claudecode-omc 5.6.7 → 5.9.1

package/bundled/upstream/oh-my-claudecode/skills/ultrawork/SKILL.md

@@ -125,6 +125,13 @@ Why bad: Opus is expensive overkill for a trivial fix. Use executor with Haiku i
 - [ ] No new errors introduced
 </Final_Checklist>
 
+## Parallel session caveats
+
+- **Multi-repo workspace anchor:** drop a `.omc-workspace` marker at the parent directory so multiple sessions across sub-repos share one `.omc/`. Resolution order: `OMC_STATE_DIR > .omc-workspace > git > cwd`. See `docs/REFERENCE.md`.
+- **Session id source:** OMC_SESSION_ID env var wins in CLI contexts; hook payload data.session_id wins in hook contexts.
+- **Plan id (when applicable):** Ultrawork has no persistent state; two concurrent runs are independent by design. No plan-id needed.
+- **Parallel verdict:** supported (stateless component)
+
 <Advanced>
 ## Relationship to Other Modes
 

package/bundled/upstream/superpowers/.omc-source/bundle.json

@@ -1,8 +1,9 @@
 {
-  "syncedAt": "2026-05-15T05:55:34.311Z",
+  "syncedAt": "2026-06-05T07:53:35.433Z",
   "sourceName": "superpowers",
   "remote": "https://github.com/obra/superpowers.git",
   "ref": "main",
+  "commit": "6fd4507659784c351abbd2bc264c7162cfd386dc",
   "kind": "content-repo",
   "harnesses": [
     "claude"

package/bundled/upstream/superpowers/.omc-source/provenance.json

@@ -0,0 +1,63 @@
+{
+  "syncedAt": "2026-06-05T07:53:35.433Z",
+  "sourceName": "superpowers",
+  "remote": "https://github.com/obra/superpowers.git",
+  "ref": "main",
+  "commit": "6fd4507659784c351abbd2bc264c7162cfd386dc",
+  "artifacts": {
+    "skills": {
+      "brainstorming/scripts/frame-template.html": "sha256:fb22ba9d47f3b83b",
+      "brainstorming/scripts/helper.js": "sha256:e763d82f32b4ebb3",
+      "brainstorming/scripts/server.cjs": "sha256:ea81185f581897c6",
+      "brainstorming/scripts/start-server.sh": "sha256:3442a54b5ee55116",
+      "brainstorming/scripts/stop-server.sh": "sha256:f65b7634a27343ea",
+      "brainstorming/SKILL.md": "sha256:bba47904a7f6bbee",
+      "brainstorming/spec-document-reviewer-prompt.md": "sha256:12cb5ed58aef41b8",
+      "brainstorming/visual-companion.md": "sha256:a2bc6fc47d0df1df",
+      "dispatching-parallel-agents/SKILL.md": "sha256:76806091c7f923ba",
+      "executing-plans/SKILL.md": "sha256:e2102f1163143393",
+      "finishing-a-development-branch/SKILL.md": "sha256:5c8d4b59aedb14c9",
+      "receiving-code-review/SKILL.md": "sha256:c9382e92b8f32363",
+      "requesting-code-review/code-reviewer.md": "sha256:595d91d05d5ecba5",
+      "requesting-code-review/SKILL.md": "sha256:5a3a44a3667800e2",
+      "subagent-driven-development/code-quality-reviewer-prompt.md": "sha256:2eeb3bf63fccfbee",
+      "subagent-driven-development/implementer-prompt.md": "sha256:a416193f881e5a71",
+      "subagent-driven-development/SKILL.md": "sha256:905a2b9be59b734d",
+      "subagent-driven-development/spec-reviewer-prompt.md": "sha256:631980e472eec539",
+      "systematic-debugging/condition-based-waiting-example.ts": "sha256:40ae5ebe497fdf31",
+      "systematic-debugging/condition-based-waiting.md": "sha256:e89fec8400d6cd50",
+      "systematic-debugging/CREATION-LOG.md": "sha256:c24733a5b1821bd6",
+      "systematic-debugging/defense-in-depth.md": "sha256:1e175fb86fc357e5",
+      "systematic-debugging/find-polluter.sh": "sha256:6462747eae9b175a",
+      "systematic-debugging/root-cause-tracing.md": "sha256:6b0622269e098ca1",
+      "systematic-debugging/SKILL.md": "sha256:4999cb851360485e",
+      "systematic-debugging/test-academic.md": "sha256:fe2ba480d78ac0d6",
+      "systematic-debugging/test-pressure-1.md": "sha256:0b6a915db0054577",
+      "systematic-debugging/test-pressure-2.md": "sha256:b2030aeffba07050",
+      "systematic-debugging/test-pressure-3.md": "sha256:96b50a52e2c7989c",
+      "test-driven-development/SKILL.md": "sha256:7dee67b4af6bdccc",
+      "test-driven-development/testing-anti-patterns.md": "sha256:bde453bc258f0654",
+      "using-git-worktrees/SKILL.md": "sha256:085a45ee3de432bd",
+      "using-superpowers/references/codex-tools.md": "sha256:37e06103a352516d",
+      "using-superpowers/references/copilot-tools.md": "sha256:9fb400a432d31494",
+      "using-superpowers/references/gemini-tools.md": "sha256:a66092fb2dd2c69b",
+      "using-superpowers/SKILL.md": "sha256:316e29381219adf0",
+      "verification-before-completion/SKILL.md": "sha256:ea52d15aabaf72bc",
+      "writing-plans/plan-document-reviewer-prompt.md": "sha256:6fce2aa83c637156",
+      "writing-plans/SKILL.md": "sha256:4fd4627d2c023678",
+      "writing-skills/anthropic-best-practices.md": "sha256:20914c2fda31670c",
+      "writing-skills/examples/CLAUDE_MD_TESTING.md": "sha256:0b379a3415e185d3",
+      "writing-skills/graphviz-conventions.dot": "sha256:e2890a593c91370e",
+      "writing-skills/persuasion-principles.md": "sha256:c3c84f572a51dd8b",
+      "writing-skills/render-graphs.js": "sha256:ccda971a87bb185f",
+      "writing-skills/SKILL.md": "sha256:38ba648975ae6ba5",
+      "writing-skills/testing-skills-with-subagents.md": "sha256:c711346852c911b2"
+    },
+    "hooks": {
+      "hooks-cursor.json": "sha256:53d8ceb3ff5d8bb1",
+      "hooks.json": "sha256:01616c57b96cc234",
+      "run-hook.cmd": "sha256:d3d9c6199678dab2",
+      "session-start": "sha256:4dff45d935243af2"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudecode-omc",
-  "version": "5.6.7",
+  "version": "5.9.1",
   "description": "Claude Code harness — best-practice skills, agents, hooks, and configs from multiple sources",
   "bin": {
     "omc-manage": "bin/omc-manage.js"
@@ -9,6 +9,7 @@
     "bin",
     "src",
     ".local",
+    ".omc-curation",
     "bundled",
     "scripts",
     "templates",

