oh-my-copilot 4.13.1 → 4.13.21

package/docs/REFERENCE.md

@@ -12,7 +12,7 @@ Complete reference for oh-my-copilot. For quick start, see the main [README.md](
 - [CLI Commands: ask/team/session](#cli-commands-askteamsession)
 - [Legacy MCP Team Runtime Tools (Deprecated)](#legacy-mcp-team-runtime-tools-deprecated)
 - [Agents (29 Total)](#agents-29-total)
-- [Skills (35 Total)](#skills-35-total)
+- [Skills (36 Total)](#skills-36-total)
 - [Slash Commands](#slash-commands)
 - [Hooks System](#hooks-system)
 - [Magic Keywords](#magic-keywords)
@@ -520,9 +520,9 @@ Always use `oh-my-copilot:` prefix when calling via Task tool.
 
 ---
 
-## Skills (35 Total)
+## Skills (36 Total)
 
-Includes **34 canonical skills + 1 deprecated alias** (`psm`). Runtime truth comes from the builtin skill loader scanning `skills/*/SKILL.md` and expanding aliases declared in frontmatter.
+Includes **34 canonical skills + 2 deprecated aliases** (`learner`, `psm`). Runtime truth comes from the builtin skill loader scanning `skills/*/SKILL.md` and expanding aliases declared in frontmatter.
 
 | Skill                     | Description                                                      | Manual Command                              |
 | ------------------------- | ---------------------------------------------------------------- | ------------------------------------------- |
@@ -900,12 +900,29 @@ Configure HUD elements in `~/.claude/settings.json`:
 | `autopilot`  | Show autopilot status                                                                             | `true`  |
 | `showTokens` | Show transcript-derived token usage (`tok:i1.2k/o340`, plus `r...` reasoning and `s...` session total when reliable) | `false` |
 
-Additional `omcHud` layout options (top-level):
+Additional `omcHud` layout and label options (top-level):
 
 | Option     | Description                                                                       | Default    |
 | ---------- | --------------------------------------------------------------------------------- | ---------- |
 | `maxWidth` | Maximum HUD line width (terminal columns)                                         | unset      |
 | `wrapMode` | `truncate` (ellipsis) or `wrap` (break at `\|` boundaries) when `maxWidth` is set | `truncate` |
+| `locale`   | HUD label preset. Supported values: `en`, `zh-CN`                                 | `en`       |
+| `labels`   | Per-label HUD text overrides; supported keys only                                 | unset      |
+
+`locale` and `labels` affect only HUD labels. English remains the default, unsupported locale values and unknown label keys are ignored, and explicit `labels` override the locale preset. Supported label keys are `context`, `tokens`, `tool`, `agent`, `skill`, `ralph`, `background`, `thinking`, `staged`, `modified`, `untracked`, `ahead`, and `behind`.
+
+Example:
+
+```json
+{
+  "omcHud": {
+    "locale": "zh-CN",
+    "labels": {
+      "context": "CTX"
+    }
+  }
+}
+```
 
 Available presets: `minimal`, `focused`, `full`, `dense`, `analytics`, `opencode`
 

