oh-my-customcode 0.177.0 → 0.179.0

package/README.md

@@ -13,7 +13,7 @@
 
 **[한국어 문서 (Korean)](./README_ko.md)**
 
-49 agents. 116 skills. 23 rules. One command.
+49 agents. 117 skills. 23 rules. One command.
 
 ```bash
 npm install -g oh-my-customcode && cd your-project && omcustom init
@@ -132,13 +132,13 @@ Each agent declares its tools, model, memory scope, and limitations in YAML fron
 
 ---
 
-### Skills (116)
+### Skills (117)
 
 | Category | Count | Includes |
 |----------|-------|----------|
 | Best Practices | 24 | Go, Python, TypeScript, Kotlin, Rust, React, FastAPI, Spring Boot, Django, Flutter, Docker, AWS, Postgres, Redis, Kafka, dbt, Spark, Snowflake, Airflow, pipeline-architecture-patterns, alembic, and more |
 | Routing | 4 | secretary, dev-lead, de-lead, qa-lead |
-| Workflow | 13 | structured-dev-cycle, deep-plan, research, evaluator-optimizer, dag-orchestration, worker-reviewer-pipeline, reasoning-sandwich, pipeline, and more |
+| Workflow | 14 | structured-dev-cycle, deep-plan, research, evaluator-optimizer, dag-orchestration, worker-reviewer-pipeline, reasoning-sandwich, pipeline, fsd, and more |
 | Development | 8 | dev-review, dev-refactor, analysis, create-agent, intent-detection, web-design-guidelines, omcustom-takeover, skill-extractor |
 | Operations | 9 | update-docs, audit-agents, sauron-watch, monitoring-setup, fix-refs, release-notes, and more |
 | Memory | 3 | memory-save, memory-recall, memory-management |
@@ -270,7 +270,7 @@ your-project/
 ├── CLAUDE.md                   # Entry point
 ├── .claude/
 │   ├── agents/                 # 49 agent definitions
-│   ├── skills/                 # 116 skill modules
+│   ├── skills/                 # 117 skill modules
 │   ├── rules/                  # 23 governance rules (R000-R023)
 │   ├── hooks/                  # 15 lifecycle hook scripts
 │   ├── schemas/                # Tool input validation schemas

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "0.177.0",
+    version: "0.179.0",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "0.177.0",
+  version: "0.179.0",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "0.177.0",
+  "version": "0.179.0",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/rules/MUST-agent-design.md

@@ -37,6 +37,10 @@ This is a settings-level resilience mechanism, distinct from the per-agent `mode
 
 > **v2.1.166+**: `MAX_THINKING_TOKENS=0`, `--thinking disabled`, and the per-model thinking toggle disable thinking on models that think by default via the Claude API (3rd-party providers unchanged). Relevant when an agent's `effort` is low and thinking overhead is undesirable.
 
+### Safe Mode & Bundled Skill Control (CC v2.1.169+)
+
+> **v2.1.169+**: `--safe-mode` (and `CLAUDE_CODE_SAFE_MODE`) starts Claude Code with ALL customizations disabled (CLAUDE.md, plugins, skills, hooks, MCP servers) — use it to isolate whether a project customization (agent/skill/hook) causes a regression. The `disableBundledSkills` setting (and `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` env) hides bundled skills, workflows, and built-in slash commands from the model — useful when bundled skills conflict with or duplicate project skills (R006 skill-surface management). Note: `disableBundledSkills` hides skills from the model but is a CC platform setting, distinct from the advisory `skills:` frontmatter field (which is documentation metadata, not a runtime allowlist).
+
 ### Optional Frontmatter
 
 Key optional fields: `memory`, `effort`, `skills`, `soul`, `isolation`, `background`, `maxTurns`, `maxTokens`, `mcpServers`, `hooks`, `permissionMode`, `disallowedTools`, `limitations`, `domain`, `disableSkillShellExecution`. Supported since CC v2.1.63+. See full optional frontmatter via Read tool.

package/templates/.claude/rules/MUST-agent-teams.md

@@ -355,6 +355,8 @@ Cross-reference: R020 ("actual outcome ≠ attempt" — verifying that a command
 
 > **CC v2.1.162+**: `claude agents --json` now includes a `waitingFor` field showing what a waiting session is blocked on (e.g. a permission prompt). Use it as an additional deterministic ground-truth signal — a member with a non-empty `waitingFor` is blocked on input (needs unblocking), NOT silently stalled (reassign per stall handling below). This distinguishes the two failure modes the verification is meant to separate.
 
+> **CC v2.1.169+**: `claude agents --json` now includes blocked and just-dispatched background sessions (previously omitted), adds `--all` to include completed sessions, and adds `id` and `state` fields. This strengthens the deterministic ground-truth for member completion verification — `state` distinguishes blocked/running/completed directly, and `--all` confirms a member actually completed (rather than just disappearing from the active list). Use `--all` + `state` as the ground-truth signal instead of inferring completion from a member's absence.
+
 **Stall handling**: When a member shows no task progress within ~2 minutes despite spawn + owner assignment + SendMessage coordination, reassign the work to a standalone Agent (R009) rather than continuing to nudge the stalled member. Stalled Teams members waste tokens on idle polling and delay the overall workflow.
