v0.121.0

Every Claude seat launches under its own CLAUDE_CONFIG_DIR rendered by
maestro install: its own settings, skill allowlist and deny list, one
claude setup-token token handed to maestro install --seat-token, and no
sight of the owner's ~/.claude. Proven live on a lab team; the seat profile
keys that reach env, hooks or the filesystem are owner-only.

Every Claude seat now launches under its own CLAUDE_CONFIG_DIR rendered by
maestro install, with its own settings, skill allowlist and deny list, the
way seatworks-starter isolates its seats; auth is one claude setup-token
token handed to maestro install --seat-token.

Added

• Seat config dirs (d845, d849, w677): maestro install renders
  ~/.maestro/claude/<seat>/ for lead, peer and team-supervisor, each
  with agents/ (the seat's Claude render; every peer-<name> render in the
  peer dir), settings.json (the Maestro base merged with the profile's
  settings: overlay, 0600, the Herdr SessionStart hook carried from the
  user settings, no cleanupPeriodDays), skills/ symlinks, projects and
  plugins symlinks to ~/.claude, and a .claude.json written once. Bare
  node and council profiles keep rendering into ~/.claude/agents for the
  subagent executor. team start and work add --to create a Claude seat
  pane with CLAUDE_CONFIG_DIR=<dir> through tab.create env, close and
  recreate a matching-label tab found at a shell prompt, and leave Codex
  panes unchanged (d850). maestro uninstall removes ~/.maestro/claude/.
• maestro install --seat-token (d846): reads one claude setup-token token
  from stdin, stores it at ~/.maestro/claude/oauth-token (0600) and renders
  it into every seat settings env as CLAUDE_CODE_OAUTH_TOKEN; the token
  never appears in install output. Without it install warns, maestro doctor
  reports seat token: missing, and team start or work add --to refuse
  SEAT_TOKEN_MISSING for a Claude seat before any pane opens.
• Profile keys skills: (d848) and settings: (d849): a seat dir's skills/
  is the union of skills: across every profile rendered into it, resolved
  in ~/maestro/skills then ~/.claude/skills, an unknown name refused
  naming the profile; settings: is a Claude seat overlay where null
  removes a key. Shipped defaults: lead maestro-work, maestro-design, maestro-council, maestro-graph, maestro-explore, maestro-diagnose; peer
  maestro-work, maestro-explore, maestro-diagnose, maestro-verify;
  team-supervisor maestro-work.

Changed

• Seat deny lists (d847): the shipped seats disallow Agent, Task,
  Workflow, SlashCommand, WebSearch, TodoWrite, EnterPlanMode,
  ExitPlanMode, AskUserQuestion, Bash(claude:*) and
  Bash(npx claude:*); the Lead adds LSP; the Peer adds Bash(herdr:*).
  Every composed peer-<name> render carries the Peer list as well (d851).
• Peer hand prompts (d847): the shipped SLP.md shared contract, the shipped
  peer.md and the slp recipe no longer tell a Peer to prompt other panes
  by hand; a Peer reaches the Lead and other Peers through recorded work
  notes and returns, which Maestro pushes for it. The Lead and the Team
  Supervisor keep the hand-typed ask.

Fixed

• A seat no longer loads the owner's ~/.claude/CLAUDE.md (d852): the home
  directory is an ancestor of every project under it, so that file matched
  the project-scope pattern and loaded regardless of CLAUDE_CONFIG_DIR,
  raising the external-imports dialog for its @ imports. The seat settings
  base now carries claudeMdExcludes for <home>/.claude/CLAUDE.md and
  <home>/.claude/rules/** as absolute paths.
• A fresh seat no longer blocks on the workspace trust dialog (d853): before
  a Claude seat pane opens, team start and work add --to record the
  project as trusted (projects[<project>].hasTrustDialogAccepted) in that
  seat's .claude.json when it is not already there, keeping every other key
  and seeding nothing else; a Codex seat is unchanged.
• A Claude seat keeps its Bash tool (d854): Claude Code treats a Bash(...)
  pattern in agent-frontmatter disallowedTools as removing the whole tool,
  so the live Lead had no Bash at all. maestro install now renders every
  Bash(...) entry of a seat's disallowed_tools into that seat's
  settings.json permissions.deny (the union across the profiles rendered
  into the dir, unioned with any settings: overlay deny) and keeps only
  bare tool names on the agent line; the Codex render is unchanged.
• Seat profile keys that reach env, hooks or the filesystem are owner-only
  (d855): a <project>/.maestro/profiles profile with settings: or
  skills: fails install naming the file and the owner dirs; a skill name
  must be a plain directory name and its resolved target must stay under
  ~/maestro/skills or ~/.claude/skills; the shipped seat Bash(...)
  patterns are a floor a shadow can widen but never narrow.
• Seat secret files are private from creation (d855): the token file, every
  seat settings.json and .claude.json are written 0600 and the seat dirs
  made 0700 whatever the umask, a pre-existing seat .claude.json is
  brought to 0600 on install, the trust seed lands through a 0600 temp file
  renamed over .claude.json, and an unknown-flag error such as a mistyped
  --seat-token=<value> no longer echoes the value.
• maestro install --seat-token <token> (the space form) no longer echoes the
  token (d855): a positional that follows a flag taking no value fails
  UNKNOWN_ARGUMENT naming the flag and the help command instead of the
  value, in both the message and the error fields.