package/docs/TEAM-WORKTREE-MODE.md

@@ -0,0 +1,86 @@
+# Native Team Worktree Mode
+
+Native team worktree mode is the opt-in rollout path for running `omc team` workers in dedicated git worktrees while keeping one leader-owned team-specific coordination root. It is intended for runtime-v2 team sessions and is designed to make worker edits isolated without fragmenting task, mailbox, status, or manifest state.
+
+## Availability
+
+- The rollout is **opt-in / config-gated** for the first slice. Do not assume worktree mode is the default behavior.
+- The target runtime is `runtime-v2`. Legacy `runtime.ts` remains limited to read/status and cleanup compatibility unless a later plan explicitly expands it.
+- No new dependency is required; lifecycle operations use git worktrees plus the existing team CLI/API surfaces.
+
+## Workspace contract
+
+When worktree mode is active, OMC uses this stable layout:
+
+| Field | Contract |
+| --- | --- |
+| Worktree root | `<repo>/.omc/team/<team-name>/worktrees/<worker-name>` |
+| Team-specific coordination root | `<repo>/.omc/state/team/<team-name>` in the leader workspace |
+| Worker cwd | The worker's `worktree_path` |
+| Worker coordination | `OMC_TEAM_STATE_ROOT` points back to the team-specific leader-owned coordination root |
+| Worker instructions | Worktree-root `AGENTS.md` is installed with backup/restore safeguards |
+
+Workers must keep using `omc team api ...` lifecycle and mailbox operations against the team-specific coordination root. They must not create or mutate a separate local `.omc/state` inside their worker worktree when `OMC_TEAM_STATE_ROOT` is available; for worktree-backed workers it should point at `<repo>/.omc/state/team/<team-name>`.
+
+## Persisted fields
+
+Config, manifest, worker identity, and status surfaces should expose the same locked field set so resume/status/bootstrap paths can reason about worker location without inference:
+
+- `workspace_mode`
+- `worktree_mode`
+- `team_state_root`
+- `working_dir`
+- `worktree_repo_root`
+- `worktree_path`
+- `worktree_branch`
+- `worktree_detached`
+- `worktree_created`
+
+`workspace_mode` should be `worktree` for worktree-backed sessions and `single` for the existing shared-workspace behavior. `team_state_root` means the team-specific coordination root (`<repo>/.omc/state/team/<team-name>`); if a future feature needs the broader `.omc/state` base, use a separately named field such as `state_base_root`.
+
+## Safety rules
+
+- OMC must check the leader workspace before provisioning worktrees. If the leader repo is dirty, startup should refuse worktree provisioning rather than copying an unsafe base state.
+- Existing compatible clean worker worktrees may be reused.
+- Dirty worker worktrees must be preserved and surfaced as warnings/events. Cleanup must not force-remove dirty worker edits.
+- Branch/path mismatches should fail instead of reusing the wrong workspace.
+- Rollback may remove newly created clean worktrees and runtime-created branches when safe; reused worktrees are preserved.
+- `orphan-cleanup` is a destructive escape hatch that may delete worktree recovery metadata and root `AGENTS.md` backups. When that evidence exists, callers must pass `acknowledge_lost_worktree_recovery: true` only after manually preserving or intentionally discarding the affected worker worktrees/backups.
+
+## CLI and status expectations
+
+`omc team status <team-name> --json` should make the workspace contract observable. JSON consumers should be able to find `workspace_mode`, `worktree_mode`, `team_state_root`, and each worker's worktree metadata without reading private files directly.
+
+Human status output should also surface the mode and worktree path/branch details enough for users to understand where worker changes live and whether cleanup preserved a dirty worktree.
+
+## Verification checklist for changes
+
+Use the source PRD/test-spec checklist when modifying this area. At minimum, changes should cover:
+
+1. Worktree planning disabled/no-op and active path modes.
+2. Fresh, reused, dirty, and mismatched worktree lifecycle cases.
+3. Runtime-v2 startup/spawn state: worker cwd, env, config, manifest, and identity all agree.
+4. Bootstrap prompts and trigger paths use `$OMC_TEAM_STATE_ROOT` for worktree-backed workers.
+5. Scale-up workers inherit the same team-specific coordination root and worktree instruction strategy.
+6. Shutdown/cleanup removes safe clean worktrees, preserves dirty ones, and reports warnings.
+7. CLI help/status tests cover the opt-in rollout and locked status field set.
+
+Recommended focused commands:
+
+```bash
+npm test -- --run src/team/__tests__/git-worktree.test.ts
+npm test -- --run src/team/__tests__/worker-bootstrap.test.ts
+npm test -- --run src/team/__tests__/runtime-v2.dispatch.test.ts
+npm test -- --run src/team/__tests__/runtime-v2.shutdown.test.ts
+npm test -- --run src/team/__tests__/api-interop.dispatch.test.ts
+npm test -- --run src/team/__tests__/api-interop.cwd-resolution.test.ts
+npm test -- --run src/team/__tests__/scaling-launch-config.test.ts
+npm test -- --run src/cli/__tests__/team-runtime-boundary.test.ts
+npm run build
+```
+
+## Review notes
+
+- Keep the first slice narrow: runtime-v2 startup/spawn/dispatch/scale-up/resume/status/shutdown/cleanup plus legacy read/cleanup compatibility.
+- Do not reduce scope by omitting status visibility, dirty-worktree preservation, or team-specific coordination-root behavior; those are part of the locked contract.
+- Prefer explicit persisted fields over reconstructing worktree state from paths or branch names.

package/docs/company-context-interface.md

@@ -2,12 +2,6 @@
 
 OMC supports a narrow, prompt-level contract for vendor-owned company context.
 