 
 Observed instance: v0.159.0 release (session 105) — members assigned to disjoint-file cleanup tasks went idle without executing; deterministic git-diff check exposed the gap; work was reassigned to standalone parallel Agents. References: #1261, #1262.

package/templates/.claude/rules/MUST-completion-verification.md

@@ -241,6 +241,21 @@ Session 106: during 529 buffering, a CHANGELOG was misdiagnosed as "61x 중복
 
 Origin: #1269 ① (R020 self-violation, session 106).
 
+### CI Publish-Step Error vs Published-Artifact Ground Truth
+
+> Origin: #1332 — `npm publish --provenance` emitted a Sigstore `TLOG_CREATE_ENTRY_ERROR` 409, but the publish step's `|| npm view <pkg>@<ver>` fallback recovered (the package WAS published) and release.yml succeeded on all jobs. A subagent read the tlog error in the logs and prematurely declared the run "failed", recommending a re-run; deterministic ground-truth (`npm view`, `gh release view`) showed the release had fully succeeded.
+
+A CI publish/deploy step that LOGS an error has NOT necessarily failed — the step may recover via a fallback (`|| npm view ...`), or the error may be in a non-fatal sub-step (provenance attestation, eventual-consistency probe). Before declaring a publish/release run failed — and ESPECIALLY before re-running, rolling back, or permanently changing the workflow — verify the PUBLISHED ARTIFACT directly:
+
+| Publish target | Ground-truth check |
+|----------------|--------------------|
+| npm | `npm view <pkg> version` == expected |
+| GitHub Release | `gh release view <tag>` exists, not draft |
+| Docker registry | image tag/manifest exists |
+| Run outcome | `gh run view <id> --json jobs` job conclusions — NOT a single step's log line |
+
+This is the publish-domain extension of Read-Before-Characterize ("actual outcome ≠ attempt"). Re-running a publish that actually succeeded risks duplicate-publish errors; permanently changing a workflow on a misdiagnosis is worse (cf. #1217 — npm E403 misdiagnosed as a `--provenance` conflict → wrong workflow change → repeated failure; real cause was token scope).
+
 ## Integration
 
 | Rule | Interaction |

package/templates/.claude/skills/fsd/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: omcustom:fsd
+description: Full Self Driving — autonomous release loop that processes all auto-dev-eligible GitHub issues until none remain, by repeatedly running /pipeline auto-dev then /homework.
+scope: harness
+user-invocable: true
+argument-hint: "[<max-releases>]"
+version: 0.1.0
+effort: high
+---
+
+# /omcustom:fsd — Full Self Driving
+
+Autonomous release loop. Equivalent to running:
+
+```
+/goal "모든 이슈가 처리될 때까지" /loop "/pipeline auto-dev -> /homework"
+```
+
+This is a **thin alias / orchestrator skill**. It does not implement loop, issue-polling, release, or verification logic — it delegates entirely to existing skills.
+
+## Usage
+
+```
+/omcustom:fsd               # Run until all auto-dev-eligible issues are exhausted
+/omcustom:fsd 3             # Optional: cap at N releases (default: unlimited)
+```
+
+No arguments are required. The default behavior runs until the auto-dev-eligible issue set is empty.
+
+## What It Does
+
+FSD expands into:
+
+1. **`/goal` wrapper** — applies disciplined goal-to-execution workflow:
+   - Objective: "모든 이슈가 처리될 때까지"
+   - Delegates planning, gap detection, and R020 completion verification to the `goal` skill
+2. **`/loop` recurrence** — self-paced loop (model decides cadence), each iteration runs:
+   1. `/pipeline auto-dev` — full release pipeline for the next eligible issue
+   2. `/homework` — retrospective 찐빠 audit gate
+
+### Loop Convergence
+
+The loop converges naturally when the auto-dev-eligible issue set reaches 0. Issue eligibility follows `/pipeline auto-dev` label selection exactly:
+
+- **Included**: `verify-ready` (preferred), unlabeled auto-dev candidates
+- **Excluded**: `verify-done`, `needs-review`, `decision-needed` labels
+
+Do NOT invent new label logic here — defer to the `pipeline` skill's auto-dev issue selection.
+
+### Iteration Flow (per iteration)
+
+```
+[FSD Iteration N]
+├── /pipeline auto-dev        → one release (PR create → merge → npm publish → milestone close)
+├── /homework                 → extract 찐빠, confirm gate (or --dry-run if requested)
+└── Check: any eligible issues remain?
+    ├── YES → next iteration
+    └── NO  → [FSD Done] converged naturally
+```
+
+## Safety and Discipline
+
+Each iteration operates under full project rules — no relaxation because FSD is autonomous:
+
+| Rule | Applies |
+|------|---------|
+| R001 (safety) | Destructive ops still require explicit approval. Credential guardrails always active. |
+| R009 (parallel) | Independent subtasks within each pipeline iteration run in parallel. |
+| R010 (orchestration) | All file modifications delegated to specialist subagents. mgr-gitnerd for git ops. |
+| R017 (sync verification) | mgr-sauron passes required before any commit. |
+| R020 (completion verification) | Each release verified via `npm view`, `gh release view`, closed issues before `[Done]`. |
+
+`/homework` runs as a **retrospective gate** between iterations — findings go through `omcustom-feedback`'s Phase 4A confirmation gate. The loop does NOT skip homework on the grounds that it is "automated". If homework requires user confirmation (e.g., to file a feedback issue), the loop pauses and waits.
