oh-my-customcode 1.0.14 → 1.0.15

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.0.14",
+    version: "1.0.15",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.0.14",
+  version: "1.0.15",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/rules/MAY-optimization.md

@@ -14,6 +14,8 @@
 
 > **Platform tool variants (#1327 찐빠 #5)**: tool names differ by platform — e.g., macOS lacks GNU `timeout` (use `gtimeout` from coreutils). Confirm platform-specific tool availability before use.
 
+> **BSD sed `\?` 미지원 (#1413)**: macOS BSD sed는 `\?`(optional 메타문자, GNU 확장)를 해석하지 않아 `sed 's|https\?://||'` 치환이 무음 실패한다. URL 도메인 추출 등은 `cut -d'/' -f3` 같은 POSIX 호환 수단을 사용한다.
+
 > **Sandbox/container tool gaps (#1401 찐빠 #4)**: `curl`, `wget`, `nc` 등 공통 CLI 도구는 샌드박스·컨테이너 환경에서 미설치일 수 있다. HTTP 요청에는 `WebFetch` 도구를 우선 사용하고, CLI 도구 사용 전 `command -v <tool>` 으로 가용성을 사전 확인한다.
 
 > **Shell output parsing — use Python, not read/grep (#1401 찐빠 #3)**: adb bounds rect, 좌표쌍, JSON 분할 등 구조화된 출력 파싱은 `read`+`grep -o` 파이프라인 대신 Python (`python3 -c "..."`) 을 사용한다. `read`+`grep -o` 조합은 공백 차이에 취약해 헛값을 산출한다. SSH 원격 `bash -c` 인자에 소괄호 포함 금지 — `ssh host "cmd; cmd2"` 형식 사용.

package/templates/.claude/rules/MUST-agent-design.md

@@ -46,6 +46,8 @@ This is a settings-level resilience mechanism, distinct from the per-agent `mode
 
 > **v2.1.183+**: CC now warns (stderr, in `-p` print mode) when the requested model is deprecated or auto-updated to a newer model — and this warning now ALSO covers models set in agent frontmatter (`model:`). Relevant to the Model Aliases table above: a stale/deprecated `model:` value in agent frontmatter now surfaces a deprecation warning instead of silently resolving. Separately, v2.1.183 fixes `thinking.disabled.display: Extra inputs are not permitted` 400 errors on subagent spawns and session-title generation — extends the v2.1.166 toggle above; subagent spawns with thinking disabled no longer 400.
 
+> **v2.1.187+**: Org-configured model restrictions now apply to the model picker, `--model`, `/model`, and `ANTHROPIC_MODEL` (a restricted model shows "restricted by your organization's settings"). Extends the v2.1.175 `enforceAvailableModels` scope to per-agent `model:` override entry points — a managed model allowlist now also constrains the picker/env paths. Also fixed `--json-schema` / workflow `agent({schema})` structured output: the model can no longer re-call `StructuredOutput` indefinitely after a successful call, and follow-up turns reliably return structured output — relevant to schema-constrained subagent spawns.
+
 ### Safe Mode & Bundled Skill Control (CC v2.1.169+)
 
 > **v2.1.169+**: `--safe-mode` (and `CLAUDE_CODE_SAFE_MODE`) starts Claude Code with ALL customizations disabled (CLAUDE.md, plugins, skills, hooks, MCP servers) — use it to isolate whether a project customization (agent/skill/hook) causes a regression. The `disableBundledSkills` setting (and `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` env) hides bundled skills, workflows, and built-in slash commands from the model — useful when bundled skills conflict with or duplicate project skills (R006 skill-surface management). Note: `disableBundledSkills` hides skills from the model but is a CC platform setting, distinct from the advisory `skills:` frontmatter field (which is documentation metadata, not a runtime allowlist).

package/templates/.claude/rules/MUST-agent-teams.md

@@ -378,6 +378,8 @@ Cross-reference: R020 ("actual outcome ≠ attempt" — verifying that a command
 
 Observed instance: v0.159.0 release (session 105) — members assigned to disjoint-file cleanup tasks went idle without executing; deterministic git-diff check exposed the gap; work was reassigned to standalone parallel Agents. References: #1261, #1262.
 
