oh-my-customcode 0.24.1 → 0.30.0

package/README.md

@@ -122,6 +122,7 @@ Claude Code selects the appropriate model and parallelizes independent tasks (up
 | **Architecture** | 2 | arch-documenter, arch-speckit-agent |
 | **Infrastructure** | 2 | infra-docker-expert, infra-aws-expert |
 | **QA** | 3 | qa-planner, qa-writer, qa-engineer |
+| **Security** | 1 | sec-codeql-expert |
 | **Total** | **42** | |
 
 ### Skills (66)
@@ -138,6 +139,8 @@ Claude Code selects the appropriate model and parallelizes independent tasks (up
 | **Operations** | 7 | update-docs, update-external, audit-agents, fix-refs, sauron-watch, monitoring-setup, claude-code-bible |
 | **Utilities** | 5 | lists, help, status, result-aggregation, writing-clearly-and-concisely |
 | **Quality & Workflow** | 9 | multi-model-verification, structured-dev-cycle, model-escalation, stuck-recovery, dag-orchestration, task-decomposition, worker-reviewer-pipeline, pr-auto-improve, pipeline-guards |
+| **Security** | 2 | cve-triage, jinja2-prompts |
+| **Research** | 1 | research |
 | **Deploy** | 2 | vercel-deploy, codex-exec |
 | **External** | 1 | skills-sh-search |
 
@@ -220,7 +223,7 @@ your-project/
     ├── rules/             # Behavior rules (18 total)
     ├── hooks/             # Event hooks (2 total)
     ├── contexts/          # Context files (4 total)
-    ├── agents/            # Agent definitions (41 flat .md files)
+    ├── agents/            # Agent definitions (42 flat .md files)
     │   ├── lang-golang-expert.md
     │   ├── be-fastapi-expert.md
     │   ├── mgr-creator.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-customcode",
-  "version": "0.24.1",
+  "version": "0.30.0",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/hooks/hooks.json

@@ -202,6 +202,16 @@
         ],
         "description": "Record agent/task outcomes (success/failure) for model escalation decisions"
       },
+      {
+        "matcher": "tool == \"Edit\" || tool == \"Write\" || tool == \"Bash\" || tool == \"Task\" || tool == \"Agent\" || tool == \"Read\" || tool == \"Glob\" || tool == \"Grep\"",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .claude/hooks/scripts/context-budget-advisor.sh"
+          }
+        ],
+        "description": "Context budget advisor — track tool usage patterns and advise ecomode activation"
+      },
       {
         "matcher": "tool == \"Edit\" || tool == \"Write\" || tool == \"Bash\" || tool == \"Task\" || tool == \"Agent\"",
         "hooks": [

package/templates/.claude/hooks/scripts/context-budget-advisor.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+set -euo pipefail
+
+# Context Budget Advisor Hook
+# Trigger: PostToolUse (Edit/Write/Agent/Task/Read/Glob/Grep/Bash)
+# Purpose: Monitor context usage and advise ecomode activation based on task type
+# Protocol: stdin JSON -> stdout pass-through, exit 0 always
+
+input=$(cat)
+
+# Read context info from status file if available
+STATUS_FILE="/tmp/.claude-env-status-${PPID}"
+BUDGET_FILE="/tmp/.claude-context-budget-${PPID}"
+
+# Initialize budget tracking file
+if [ ! -f "$BUDGET_FILE" ]; then
+  echo "task_type=general" > "$BUDGET_FILE"
+  echo "tool_count=0" >> "$BUDGET_FILE"
+  echo "write_count=0" >> "$BUDGET_FILE"
+  echo "read_count=0" >> "$BUDGET_FILE"
+  echo "agent_count=0" >> "$BUDGET_FILE"
+fi
+
+# Read current counts
+source "$BUDGET_FILE" 2>/dev/null || true
+tool_count=${tool_count:-0}
+write_count=${write_count:-0}
+read_count=${read_count:-0}
+agent_count=${agent_count:-0}
+
+# Determine tool type from input
+TOOL=$(echo "$input" | jq -r '.tool // ""' 2>/dev/null || echo "")
+tool_count=$((tool_count + 1))
+
+case "$TOOL" in
+  Write|Edit)
+    write_count=$((write_count + 1))
+    ;;
+  Read|Glob|Grep)
+    read_count=$((read_count + 1))
+    ;;
+  Task|Agent)
+    agent_count=$((agent_count + 1))
+    ;;
+esac
+
+# Infer task type based on tool usage pattern
+if [ "$agent_count" -ge 4 ]; then
+  task_type="research"
+elif [ "$write_count" -gt "$read_count" ] && [ "$write_count" -ge 5 ]; then
+  task_type="implementation"
+elif [ "$read_count" -gt "$write_count" ] && [ "$read_count" -ge 10 ]; then
+  task_type="review"
+else
+  task_type="general"
+fi
+
+# Update budget file
+cat > "$BUDGET_FILE" << EOF
+task_type=${task_type}
+tool_count=${tool_count}
+write_count=${write_count}
+read_count=${read_count}
+agent_count=${agent_count}
+EOF
+
+# Determine threshold for current task type
+case "$task_type" in
+  research)      THRESHOLD=40 ;;
+  implementation) THRESHOLD=50 ;;
+  review)        THRESHOLD=60 ;;
+  management)    THRESHOLD=70 ;;
+  *)             THRESHOLD=80 ;;
+esac
+
+# Emit advisory at milestones (every 25 tool calls)
+if [ "$tool_count" -gt 0 ] && [ $((tool_count % 25)) -eq 0 ]; then
+  echo "[Context Budget] Task: ${task_type} | Threshold: ${THRESHOLD}% | Tools used: ${tool_count}" >&2
+  if [ "$tool_count" -ge 75 ]; then
+    echo "[Context Budget] ⚠ High tool usage — consider /compact or ecomode" >&2
+  fi
+fi
+
+# Pass through
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/session-env-check.sh

