oh-my-customcode 0.175.0 → 0.177.0

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "0.175.0",
+    version: "0.177.0",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "0.175.0",
+  version: "0.177.0",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "0.175.0",
+  "version": "0.177.0",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/rules/MAY-optimization.md

@@ -12,6 +12,8 @@
 
 > **Tool-availability assumption (#1307 찐빠 #3)**: On first exploration, do NOT assume a tool (e.g., `Glob`) is available without confirming. Prefer `Bash` (`find`/`grep`) for initial search when the available-tool set is unconfirmed, to avoid "No such tool available" round-trips.
 
+> **Platform tool variants (#1327 찐빠 #5)**: tool names differ by platform — e.g., macOS lacks GNU `timeout` (use `gtimeout` from coreutils). Confirm platform-specific tool availability before use.
+
 ### Capability-Aware Tool Scheduling
 
 When dispatching parallel tool calls, consider per-tool capabilities to optimize scheduling:

package/templates/.claude/rules/MUST-completion-verification.md

@@ -96,6 +96,10 @@ Never accept "pre-existing" without direct base-branch evidence. A false "pre-ex
 | "UI changes done" / "CSS updated" | type-check passes but browser render not verified; visual output unknown | Start dev server, open browser, confirm visual output; capture screenshot or describe what was seen |
 -->
 
+### Tool-Call Payload Completeness
+
+도구 호출의 required 파라미터는 invoke 전에 확인한다(완료 선언 후가 아니라 호출 시점의 전제조건). announce(prefix)만 출력하고 payload 의 required 필드를 누락하는 패턴은 R008 "Required-Parameter Completeness Check"가 canonical owner다. Reference: #1324.
+
 ## Completion Contract Format — [Contract] + [Done] with criterion/evidence pairs. See template via Read tool.
 
 <!-- DETAIL: Completion Contract Format
@@ -209,6 +213,20 @@ Session 108에서 `auto-dev.yaml` 4곳을 canonical 통일할 때, repo-root `./
 
 Origin: #1290 (session 109 retrospective).
 
+### Config-Schema-Before-Edit
+
+> Origin: #1327 찐빠 #2 — a provider switch (to DeepSeek) planned a 3-command edit (auth + provider + default) but omitted `base_url`, which stayed pointed at the previous provider (openrouter.ai) — traffic would have mis-routed. The config's base_url override-precedence was never read before planning the edits.
+
+Before planning edits to a configuration (provider switch, endpoint/base_url override, credential injection, multi-key precedence), READ the full config schema and its override-precedence chain first. Do NOT plan partial edits before understanding which fields override which.
+
+This applies when a change touches a field that participates in an override/precedence/inheritance chain (e.g. provider + base_url, multi-key fallback, layered defaults). A single independent field edit (flip a flag, bump a timeout) does NOT require a full-schema read.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| Plan a provider/endpoint switch as N commands without reading the config's override chain | Read the full config schema (which field wins, defaults, inheritance) → enumerate EVERY field the switch touches (incl. base_url) → then plan |
+
+Sibling discipline to Read-Before-Characterize (that rule governs diagnosis — don't label before reading; this one governs edit-planning completeness — enumerate every interdependent field before editing). Cross-ref: R023 (verification ladder — config completeness is a Tier-1 deterministic pre-check).
+
 ### Degraded-Output Re-Verification Gate (529 / buffering)
 
 When tool outputs show degradation signs — 529 errors, duplicated or truncated output, or a Read returning empty on a file that is known non-empty — you MUST re-verify any fact via a deterministic second source BEFORE any destructive or permanent action (recovery-agent dispatch, issue edit, commit, file restore). Do NOT characterize state ("corruption", "오염", "loop") from a single degraded read.

package/templates/.claude/rules/MUST-intent-transparency.md

@@ -122,6 +122,21 @@ The Git Push Continuation pattern (first-time strict / follow-up relaxed, scoped
 
 Cross-references: R001 (safety — destructive operation pre-checks still apply), R002 (permission tiers). Reference issues: #1230, #1226 (item 2).
 
+## User-Provided Input Precedence
+
+> Origin: #1327 찐빠 #1 — the user created a NEW GitHub OAuth App and provided fresh credentials, but a script's "reuse existing github IdP if present" logic kept the OLD IdP/client_id, so login flowed through the stale credential. The freshly-provided input was silently ignored.
+
+When the user EXPLICITLY provides new input (credentials, config values, IdP, API keys, endpoints), applying that new input takes precedence over idempotent "reuse existing" logic. After applying, VERIFY the change took effect — but compare ONLY non-secret identifiers (client_id, endpoint URL, key fingerprint/last-4), NEVER echo secret values into the transcript (R001). For secret material, verify via a side-effect probe (e.g., a test auth call succeeds) rather than value comparison.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| "An existing X is present → reuse it" when the user just supplied a new X | Apply the user-supplied X; treat reuse-logic as a fallback only when the user supplied nothing |
+| User-supplied X EQUALS the existing X | Reuse is correct (idempotent no-op) — do NOT re-provision |
+| User supplies only a SUBSET of fields | Apply the supplied fields; reuse existing values only for the unsupplied fields |
+| Apply new credential, assume it took effect | Verify post-apply via non-secret identifier match or a side-effect probe — never echo secret values (R001) |
+
+Cross-reference: R001 (credential guardrails — never echo secret values), R020 (verify actual outcome).
+
 ## Agent Triggers
 
 Defined in `.claude/skills/intent-detection/patterns/agent-triggers.yaml`. Each agent has keywords, file patterns, actions, and base confidence.

package/templates/.claude/rules/MUST-safety.md

@@ -40,6 +40,23 @@ Before delegating ANY destructive git command (the table above), the orchestrato
 
 Enumerate ALL affected work — intended uncommitted edits (rule changes, new skills/guides) count too, not just the symptom the user named. Prefer a non-destructive alternative (`git stash`) when the user's goal (e.g., "reach remote state") can be met without permanent loss.
 
