oh-my-customcode 1.0.5 → 1.0.6

package/dist/cli/index.js

@@ -241,7 +241,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.0.5",
+    version: "1.0.6",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2031,7 +2031,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.0.5",
+  version: "1.0.6",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/agents/infra-aws-expert.md

@@ -40,10 +40,64 @@ Skills are located at: `.claude/skills/aws-best-practices/`
 
 Guides are located at: `guides/aws/`
 
+## AWS MCP Server Integration (opt-in)
+
+The AWS MCP Server (GA) is a remote MCP server managed by AWS that provides live documentation lookup and real AWS API execution. It complements this agent's offline design/IaC role by filling two gaps: knowledge-cutoff staleness and lack of direct execution.
+
+### Available Tools (when aws-mcp is configured)
+
+| Tool | Purpose | Privilege level |
+|------|---------|----------------|
+| `search_documentation` | Full-text search across latest AWS docs and best practices | Read-only, safe |
+| `read_documentation` | Fetch a specific AWS documentation page | Read-only, safe |
+| `call_aws` | Execute 15,000+ AWS API operations using existing IAM credentials | **HIGH — can create/modify/delete resources** |
+| `run_script` | Run sandboxed Python with IAM permissions (no network/filesystem access) | Sandboxed, IAM-scoped |
+
+### Usage Guidelines
+
+When aws-mcp is available, prioritize live documentation over static knowledge:
+
+1. Use `search_documentation` / `read_documentation` first to verify current AWS API syntax, service limits, and best practices before designing or reviewing architecture.
+2. Use `call_aws` only when the user explicitly requests real AWS operations (describe, create, modify, delete). Default to IaC code generation (CloudFormation/CDK/Terraform) for infrastructure changes.
+3. Use `run_script` for AWS data analysis or resource audits that benefit from programmatic processing.
+
+### R010/R001 Privileged-Scope Boundary (IMPORTANT)
+
+`call_aws` can create, modify, and delete real AWS resources — it is a high-privilege execution tool.
+
+**Required boundary for any `call_aws` operation:**
+
+- (a) Orchestrator MUST NOT call `call_aws` directly — delegate ALL AWS API execution to this infra-aws-expert agent (R010).
+- (b) The delegation prompt MUST explicitly state: approved actions, forbidden actions (e.g., "do NOT delete resources", "do NOT modify production"), and the authorization scope tied to the user request (R010 Pre-Delegation Privileged-Scope Boundary).
+- (c) Prefer IAM-scoped read-only access (Describe*/List* operations) by default. Write/delete operations require explicit user approval per invocation.
+- (d) NEVER echo IAM credentials, access keys, or secret values into the transcript or output (R001). Reference by name only.
+- (e) Prefer read-only verification (`describe-*`, `list-*`) before any write operation to confirm target state.
+
+### Activation (opt-in, user-manual)
+
+R001 prohibits auto-installation. The user must install manually:
+
+```bash
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
+```
+
+`mcp-proxy-for-aws` bridges IAM credentials to MCP OAuth. Regional availability: US East (us-east-1), Europe (eu-central-1). AWS API calls are possible in all regions.
+
+Once installed, add `aws-mcp` to the agent's `mcpServers` in `.mcp.json` or the agent frontmatter to activate. Without installation, this agent falls back to the offline `aws-best-practices` skill and `guides/aws/` documents.
+
+### Security Features
+
+- IAM context key-based granular access control
+- CloudWatch `AWS-MCP` namespace separates agent calls from human calls
+- CloudTrail audit trail for all `call_aws` operations
+- Sandboxed script execution (no network or filesystem access)
+
 ## Workflow
 
 1. Understand requirements
-2. Apply aws-best-practices skill
-3. Reference aws guide for specifics
-4. Design/review architecture
-5. Ensure security, scalability, cost optimization
+2. If aws-mcp is available, use `search_documentation` to verify current AWS documentation for the relevant service
+3. Apply aws-best-practices skill for offline patterns and Well-Architected guidance
+4. Reference aws guide for specifics
+5. Design/review architecture — prefer IaC code generation over live `call_aws` unless user explicitly requests real execution
+6. If real AWS operations are needed, confirm scope with user, then use `call_aws` within approved boundary
+7. Ensure security, scalability, cost optimization

package/templates/.claude/skills/aws-best-practices/SKILL.md

@@ -9,6 +9,8 @@ user-invocable: false
 
 Apply AWS patterns for building scalable, secure, and cost-effective cloud infrastructure.
 