package/src/catalog/source-catalog.js

@@ -162,7 +162,8 @@ function listManifestFiles(sourceName, sourceConfig, root) {
   });
 }
 
-async function buildSourceCatalog(sourceName, root = getProjectRoot()) {
+async function buildSourceCatalog(sourceName, root = getProjectRoot(), options = {}) {
+  const { ignoreAllowlist = false } = options;
   const config = readConfig();
   const sourceConfig = config.sources[sourceName];
   if (!sourceConfig) {
@@ -177,9 +178,14 @@ async function buildSourceCatalog(sourceName, root = getProjectRoot()) {
     const artifactPath = getSourceArtifactDir(sourceName, artifactType, root);
     const present = fs.existsSync(artifactPath);
     const loader = getArtifactLoader(artifactType);
-    const loadedItems = (present && loader)
-      ? filterItemsByAllowlist(sourceConfig, artifactType, loader(artifactPath, sourceName))
-      : [];
+    // When re-curating (plan apply with a selection file), ignore the current
+    // allowlist so itemNames exposes the full available universe — otherwise the
+    // catalog pre-filters to already-allowed names and new selections can never
+    // be validated/added (chicken-and-egg).
+    const rawItems = (present && loader) ? loader(artifactPath, sourceName) : [];
+    const loadedItems = ignoreAllowlist
+      ? rawItems
+      : filterItemsByAllowlist(sourceConfig, artifactType, rawItems);
     upsertSurface(surfaces, {
       name: artifactType,
       harness: 'claude',

