odd-studio 3.4.2 → 3.5.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "odd-studio",
   "description": "Outcome-Driven Development — a planning and build harness for domain experts building serious software with AI. Installs the /odd skill, safety hooks, and project scaffolding into Claude Code.",
-  "version": "3.3.3",
+  "version": "3.5.1",
   "author": {
     "name": "ODD Studio"
   },

package/bin/odd-studio.js

@@ -15,7 +15,7 @@ import { registerUninstall } from './commands/uninstall.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const require = createRequire(import.meta.url);
-const pkg = require('../package.json'); // v3.4.2
+const pkg = require('../package.json'); // v3.5.1
 
 const PACKAGE_ROOT = path.resolve(__dirname, '..');
 const deps = { PACKAGE_ROOT, print };

package/codex-plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "odd-studio",
-  "version": "3.4.2",
+  "version": "3.5.1",
   "description": "Outcome-Driven Development planning and build harness for domain experts building serious software with AI.",
   "author": {
     "name": "ODD Studio"

package/hooks/odd-studio.sh

@@ -152,21 +152,34 @@ build-gate)
 # ─────────────────────────────────────────────────────────────────────────────
 # PreToolUse: Write|Edit — blocks source writes without active build session
 # ─────────────────────────────────────────────────────────────────────────────
+# Two-marker system:
+#   1. .odd/.odd-flow-swarm-active  — created by *build, 24h TTL (session marker)
+#   2. .odd/.odd-flow-agent-token    — created by Task agents before each write batch, 120s TTL
+#
+# The orchestrator (main conversation) can read files and coordinate, but CANNOT
+# write source code. Only Task agents can, and only after creating the agent token.
+# This prevents the LLM from bypassing swarm coordination by editing files directly.
 swarm-write)
   [ "$TOOL_NAME" = "Write" ] || [ "$TOOL_NAME" = "Edit" ] || exit 0
   [ "$CURRENT_PHASE" = "build" ] || exit 0
   is_source_file "$FILE_PATH" || exit 0
 
-  # Gate: Build session must be active (swarm marker with 24h TTL)
-  # Both the main orchestrator and Task agents can write source code
-  # when a build session is active. The swarm marker is refreshed when
-  # *build is invoked and during odd-flow coordination syncs.
+  # Gate 1: Build session must be active (swarm marker with 24h TTL)
   if ! marker_valid ".odd/.odd-flow-swarm-active" 86400; then
     echo "ODD STUDIO [swarm-write]: Source writes blocked — no active build session." >&2
     echo "Run *build to start a build session before writing source code." >&2
     echo "File blocked: $FILE_PATH" >&2
     exit 2
   fi
+
+  # Gate 2: Agent write token must be fresh (120s TTL)
+  # Only Task agents create this token — the orchestrator must NOT.
+  if ! marker_valid ".odd/.odd-flow-agent-token" 120; then
+    echo "ODD STUDIO [swarm-write]: Source writes blocked — no agent write token." >&2
+    echo "Only Task agents can write source code. The orchestrator must dispatch work, not write code directly." >&2
+    echo "File blocked: $FILE_PATH" >&2
+    exit 2
+  fi
   exit 0
   ;;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "odd-studio",
-  "version": "3.4.2",
+  "version": "3.5.1",
   "description": "Outcome-Driven Development for AI coding agents — a planning and build harness for domain experts building serious software with AI. Works with Claude Code, OpenCode, and Codex.",
   "keywords": [
     "claude-code",

package/plugins/plugin-gates.js

@@ -33,10 +33,10 @@ export function createBeforeHook(readState) {
 
     if ((toolName === 'Write' || toolName === 'Edit') && state.currentPhase === 'build' && isSourceCodePath(filePath)) {
       if (!markerValid(resolve(process.cwd(), '.odd', '.odd-flow-swarm-active'), 3600000)) {
-        return { blocked: true, message: `ODD SWARM WRITE GATE: Source writes blocked — swarm not initialised. File: ${filePath}` };
+        return { blocked: true, message: `ODD SWARM WRITE GATE: Source writes blocked — no active build session. Run *build first. File: ${filePath}` };
       }
       if (!markerValid(resolve(process.cwd(), '.odd', '.odd-flow-agent-token'), 120000)) {
-        return { blocked: true, message: `ODD SWARM WRITE GATE: Source writes blocked — no agent token. Task agents must create token before writing. File: ${filePath}` };
+        return { blocked: true, message: `ODD SWARM WRITE GATE: Source writes blocked — no agent write token. Only Task agents can write source code, not the orchestrator. Dispatch work to agents instead. File: ${filePath}` };
       }
     }
 

package/scripts/setup-hooks.js

@@ -6,6 +6,16 @@ import { ODD_HOOK_FILE as HOOK_FILE } from './assets.js';
 // All ODD Studio gates, grouped by event + matcher.
 // Each entry becomes one hooks[] item in settings.json pointing to:
 //   odd-studio.sh <gate-name>
+//
+// Two-marker system (swarm-write gate):
+//   1. .odd/.odd-flow-swarm-active  — created by *build, 24h TTL (session marker)
+//   2. .odd/.odd-flow-agent-token    — created by Task agents, 120s TTL (write token)
+//
+// The orchestrator (main conversation) can read files and coordinate,
+// but CANNOT write source code. Only Task agents can write source code,
+// and only after creating the agent token. This prevents the LLM from
+// bypassing swarm coordination by editing files directly from the main
+// conversation.
 const GATES = [
   // ── PreToolUse ──────────────────────────────────────────────────────────
   {

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: "odd"
-version: "3.4.2"
+version: "3.5.1"
 description: "Outcome-Driven Development planning and build coach. Use /odd to start or resume an ODD project — building personas, writing outcomes, mapping contracts, creating a Master Implementation Plan, and directing a odd-flow-powered build. Designed for domain experts who are not developers. Works with Claude Code, OpenCode, and Codex."
 metadata:
   priority: 10
@@ -96,7 +96,7 @@ Display this when no existing state is found:
 
 ---
 
-Welcome to ODD Studio v3.4.2.
+Welcome to ODD Studio v3.5.1.
 
 You are about to plan and build something real — using a methodology called Outcome-Driven Development. Before we write a single line of code, we are going to get precise about three things:
 
@@ -120,7 +120,7 @@ Display this when existing state is found. Replace the bracketed values with act
 
 ---
 
-Welcome back to ODD Studio v3.4.2.
+Welcome back to ODD Studio v3.5.1.
 
 **Project:** [project.name]
 **Current Phase:** [state.currentPhase]