## The shape of the change

    -export const MIN_CC_VERSION = '2.1.113';
    +export const MIN_CC_VERSION = '2.1.116';

    // cc-version-matrix.ts — 323 → 333 entries
    + agent_hooks_main_thread            2.1.116
    + sandbox_rm_dangerous_path_fix      2.1.116
    + reload_plugins_auto_deps           2.1.116
    + doctor_while_responding            2.1.116
    + config_search_option_values        2.1.116
    + slash_no_match_empty_state         2.1.116
    + bash_gh_rate_limit_hint            2.1.116
    + usage_tab_immediate                2.1.116
    + terminal_setup_scroll_tuning       2.1.116
    + resume_large_sessions_fast         2.1.116

## The one behavior change worth thinking about

### `agent_hooks_main_thread` — main-thread firing of agent hooks

Before 2.1.116: agent-scoped `hooks:` frontmatter fired only when the agent ran as a subagent via the `Task` tool.
After 2.1.116: they also fire when a user invokes the agent as their main thread via `claude --agent <name>`.

Every existing OrchestKit agent hook was written with subagent context in mind. The question the audit had to answer: is any one of them broken or net-negative when it fires on the main thread too?

## Agent hooks audit — all 14 unique hook commands

Hook | Category | Agents using it | Main-thread verdict
--- | --- | --- | ---
`dangerous-command-blocker` | pretool/bash | 20 agents | NET POSITIVE — tool-level deny/ask/allow, context-agnostic
`restrict-bash` | agent | 7 read-only agents | INTENTIONAL — read-only bash is the agent's design contract; main-thread should honor it
`block-writes` | agent | 4 agents | NET POSITIVE — Write tool block, same semantics in both contexts
`security-command-audit` | agent | 3 security agents | NET POSITIVE — logs only, uses `CLAUDE_AGENT_ID` for tagging
`ci-safety-check` | agent | `ci-cd-engineer` | NET POSITIVE
`deployment-safety-check` | agent | `deployment-manager` | NET POSITIVE
`migration-safety-check` | agent | `database-engineer` | NET POSITIVE
`git-validator` | pretool/bash | 3 agents | NET POSITIVE
`changelog-generator` | pretool/bash | `release-engineer` | NET POSITIVE
`ci-simulation` | pretool/bash | `ci-cd-engineer` | NET POSITIVE
`conflict-predictor` | pretool/bash | `git-operations-engineer` | NET POSITIVE
`pre-commit-simulation` | pretool/bash | `git-operations-engineer` | NET POSITIVE
`version-sync` | pretool/bash | `release-engineer` | NET POSITIVE
`merge-readiness-checker` | skill | `git-operations-engineer` | NET POSITIVE

14 / 14 safe. No code changes required. Users who run `claude --agent <ork-agent>` now get the same defensive rails that subagent invocations always got.

## Files touched

### `src/hooks/src/lib/cc-version-matrix.ts`

MIN_CC_VERSION bump + 10 new entries. 323 → 333.

### `src/hooks/src/__tests__/lib/cc-version-matrix.test.ts`

3 new boundary tests; missing-count assertions updated. 56/56 pass.

### `src/skills/configure/references/cc-version-settings.md`

New "CC 2.1.116 Settings" section covering sandbox hardening, `/reload-plugins` deps, agent hooks main-thread.

### `src/skills/doctor/references/version-compatibility.md`

Added 10 rows for 2.1.116, plus backfilled 10 rows for 2.1.113 and 1 for 2.1.114 that had been missing from the doc table.

### `CLAUDE.md`

Version line: `>= 2.1.113` → `>= 2.1.116`.

### `plugins/ork/**` + `src/hooks/dist/**` + `docs/site/lib/generated/**`

Auto-regenerated from `npm run build`. Expected as part of OrchestKit's source → plugins sync.

## What's explicitly NOT in this PR

- OrchestKit-side usage of new 2.1.116 capabilities. The matrix now knows about `reload_plugins_auto_deps`, `bash_gh_rate_limit_hint` etc., but no OrchestKit skill/hook actively uses them. Wiring them in is follow-up work.
- Active `gh` rate-limit backoff in `ork:commit` / `ork:create-pr`. 2.1.116 surfaces the hint in the transcript; an OrchestKit hook could read it.
- Active use of `/doctor` mid-turn. Our `ork:doctor` skill is distinct from CC's `/doctor`; no change here.

## Test plan

    $ npm run build                ✓  plugins/ assembled, 338 KB unified bundle
    $ npm run typecheck            ✓
    $ npx vitest run cc-version-matrix  56/56
    $ npm run test:skills          ✓  98 skills pass
    $ npm run test:agents          ✓  37 agents pass
    $ npm run test:security        13/13
    $ npm run test:manifests       ✓  106/106 delivered