-This contract is aimed at a specific failure mode from upstream issue #2692:
-purely prompt-directive company-context guidance is still missed in practice
-roughly 5% of the time. Making the lookup an explicit configured tool call
-materially reduces that miss mode at the spec layer without changing OMC
-runtime behavior.
-
 This is **not** a runtime enforcement feature. It gives OMC workflows:
 
 - a consistent tool shape,
@@ -52,8 +46,8 @@ OMC skill clauses should treat the returned markdown the same way `deep-dive` tr
 
 Configure the contract in the standard OMC config surface:
 
-- Project: `.copilot/omg.jsonc`
-- User: `~/.config/copilot-omg/config.jsonc`
+- Project: `.claude/omc.jsonc`
+- User: `~/.config/claude-omc/config.jsonc`
 
 Project config overrides user config.
 
@@ -98,23 +92,18 @@ Each skill should build a `query` that summarizes the current task, current stag
 
 The company-context server itself is still registered through the normal MCP surfaces:
 
-- Copilot CLI MCP configuration / `copilot mcp add ...`
+- Claude MCP configuration / `claude mcp add ...`
 - the unified MCP registry that OMC syncs to Codex
 
 This contract does not change how MCP servers are registered.
 
 For a tiny runnable reference implementation, see:
 
-- [`examples/vendor-mcp-server/README.md`](../examples/vendor-mcp-server/README.md)
+- [`examples/vendor-mcp-server/README.md`](/mnt/offloading/Workspace/oh-my-claudecode.omx-worktrees/issue-2692-company-context-mcp-interface/examples/vendor-mcp-server/README.md)
 
 ## Residual Risk
 
-This interface addresses the observed ~5% prompt-directive miss mode by making
-the company-context lookup explicit, but it still operates at the skill-prompt
-layer. The documented MUST-call clauses should meaningfully reduce that miss
-rate, yet they do **not** guarantee a 0% miss rate or mathematically perfect
-invocation. If you need deterministic invocation, that would require a separate
-runtime enforcement design.
+This interface makes the contract explicit and lowers prompt drift, but it still operates at the skill-prompt layer. If you need guaranteed invocation, that would require a separate runtime enforcement design.
 
 ## Non-Goals
 

package/docs/copilot-instructions.md

@@ -1,5 +1,5 @@
 <!-- OMC:START -->
-<!-- OMC:VERSION:4.13.1 -->
+<!-- OMC:VERSION:4.13.21 -->
 
 # oh-my-copilot - Intelligent Multi-Agent Orchestration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-copilot",
-  "version": "4.13.1",
+  "version": "4.13.21",
   "description": "Multi-agent orchestration system for Copilot CLI - Inspired by oh-my-opencode",
   "type": "module",
   "main": "dist/index.js",

package/scripts/keyword-detector.mjs

@@ -28,6 +28,7 @@ import { join, dirname } from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
 import { getClaudeConfigDir } from './lib/config-dir.mjs';
+import { atomicWriteFileSync } from './lib/atomic-write.mjs';
 import { readStdin } from './lib/stdin.mjs';
 
