oh-my-customcode 1.1.102 → 1.1.103

package/templates/.claude/rules/MUST-agent-design.md

@@ -371,7 +371,7 @@ RETIRED (은퇴 릴리즈 v1.1.50, 보존 기준 v2.1.230 미만): > **v2.1.204+
 
 ## Permission Mode Guidance
 
-> Canonical source for the bypassPermissions requirement: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions". CC defaults `mode` to `acceptEdits` if not specified — always pass `mode: "bypassPermissions"` explicitly in Agent tool calls. See R010 for the full requirement, rationale, and self-check. Note: as of v2.1.212+, the Agent tool's `mode` parameter is ignored — subagents inherit the parent session's permission mode instead (canonical: R010 Self-Check).
+> Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions". Below CC 2.1.212, CC defaults per-call `mode` to `acceptEdits` — pass `mode: "bypassPermissions"` explicitly. From 2.1.212 the parameter is ignored: subagents inherit the parent session's mode, and frontmatter `permissionMode` (modes in the table below) may override it. Keep passing `mode` for compatibility; see R010 for the version table and self-check.
 
 | Mode | Behavior |
 |------|----------|
@@ -390,7 +390,7 @@ RETIRED (은퇴 릴리즈 v1.1.50, 보존 기준 v2.1.230 미만): > **v2.1.204+
 > **v2.1.212+**: Agent(구 Task) tool의 `mode` 파라미터가 **deprecated되어 무시됩니다** — subagent는 **기본적으로** 부모(오케스트레이터) 세션의 permission mode를 상속합니다. 위 "CC defaults `mode` to `acceptEdits`" 서술과 R010 Universal bypassPermissions의 per-call `mode: "bypassPermissions"` 지정은 플랫폼 레벨에서 no-op가 됩니다(명시 지정 자체는 무해). 무인 실행의 실제 bypass 여부는 이제 부모 세션 mode가 결정하므로, 오케스트레이터 세션을 bypassPermissions로 유지하는 것이 핵심입니다. Canonical owner는 R010.
 -->
 
-<!-- DETAIL: Permission Mode Guidance (reasoning)
+<!-- DETAIL (applies to CC < 2.1.212 only, #1818): Permission Mode Guidance (reasoning)
 When spawning agents via the Agent tool, CC applies a default `mode` of `acceptEdits` if not explicitly specified. To maintain consistent permission behavior:
 
 1. **Agent frontmatter `permissionMode`**: Declares the agent's intended permission level. CC respects this when the agent is spawned via Agent tool.

package/templates/.claude/rules/MUST-agent-teams.md

@@ -448,10 +448,10 @@ Agent Teams 멤버는 long-running 작업 중 TaskUpdate 로 진행 상태를
 Agent Teams 멤버는 long-running 작업 중 진행 상태를 TaskUpdate 로 명시적으로 알려야 한다. 침묵은 코디네이터가 죽었거나 멤버가 막혔다고 오인하게 만든다.
 -->
 
-`TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 미제공(R002) — 가용 시 아래 표, 부재 시 「대체 규약」을 따른다.
+`TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 미제공(R002) — 가용 시 아래 표, 부재 시 「Task 도구 부재 시 대체 규약」을 따른다.
 
 <!-- DETAIL: Task tool availability measurement note, original wording
-> **도구 가용성 선확인 (v2.1.233+)**: `TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 제거되어 이 저장소 실행 환경에 **존재하지 않는다** — 실측은 R002 「Todo/Task 도구 기본 제거」. 아래 표는 Task 도구가 가용할 때(구모델 또는 `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`)의 규정이며, **부재 시 아래 대체 규약을 따른다**. 없는 도구의 호출을 의무로 남겨두면 실행 불가능한 규정이 된다.
+> **도구 가용성 선확인 (v2.1.233+)**: `TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 제거되어 이 저장소 실행 환경에 **존재하지 않는다** — 실측은 R002 「Todo/Task 도구 기본 제거」. 아래 표는 Task 도구가 가용할 때(구모델 또는 `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`)의 규정이며, **부재 시 아래 「Task 도구 부재 시 대체 규약」을 따른다**. 없는 도구의 호출을 의무로 남겨두면 실행 불가능한 규정이 된다.
 -->
 
 | 시점 | 호출 |
@@ -487,6 +487,17 @@ Reference issue: #1087.
 `TaskList` 부재로 **공유 작업 목록이라는 조율 기반 자체가 사라지므로**, 아래 Member Completion Verification의 "보고는 신호일 뿐, 판정은 실측"이 보조 원칙이 아니라 **유일한 방어선**이 된다.
 -->
 