+> **v2.1.186+**: Added the `teammateMode: "iterm2"` setting (warns when auto mode cannot find the `it2` CLI), and added status filtering (press `f`) to the `/workflows` agent detail view. Relevant to Agent Teams teammate launch configuration (cf. v2.1.183 tmux teammate-pane fix).
+
 ## Member Prompt Size Cap
 
 Keep per-member delegation prompts under ~5000 tokens and within a single domain. Oversized or multi-domain prompts risk malformed-parsing truncation in the CC platform (see R009 giant-prompt heuristic and `feedback_agent_malformed_parsing.md`). Large multi-file delegations should be decomposed and split across multiple members or standalone Agents.

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -325,6 +325,10 @@ Before spawning any agent:
 
 > **v2.1.181+**: Fixed prompt caching not reading on a custom `ANTHROPIC_BASE_URL` (and on Foundry) due to a per-request attestation token changing every turn. Further strengthens background-agent provider isolation (cf. v2.1.174 ANTHROPIC_* env isolation, v2.1.178 401 bearer-token fix): a `/bg`-dispatched or custom-gateway session now benefits from prompt caching instead of paying a cache miss every turn. Separately, v2.1.179 fixed remote-session background tasks appearing stuck as "still running" between turns. `mode: "bypassPermissions"` on every Agent tool call remains required regardless.
 
+> **v2.1.186+**: `!` bash commands now trigger Claude to respond to the output automatically (set `"respondToBashCommands": false` to keep the prior context-only behavior). Also fixed Esc/Ctrl+C not responding while background agents run after the main turn ends. `mode: "bypassPermissions"` on every Agent tool call remains required.
+
+> **v2.1.187+**: Fixed subagent depth tracking — resumed subagents restore their original spawn depth, and forked subagents count toward the depth cap. Also fixed background jobs stuck in "working" indefinitely when an agent ended a turn without structured output, and leaked agent worktree registrations are now auto-cleaned. Reinforces the sole-orchestrator design's depth accounting (cf. v2.1.172 5-level nesting note). `mode: "bypassPermissions"` remains required.
+
 ## Agent Capability Pre-Check
 
 Before delegating a task to a subagent, MUST verify the target agent's tool capabilities against the task requirements. Failure to pre-check causes round-trip waste (delegation → failure → re-delegation).

package/templates/.claude/rules/MUST-permissions.md

@@ -49,6 +49,10 @@ Use a `"*"` deny rule in `settings.json` to enforce a deny-by-default posture, t
 
 > **v2.1.183+**: Fixed MCP servers requiring authentication exposing auth-stub tools to the model in headless/SDK mode — unauthenticated MCP auth-stub tools are no longer surfaced to the model in `-p` / SDK runs (they would fail on call). Relevant to the Tier-6 MCP tier: a headless run no longer offers auth-stub MCP tools. Separately, v2.1.181 added the `sandbox.allowAppleEvents` opt-in setting, letting sandboxed commands send Apple Events on macOS (default off) — a deliberate sandbox-scope widening, complementing the Tier-based policy above.
 
+> **v2.1.186+**: Added `claude mcp login <name>` / `claude mcp logout <name>` to authenticate MCP servers from the CLI without the interactive `/mcp` menu (`--no-browser` stdin redirect for SSH). Also fixed `Agent(type)` deny rules and `Agent(x,y)` allowed-types restrictions not being enforced for named subagent spawns — extends the v2.1.178 `Tool(param:value)` per-parameter permission syntax (Agent model/param deny) to reliable enforcement on named spawns. Relevant to Tier-6 MCP and the Agent Tool Permission Mode section.
+
+> **v2.1.187+**: Org-configured model restrictions now apply to the model picker, `--model`, `/model`, and `ANTHROPIC_MODEL`, surfacing a "restricted by your organization's settings" message for a restricted model. Extends the v2.1.175 `enforceAvailableModels` managed-setting scope to the model picker/env entry points. Also added the `sandbox.credentials` setting (blocks sandboxed reads of credential files/secret env) — cross-ref R001.
+
 ## Agent Tool Permission Mode
 
 When spawning subagents via the Agent tool, always pass `mode: "bypassPermissions"` explicitly. The Agent tool's default mode is `acceptEdits`, which **overrides** the agent frontmatter `permissionMode` field.

package/templates/.claude/rules/MUST-safety.md

@@ -98,6 +98,8 @@ Cross-reference: R010 Subagent Scope-Creep STOP Protocol (2-trip stop), R015 Fai
 
 Cross-reference: R010 Subagent Scope-Creep STOP Protocol, R002 (permission tiers).
 
