diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 632dfa3..30081e8 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -9,7 +9,7 @@
       "name": "second-brain",
       "source": "./",
       "description": "Self-evolving AI second brain. Auto-learns from sessions, discovers tools, maintains a local knowledge base, and self-critiques code quality.",
-      "version": "0.34.1"
+      "version": "0.34.2"
     },
     {
       "name": "cost-router",
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index d2277de..4a9d2db 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "second-brain",
   "description": "Self-evolving AI second brain. Automatically learns from sessions, discovers tools, maintains a local knowledge base, and self-critiques code quality — getting smarter with every interaction.",
-  "version": "0.34.1",
+  "version": "0.34.2",
   "author": {
     "name": "second-brain"
   },
diff --git a/.claude/settings.json b/.claude/settings.json
index 3af9a01..93ec661 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -4,5 +4,13 @@
       "source": "local",
       "path": "."
     }
+  },
+  "permissions": {
+    "deny": [
+      "Bash(sudo *)",
+      "Bash(chmod 777 *)",
+      "Bash(rm -rf /*)",
+      "Bash(ssh *)"
+    ]
   }
 }
diff --git a/scripts/merge-persona-signals.sh b/scripts/merge-persona-signals.sh
index 015b451..70230e8 100755
--- a/scripts/merge-persona-signals.sh
+++ b/scripts/merge-persona-signals.sh
@@ -116,14 +116,17 @@ MERGED=$(echo "$MERGED" | jq -c \
 # duplicate USER.md pin.
 SCORED=$(echo "$MERGED" | jq -c '
   map(. + {score:
-    ((if .count >= 11 then 0.85
+    # The WHOLE value expression is parenthesized: an object value that is a bare
+    # pipeline (`{k: a | b / c}`) parses on newer jq but is a SYNTAX ERROR on the
+    # older jq CI ships — the object-value grammar there needs one enclosing group.
+    (((if .count >= 11 then 0.85
       elif .count >= 6 then 0.7
       elif .count >= 3 then 0.5
       else 0.3 end)
      - 0.02 * ((((now - ((((.last_seen // "") + "T00:00:00Z") | fromdateiso8601?) // now)) / 604800) | floor)
                | if . < 0 then 0 else . end))
     | (if . < 0.1 then 0.1 else . end)
-    | (. * 100 | round) / 100
+    | ((. * 100 | round) / 100))
   })
   | {keep:   map(select(.graduated == true or .score >= 0.2)),
      pruned: map(select(.graduated != true and .score < 0.2) | .signal)}