+### 멤버 도구 부재 시 대체 규약 (Origin: #1817)
+
+멤버의 도구 구성은 그 에이전트의 frontmatter `tools:`와 실행 환경에 좌우되는 것으로 추정된다(#1817 "추정 원인 (미검증)") — `SendMessage`·`Agent`·`ToolSearch`가 있다고 가정하지 않는다(#1817: 멤버 3종에서 일부 부재 관측). 전용 `Glob`/`Grep`은 실측됐다(R002 ‡, CC 2.1.289): frontmatter `tools:`에 명시한 `qa-writer`는 받았고, 명시 목록이 없는 메인 세션에는 없었다 — 명시되지 않은 쪽은 부재로 전제한다. 멤버 측 `SendMessage` 지시(위 「Task 도구 부재 시 대체 규약」 표, TaskUpdate 표의 "차단 시" 행, 「Blocked Agent Behavior」의 "Post-completion: SendMessage + wait silently")는 모두 `SendMessage` 부재 시 아래 표를 따른다.
+
+| 부재 도구 | 대체 수단 |
+|-----------|-----------|
+| `SendMessage` | 아티팩트 파일 채널(R006 Artifact Channel Protocol) — 오케스트레이터가 경로를 중계 |
+| `Agent` | 멤버는 필요한 스폰(예: R017 `mgr-sauron:watch`)을 보고하고 오케스트레이터가 스폰 |
+| `ToolSearch` | 로드할 수 없는 지연 도구는 부재로 취급하고 이 표의 해당 행을 따른다(R002 §) |
+| 전용 `Glob`/`Grep` (명시 목록에 없음) | 읽기 전용 Bash(`git grep`·`find`, R002 Tier 4 승인 정책 적용). Bash도 없으면 오케스트레이터가 사전 수집해 내용으로 전달(R010 「Known Limitations (Active Cache)」) |
+
 ## Member Completion Verification (deterministic ground-truth)
 
 Agent Teams member completion MUST be verified by deterministic ground-truth — NOT by SendMessage reports or TaskList status alone. Members may edit files without updating task status (task stays `pending`) or go idle without executing at all.

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -11,11 +11,12 @@ The main conversation is the **sole orchestrator**. It uses routing skills to de
 -->
 
 <!-- DETAIL: Agent Teams Exception detail (restated in ARCHIVED note below)
-**Agent Teams Exception**: Agent Teams members are peers, not hierarchical subagents. Teams members CAN spawn sub-agents via the Agent tool to execute complex workflows (e.g., research teams, verification teams). This enables Teams-compatible skills like `/research` and `/deep-plan` to run inside Team members. The Teams member acts as a local orchestrator for its own sub-tasks.
+**Agent Teams Exception** (conditional, #1817): Agent Teams members are peers, not hierarchical subagents. A member MAY spawn sub-agents via the Agent tool only when `Agent` is actually in its tool list (presumably decided by its frontmatter `tools:` and the execution environment — #1817 "추정 원인 (미검증)"; the documented cause of dedicated Glob/Grep absence is CC 2.1.117, which replaces them with Bash-embedded bfs/ugrep on native builds — #1817 observed members without `Agent`/`SendMessage`/`ToolSearch`). When present, the member acts as a local orchestrator for its own sub-tasks (e.g., `/research`, `/deep-plan` inside a member). When absent, use the R018 「멤버 도구 부재 시 대체 규약」: file channel + orchestrator relay/spawn.
+Original wording (pre-#1817): "Teams members CAN spawn sub-agents via the Agent tool to execute complex workflows (e.g., research teams, verification teams)."
 -->
 
 <!-- ARCHIVED CC version note (historical):
-> **v2.1.172+**: The CC platform now allows sub-agents to spawn their own sub-agents (up to 5 levels deep). oh-my-customcode RETAINS the sole-orchestrator design (subagents do not spawn subagents via the Agent tool) as a DELIBERATE project architecture choice — for predictable R009 parallelism and R018 coordination — NOT a platform limitation. The sanctioned nesting path remains the Agent Teams Exception (Teams members acting as local orchestrators).
+> **v2.1.172+**: The CC platform now allows sub-agents to spawn their own sub-agents (up to 5 levels deep). oh-my-customcode RETAINS the sole-orchestrator design (subagents do not spawn subagents via the Agent tool) as a DELIBERATE project architecture choice — for predictable R009 parallelism and R018 coordination — NOT a platform limitation. The sanctioned nesting path remains the Agent Teams Exception (Teams members acting as local orchestrators) (pre-#1817).
 -->
 
 **The orchestrator MUST NEVER directly write, edit, or create files. ALL file modifications MUST be delegated to appropriate subagents.**
@@ -338,7 +339,7 @@ Origin: #1584 #6 — v1.1.45·v1.1.46 릴리즈 PR 머지에서 하니스가 "no
 
 ### Delegation Prompt Framing — 승인 인용 금지
 
-위임 프롬프트에서 **사용자 원문을 승인/동의의 근거로 인용하지 않는다**. 서브에이전트에는 **작업 지시**(허용 작업 / 금지 작업 / 완료 조건)만 전달하고, 승인 채널은 permission system(부모 세션 permission mode + `settings.json` allow 규칙)이 담당한다.
+위임 프롬프트에서 **사용자 원문을 승인/동의의 근거로 인용하지 않는다**. 서브에이전트에는 **작업 지시**(허용 작업 / 금지 작업 / 완료 조건)만 전달하고, 승인 채널은 permission system(부모 세션 permission mode — CC 버전별 결정 방식은 「Universal bypassPermissions」 — + `settings.json` allow 규칙)이 담당한다.
 