@@ -50,6 +50,38 @@ if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/n
   CURRENT_BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
 fi
 
+# Drift Detection: compare git HEAD between sessions
+DRIFT_STATUS="not-git"
+if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  SESSION_STATE_DIR="$HOME/.claude/session-state"
+  mkdir -p "$SESSION_STATE_DIR"
+
+  PROJECT_HASH=$(echo "$(pwd)" | md5 2>/dev/null || echo "$(pwd)" | md5sum 2>/dev/null | cut -c1-8)
+  # md5 on macOS outputs "MD5 (stdin) = <hash>", extract just the hash
+  PROJECT_HASH=$(echo "$PROJECT_HASH" | grep -oE '[a-f0-9]{32}' | cut -c1-8)
+  STATE_FILE="${SESSION_STATE_DIR}/${PROJECT_HASH}.last-head"
+
+  CURRENT_HEAD=$(git log -1 --format="%H" 2>/dev/null || echo "")
+
+  if [ -n "$CURRENT_HEAD" ]; then
+    if [ -f "$STATE_FILE" ]; then
+      LAST_HEAD=$(cat "$STATE_FILE" 2>/dev/null || echo "")
+      if [ -n "$LAST_HEAD" ] && [ "$LAST_HEAD" != "$CURRENT_HEAD" ]; then
+        DRIFT_STATUS="drifted"
+        NEW_COMMITS=$(git rev-list --count "${LAST_HEAD}..${CURRENT_HEAD}" 2>/dev/null || echo "?")
+        CHANGED_FILES=$(git diff --name-only "${LAST_HEAD}..${CURRENT_HEAD}" 2>/dev/null | head -10)
+      else
+        DRIFT_STATUS="clean"
+      fi
+    else
+      DRIFT_STATUS="first-session"
+    fi
+
+    # Save current HEAD for next session
+    echo "$CURRENT_HEAD" > "$STATE_FILE"
+  fi
+fi
+
 # Write status to file for other hooks to reference
 STATUS_FILE="/tmp/.claude-env-status-${PPID}"
 cat > "$STATUS_FILE" << ENVEOF
@@ -58,6 +90,7 @@ agent_teams=${AGENT_TEAMS_STATUS}
 git_branch=${CURRENT_BRANCH}
 claude_version=${CLAUDE_VERSION}
 compat_status=${COMPAT_STATUS}
+drift_status=${DRIFT_STATUS}
 ENVEOF
 
 # Report to stderr (visible in conversation)
@@ -78,6 +111,31 @@ else
   echo "  ✓ Feature branch detected" >&2
 fi
 echo "  Rules: feature branch → commit → push → PR → merge" >&2
+echo "" >&2
+
+# Drift Detection report
+echo "  [Drift Detection]" >&2
+case "$DRIFT_STATUS" in
+  drifted)
+    echo "  ⚠ Repository changed since last session" >&2
+    echo "  New commits: ${NEW_COMMITS}" >&2
+    if [ -n "${CHANGED_FILES:-}" ]; then
+      echo "  Changed files:" >&2
+      echo "$CHANGED_FILES" | while IFS= read -r file; do
+        echo "    - ${file}" >&2
+      done
+    fi
+    ;;
+  clean)
+    echo "  ✓ No changes since last session" >&2
+    ;;
+  first-session)
+    echo "  First session for this project" >&2
+    ;;
+  not-git)
+    echo "  Skipped (not a git repository)" >&2
+    ;;
+esac
 echo "------------------------------------" >&2
 