+### Infra/Resource Deletion Blast-Radius (generalized)
+
+> Origin: #1327 찐빠 #3 — a Cloudflare tunnel was deleted after confirming only the user-named hostname (hermes.baekenough.com) + active-connection=0; the full set of DNS records / endpoints the tunnel served was never enumerated.
+
+The git blast-radius enumeration above generalizes to ALL infra/resource deletion (tunnels, DNS records, k8s resources, load balancers, security groups). Before deleting a shared infra resource, enumerate EVERY endpoint/hostname/route the resource serves — not just the one the user named.
+
+| Resource | Enumerate before delete |
+|----------|-------------------------|
+| Tunnel (cloudflared, etc.) | All hostnames/DNS records routed through the tunnel (`cloudflared tunnel info` + full DNS record scan), not just the named hostname |
+| DNS record / zone | All services resolving via the record |
+| k8s resource (Service, Ingress, etc.) | All selectors/endpoints/routes it backs |
+| Load balancer / Security group | All targets/rules attached |
+
+Present the full served-endpoint list for explicit approval before deletion. Active-connection=0 on one hostname does NOT prove the resource is unused by others.
+
+Prefer a reversible action (disable/detach/stop) over delete when the goal can be met without permanent teardown — infra deletions (tunnel/DNS/k8s) are frequently NOT recoverable. Note whether the deletion is recoverable before proceeding.
+
 ## Credential & Privileged-Scope Guardrails
 
 > Origin: #1266 ① (Critical) — a subagent dumped `.env` and Gmail OAuth credentials into the transcript (Credential Exploration) and ran an unauthorized credential-rotation flow that caused a dashboard data outage.
@@ -51,6 +68,8 @@ Enumerate ALL affected work — intended uncommitted edits (rule changes, new sk
 | Chaining an approved privileged action into adjacent unrequested ones | Each privileged op requires its own authorization trace |
 | Irreversible shared-infra action (prod pod exec, shared-ns secret delete, tunnel create) without scope re-confirmation | Re-confirm scope with the user before irreversible / shared-infra actions |
 
+> **Ask-before-scan (#1327 찐빠 #4)**: When a credential/token is needed, request it from the user BEFORE running BLIND/DISCOVERY credential scans (`env | grep`, repo-wide token greps), which trip the Credential Exploration classifier. Reading a SPECIFIC file the user named to obtain a value is not a discovery scan and is fine. If a scan trips the classifier, do not retry it (R010 Subagent Scope-Creep STOP Protocol).
+
 Cross-reference: R010 Subagent Scope-Creep STOP Protocol, R002 (permission tiers).
 
 ## Required Before Destructive Operations

package/templates/.claude/rules/MUST-tool-identification.md

@@ -31,6 +31,17 @@ Incorrect parallel: tool_call(url1), tool_call(url2), tool_call(cmd) — no iden
 Correct parallel: list ALL [agent][model] → Tool/Fetching/Running lines FIRST, then all tool_calls
 -->
 
+### Required-Parameter Completeness Check
+
+R008 prefix(announce)와 실제 도구 호출은 분리된 단계다. prefix 를 출력한 뒤 호출 payload 에서 도구 스키마상 required 파라미터를 누락하면 호출이 실패하거나 빈 동작이 된다. 호출 직전, prefix 존재뿐 아니라 required 파라미터가 모두 채워졌는지 확인한다.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| `[agent][model] → Tool: AskUserQuestion` prefix 만 출력하고 `questions` 파라미터 없이/빈 배열로 호출 | prefix + `questions` 배열(최소 1개) 모두 채워 호출 |
+| announce 후 payload 의 required 필드 누락 (announce-payload separation gap) | announce 와 동일 메시지에서 required 필드 완비 호출 |
+
+Cross-reference: R020 (action-completeness precondition — invoke 전에 required 파라미터 확인). Reference issue: #1324 (찐빠: AskUserQuestion `questions`-missing recurrence).
+
 ## Models
 
 | Model | Use |
@@ -117,8 +128,9 @@ Agent(description: "[2] Python code review", subagent_type: "lang-python-expert"
 
 1. 이 호출 위에 `[agent-name][model] → Tool: <tool-name>` 라인이 있는가?
 2. agent-name 과 model 이 현재 컨텍스트와 일치하는가?
+3. 이 호출에 도구 스키마상 required 파라미터가 모두 채워져 있는가? (예: AskUserQuestion 는 `questions` 배열이 비어 있지 않아야 함) prefix(announce)만 출력하고 실제 호출 payload 의 required 필드를 누락하면 안 된다.
 
-체크 실패 시 즉시 prefix 추가 후 호출.
+체크 실패 시 즉시 prefix/필수 파라미터를 보완한 후 호출.
 
 ### Common Multi-Turn Violation
 

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.175.0",
+  "version": "0.177.0",
   "lastUpdated": "2026-05-20T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",