Permission rules live in ~/.forge-osh/permissions.json and use wildcard patterns such as bash(git *) or edit_file(/src/*).
Deny rules are checked first, allow rules second, then the user is prompted when no rule matches.
ReadOnly tools never prompt, and trust mode bypasses prompts.
Hooks are configured in ~/.forge-osh/hooks.json and can run before tools, after tools, at stop events, notifications, prompt submission, session start/end, and pre-compaction.
Hook commands receive TOOL_NAME, TOOL_INPUT, TOOL_OUTPUT, and IS_ERROR environment variables where relevant.
CLAUDE.md memory files are loaded from project scope, user scope, Claude-compatible directories, and parent directories.
Sessions auto-save to ~/.local/share/forge-osh/sessions/ with provider, model, message history, timestamps, and token usage.
Context compaction replaces older messages with dense summaries that preserve files touched, decisions, task state, errors, IDs, branch names, and next steps.
Every write_file, edit_file, create_file, and delete_file call snapshots the previous state so /undo can restore or delete the affected file.