics/claude-code": true,
+		"feature-dev@anthropics/claude-code": true,
+		"pr-review-toolkit@anthropics/claude-code": true,
+		"codeforge-lsp@devs-marketplace": false,
+		"ticket-workflow@devs-marketplace": false,
+		"notify-hook@devs-marketplace": false,
+		"dangerous-command-blocker@devs-marketplace": false,
+		"protected-files-guard@devs-marketplace": true,
+		"agent-system@devs-marketplace": true,
+		"skill-engine@devs-marketplace": false,
+		"spec-workflow@devs-marketplace": false,
+		"session-context@devs-marketplace": false,
+		"auto-code-quality@devs-marketplace": true,
+		"workspace-scope-guard@devs-marketplace": true,
+		"prompt-snippets@devs-marketplace": true,
+		"git-workflow@devs-marketplace": false
+	},
+	"autoUpdatesChannel": "latest",
+	"model": "claude-opus-4-5",
+	"autoCompactWindow": 200000
+}

container/.devcontainer/defaults/codeforge/config/settings-opus-46-1m-400k.json

@@ -0,0 +1,130 @@
+{
+	"cleanupPeriodDays": 60,
+	"autoCompact": true,
+	"alwaysThinkingEnabled": true,
+	"env": {
+		"ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-4-6",
+		"ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5-20251001",
+		"BASH_DEFAULT_TIMEOUT_MS": "120000",
+		"BASH_MAX_TIMEOUT_MS": "300000",
+		"CLAUDE_CODE_MAX_OUTPUT_TOKENS": "64000",
+		"MAX_MCP_OUTPUT_TOKENS": "10000",
+		"CLAUDE_CODE_EFFORT_LEVEL": "high",
+		"MCP_TIMEOUT": "120000",
+		"MCP_TOOL_TIMEOUT": "30000",
+		"CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "80",
+		"FORCE_AUTOUPDATE_PLUGINS": "1",
+		"CLAUDE_CODE_SCROLL_SPEED": "3",
+		"ENABLE_TOOL_SEARCH": "auto:5",
+		"CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "0",
+		"CLAUDE_CODE_ENABLE_TASKS": "1",
+		"CLAUDE_CODE_DISABLE_AUTO_MEMORY": "0",
+		"ENABLE_CLAUDE_CODE_SM_COMPACT": "1",
+		"CLAUDE_CODE_FORCE_GLOBAL_CACHE": "1",
+		"CLAUDE_CODE_PLAN_MODE_INTERVIEW_PHASE": "true",
+		"CLAUDE_CODE_PLAN_V2_AGENT_COUNT": "5",
+		"CLAUDE_CODE_PLAN_MODE_REQUIRED": "true",
+		"CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR": "true",
+		"CLAUDE_AUTO_BACKGROUND_TASKS": "1",
+		"CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION": "false",
+		"CLAUDE_CODE_NO_FLICKER": "1",
+		"CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY": "10",
+		"CLAUDE_CODE_MAX_RETRIES": "1",
+		"BASH_MAX_OUTPUT_LENGTH": "15000",
+		"TASK_MAX_OUTPUT_LENGTH": "64000",
+		"DISABLE_AUTOUPDATER": "1",
+		"ANTHROPIC_MODEL": "claude-opus-4-6[1m]",
+		"ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-4-6[1m]",
+		"CLAUDE_CODE_MAX_CONTEXT_TOKENS": "400000",
+		"CLAUDE_CODE_AUTO_COMPACT_WINDOW": "400000",
+		"MAX_THINKING_TOKENS": "31999",
+		"CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING": "1"
+	},
+	"teammateMode": "auto",
+	"showClearContextOnPlanAccept": true,
+	"showThinkingSummaries": true,
+	"attribution": {
+		"commit": "",
+		"pr": ""
+	},
+	"autoMemoryDirectory": "./.claude/memory",
+	"plansDirectory": "./.claude/plans",
+	"viewMode": "focus",
+	"spinnerVerbs": {
+		"mode": "replace",
+		"verbs": [
+			"Butchering",
+			"Mangling",
+			"Wrecking",
+			"Botching",
+			"Misreading",
+			"Derailing",
+			"Overcomplicating",
+			"Hallucinating",
+			"Breaking",
+			"Fumbling",
+			"Sabotaging",
+			"Shredding",
+			"Confusing",
+			"Corrupting",
+			"Ruining",
+			"Winging",
+			"Guessing",
+			"Misinterpreting",
+			"Overengineering",
+			"Improvising Poorly",
+			"Making It Worse",
+			"Massacring",
+			"Mutilating",
+			"Annihilating",
+			"Trashing",
+			"Destroying",
+			"Misfiring",
+			"Ignoring",
+			"Unthinking",
+			"Wondering",
+			"Draining",
+			"Exhausting",
+			"Petering Out"
+		]
+	},
+	"permissions": {
+		"allow": [
+			"Read(/workspaces/*)",
+			"WebFetch(domain:*)"
+		],
+		"deny": [],
+		"ask": [],
+		"defaultMode": "plan",
+		"additionalDirectories": []
+	},
+	"enabledMcpjsonServers": [],
+	"disabledMcpjsonServers": [],
+	"hooks": {},
+	"statusLine": {
+		"type": "command",
+		"command": "/usr/local/bin/ccstatusline-wrapper"
+	},
+	"enabledPlugins": {
+		"frontend-design@anthropics/claude-code": true,
+		"code-review@anthropics/claude-code": true,
+		"feature-dev@anthropics/claude-code": true,
+		"pr-review-toolkit@anthropics/claude-code": true,
+		"codeforge-lsp@devs-marketplace": false,
+		"ticket-workflow@devs-marketplace": false,
+		"notify-hook@devs-marketplace": false,
+		"dangerous-command-blocker@devs-marketplace": false,
+		"protected-files-guard@devs-marketplace": true,
+		"agent-system@devs-marketplace": true,
+		"skill-engine@devs-marketplace": false,
+		"spec-workflow@devs-marketplace": false,
+		"session-context@devs-marketplace": false,
+		"auto-code-quality@devs-marketplace": true,
+		"workspace-scope-guard@devs-marketplace": true,
+		"prompt-snippets@devs-marketplace": true,
+		"git-workflow@devs-marketplace": false
+	},
+	"autoUpdatesChannel": "latest",
+	"model": "claude-opus-4-6[1m]",
+	"autoCompactWindow": 400000
+}