 // Resolve OMC package root: PLUGIN_ROOT (plugin system) or derive from this script's location
@@ -359,6 +360,119 @@ const QUESTION_FOLLOWUP_PATTERNS = [
   /\b(?:how\s+many|how\s+much|why|what\s+happened|what\s+went\s+wrong|token\s+budget|cost|pricing)\b/i,
   /(?:왜|얼마|몇\s*번|몇번|토큰|가격|비용|질문)/u,
 ];
+
+// Patterns that identify system-generated echoes (hook outputs) which can be
+// pasted back into the prompt verbatim. If a mode keyword only appears inside
+// such an echo block we MUST NOT re-activate the mode: otherwise a user who
+// copies a "[RALPH LOOP - ITERATION N] ..." block into a new session to debug
+// it will unintentionally re-trigger ralph, and the pasted text ends up as
+// the new state.prompt — producing a recursive self-reinforcing loop.
+// Continuation lines that hook output typically emits DIRECTLY after a
+// recognized block header. They must be stripped only in that context —
+// never standalone — because a user might legitimately start a prompt with
+// "Task: …" or similar (Codex automated review P1/P2 on #2795).
+const ECHO_CONTINUATION = '(?:\\r?\\n[ \\t]*(?:Task:\\s|When FULLY complete \\(after Architect verification\\)|run\\s+\\/oh-my-(?:claudecode|codex|copilot):cancel).*)*';
+
+// NOTE: each pattern is a SINGLE LOGICAL BLOCK: the block header line +
+// zero-or-more continuation lines that hooks emit right after it. The whole
+// match is stripped together. Both `i` (case-insensitive against the
+// lower-cased cleanPrompt upstream) and `m` (so `^`/`$` match line
+// boundaries) are required.
+function buildEchoBlockRegex(headerBody) {
+  return new RegExp(`^[ \\t]*${headerBody}.*${ECHO_CONTINUATION}$`, 'gim');
+}
+
+const SYSTEM_ECHO_BLOCK_PATTERNS = [
+  // persistent-mode.mjs block headers
+  buildEchoBlockRegex('\\[RALPH LOOP\\s*-\\s*ITERATION[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[RALPH LOOP\\s*-\\s*(?:HARD LIMIT|EXTENDED)\\]'),
+  buildEchoBlockRegex('\\[TEAM\\s*-\\s*Phase:[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[AUTOPILOT[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[ULTRAPILOT[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[ULTRAWORK[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[ULTRAQA[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[PIPELINE[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[SWARM[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[TOOL ERROR[^\\]\\n]*\\]'),
+  // keyword-detector.mjs block headers
+  buildEchoBlockRegex('\\[MAGIC KEYWORD:[^\\]\\n]*\\]'),
+  buildEchoBlockRegex('\\[MAGIC KEYWORDS DETECTED:[^\\]\\n]*\\]'),
+  // Stop-hook wrapping by the Claude Code harness
+  buildEchoBlockRegex('Stop hook (?:blocking error|feedback|stopped continuation)'),
+  buildEchoBlockRegex('PreToolUse:[^\\n]*hook additional context:'),
+  buildEchoBlockRegex('PostToolUse:[^\\n]*hook additional context:'),
+];
+
+// Signature lines indicating the text is predominantly a system echo. Even
+// when the block patterns above fail to delimit cleanly (e.g. truncation),
+// presence of these sentinels should make us treat the prompt as an echo.
+// All patterns use `i` because hasActionableKeyword sees a lowercased prompt.
+const SYSTEM_ECHO_SIGNATURES = [
+  /\bWhen FULLY complete \(after Architect verification\)\b/i,
+  /\brun\s+\/oh-my-(?:claudecode|codex|copilot):cancel\b/i,
+  /\[RALPH LOOP\s*-\s*ITERATION\b/i,
+];
+
+const MAX_STATE_PROMPT_LEN = 500;
+
+function stripSystemEchoes(text) {
+  if (typeof text !== 'string' || text.length === 0) return '';
+  let cleaned = text;
+  for (const pattern of SYSTEM_ECHO_BLOCK_PATTERNS) {
+    cleaned = cleaned.replace(pattern, ' ');
+  }
+  return cleaned;
+}
+
+function looksLikeSystemEcho(text) {
+  if (typeof text !== 'string' || text.length === 0) return false;
+  if (SYSTEM_ECHO_SIGNATURES.some((pattern) => pattern.test(text))) return true;
+  // Also treat the presence of ANY echo block pattern as an echo, so that
+  // mode-specific paste blocks (AUTOPILOT, ULTRAWORK, TEAM, etc.) are
+  // recognized without needing a dedicated signature line.
+  for (const pattern of SYSTEM_ECHO_BLOCK_PATTERNS) {
+    const probe = new RegExp(pattern.source, pattern.flags.replace('g', ''));
+    if (probe.test(text)) return true;
+  }
+  return false;
+}
+
+/**
+ * Sanitize a prompt before persisting it to a *-state.json file.
+ * Returning the raw prompt risks storing large system echoes or pasted
+ * hook output, which persistent-mode.mjs would then blast back into the
+ * next Stop-hook block reason on every iteration.
+ *
+ * Strategy:
+ * 1. Strip echoes first. If non-empty content remains AND that remainder no
+ *    longer looks like an echo, keep it (preserves the real user request in
+ *    an "echo + blank line + real request" paste).
+ * 2. Otherwise, if the raw prompt looks like a pure echo, substitute the
+ *    placeholder sentinel.
+ * 3. Finally, hard-truncate to MAX_STATE_PROMPT_LEN chars.
+ */
+function sanitizePromptForState(prompt) {
+  if (typeof prompt !== 'string') return '';
+  const trimmed = prompt.trim();
+  if (!trimmed) return '';
+
+  const stripped = stripSystemEchoes(trimmed).trim();
+  if (stripped.length > 0 && !looksLikeSystemEcho(stripped)) {
+    return stripped.length > MAX_STATE_PROMPT_LEN
+      ? `${stripped.slice(0, MAX_STATE_PROMPT_LEN - 3)}...`
+      : stripped;
+  }
+
+  if (looksLikeSystemEcho(trimmed)) {
+    return '(prompt omitted: pasted system echo)';
+  }
+
+  // Fallback (stripping left nothing but original isn't recognizably an echo)
+  const base = stripped.length > 0 ? stripped : trimmed;
+  return base.length > MAX_STATE_PROMPT_LEN
+    ? `${base.slice(0, MAX_STATE_PROMPT_LEN - 3)}...`
+    : base;
+}
 const MODE_REFERENCE_PATTERN =
   /\b(?:ralph|autopilot|auto[\s-]?pilot|ultrawork|ulw|ralplan|ultrathink|deepsearch|deep[\s-]?analyze|deepanalyze|deep[\s-]interview|ouroboros|ccg|claude-codex-gemini|deerflow)\b/gi;
 