+
+If a release operation triggers the safety classifier, the current iteration stops and surfaces the block to the user before continuing.
+
+## When to Use
+
+| Scenario | Use FSD? |
+|----------|----------|
+| Multiple eligible issues ready to process autonomously | YES |
+| Session where the user wants to "let it run" through the backlog | YES |
+| Verifying the autonomous release loop pattern from session memory | YES |
+| Single targeted issue fix | NO — use `/pipeline auto-dev` directly |
+| Exploratory research / planning only | NO — use `/research` or `/deep-plan` |
+| Only one issue and it needs human judgment | NO — use `/pipeline auto-dev` with manual oversight |
+
+## When NOT to Use
+
+- When issues require stakeholder approval or design decisions before implementation
+- When the issue set includes `decision-needed` or `needs-review` items only (loop converges immediately — just use `/pipeline auto-dev` once)
+- When cost sensitivity is high and the issue backlog is large — inspect the eligible set first before running FSD
+
+## Optional Release Cap
+
+Pass a numeric argument to cap at N releases:
+
+```
+/omcustom:fsd 3    # Process at most 3 issues this FSD run
+```
+
+This corresponds to the `-max` parameter used in the manual pattern. Default is unlimited (run until eligible issues exhausted). The cap is advisory — the pipeline itself may stop earlier if the eligible set runs out before the cap is reached.
+
+## Session 114 Precedent
+
+This skill was extracted from the manual pattern used in Session 114 (2026-06-09):
+
+```
+/goal "모든 이슈가 처리될 때까지" /loop "/pipeline auto-dev -> /homework"
+```
+
+That session ran 2 iterations (v0.177.0 and v0.178.0) before converging with 0 eligible issues remaining. FSD codifies this pattern as a first-class invocable command.
+
+## Cross-References
+
+| Skill / Rule | Role |
+|--------------|------|
+| `goal` | Disciplined goal-to-execution wrapper — objective parse, gap detection, R020 verification |
+| `omcustom-loop` | Session auto-continuation via SubagentStop hook — keeps the loop alive during background agent work |
+| `pipeline` | `/pipeline auto-dev` — the core release pipeline per iteration |
+| `homework` | Retrospective 찐빠 audit gate per iteration |
+| R001 (safety) | Destructive ops require approval; credential guardrails |
+| R009 (parallel execution) | Parallel subtasks within each pipeline iteration |
+| R010 (orchestrator coordination) | All file writes delegated; mgr-gitnerd for git |
+| R017 (sync verification) | mgr-sauron required before commit/push |
+| R020 (completion verification) | Actual outcome verified before declaring each release done |
+
+## Design Notes
+
+This skill is intentionally a **thin alias**. It does NOT duplicate:
+- Issue polling logic (owned by `pipeline`)
+- Loop cadence / auto-continuation (owned by `omcustom-loop` + SubagentStop hook)
+- Release pipeline steps (owned by `pipeline auto-dev`)
+- Retrospective analysis (owned by `homework`)
+- Completion verification (owned by R020 + `goal`)
+
+If any of those underlying skills evolve, FSD automatically benefits — its only responsibility is declaring the intent and forwarding to the right components.
+
+## Permission Mode Note
+
+When this skill delegates work via Agent tool calls, ALL Agent tool calls MUST include `mode: "bypassPermissions"` per R010 Universal bypassPermissions.
+
+## Artifact Output
+
+Artifacts from each iteration follow the conventions of the constituent skills:
+- Pipeline artifacts: `.claude/outputs/sessions/{YYYY-MM-DD}/pipeline-auto-dev-{HHmmss}.md`
+- Homework artifacts: `.claude/outputs/sessions/{YYYY-MM-DD}/homework-{HHmmss}.md`

package/templates/CLAUDE.md

@@ -116,7 +116,7 @@ project/
 +-- CLAUDE.md                    # 진입점
 +-- .claude/
 |   +-- agents/                  # 서브에이전트 정의 (49 파일)
-|   +-- skills/                  # 스킬 (116 디렉토리)
+|   +-- skills/                  # 스킬 (117 디렉토리)
 |   +-- rules/                   # 전역 규칙 (R000-R023)
 |   +-- hooks/                   # 훅 스크립트 (보안, 검증, HUD)
 |   +-- contexts/                # 컨텍스트 파일 (ecomode)

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.177.0",
+  "version": "0.179.0",
   "lastUpdated": "2026-05-20T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",
@@ -20,7 +20,7 @@
       "name": "skills",
       "path": ".claude/skills",
       "description": "Reusable skill modules (includes slash commands)",
-      "files": 116
+      "files": 117
     },
     {
       "name": "guides",