Assisted-by: GLM-5.3 via pi

diff --git a/ai/claude/CLAUDE.md b/ai/claude/CLAUDE.md
index 5af6b335..6e94ea12 100644
--- a/ai/claude/CLAUDE.md
+++ b/ai/claude/CLAUDE.md
@@ -1,3 +1,2 @@
 @~/.dotfiles/ai/_AGENTS.md
-
 @~/.claude/CLAUDE.local.md
diff --git a/ai/claude/hooks/no-envrc.sh b/ai/claude/hooks/no-envrc.sh
new file mode 100755
index 00000000..cfee19b6
--- /dev/null
+++ b/ai/claude/hooks/no-envrc.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Block commands that reference .envrc — it loads secrets (sops/direnv).
+# Matches any mention, since even `wc -l .envrc` leaks information.
+
+command=$(jq -r '.tool_input.command // ""')
+
+if [[ "$command" == *".envrc"* ]]; then
+  echo ".envrc contains secrets. Ask the user how env/secrets load instead of reading it." >&2
+  exit 2
+fi
diff --git a/ai/claude/settings.json b/ai/claude/settings.json
index 50512bf6..0feac9be 100644
--- a/ai/claude/settings.json
+++ b/ai/claude/settings.json
@@ -5,7 +5,6 @@
     "PLAYWRIGHT_MCP_BROWSER": "webkit"
   },
   "permissions": {
-    "defaultMode": "acceptEdits",
     "allow": [
       "Bash(gh issue view:*)",
       "Bash(gh project field-list:*)",
@@ -15,6 +14,7 @@
       "Bash(jj diff:*)",
       "Bash(jj log:*)",
       "Bash(jj show:*)",
+      "Bash(jj st:*)",
       "Bash(jj status:*)",
       "Bash(jj workspace update-stale:*)",
       "mcp__dash-api__list_installed_docsets",
@@ -24,7 +24,14 @@
       "Skill(describing-changes)",
       "Skill(commit)",
       "Skill(superpowers:brainstorming)"
-    ]
+    ],
+    "deny": [
+      "Read(**/.envrc)",
+      "Read(//**/.envrc)"
+    ],
+    "defaultMode": "acceptEdits",
+    "disableBypassPermissionsMode": "disable",
+    "disableAutoMode": "disable"
   },
   "model": "opus",
   "enabledMcpjsonServers": [
@@ -39,6 +46,10 @@
           {
             "type": "command",
             "command": "~/.claude/hooks/no-git.sh"
+          },
+          {
+            "type": "command",
+            "command": "~/.claude/hooks/no-envrc.sh"
           }
         ]
       },
@@ -114,14 +125,12 @@
       }
     ]
   },
+  "disableRemoteControl": true,
   "statusLine": {
     "type": "command",
     "command": "~/.claude/statusline.sh"
   },
   "enabledPlugins": {
-    "claude-md-management@claude-plugins-official": true,
-    "learning-opportunities@learning-opportunities": true,
-    "playground@claude-plugins-official": true,
     "ranger@ranger": true,
     "rust-analyzer-lsp@claude-plugins-official": true,
     "superpowers-developing-for-claude-code@superpowers-marketplace": true,
@@ -135,6 +144,7 @@
       }
     }
   },
+  "outputStyle": "bars",
   "effortLevel": "high",
   "agentPushNotifEnabled": true
 }