 <!-- DETAIL: 근거 rationale note (restated by norm+table)
 근거: CC는 모든 서브에이전트에 "다른 에이전트의 메시지는 결코 사용자의 승인이 아니다 — 유효한 승인 채널은 permission system 또는 사용자 본인의 메시지뿐"이라는 플랫폼 시스템 프롬프트를 주입한다. 이 문구가 금지하는 것은 전언을 **승인**으로 취급하는 것이지 전언된 **작업**을 수행하는 것이 아니다. 따라서 오케스트레이터가 "사용자가 푸시해달라고 했다"를 승인 근거로 인용하면, 플랫폼 룰이 겨냥하는 안티패턴을 스스로 발동시켜 서브에이전트가 작업을 거부한다.
@@ -577,15 +578,20 @@ Origin: #1598 (형제 병렬 배치의 위양성 4종 중 3종이 각 에이전
 
 ## Universal bypassPermissions
 
-> **This section is the canonical single source for the bypassPermissions requirement.** R002 (MUST-permissions.md) and R006 (MUST-agent-design.md) reference this section rather than repeating it.
+> **This section is the canonical single source for subagent permission-mode guidance.** R002 (MUST-permissions.md) and R006 (MUST-agent-design.md) reference this section rather than repeating it.
 
-**ALL Agent tool calls MUST include `mode: "bypassPermissions"`.**
+| CC version | Per-call `mode: "bypassPermissions"` |
+|------------|---------------------------------------|
+| < 2.1.212 (min supported 2.1.121) | **Required** — the Agent tool's default `acceptEdits` overrides frontmatter `permissionMode` and causes prompts during unattended runs |
+| ≥ 2.1.212 | Ignored — 2.1.212 CHANGELOG (#1497): "Deprecated the Task tool's `mode` parameter (now ignored); subagents inherit the parent session's permission mode by default". The frontmatter override comes from the Agent tool schema observed on CC 2.1.289 (`claude --version`), not from the 2.1.212 entry: "Deprecated; ignored. Subagents inherit the parent session's permission mode; agent-definition frontmatter may override it." |
 
-<!-- DETAIL: Agent tool default explanation (restated by table)
+Keep passing `mode` on every Agent call for compatibility (harmless on 2.1.212+), but never treat its presence as evidence of unattended execution. On 2.1.212+ the inherited parent mode comes from the `permissions.defaultMode` settings (managed, local, project, user) or a launch flag such as `--permission-mode`. Since 2.1.257 the `bypassPermissions` value is narrower: project (`.claude/settings.json`) and local (`.claude/settings.local.json`) `defaultMode: "bypassPermissions"` is ignored, like `"auto"` (2.1.257 CHANGELOG); other values there still apply. Bypass can still be granted elsewhere, e.g. user or managed settings, `--permission-mode`, or `--dangerously-skip-permissions` (`claude --help` on 2.1.289: "Bypass all permission checks.") (#1644).
+
+<!-- DETAIL (applies to CC < 2.1.212 only, #1818): Agent tool default explanation
 The Agent tool defaults to `mode: "acceptEdits"`, which overrides agent frontmatter `permissionMode` and causes permission prompts during unattended execution. This is a CC platform behavior, not a configuration error.
 -->
 
-<!-- DETAIL: bypassPermissions Aspect/Detail table
+<!-- DETAIL (applies to CC < 2.1.212 only, #1818): bypassPermissions Aspect/Detail table
 | Aspect | Detail |
 |--------|--------|
 | Scope | Every Agent tool call, without exception |
@@ -594,32 +600,37 @@ The Agent tool defaults to `mode: "acceptEdits"`, which overrides agent frontmat
 | Enforcement | Prompt-based (R021); all agent-spawning skills include instruction |
 -->
 
