# M132 Group G — CC 2.1.133 perm + sandbox + settings

Second adoption PR for M132 (CC 2.1.133). 3 new-perm features + 1 breaking permission-rule fix. Stacked on Group F (#1747) which introduced the `## CC 2.1.133 Settings` parent header.

⚠ Behavior change for OrchestKit — CC 2.1.133 added `worktree.baseRef` with default `"fresh"`, which branches new worktrees from `origin/<default>` instead of local `HEAD`. OrchestKit's agent-isolation pattern needs unpushed commits visible to spawned agents. Set `worktree.baseRef: "head"` in `.claude/settings.json` or you will lose in-progress work when agents spawn.

## Issues closed

# | Slug | Category | What it does
--- | --- | --- | ---
1699 | worktree-base-ref-setting | new_perm | New `worktree.baseRef` setting — default `"fresh"` regresses 2.1.128–2.1.132 local-HEAD behavior. OrchestKit must set `"head"`.
1700 | sandbox-bwrap-socat-managed-settings | new_perm | New `sandbox.bwrapPath` / `sandbox.socatPath` managed settings for Linux/WSL custom binary locations.
1701 | parent-settings-behavior-admin-key | new_perm | New `parentSettingsBehavior` admin key (`first-wins`|`merge`) for SDK `managedSettings` precedence.
1704 | edit-write-drive-root-allow-rules-fix | breaking | `Edit`/`Write` allow rules at drive root (`C:\`) or POSIX `/` now match correctly instead of always prompting.

## Files touched

- `src/skills/configure/references/cc-version-settings.md` — 4 new subsections under existing `## CC 2.1.133 Settings` parent (Group F)
- `src/skills/chain-patterns/references/worktree-agent-pattern.md` — Required Setting callout + corrected branch-base prose
- `src/skills/doctor/references/remediation-guide.md` — "EnterWorktree drops my unpushed commits" entry
- `src/hooks/src/lib/cc-version-matrix.ts` — 4 new entries at `minVersion: '2.1.133'`

## Recommended setting

    {
      "worktree": {
        "baseRef": "head"
      }
    }

## Verification

    test:security    14/14 PASS
    test:agents      37/37 valid
    test:skills      PASSED
    test:manifests   108 skills, 0 orphans
    typecheck        clean
    build            107 skills / 37 agents / 188 hooks (no count drift)

## Stacking notes

This PR is stacked on Group F (#1747). When F squash-merges to main, rebase G onto main: `git rebase --onto main <F-tip-sha>` (per stacked-PR squash-rebase memory).