@@ -473,15 +587,25 @@ function isInformationalKeywordContext(text, position, keywordLength, keywordTex
 }
 
 function hasActionableKeyword(text, pattern) {
+  // Strip system-generated echo blocks (persistent-mode/keyword-detector
+  // outputs, Stop-hook wrappers) BEFORE searching for keywords. Otherwise
+  // pasting a previous "[RALPH LOOP - ITERATION N] ..." block into a prompt
+  // would re-activate ralph mode and the echo itself would be saved as
+  // state.prompt, which persistent-mode.mjs then blasts back on every
+  // iteration — a self-reinforcing loop that is hard to cancel.
+  const searchText = looksLikeSystemEcho(text)
+    ? stripSystemEchoes(text)
+    : text;
+
   const flags = pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`;
   const globalPattern = new RegExp(pattern.source, flags);
 
-  for (const match of text.matchAll(globalPattern)) {
+  for (const match of searchText.matchAll(globalPattern)) {
     if (match.index === undefined) {
       continue;
     }
 
-    if (isInformationalKeywordContext(text, match.index, match[0].length, match[0])) {
+    if (isInformationalKeywordContext(searchText, match.index, match[0].length, match[0])) {
       continue;
     }
 
@@ -508,19 +632,26 @@ function hasExplicitInvocationContext(text, position, keywordLength, keywordText
 }
 
 function hasActionableRalplanKeyword(text, pattern) {
+  // Same echo guard as hasActionableKeyword.
+  const searchText = looksLikeSystemEcho(text)
+    ? stripSystemEchoes(text)
+    : text;
+
   const flags = pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`;
   const globalPattern = new RegExp(pattern.source, flags);
 
-  for (const match of text.matchAll(globalPattern)) {
+  for (const match of searchText.matchAll(globalPattern)) {
     if (match.index === undefined) {
       continue;
     }
 
-    if (isInformationalKeywordContext(text, match.index, match[0].length, match[0])) {
+    // match.index is relative to searchText — use searchText for all
+    // downstream context lookups to keep indices aligned.
+    if (isInformationalKeywordContext(searchText, match.index, match[0].length, match[0])) {
       continue;
     }
 
-    if (!hasExplicitInvocationContext(text, match.index, match[0].length, match[0])) {
+    if (!hasExplicitInvocationContext(searchText, match.index, match[0].length, match[0])) {
       continue;
     }
 