package/src/cli/index.js

@@ -20,6 +20,9 @@ function showHelp() {
   console.log('            Install merged artifacts (skills, agents, hooks, commands, etc.)');
   console.log('  doctor    Health checks for all artifact types');
   console.log('  source    list|add|remove|sync|status — manage sources');
+  console.log('            sync [<name>] [--frozen] — update sources (--frozen: to locked commits)');
+  console.log('            lock [<name>] — pin sources to their synced commit');
+  console.log('            drift [<name>] [--json] — detect edits vs recorded provenance');
   console.log('            inspect <name> — inspect source bundle/catalog');
   console.log('  plan      install <source> [--profile <name>] — build install plan');
   console.log('            apply <source> [--profile <name>] — materialize plan into source activation');
@@ -103,6 +106,7 @@ async function main(argv) {
     else if (arg === '--profile' && args[i + 1]) flags.profile = args[++i];
     else if (arg.startsWith('--profile=')) flags.profile = arg.split('=')[1];
     else if (arg === '--json') flags.json = true;
+    else if (arg === '--frozen') flags.frozen = true;
     else if (arg === '--apply') flags.apply = true;
     else if (arg === '--threshold' && args[i + 1]) flags.threshold = args[++i];
     else if (arg.startsWith('--threshold=')) flags.threshold = arg.split('=')[1];

package/src/cli/plan.js

@@ -135,9 +135,21 @@ async function plan(args, flags = {}) {
 
       const root = getProjectRoot();
       const profile = flags.profile || 'claude-runtime';
-      const catalog = await buildSourceCatalog(sourceName, root);
+      // Resolve the curation source of truth: an explicit --selection-file wins,
+      // otherwise auto-discover the in-repo .omc-curation/<source>-selection.json
+      // so `plan apply <source>` applies the committed curation with no flags.
+      let selectionFile = flags.selectionFile;
+      if (!selectionFile) {
+        const defaultSelection = path.join(root, '.omc-curation', `${sourceName}-selection.json`);
+        if (fs.existsSync(defaultSelection)) {
+          selectionFile = defaultSelection;
+          console.log(`Using curation: ${path.relative(root, defaultSelection)}`);
+        }
+      }
+      // Re-curating: load the full available universe so new selections validate.
+      const catalog = await buildSourceCatalog(sourceName, root, { ignoreAllowlist: Boolean(selectionFile) });
       const planResult = buildInstallPlan(catalog, profile);
-      const selectionData = flags.selectionFile ? await readSelectionFile(flags.selectionFile) : {};
+      const selectionData = selectionFile ? await readSelectionFile(selectionFile) : {};
       const allowlist = extractAllowlistFromSelection(planResult, selectionData);
       const currentSource = readConfig().sources[sourceName] || {};
       const activation = {

package/src/cli/setup.js

@@ -4,13 +4,14 @@ const fsp = require('fs/promises');
 const path = require('path');
 const os = require('os');
 const { getProjectRoot, getScopedInstallTarget, getMergeConfigPath } = require('../config/paths');
-const { readConfig, filterItemsByAllowlist } = require('../config/sources');
+const { readConfig, filterItemsByAllowlist, loadGovernance } = require('../config/sources');
 const { getArtifactTypeNames, ARTIFACT_TYPES } = require('../config/artifact-types');
 const { detectConflicts, resolveConflicts, applyResolutions } = require('../merge/base-merger');
 const { loadHooksConfig, mergeHooksConfigs, hasHookLib } = require('../merge/hook-merger');
 const { loadClaudeMd, mergeIntoExisting, assembleSections } = require('../merge/claude-md-merger');
 const { loadSettingsFragment, mergeSettingsFragments } = require('../merge/settings-merger');
 const { collectSourceDirsForType, getArtifactLoader } = require('../merge/artifact-source-loader');
+const { applyContentPatch } = require('../merge/content-patch');
 
 const OMC_VERSION_PATH = path.join(os.homedir(), '.claude', '.omc-version.json');
 const OMC_CONFIG_PATH = path.join(os.homedir(), '.claude', '.omc-config.json');
@@ -231,11 +232,12 @@ async function installNameBasedArtifacts(artifactType, sources, mergeConfig, ins
   const excludeList = (mergeConfig.exclude && mergeConfig.exclude[artifactType]) || [];
   if (excludeList.length > 0) {
     const excludeSet = new Set(excludeList);
-    const before = merged.length;
+    // Names actually present and removed — so the count and the listed names
+    // always agree (exclude entries absent from the catalog aren't reported).
+    const removedNames = merged.filter(item => excludeSet.has(item.name)).map(item => item.name);
     merged = merged.filter(item => !excludeSet.has(item.name));
-    const excluded = before - merged.length;
-    if (excluded > 0) {
-      console.log(`    excluded ${excluded} items: ${excludeList.filter(n => merged.every(m => m.name !== n)).join(', ')}`);
+    if (removedNames.length > 0) {
+      console.log(`    excluded ${removedNames.length} items: ${removedNames.join(', ')}`);
     }
   }
 