+> **v2.1.187+**: Added the `sandbox.credentials` setting — blocks sandboxed commands from reading credential files and secret environment variables. Platform-level complement to this section's credential guardrails (the model still never echoes secret values; CC now also blocks sandboxed reads of credential files/secret env at the platform level) — defense-in-depth.
+
 ## Required Before Destructive Operations
 
 Verify target, assess impact scope, check recoverability, get user approval.

package/templates/.claude/skills/claude-native/SKILL.md

@@ -90,26 +90,26 @@ Issue body format (matching the pattern established by issue #683):
 **Published:** {published_at}
 **Link:** {html_url}
 
-## Release Summary
+## 릴리즈 요약
 
 {release_notes_body — truncated to first 2000 chars if too long}
 
 ---
 
-## Action Items
+## 액션 아이템
 
-- [ ] Review release notes for impact on oh-my-customcode
-- [ ] Update agent definitions if new Claude Code features affect agents
-- [ ] Test compatibility with current oh-my-customcode version
-- [ ] Update CLAUDE.md if new capabilities are relevant
+- [ ] oh-my-customcode 영향도 관점에서 릴리즈 노트 검토
+- [ ] 새 Claude Code 기능이 에이전트에 영향을 주면 에이전트 정의 갱신
+- [ ] 현재 oh-my-customcode 버전과의 호환성 테스트
+- [ ] 새 기능이 관련되면 CLAUDE.md 갱신
 
 ---
 
-_This issue was auto-created by the cc-release-monitor workflow (claude-native skill)._
+_이 이슈는 cc-release-monitor 워크플로우(claude-native 스킬)가 자동 생성했습니다._
 ```
 
 **Notes:**
-- If `body` from the release is empty, use `_No release notes provided._`
+- If `body` from the release is empty, use `_릴리즈 노트가 제공되지 않았습니다._`
 - Truncate release body at 2000 characters and append `... (truncated)` if needed
 - The `automated` and `claude-code-release` labels must exist in the repository; create them if missing:
   ```bash

package/templates/.claude/skills/scout/SKILL.md

@@ -54,7 +54,7 @@ If invalid: `[Pre-flight] GATE: Invalid or unreachable URL. Please check and ret
 Search existing GitHub issues for prior scout reports on the same URL domain:
 
 ```bash
-DOMAIN=$(echo "$URL" | sed 's|https\?://||' | cut -d'/' -f1)
+DOMAIN=$(echo "$URL" | cut -d'/' -f3)
 gh issue list --state all --label "scout:internalize,scout:integrate,scout:skip" \
   --json number,title,body --jq ".[] | select(.body | contains(\"$DOMAIN\"))" 2>/dev/null
 ```

package/templates/.github/workflows/cc-release-monitor.yml

@@ -122,7 +122,7 @@ jobs:
               # Truncate release body
               MAX_BODY = 2000
               if not body_raw:
-                  release_summary = "_No release notes provided._"
+                  release_summary = "_릴리즈 노트가 제공되지 않았습니다._"
               elif len(body_raw) > MAX_BODY:
                   release_summary = body_raw[:MAX_BODY] + "... (truncated)"
               else:
@@ -135,22 +135,22 @@ jobs:
                   **Published:** {published_at}
                   **Link:** {html_url}
 
-                  ## Release Summary
+                  ## 릴리즈 요약
 
                   {release_summary}
 
                   ---
 
-                  ## Action Items
+                  ## 액션 아이템
 
-                  - [ ] Review release notes for impact on oh-my-customcode
-                  - [ ] Update agent definitions if new Claude Code features affect agents
-                  - [ ] Test compatibility with current oh-my-customcode version
-                  - [ ] Update CLAUDE.md if new capabilities are relevant
+                  - [ ] oh-my-customcode 영향도 관점에서 릴리즈 노트 검토
+                  - [ ] 새 Claude Code 기능이 에이전트에 영향을 주면 에이전트 정의 갱신
+                  - [ ] 현재 oh-my-customcode 버전과의 호환성 테스트
+                  - [ ] 새 기능이 관련되면 CLAUDE.md 갱신
 
                   ---
 
-                  _This issue was auto-created by the cc-release-monitor GitHub Actions workflow._\
+                  _이 이슈는 cc-release-monitor GitHub Actions 워크플로우가 자동 생성했습니다._\
               """)
 
               create = subprocess.run(

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.14",
+  "version": "1.0.15",
   "lastUpdated": "2026-05-20T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",