@@ -532,6 +663,10 @@ function hasActionableRalplanKeyword(text, pattern) {
 
 // Create state file for a mode
 function activateState(directory, prompt, stateName, sessionId) {
+  const now = new Date().toISOString();
+  // Sanitize prompt BEFORE writing to state: prevents pasted system echoes
+  // and oversized blobs from being persisted and re-emitted by Stop hook.
+  const safePrompt = sanitizePromptForState(prompt);
   let state;
 
   if (stateName === 'ralph') {
@@ -540,45 +675,51 @@ function activateState(directory, prompt, stateName, sessionId) {
       active: true,
       iteration: 1,
       max_iterations: 100,
-      started_at: new Date().toISOString(),
-      prompt: prompt,
+      started_at: now,
+      prompt: safePrompt,
       session_id: sessionId || undefined,
       project_path: directory,
       linked_ultrawork: true,
       awaiting_confirmation: true,
-      last_checked_at: new Date().toISOString()
+      awaiting_confirmation_set_at: now,
+      last_checked_at: now
     };
   } else if (stateName === 'ralplan') {
     // Ralplan needs active + session_id for stop-hook enforcement
     state = {
       active: true,
-      started_at: new Date().toISOString(),
+      started_at: now,
       session_id: sessionId || undefined,
       project_path: directory,
       awaiting_confirmation: true,
-      last_checked_at: new Date().toISOString()
+      awaiting_confirmation_set_at: now,
+      last_checked_at: now
     };
   } else {
     // Generic state for ultrawork, autopilot, etc.
     state = {
       active: true,
-      started_at: new Date().toISOString(),
-      original_prompt: prompt,
+      started_at: now,
+      original_prompt: safePrompt,
       session_id: sessionId || undefined,
       project_path: directory,
       reinforcement_count: 0,
       awaiting_confirmation: true,
-      last_checked_at: new Date().toISOString()
+      awaiting_confirmation_set_at: now,
+      last_checked_at: now
     };
   }
 
-  // Write to session-scoped path if sessionId available
+  // Write to session-scoped path if sessionId available. Use atomic writes
+  // so that concurrent hook processes cannot expose half-written JSON to
+  // persistent-mode.mjs's readJsonFile (which would otherwise return null
+  // and temporarily drop mode enforcement).
   if (sessionId && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,255}$/.test(sessionId)) {
     const sessionDir = join(directory, '.omcp', 'state', 'sessions', sessionId);
     if (!existsSync(sessionDir)) {
       try { mkdirSync(sessionDir, { recursive: true }); } catch {}
     }
-    try { writeFileSync(join(sessionDir, `${stateName}-state.json`), JSON.stringify(state, null, 2), { mode: 0o600 }); } catch {}
+    try { atomicWriteFileSync(join(sessionDir, `${stateName}-state.json`), JSON.stringify(state, null, 2)); } catch {}
     return;
   }
 
@@ -587,7 +728,7 @@ function activateState(directory, prompt, stateName, sessionId) {
   if (!existsSync(localDir)) {
     try { mkdirSync(localDir, { recursive: true }); } catch {}
   }
-  try { writeFileSync(join(localDir, `${stateName}-state.json`), JSON.stringify(state, null, 2), { mode: 0o600 }); } catch {}
+  try { atomicWriteFileSync(join(localDir, `${stateName}-state.json`), JSON.stringify(state, null, 2)); } catch {}
 }
 
 function activateRalplanStartupState(directory, prompt, sessionId) {
@@ -596,7 +737,7 @@ function activateRalplanStartupState(directory, prompt, sessionId) {
     active: true,
     started_at: now,
     current_phase: 'ralplan',
-    original_prompt: prompt,
+    original_prompt: sanitizePromptForState(prompt),
     session_id: sessionId || undefined,
     project_path: directory,
     awaiting_confirmation: true,
@@ -609,7 +750,7 @@ function activateRalplanStartupState(directory, prompt, sessionId) {
     if (!existsSync(sessionDir)) {
       try { mkdirSync(sessionDir, { recursive: true }); } catch {}
     }
-    try { writeFileSync(join(sessionDir, 'ralplan-state.json'), JSON.stringify(state, null, 2), { mode: 0o600 }); } catch {}
+    try { atomicWriteFileSync(join(sessionDir, 'ralplan-state.json'), JSON.stringify(state, null, 2)); } catch {}
     return;
   }
 
