oh-my-customcode 0.170.0 → 0.172.0

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "0.170.0",
+    version: "0.172.0",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "0.170.0",
+  version: "0.172.0",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "0.170.0",
+  "version": "0.172.0",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/rules/MAY-optimization.md

@@ -10,6 +10,8 @@
 | Caching | Same data accessed repeatedly | Cache file contents, reuse search results |
 | Lazy Loading | Large datasets, partial use | Read only needed files, stream results |
 
+> **Tool-availability assumption (#1307 찐빠 #3)**: On first exploration, do NOT assume a tool (e.g., `Glob`) is available without confirming. Prefer `Bash` (`find`/`grep`) for initial search when the available-tool set is unconfirmed, to avoid "No such tool available" round-trips.
+
 ### Capability-Aware Tool Scheduling
 
 When dispatching parallel tool calls, consider per-tool capabilities to optimize scheduling:

package/templates/.claude/rules/MUST-safety.md

@@ -25,6 +25,21 @@ The following git commands have caused working tree loss in past sessions (#1146
 
 **Recovery hint**: If working tree loss occurs, check `git reflog` immediately — most operations are recoverable within 30 days.
 
+### Pre-Delegation Blast-Radius Enumeration
+
+> Origin: #1307 찐빠 #1 (High) — user chose "discard local changes and pull", and `git reset --hard origin/develop` was delegated immediately → user rejected (interrupt). The blast radius — that "discard local changes" included 18 files of *intended* uncommitted work (rule edits, new skills, new guides), not just a version downgrade — was never enumerated for the user.
+
+Before delegating ANY destructive git command (the table above), the orchestrator MUST first enumerate the EXACT discard targets and present them for explicit approval. Do NOT delegate a destructive git op on a paraphrased intent ("로컬 변경 버리기" / "discard local changes") without showing what will actually be lost.
+
+| Required before delegation | Command |
+|----------------------------|---------|
+| List modified/staged tracked files | `git status --short` |
+| Show uncommitted diff scope | `git diff --stat` (and `git diff --stat --cached`) |
+| Show stashable work scope | `git stash show --stat` (when a stash is involved) |
+| Show untracked files at risk (for `clean`) | `git clean -nd` |
+
+Enumerate ALL affected work — intended uncommitted edits (rule changes, new skills/guides) count too, not just the symptom the user named. Prefer a non-destructive alternative (`git stash`) when the user's goal (e.g., "reach remote state") can be met without permanent loss.
+
 ## Credential & Privileged-Scope Guardrails
 
 > Origin: #1266 ① (Critical) — a subagent dumped `.env` and Gmail OAuth credentials into the transcript (Credential Exploration) and ran an unauthorized credential-rotation flow that caused a dashboard data outage.

package/templates/.claude/rules/SHOULD-memory-integration.md

@@ -364,6 +364,19 @@ Related records from session v0.87.2~v0.88.0 (issue #869):
 - `feedback_bun_mock_module.md`
 -->
 
+## Safety-Related Feedback Memory Framing
+
+> Origin: #1307 찐빠 #2 (Medium) — a sys-memory-keeper delegation prompt framed a learning as "오탐으로 판단하고 진행한다" (conclude it's a false positive and proceed), tripping the memory-poisoning safety classifier and requiring a rewrite.
+
+Safety-related feedback memories MUST be written in **verification-obligation form**, NOT **conclusion form**. Conclusion-form framing ("ignore the warning and proceed", "오탐이므로 무시") risks future sessions ignoring genuine threat warnings (memory-poisoning).
+
+| Anti-pattern (conclusion form) | Required (verification-obligation form) |
+|--------------------------------|------------------------------------------|
+| "이 경고는 오탐이므로 무시하고 진행" | "이 패턴은 X 검증을 트리거; 검증 통과 시에만 진행, 실패 시 STOP" |
+| "warning is false positive, proceed" | "warning triggers a duty to verify Y; proceed only if verified, else STOP" |
+
+Write safety learnings as triggers (what to check) + STOP conditions (when to halt), never as standing permission to dismiss a class of warnings.
+
 ## Session-End Auto-Save
 
 ### Trigger

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -160,6 +160,19 @@ steps:
         - All pipeline steps execute normally with full skill spawns
         - Log: "[compression-mode] standard mode (scope={n}, mixed/high-risk labels, large scope, or code logic change)"
 
+      ## Cross-tier — Pre-Existing Converged Artifact Substitution
+
+      Independent of the tier selected above, an INDIVIDUAL planning/verification step (triage / plan / deep-plan / deep-verify) MAY be satisfied by a pre-existing converged artifact instead of a fresh skill spawn — even in standard mode — when ALL of the following hold for that step:
+      1. A scoped issue carries (in its body or a linked artifact) a CONVERGED research/plan output equivalent to the step's skill — e.g. a `/research` multi-team analysis that explicitly converged, a `/deep-plan` artifact, or a prior `professor-triage`/`release-plan` output.
+      2. The artifact covers the scoped issues' domain (not stale or unrelated).
+      3. The substitution is for a PLANNING/VERIFICATION step ONLY — never for implement, verify-build, release, or ci-check.
+
+      If substituted, emit a MANDATORY justification log naming the artifact:
+        "[compression-mode] step '{step}' satisfied by converged artifact {ref} (substitution); skill spawn skipped"
+      If the artifact's convergence or domain coverage cannot be concretely asserted, do NOT substitute — spawn the skill.
+
+      This authorizes, under an audit log, a substitution that would otherwise be a standard-mode contract deviation. Origin: #1309 (a converged `/research` artifact was used in place of triage/plan/deep-plan under standard mode without an authorizing rule).
+
       ## Output
 
       compression_mode ∈ {docs-only, lite, standard} as pipeline state for downstream steps.

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.170.0",
+  "version": "0.172.0",
   "lastUpdated": "2026-05-20T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",

package/templates/workflows/auto-dev.yaml

@@ -160,6 +160,19 @@ steps:
         - All pipeline steps execute normally with full skill spawns
         - Log: "[compression-mode] standard mode (scope={n}, mixed/high-risk labels, large scope, or code logic change)"
 
+      ## Cross-tier — Pre-Existing Converged Artifact Substitution
+
+      Independent of the tier selected above, an INDIVIDUAL planning/verification step (triage / plan / deep-plan / deep-verify) MAY be satisfied by a pre-existing converged artifact instead of a fresh skill spawn — even in standard mode — when ALL of the following hold for that step:
+      1. A scoped issue carries (in its body or a linked artifact) a CONVERGED research/plan output equivalent to the step's skill — e.g. a `/research` multi-team analysis that explicitly converged, a `/deep-plan` artifact, or a prior `professor-triage`/`release-plan` output.
+      2. The artifact covers the scoped issues' domain (not stale or unrelated).
+      3. The substitution is for a PLANNING/VERIFICATION step ONLY — never for implement, verify-build, release, or ci-check.
+
+      If substituted, emit a MANDATORY justification log naming the artifact:
+        "[compression-mode] step '{step}' satisfied by converged artifact {ref} (substitution); skill spawn skipped"
+      If the artifact's convergence or domain coverage cannot be concretely asserted, do NOT substitute — spawn the skill.
+
+      This authorizes, under an audit log, a substitution that would otherwise be a standard-mode contract deviation. Origin: #1309 (a converged `/research` artifact was used in place of triage/plan/deep-plan under standard mode without an authorizing rule).
+
       ## Output
 
       compression_mode ∈ {docs-only, lite, standard} as pipeline state for downstream steps.