chore(deps): bump actions/checkout from 4.2.2 to 7.0.0

.github/workflows/lint.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
         with:
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Parse every shell script with bash -n
         run: |
           failed=0
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Assert step-5 advertises Vercel MCP (option 11)
         run: |
           if ! grep -q '11) Vercel' step-5/step-5-install.sh; then

.github/workflows/security.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Run ShellCheck at error severity
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # v2.0.0
         with:
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Scan for hardcoded secrets
@@ -53,11 +53,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check SKILL_URL in step-8
         run: |
           COMMIT=$(grep 'SKILL_COMMIT=' step-8/step-8-install.sh | head -1 | cut -d'"' -f2)
-          URL="https://raw.githubusercontent.com/lorecraft-io/cli-maxxing/${COMMIT}/step-8/safetycheck-skill/SKILL.md"
+          URL="https://raw.githubusercontent.com/fidgetcoding/cli-maxxing/${COMMIT}/step-8/safetycheck-skill/SKILL.md"
           HTTP_STATUS=$(curl -o /dev/null -s -w "%{http_code}" "$URL")
           if [ "$HTTP_STATUS" != "200" ]; then
             echo "::error::Pinned SKILL_URL returned HTTP $HTTP_STATUS — commit SHA may be invalid"

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "terminal-academy"]
 	path = terminal-academy
-	url = https://github.com/lorecraft-io/terminal-academy.git
+	url = https://github.com/fidgetcoding/terminal-academy.git

CHANGELOG.md

@@ -7,6 +7,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 ## [Unreleased]
 
 ### Added
+- **`/bullets` skill** (step 4) — crushes a paragraph or prose blob into the shortest scannable bullets: one fact per bullet, ≤~12 words, zero fluff, every signal preserved (names, numbers, dates, paths, decisions). Always outputs bullets — built because `/concise` decides shape per reply and sometimes leaves prose, which is wrong for document handoffs where nobody should have to read a blob. Triggers on `/bullets` and in plain English ("bullet this", "bulletize", "turn this into bullets"). Vendored at `bullets-skill/` (single SKILL.md). Installed by Step 4 as an inline heredoc alongside `/w4w` and `/concise` (no network dependency); self-test asserts SKILL.md landed. Listed across `README.md`, `CHEATSHEET.md`, `README-SECTIONS/cheat-sheet.md`, `install.sh` + `update.sh` summaries, the Step 4 self-test + summary, and the `uninstall.sh` Step 4 removal loop.
+- **`/recon` skill** (step 7) — pre-build prior-art reconnaissance. On build-intent ("build / make / start a new X", "does X exist?") it offers a one-line prompt first (never auto-runs — Nate sometimes clones a known paid tool on purpose), then sweeps GitHub via the `gh` CLI + the web for existing free and paid options, ranks the top ~10 in a comparison table, finds the edge (or honestly calls it a red ocean), and ends with a GREEN/YELLOW/RED verdict. Output is a discussion, not code. Vendored at `recon-skill/` (single SKILL.md). Installed by Step 7 alongside `/gitfix` (depends on the `gh` CLI Step 7 already installs); no PAT needed. Step 7 installer downloads from `fidgetcoding/cli-maxxing/main` via curl with a local fallback, the non-interactive path installs it too, and the self-test asserts SKILL.md landed. Listed across `README.md`, `CHEATSHEET.md`, `README-SECTIONS/cheat-sheet.md`, `install.sh` + `update.sh` summaries, `step-final` self-test, and the `uninstall.sh` Step 7 removal.
+- **`/concise` skill** (step 4) — default chat-shape filter. No fluff, no scaffolding, no headers on simple questions, no sycophancy. Auto-suspends for copywriting deliverables (tweets, scripts, decks, client docs) so it doesn't sand down voice on output going to a human audience. Vendored at `concise-skill/` (SKILL.md + 3 references — `copywriting.md`, `inputs.md`, `code-and-commits.md`). Step 4 installer downloads from `lorecraft-io/cli-maxxing/main` via curl with a local fallback for offline / pre-publish runs. Self-test asserts SKILL.md + copywriting.md reference landed. Listed across `README.md`, `CHEATSHEET.md`, `install.sh` summary, `update.sh` summary, and `uninstall.sh` skill removal loop.
+- `pdf-skill` — markdown→PDF renderer enforcing Nate's house style (single H1 from frontmatter `title:`, strips body H1 / Purpose / Internal notes / Sources sections by default). Pandoc + WeasyPrint. Opt back in to dropped sections via `--keep-notes` / `--keep-sources`. Mirror of the global `~/.claude/skills/pdf/` skill.
 - README: social-links badge strip (X · LinkedIn · YouTube · Instagram, ruvnet-style for-the-badge) inserted into the centered header block beneath the banner.
 - **`cbrain` + `cbraintg` shell shortcuts** (step 10.9) — quick-launch aliases for the Brain² + Telegram-bridged sessions.
 - Step 5 — full upstream URL verification across all five external MCPs (morgen / motion / playwright / granola / n8n).
@@ -21,6 +25,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Step 5 — `2ndbrain-maxxing` references flipped to `2ndBrain-mogging` across `README-SECTIONS/` and `tests/`.
 