@@ -256,19 +258,49 @@ async function installNameBasedArtifacts(artifactType, sources, mergeConfig, ins
 
   await fsp.mkdir(installTarget, { recursive: true });
   let fileCount = 0;
+  let patchedCount = 0;
+
+  // Content patches: governance.json sources.<name>.patches["<type>/<artifact>"]
+  // are applied to the winning artifact's content as it is written.
+  const govSources = loadGovernance().sources || {};
+  const patchFor = (item) => {
+    const patches = (govSources[item.sourceName] || {}).patches;
+    return patches ? patches[`${artifactType}/${item.name}`] : undefined;
+  };
 
   for (const item of merged) {
+    const dest = path.join(installTarget, getManagedPathForItem(artifactType, item));
+    const patch = patchFor(item);
+
+    // (dry-run already returned above; this loop only runs for real installs)
     if (artifactType === 'skills' || item.isDirectory) {
-      const dest = path.join(installTarget, getManagedPathForItem(artifactType, item));
       fileCount += await copyDirectory(item.path, dest, flags);
+      // A skill patch targets its entry file (SKILL.md) inside the copied dir.
+      if (patch) {
+        const skillFile = path.join(dest, 'SKILL.md');
+        if (fs.existsSync(skillFile)) {
+          const { content, warnings } = applyContentPatch(fs.readFileSync(skillFile, 'utf8'), patch);
+          await fsp.writeFile(skillFile, content, 'utf8');
+          patchedCount += 1;
+          for (const w of warnings) console.log(`    patch warn (${item.name}): ${w}`);
+        }
+      }
     } else {
-      const dest = path.join(installTarget, getManagedPathForItem(artifactType, item));
       await fsp.mkdir(path.dirname(dest), { recursive: true });
-      await fsp.copyFile(item.path, dest);
+      if (patch) {
+        const { content, warnings } = applyContentPatch(fs.readFileSync(item.path, 'utf8'), patch);
+        await fsp.writeFile(dest, content, 'utf8');
+        patchedCount += 1;
+        for (const w of warnings) console.log(`    patch warn (${item.name}): ${w}`);
+      } else {
+        await fsp.copyFile(item.path, dest);
+      }
       fileCount += 1;
     }
   }
 
+  if (patchedCount > 0) console.log(`    patched ${patchedCount} item(s) from governance`);
+
   return {
     count: fileCount,
     total: merged.length,
@@ -413,11 +445,18 @@ async function setup(args, flags = {}) {
   if (typeFilter) console.log(`Types: ${typeFilter.join(', ')}`);
   console.log('');
 
-  // Load merge config
-  const mergeConfigPath = getMergeConfigPath(root);
-  let mergeConfig = { preferences: {} };
-  if (fs.existsSync(mergeConfigPath)) {
-    try { mergeConfig = JSON.parse(fs.readFileSync(mergeConfigPath, 'utf8')); } catch {}
+  // Conflict policy: unified governance.json is authoritative; fall back to the
+  // legacy templates/merge-config.json when governance declares no conflict block.
+  const governanceConflict = loadGovernance().conflict;
+  let mergeConfig;
+  if (governanceConflict && typeof governanceConflict === 'object') {
+    mergeConfig = { preferences: {}, ...governanceConflict };
+  } else {
+    const mergeConfigPath = getMergeConfigPath(root);
+    mergeConfig = { preferences: {} };
+    if (fs.existsSync(mergeConfigPath)) {
+      try { mergeConfig = JSON.parse(fs.readFileSync(mergeConfigPath, 'utf8')); } catch {}
+    }
   }
 
   const allTypes = getArtifactTypeNames().filter(type => type !== 'claude-md');

package/src/cli/skill.js

@@ -192,7 +192,7 @@ async function recommend(args, flags) {
 
   // Load existing config
   const configPath = getMergeConfigPath(root);
-  let config = { merge_strategy: 'version-priority', auto_merge: true, allow_namespacing: false, sources: [], preferences: {} };
+  let config = { preferences: {} };
   if (fs.existsSync(configPath)) {
     try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
   }