@@ -617,7 +758,7 @@ function activateRalplanStartupState(directory, prompt, sessionId) {
   if (!existsSync(localDir)) {
     try { mkdirSync(localDir, { recursive: true }); } catch {}
   }
-  try { writeFileSync(join(localDir, 'ralplan-state.json'), JSON.stringify(state, null, 2), { mode: 0o600 }); } catch {}
+  try { atomicWriteFileSync(join(localDir, 'ralplan-state.json'), JSON.stringify(state, null, 2)); } catch {}
 }
 
 /**
@@ -858,7 +999,14 @@ async function main() {
       return;
     }
 
-    const cleanPrompt = sanitizeForKeywordDetection(prompt).toLowerCase();
+    // Strip pasted system-echo blocks BEFORE any mode-keyword dispatch runs.
+    // This covers both the hasActionableKeyword() call sites AND alternative
+    // matchers (e.g. isAntiSlopCleanupRequest) that bypass it. The helper
+    // inside hasActionableKeyword also strips defensively, which stays as
+    // belt-and-suspenders.
+    const cleanPrompt = stripSystemEchoes(
+      sanitizeForKeywordDetection(prompt).toLowerCase(),
+    );
 
     // Collect all matching keywords
     const matches = [];

package/scripts/lib/hud-cache-wrapper.sh

@@ -0,0 +1,122 @@
+#!/bin/sh
+# OMC HUD cached statusLine launcher.
+#
+# Claude Code invokes statusLine commands for every render. Starting Node and
+# importing the HUD bundle each time can take hundreds of milliseconds, which
+# makes the first frame blank/flickery. This POSIX wrapper keeps the statusLine
+# protocol unchanged (stdin JSON in, one line out) while making the hot path a
+# shell read + cat of the last rendered line. A single background Node refresh
+# updates the session-scoped cache for the next frame.
+
+case "$0" in
+  */*) SCRIPT_DIR=${0%/*} ;;
+  *) SCRIPT_DIR=. ;;
+esac
+SCRIPT_DIR=$(cd "$SCRIPT_DIR" 2>/dev/null && pwd -P) || SCRIPT_DIR=.
+CONFIG_DIR=${COPILOT_CONFIG_DIR:-$(cd "$SCRIPT_DIR/.." 2>/dev/null && pwd -P)}
+CACHE_DIR=${OMC_HUD_CACHE_DIR:-"$CONFIG_DIR/hud/cache"}
+HUD_SCRIPT=${1:-"$SCRIPT_DIR/omcp-hud.mjs"}
+INPUT_TMP="$CACHE_DIR/stdin.$$.tmp"
+
+mkdir -p "$CACHE_DIR" 2>/dev/null || {
+  printf '[OMC] Starting...\n'
+  exit 0
+}
+
+# Capture Claude's current statusLine stdin first so rendered output can be
+# scoped per session/worktree instead of leaking across concurrent sessions.
+cat > "$INPUT_TMP" 2>/dev/null || :
+
+extract_json_string() {
+  key=$1
+  sed -n "s/.*\"$key\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" "$INPUT_TMP" 2>/dev/null | head -1
+}
+
+SESSION_KEY=$(extract_json_string session_id)
+if [ -z "$SESSION_KEY" ] && [ -n "${CLAUDE_SESSION_ID:-}" ]; then
+  SESSION_KEY=$CLAUDE_SESSION_ID
+fi
+if [ -z "$SESSION_KEY" ] && [ -n "${CLAUDECODE_SESSION_ID:-}" ]; then
+  SESSION_KEY=$CLAUDECODE_SESSION_ID
+fi
+TRANSCRIPT_PATH=$(extract_json_string transcript_path)