 ### Fixed
+- `uninstall.sh` — `strip_line` / `strip_block` now escape `/` before interpolating patterns into the sed address. Path-bearing patterns (the brew `shellenv` evals, the `$HOME/.local/bin` PATH export) broke the address, failed silently under `|| true`, and left the lines behind while the uninstaller reported success — after a Homebrew uninstall that meant every new shell ran a dangling `eval "$(/opt/homebrew/bin/brew shellenv)"`. Verified against an rc-file fixture: all suite-written lines removed, user lines untouched.
+- Status line (`templates/statusline.sh` + the step-final embedded copy, kept byte-identical) — added a `command -v jq` guard (minimal fallback line instead of error spray when jq is absent) and hardened the stdin parse: malformed/empty JSON now degrades to `Claude • ⏱ 0s • 0% ctx` with zero stderr instead of an arithmetic syntax error on empty `total_duration_ms`. `rate_limits.*.used_percentage` missing-field handling verified under stock macOS bash 3.2.
+- Step 4 — the fidgetflo verify chain no longer prints a false `success "fidgetflo CLI installed"` when neither the global binary nor `npx` can run it (now a warn with a check hint); the direct-config fallback uses a structural `jq -e '.mcpServers.fidgetflo'` check instead of a substring grep that could false-skip registration.
+- Step final — settings.json statusLine merge and project-override `del(.statusLine)` now check jq's exit status: on invalid JSON the temp file is cleaned up and a manual-add warning is printed instead of a false success.
+- Step 2 (`step-2/ghostty-install.sh`) — JetBrains Mono download pinned to the `v2.304` release tag; the old `releases/latest/download/JetBrainsMono-2.304.zip` URL 404s the moment JetBrains ships a newer release.
+- Step 6 — Telegram bot token file is written inside a `umask 077` subshell so it is born `0600` (no permissive-umask window before the chmod).
+- Step 7 — corrected the comment that claimed the GitHub PAT is "never in `ps` output" (it is briefly visible in the local process list while `claude mcp add` runs; behavior unchanged, comment now truthful).
+- README — uninstall "what gets removed" list no longer claims ffmpeg (creativity-maxxing installs and removes it; ten lines up the same section already said so).
 - Step 2 (`step-2/ghostty-install.sh`): post-install summary now includes a yellow "ONE MORE STEP — GRANT FULL DISK ACCESS" section with click-by-click instructions (System Settings → Privacy & Security → Full Disk Access → toggle Ghostty ON, with the `+` → `/Applications` fallback if Ghostty isn't listed). New `--open-fda` flag jumps directly to the right pane via the canonical `x-apple.systempreferences:...?Privacy_AllFiles` URL. Closes item 1 of the WAGMI Apr-22 install-call bug catalog (`project_wagmi_install_bugs_2026_04_22.md`) — every WAGMI teammate hit silent FDA-permission errors on first launch.
 - Step 1-5 — anchored MCP grep patterns at `^<name>:` so substring matches don't trigger false-positive "already installed" detection.
 - Step 5 — BSD grep compat fix in Motion detection (macOS `grep` doesn't support `-P` like GNU does; pattern simplified accordingly).