Capability targeting (new feature):
- loop --capability <SET|ALL> scopes which capability library the loop reasons
against. data/capability_sets/<name>.json (same schema as capabilities.json)
holds one-off targeted products; drop a file in and pass its name, no code
changes. First set: agentminder (Broadcom AgentMinder, agentic-AI identity).
- capabilities.set_active_set() swaps the active library; keyword pre-filter is
bypassed for small targeted sets so every signal is evaluated. New
'capability-sets' command lists them; run banner shows the active set.
LLM provider — the '429' was a disguised policy block:
- Anthropic rejects Claude Code OAuth tokens on /v1/messages for non-Claude-Code
traffic with a fake rate_limit_error (no anthropic-ratelimit-* headers). New
'claude-cli' provider runs inference through the sanctioned headless path
(claude -p --append-system-prompt --model), now the default provider.
- OAuth keychain token auto-refresh via headless claude when expired.
Resilience:
- STATE_DIR is overridable (macOS endpoint-security locked output/state via
com.apple.macl); load_memory tolerates PermissionError; exa usage counter
tolerates malformed files; run.py handles Ctrl-C cleanly (no traceback).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
