chore: harden codex and swift setup

.codefactor.yml

@@ -0,0 +1,12 @@
+ratings:
+  paths:
+    - "src/**"
+    - "scripts/**"
+    - "build-assets/shared/**"
+    - "build-assets/swiftun-shell/Sources/**"
+
+exclude:
+  - "eliza/**"
+  - "dist-agent/**"
+  - "build-assets/**/Detour*.app/**"
+  - "build-assets/**/_CodeSignature/**"

.githooks/post-commit

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v xh >/dev/null 2>&1; then
+	xh _record-commit "${GIT_DIR:-.git}" || true
+	xh backup --bg || true
+elif [[ -x /Users/home/.local/bin/xh ]]; then
+	/Users/home/.local/bin/xh _record-commit "${GIT_DIR:-.git}" || true
+	/Users/home/.local/bin/xh backup --bg || true
+fi

.githooks/pre-commit

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+bun run scripts/verify-codex-setup.ts --skip-xh-status --hook
+git diff --cached --check
+
+blocked=$(
+	git diff --cached --name-only --diff-filter=ACMR |
+		grep -E '(^|/)(\.env(\..*)?|\.agents/|\.eliza/|\.detour/|\.xhawk/|\.DS_Store$|.*\.log$|\.codex/(config\.toml|hooks\.json)$|\.cursor/hooks\.json$|\.gemini/settings\.json$|\.opencode/(node_modules/|package(-lock)?\.json$|plugins/xh-hooks\.js$)|eliza/.*-export\.jsonl?$)' || true
+)
+
+if [[ -n "$blocked" ]]; then
+	printf 'pre-commit blocked local agent/runtime files:\n%s\n' "$blocked" >&2
+	exit 1
+fi
+
+large=$(
+	while IFS= read -r path; do
+		[[ -f "$path" ]] || continue
+		bytes=$(wc -c < "$path" | tr -d ' ')
+		if [[ "$bytes" -gt 95000000 ]]; then
+			printf '%s (%s bytes)\n' "$path" "$bytes"
+		fi
+	done < <(git diff --cached --name-only --diff-filter=ACMR)
+)
+
+if [[ -n "$large" ]]; then
+	printf 'pre-commit blocked files over 95MB:\n%s\n' "$large" >&2
+	exit 1
+fi

.githooks/pre-push

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+bun run scripts/verify-codex-setup.ts --hook
+bun run verify:swift
+
+TESTS=$(find src -name "*.test.ts" -not -path "*/node_modules/*")
+if [[ -z "$TESTS" ]]; then
+	echo "pre-push found no src tests" >&2
+	exit 1
+fi
+
+bun test $TESTS
+bun run typecheck

.gitignore

@@ -39,6 +39,7 @@ packages/web/public/apple-touch-icon.png
 
 # Eliza local data (vault, audit, auth) — NEVER commit.
 .eliza/
+.agents/
 .xhawk/
 .claude/settings.local.json
 .codex/hooks.json

.opencode/.gitignore

@@ -0,0 +1,5 @@
+node_modules
+package.json
+package-lock.json
+bun.lock
+.gitignore

.opencode/antigravity.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://raw.githubusercontent.com/NoeFabris/opencode-antigravity-auth/main/assets/antigravity.schema.json",
+  "account_selection_strategy": "round-robin",
+  "switch_on_first_rate_limit": true,
+  "pid_offset_enabled": true,
+  "switch_on_error": true
+}

.opencode/opencode.json

@@ -0,0 +1,75 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": [
+    "opencode-antigravity-auth"
+  ],
+  "provider": {
+    "google": {
+      "models": {
+        "antigravity-gemini-3-pro": {
+          "name": "Gemini 3 Pro (Antigravity)",
+          "limit": { "context": 1048576, "output": 65535 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] },
+          "variants": {
+            "low": { "thinkingLevel": "low" },
+            "high": { "thinkingLevel": "high" }
+          }
+        },
+        "antigravity-gemini-3-flash": {
+          "name": "Gemini 3 Flash (Antigravity)",
+          "limit": { "context": 1048576, "output": 65536 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] },
+          "variants": {
+            "minimal": { "thinkingLevel": "minimal" },
+            "low": { "thinkingLevel": "low" },
+            "medium": { "thinkingLevel": "medium" },
+            "high": { "thinkingLevel": "high" }
+          }
+        },
+        "antigravity-claude-sonnet-4-6": {
+          "name": "Claude Sonnet 4.6 (Antigravity)",
+          "limit": { "context": 200000, "output": 64000 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] }
+        },
+        "antigravity-claude-sonnet-4-6-thinking": {
+          "name": "Claude Sonnet 4.6 Thinking (Antigravity)",
+          "limit": { "context": 200000, "output": 64000 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] },
+          "variants": {
+            "low": { "thinkingConfig": { "thinkingBudget": 8192 } },
+            "max": { "thinkingConfig": { "thinkingBudget": 32768 } }
+          }
+        },
+        "antigravity-claude-opus-4-7-thinking": {
+          "name": "Claude Opus 4.7 Thinking (Antigravity)",
+          "limit": { "context": 200000, "output": 64000 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] },
+          "variants": {
+            "low": { "thinkingConfig": { "thinkingBudget": 8192 } },
+            "max": { "thinkingConfig": { "thinkingBudget": 32768 } }
+          }
+        },
+        "gemini-2.5-flash": {
+          "name": "Gemini 2.5 Flash (Gemini CLI)",
+          "limit": { "context": 1048576, "output": 65536 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] }
+        },
+        "gemini-2.5-pro": {
+          "name": "Gemini 2.5 Pro (Gemini CLI)",
+          "limit": { "context": 1048576, "output": 65536 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] }
+        },
+        "gemini-3-flash-preview": {
+          "name": "Gemini 3 Flash Preview (Gemini CLI)",
+          "limit": { "context": 1048576, "output": 65536 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] }
+        },
+        "gemini-3-pro-preview": {
+          "name": "Gemini 3 Pro Preview (Gemini CLI)",
+          "limit": { "context": 1048576, "output": 65535 },
+          "modalities": { "input": ["text", "image", "pdf"], "output": ["text"] }
+        }
+      }
+    }
+  }
+}

AGENTS.md

@@ -14,6 +14,14 @@
 - **Phantom Connect** embedded flows should live on **first-party** surfaces (main React shell or a dedicated allowlisted wallet webview with its own partition), not on arbitrary HTTPS pages loaded in the general agent browser, because Portal **allowed origins** must match the page origin exactly.
 - `.superstack/idea-context.md` and `.superstack/build-context.md` are often **missing** in this workspace; skills that expect them should fall back to repo inspection without assuming those files exist.
 
+## Project Agent Setup
+
+- Local agent session capture is managed by XHawk. Keep `.xhawk/`, `.agents/`, `.codex/`, `.cursor/`, `.gemini/`, and local Claude settings out of commits unless a file is intentionally allowlisted.
+- `xh skill install` should report installed for Claude Code, Codex, Gemini CLI, Cursor, and OpenCode. Re-run it after adding a new coding agent on this machine.
+- Project Git hooks live in `.githooks/`; this worktree should have `core.hooksPath=.githooks`. Run `bun run verify:agents` after moving or recloning the checkout.
+- Swift/macOS setup is checked with `bun run verify:swift`; run `bun run verify:swift:build` after Swift or SwiftPM package changes.
+- The Codex prompt-submit hook should remain local in `.codex/hooks.json`; do not move machine-specific auth, hook, or session-capture files into tracked source.
+
 <!-- VERCEL BEST PRACTICES START -->
 ## Best practices for developing on Vercel