+> **Offline core vs. live documentation**: This skill provides static Well-Architected patterns that work without credentials or network access — the always-available baseline. For real-time AWS documentation, current API syntax, and up-to-date best practices (resolving knowledge-cutoff gaps), use the AWS MCP Server's `search_documentation` / `read_documentation` tools when installed. The two sources are complementary: static patterns for structural guidance; live docs for current specifics. Installation is user-manual (R001 auto-install prohibited) — see `infra-aws-expert` agent for setup instructions.
+
 ## Well-Architected Framework Pillars
 
 ### 1. Operational Excellence

package/templates/CLAUDE.md

@@ -243,6 +243,7 @@ Claude Code의 Agent Teams 기능이 활성화되어 있으면 (`CLAUDE_CODE_EXP
 |------|------|
 | code-review-graph | Token-efficient AST 기반 context retrieval (8.2× 토큰 절감) — wrapper: `crg-integration` 스킬 (#1171) |
 | semble | Semantic code search via embeddings (98% 토큰 절감, NDCG@10=0.854) — wrapper: `semble-integration` 스킬 (#1173) |
+| aws-mcp | AWS 서비스 인증 접근 — call_aws(15,000+ API 실행), search_documentation/read_documentation(실시간 AWS 문서), run_script(샌드박스). 고특권 실행은 infra-aws-expert 위임 + R010/R001 특권경계 |
 
 ### 설치 명령어
 
@@ -263,6 +264,10 @@ pipx install code-review-graph
 uv tool install semble
 claude mcp add semble -- semble mcp
 # 또는 .mcp.json 수동 편집 (R001 auto-install 금지)
+
+# AWS MCP 서버 (IAM 인증 필요, 수동 설치 — R001 auto-install 금지)
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
+# 사전요건: AWS IAM 자격증명 구성. 가용 리전: us-east-1, eu-central-1 (API 호출은 전 리전)
 ```
 
 <!-- omcustom:git-workflow -->

package/templates/guides/aws/index.yaml

@@ -12,15 +12,49 @@ source:
     - https://docs.aws.amazon.com/
     - https://aws.amazon.com/architecture/
   last_fetched: "2026-01-22"
+  note: >
+    Static documents below were last fetched 2026-01-22 and may be stale.
+    For current AWS documentation, use the AWS MCP Server (mcp_server section below)
+    which provides real-time lookup with no knowledge-cutoff limitation.
+
+mcp_server:
+  name: aws-mcp
+  type: remote
+  managed_by: AWS
+  endpoint: https://aws-mcp.us-east-1.api.aws/mcp
+  availability:
+    - us-east-1  # US East (N. Virginia)
+    - eu-central-1  # Europe (Frankfurt)
+  note: >
+    Live source — takes precedence over static documents below for current API syntax,
+    service limits, and best practices. Requires user-manual installation (R001 auto-install
+    prohibited). AWS API calls via call_aws are possible in all regions regardless of
+    MCP endpoint region.
+  tools:
+    - name: search_documentation
+      description: Full-text search across latest AWS docs and best practices (read-only, safe)
+    - name: read_documentation
+      description: Fetch a specific AWS documentation page (read-only, safe)
+    - name: call_aws
+      description: >
+        Execute 15,000+ AWS API operations using existing IAM credentials.
+        HIGH PRIVILEGE — can create/modify/delete resources. Delegate to infra-aws-expert
+        only; orchestrator must NOT call directly (R010). Requires explicit user approval
+        for write/delete operations. IAM credentials must not be echoed to transcript (R001).
+    - name: run_script
+      description: Run sandboxed Python with IAM permissions (no network/filesystem access)
+  install_command: >
+    claude mcp add-json aws-mcp --scope user
+    '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
 
 documents:
   - name: well-architected
     path: ./well-architected.md
-    description: AWS Well-Architected Framework summary
+    description: AWS Well-Architected Framework summary (static, last_fetched 2026-01-22)
 
   - name: common-patterns
     path: ./common-patterns.md
-    description: Common AWS architecture patterns
+    description: Common AWS architecture patterns (static, last_fetched 2026-01-22)
 
 used_by:
   - infra-aws-expert

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.5",
+  "version": "1.0.6",
   "lastUpdated": "2026-05-20T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",