 # Pass through

package/templates/.claude/rules/MUST-agent-identification.md

@@ -19,6 +19,53 @@ Default (no specific agent): `┌─ Agent: claude (default)`
 For brief responses: `[mgr-creator] Creating agent structure...`
 With skill: `[fe-vercel-agent → react-best-practices] Analyzing...`
 
+## Routing & Skill Context
+
+When the orchestrator uses a routing skill, identification should reflect the active context:
+
+```
+┌─ Agent: claude (secretary-routing)
+├─ Skill: secretary-routing
+└─ Task: route agent management request
+```
+
+| Context | Identification |
+|---------|---------------|
+| No routing active | `claude (default)` |
+| secretary-routing | `claude (secretary-routing)` |
+| dev-lead-routing | `claude (dev-lead-routing)` |
+| de-lead-routing | `claude (de-lead-routing)` |
+| qa-lead-routing | `claude (qa-lead-routing)` |
+| Skill invocation | `claude → {skill-name}` |
+
+## Skill Invocation Format
+
+When the orchestrator invokes a skill via the Skill tool, the skill name MUST be integrated into the identification block — NOT displayed as a separate tool call.
+
+```
+┌─ Agent: claude → {skill-name}
+└─ Task: {brief-task-description}
+```
+
+### Common Violations
+
+```
+❌ WRONG: Skill as separate display
+   ┌─ Agent: claude (default)
+   └─ Task: research topic analysis
+
+   Skill(research)    ← separate, disconnected
+
+✓ CORRECT: Skill integrated into identification
+   ┌─ Agent: claude → research
+   └─ Task: research topic analysis
+
+✓ CORRECT: With sub-skill
+   ┌─ Agent: claude → research
+   ├─ Skill: result-aggregation
+   └─ Task: aggregate team findings
+```
+
 ## When to Display
 
 | Situation | Display |
@@ -27,3 +74,4 @@ With skill: `[fe-vercel-agent → react-best-practices] Analyzing...`
 | Using skill | Include skill name |
 | General conversation | "claude (default)" |
 | Long tasks | Show progress with agent context |
+| Skill invocation | Integrated `claude → {skill-name}` format |

package/templates/.claude/rules/MUST-agent-teams.md

@@ -20,6 +20,7 @@ Available when `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` or TeamCreate/SendMessag
 | Code review + fix cycle | **Agent Teams** | Review → fix → re-review loop |
 | Single file operations | Agent Tool | Overkill for simple tasks |
 | Dynamic agent creation + usage | **Agent Teams** | Create → test → iterate cycle |
+| Multi-issue release batch | **Agent Teams** | Shared task tracking, coordinated release |
 
 **When Agent Teams is enabled and criteria are met, usage is MANDATORY.**
 
@@ -41,9 +42,14 @@ BEFORE using Agent tool for 2+ agent tasks, this check is **ENFORCED**:
 ║                                                                   ║
 ║  3. Is there a review → fix → re-review cycle?                  ║
 ║     YES → MUST use Agent Teams                                   ║
+║     NO  → Check #4                                               ║
+║                                                                   ║
+║  4. Are 2+ issues being fixed in the same release batch?        ║
+║     YES → SHOULD use Agent Teams (coordination benefit)          ║
 ║     NO  → Proceed with Agent tool                                ║
 ║                                                                   ║
-║  Simple rule: 3+ agents OR review cycle → Agent Teams            ║
+║  Simple rule: 3+ agents OR review cycle → Agent Teams (MUST)    ║
+║  2+ issues in same batch → Agent Teams (SHOULD)                  ║
 ║  Everything else → Agent tool                                    ║
 ╚══════════════════════════════════════════════════════════════════╝
 ```
@@ -122,6 +128,18 @@ When spawning Agent Teams members:
      Agent(researcher-1) → Analysis 1  ┐
      Agent(researcher-2) → Analysis 2  ├─ ALL spawned together
      Agent(researcher-3) → Analysis 3  ┘
+
+❌ WRONG: Multi-issue batch as independent agents
+   Agent(general-purpose) → "Fix issue #1"
+   Agent(general-purpose) → "Fix issue #2"
+   Agent(general-purpose) → "Fix issue #3"
+   (no coordination, no shared task tracking)
+
+✓ CORRECT: Agent Teams for multi-issue batches
+   TeamCreate("release-fixes")
+   TaskCreate for each issue
+   Agent(fixer-1) + Agent(fixer-2) + Agent(fixer-3) → team members
+   Shared task list tracks progress across all issues
 ```
 