+if [ -z "$SESSION_KEY" ] && [ -n "$TRANSCRIPT_PATH" ]; then
+  SESSION_KEY=$(printf '%s\n' "$TRANSCRIPT_PATH" | sed -n 's/.*\([0-9a-fA-F][0-9a-fA-F-]\{35\}\).*/\1/p' | head -1)
+  if [ -z "$SESSION_KEY" ]; then
+    SESSION_KEY=$(printf '%s\n' "$TRANSCRIPT_PATH" | cksum 2>/dev/null | awk '{print "transcript-" $1}')
+  fi
+fi
+if [ -z "$SESSION_KEY" ]; then
+  CWD_VALUE=$(extract_json_string cwd)
+  if [ -n "$CWD_VALUE" ]; then
+    SESSION_KEY=$(printf '%s\n' "$CWD_VALUE" | cksum 2>/dev/null | awk '{print "cwd-" $1}')
+  fi
+fi
+if [ -z "$SESSION_KEY" ]; then
+  SESSION_KEY=default
+fi
+SESSION_KEY=$(printf '%s' "$SESSION_KEY" | sed 's/[^A-Za-z0-9_.-]/_/g')
+
+INPUT_FILE="$CACHE_DIR/stdin.$SESSION_KEY.json"
+OUTPUT_FILE="$CACHE_DIR/statusline.$SESSION_KEY.txt"
+LOCK_DIR="$CACHE_DIR/render.$SESSION_KEY.lock"
+NODE_STDOUT_TMP="$CACHE_DIR/statusline.$SESSION_KEY.$$.tmp"
+NODE_STDERR_TMP="$CACHE_DIR/statusline.$SESSION_KEY.$$.err"
+
+if [ -s "$INPUT_TMP" ]; then
+  mv "$INPUT_TMP" "$INPUT_FILE" 2>/dev/null || cp "$INPUT_TMP" "$INPUT_FILE" 2>/dev/null || :
+fi
+rm -f "$INPUT_TMP" 2>/dev/null || :
+
+# Hot path: return immediately from the last successful render for this session.
+if [ -s "$OUTPUT_FILE" ]; then
+  cat "$OUTPUT_FILE" 2>/dev/null || printf '[OMC] Starting...\n'
+else
+  printf '[OMC] Starting...\n'
+fi
+
+# Avoid spawning a Node renderer on every statusLine render. mkdir is atomic.
+if ! mkdir "$LOCK_DIR" 2>/dev/null; then
+  # Recover from stale locks left by crashes.
+  if [ -d "$LOCK_DIR" ]; then
+    now=$(date +%s 2>/dev/null || printf '0')
+    lock_mtime=$( (stat -c %Y "$LOCK_DIR" 2>/dev/null || stat -f %m "$LOCK_DIR" 2>/dev/null) | head -1 )
+    if [ -n "$lock_mtime" ] && [ "$now" -gt 0 ] && [ $((now - lock_mtime)) -gt 10 ]; then
+      rm -rf "$LOCK_DIR" 2>/dev/null || :
+      mkdir "$LOCK_DIR" 2>/dev/null || exit 0
+    else
+      exit 0
+    fi
+  else
+    exit 0
+  fi
+fi
+
+refresh_cache() {
+  if [ ! -s "$INPUT_FILE" ]; then
+    rm -rf "$LOCK_DIR" 2>/dev/null || :
+    return
+  fi
+
+  if [ -x "$SCRIPT_DIR/find-node.sh" ]; then
+    sh "$SCRIPT_DIR/find-node.sh" "$HUD_SCRIPT" < "$INPUT_FILE" > "$NODE_STDOUT_TMP" 2> "$NODE_STDERR_TMP"
+  else
+    node "$HUD_SCRIPT" < "$INPUT_FILE" > "$NODE_STDOUT_TMP" 2> "$NODE_STDERR_TMP"
+  fi
+
+  # Keep the last good line if rendering fails or returns empty output.
+  if [ -s "$NODE_STDOUT_TMP" ]; then
+    mv "$NODE_STDOUT_TMP" "$OUTPUT_FILE" 2>/dev/null || cp "$NODE_STDOUT_TMP" "$OUTPUT_FILE" 2>/dev/null || :
+  fi
+
+  rm -f "$NODE_STDOUT_TMP" "$NODE_STDERR_TMP" 2>/dev/null || :
+  rm -rf "$LOCK_DIR" 2>/dev/null || :
+}
+
+if [ "${OMC_HUD_SYNC_REFRESH:-0}" = "1" ]; then
+  refresh_cache
+else
+  ( refresh_cache ) >/dev/null 2>&1 &
+fi
+
+exit 0