 ## Cost Guidelines
@@ -202,3 +220,5 @@ Agent Teams actively preferred for qualifying collaborative tasks. Use Agent too
 - Simple independent subtasks
 
 Do NOT avoid Agent Teams solely for cost reasons when criteria are met.
+
+**Active preference rule**: When Agent Teams is available, default to using it for any multi-step or multi-issue work. Only fall back to Agent tool for truly simple, single-issue tasks with no verification needs.

package/templates/.claude/rules/SHOULD-ecomode.md

@@ -35,3 +35,42 @@ Ecomode: `[lang-golang-expert] ✓ src/main.go reviewed: 1 naming issue (handle_
 ## Override
 
 Disable with: "ecomode off", "verbose mode", or "show full details".
+
+## Context Budget Management
+
+Task-type-aware context thresholds that trigger ecomode earlier for context-heavy operations.
+
+### Task Type Thresholds
+
+| Task Type | Context Trigger | Rationale |
+|-----------|----------------|-----------|
+| Research (/research, multi-team) | 40% | High context consumption from parallel team results |
+| Implementation (code generation) | 50% | Moderate context for code + test output |
+| Review (code review, audit) | 60% | Moderate context for diff analysis |
+| Management (git, deploy, CI) | 70% | Lower context needs |
+| General (default) | 80% | Standard threshold |
+
+### Detection
+
+Task type is inferred from active context:
+- **Research**: `/research` skill active, 4+ parallel agents
+- **Implementation**: Write/Edit tools dominant, code files targeted
+- **Review**: Read/Grep dominant, review/audit skill active
+- **Management**: git/gh commands, CI/CD operations
+- **General**: No specific pattern detected
+
+### Budget Advisor Hook
+
+The `context-budget-advisor.sh` hook monitors context usage and emits warnings when task-specific thresholds are approached:
+
+```
+[Context Budget] Task: research | Threshold: 40% | Current: 38%
+[Context Budget] ⚠ Approaching budget limit — consider /compact or ecomode
+```
+
+### Integration
+
+- Works with existing ecomode activation (R013)
+- Does NOT override explicit user settings
+- Advisory only — never blocks operations
+- Context percentage from statusline data when available

package/templates/.claude/rules/SHOULD-memory-integration.md

@@ -38,6 +38,56 @@ Agent frontmatter `memory: project|user|local` enables persistent memory:
 - Do not store sensitive data or duplicate CLAUDE.md content
 - Memory write failures should not block main task
 
+## Confidence-Tracked Memory
+
+Memory entries in MEMORY.md should include confidence annotations to distinguish verified facts from hypotheses.
+
+### Confidence Levels
+
+| Level | Tag | Meaning | Example |
+|-------|-----|---------|---------|
+| High | `[confidence: high]` | Verified across multiple sessions or confirmed by user | Architecture decisions, confirmed patterns |
+| Medium | `[confidence: medium]` | Observed pattern, not yet fully verified | Code conventions seen in 2-3 files |
+| Low | `[confidence: low]` | Single observation or hypothesis | First-time discovery, untested assumption |
+
+### Format in MEMORY.md
+
+```
+### Key Patterns [confidence: high]
+- `.claude/` files are gitignored → always use `git add -f`
+- pre-commit hooks auto-detect README/manifest count mismatches
+
+### Hypotheses [confidence: medium]
+- Template sync might need CI enforcement (seen in 2 PRs)
+
+### Unverified [confidence: low]
+- Possible race condition in parallel hook execution (observed once)
+```
+
+### Confidence Lifecycle
+
+```
+[low] → observed again → [medium] → confirmed by user/testing → [high]
+[any] → contradicted by evidence → demoted or removed
+```
+
+### Rules
+
+| Rule | Detail |
+|------|--------|
+| New discoveries | Start at `[confidence: low]` unless user explicitly confirms |
+| Cross-session verification | Promote to `[confidence: medium]` when seen in 2+ sessions |
+| User confirmation | Promote to `[confidence: high]` when user confirms or tests pass |
+| Contradiction | Demote or remove when contradicted by new evidence |
+| Default | Entries without tags are treated as `[confidence: high]` (backward compatibility) |
+
+### Integration with Session-End
+
+When sys-memory-keeper updates MEMORY.md at session end:
+1. New findings from this session → `[confidence: low]`
+2. Findings that match existing entries → promote confidence
+3. Findings that contradict existing entries → flag for review
+
 ## Session-End Auto-Save
 
 ### Trigger
@@ -49,23 +99,63 @@ Session-end detected when user says: "끝", "종료", "마무리", "done", "wrap
 ```
 User signals session end
   → Orchestrator delegates to sys-memory-keeper
-    → sys-memory-keeper performs dual-system save:
-       1. claude-mem save (if available)
-       2. episodic-memory verification (if available)
-    → Reports result to orchestrator
+    → sys-memory-keeper performs:
+       1. Collect session summary (tasks, decisions, open items)
+       2. Update native auto-memory (MEMORY.md)
+       3. Return formatted summary to orchestrator
+  → Orchestrator performs MCP saves directly:
+       1. claude-mem save (if available via ToolSearch)
+       2. episodic-memory verification (if available via ToolSearch)
   → Orchestrator confirms to user
 ```
 
+### Responsibility Split
+
+MCP tools (claude-mem, episodic-memory) are **orchestrator-scoped** and not inherited by subagents. Therefore:
+
+| Responsibility | Owner | Reason |
+|----------------|-------|--------|
+| Session summary collection | sys-memory-keeper | Domain expertise in memory formatting |
+| Native auto-memory (MEMORY.md) | sys-memory-keeper | Has Write access to memory directory |
+| claude-mem MCP save | Orchestrator | MCP tools only available at orchestrator level |
+| episodic-memory MCP verification | Orchestrator | MCP tools only available at orchestrator level |
+
 ### Dual-System Save
 
-| System | Tool | Action | Required |
-|--------|------|--------|----------|
-| claude-mem | `mcp__plugin_claude-mem_mcp-search__save_memory` | Save session summary with project, tasks, decisions | No (best-effort) |
-| episodic-memory | `mcp__plugin_episodic-memory_episodic-memory__search` | Verify session is indexed for future retrieval | No (best-effort) |
+| System | Owner | Tool | Action | Required |
+|--------|-------|------|--------|----------|
+| Native auto-memory | sys-memory-keeper | Write | Update MEMORY.md with session learnings | Yes |
+| claude-mem | Orchestrator | `mcp__plugin_claude-mem_mcp-search__save_memory` | Save session summary with project, tasks, decisions | No (best-effort) |
+| episodic-memory | Orchestrator | `mcp__plugin_episodic-memory_episodic-memory__search` | Verify session is indexed for future retrieval | No (best-effort) |
+
+### Session-End Self-Check (MANDATORY)
+
+```
+╔══════════════════════════════════════════════════════════════════╗
+║  BEFORE CONFIRMING SESSION-END TO USER:                          ║
+║                                                                   ║
+║  1. Did sys-memory-keeper update MEMORY.md?                      ║
+║     YES → Continue                                               ║
+║     NO  → Delegate to sys-memory-keeper first                    ║
+║                                                                   ║
+║  2. Did I attempt claude-mem save?                               ║
+║     YES → Continue (even if it failed)                           ║
+║     NO  → ToolSearch + save now                                  ║
+║                                                                   ║
+║  3. Did I attempt episodic-memory verification?                  ║
+║     YES → Continue (even if it failed)                           ║
+║     NO  → ToolSearch + verify now  ← THIS IS THE COMMONLY       ║
+║           SKIPPED STEP. DO NOT SKIP IT.                          ║
+║                                                                   ║
+║  ALL THREE must be attempted before confirming to user.          ║
+║  "Attempted" means called the tool — failure is OK, skipping     ║
+║  is NOT.                                                          ║
+╚══════════════════════════════════════════════════════════════════╝
+```
 
 ### Failure Policy
 
-- Both saves are **non-blocking**: memory failure MUST NOT prevent session from ending
+- MCP saves are **non-blocking**: memory failure MUST NOT prevent session from ending
 - If claude-mem unavailable: skip, log warning
 - If episodic-memory unavailable: skip, log warning
 - If both unavailable: warn user, proceed with session end

package/templates/.claude/skills/research/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: research
 description: 10-team parallel deep analysis with cross-verification for any topic, repository, or technology. Use when user invokes /research or asks for comprehensive research.
-context: fork
 user-invocable: true
 ---
 

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.24.1",
+  "version": "0.30.0",
   "lastUpdated": "2026-03-09T00:00:00.000Z",
   "components": [
     {