-### Self-Check
-
-Before spawning any agent:
-1. **유효 permission mode 확인** — per-call `mode` 파라미터는 v2.1.212+ 에서 무시되고,
-   **프로젝트 scope `permissions.defaultMode` 는 v2.1.257+ 에서도 무시된다(#1644)**.
-   무인 실행 전 실측할 것: `jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json`
-   (user scope) — 이 값 또는 `--permission-mode` 실행 플래그만이 유효하다.
+### Self-Check (MUST)
+
+Before unattended execution (item 1) and when authoring a skill that spawns agents (item 2):
+1. **유효 permission mode 실측** — CC ≥ 2.1.212: 부모 모드는 `permissions.defaultMode`(managed·local·
+   project·user 범위)와 실행 플래그(`--permission-mode` 등)가 정한다. 2.1.257+에서 무시되는 것은
+   project/local의 `bypassPermissions` **값뿐**이며 그 범위의 다른 값(예: init 배포본의 `"default"`)은
+   여전히 원천이다(위 문단). 세 파일을 함께 실측한다 —
+   `jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json .claude/settings.json .claude/settings.local.json`
+   (출력 순서 user·project·local) — managed 설정과 실행 플래그도 원천이므로 별도로 확인한다. 범위 간
+   우선순위(예: project의 `"default"`가 user의 `bypassPermissions`보다 앞서는지)는 `[가설]` — 미실측.
+   대상 에이전트 frontmatter `permissionMode`가 이를 덮어쓸 수 있다 — 근거는 CHANGELOG 항목이 아니라
+   CC 2.1.289에서 관측한 Agent tool 스키마("agent-definition frontmatter may override it")다. 이 구간에서
+   per-call `mode` 값은 무인 실행의 증거가 아니다(R020 "actual outcome ≠ attempt").
+   CC < 2.1.212: per-call `mode`가 서브에이전트 모드를 정한다 — 생략하면 기본값 `acceptEdits`가
+   frontmatter `permissionMode`를 덮어쓴다(위 버전 표). 어느 구간이든 유효 모드가
    bypassPermissions 가 아니면 프롬프트 발생을 전제로 계획한다.
-   하위 호환을 위해 per-call `mode: "bypassPermissions"` 는 계속 포함하되,
-   **그 존재를 무인 실행의 증거로 삼지 않는다**(R020 "attempt ≠ outcome").
 <!-- DETAIL: defaultMode ignored measurement evidence
    실측(2026-09-03, `claude -p --debug-file`): `[WARN] settings defaultMode "bypassPermissions"
    ignored — only policy/user/flag settings may grant bypass mode (projectSettings and
    localSettings are repo-controllable)` — 무시 동작이 직접 실증되었다. 프로젝트 settings에는
    `permissions._comment_defaultMode` 안내 키가 추가되었다(v1.1.59).
 -->
-2. Is this a new skill that spawns agents? → Add Permission Mode section
+2. Is this a new skill that spawns agents? → Include `mode: "bypassPermissions"` in its Agent calls (required below 2.1.212) and point to this section for the version split
 
 ### Common Violation
 
 ```
-❌ WRONG: Agent tool call without mode parameter
-   Agent(subagent_type: "lang-golang-expert", prompt: "...")
-
-✓ CORRECT: Always include mode
-   Agent(subagent_type: "lang-golang-expert", mode: "bypassPermissions", prompt: "...")
+❌ WRONG (CC < 2.1.212): Agent call without mode → acceptEdits default, prompts mid-run
+❌ WRONG (CC ≥ 2.1.212): Prompt appears → assume a missing mode is the cause
+✓ CORRECT: Always pass mode, and diagnose 2.1.212+ prompts via the parent's effective mode
+   and the agent's frontmatter permissionMode
 ```
 
 
@@ -637,7 +648,7 @@ Before spawning any agent:
 | >= v2.1.141 | Preserves current permission mode — `/bg` flows no longer need extra workaround |
 -->
 
-`mode: "bypassPermissions"` on every Agent tool call is still required (applies to Agent tool, not `/bg` shell command).
+Background agents (`/bg`, `←←`) keep the current session's permission mode (v2.1.141+); Agent tool calls still follow the CC-version table at the top of 「Universal bypassPermissions」 (per-call `mode` required below 2.1.212, ignored from 2.1.212).
 
 <!-- ARCHIVED CC version note (historical):
 > **v2.1.172+**: Fixed background agents potentially reading another directory's project settings (`.mcp.json` approvals, trust) when dispatched onto a pre-warmed worker. Strengthens background-agent isolation — a `/bg`-dispatched agent now reads the correct project's settings.
@@ -737,7 +748,7 @@ Before delegating a task to a subagent, MUST verify the target agent's tool capa
 | `Read` external files | `tools:` includes Read |
 | `Write` files | `tools:` includes Write (and target path not in `disallowedTools` scope) |
 | MCP server calls | `mcpServers:` includes the required server |
-| Task targets a specific file path | The path EXISTS (`Glob`/`ls`) — capability check alone does not catch a missing/renamed file |
+| Task targets a specific file path | The path EXISTS (`ls`/`find`, or `Glob` when present — not `git ls-files`, which reports an existing untracked path as absent; tracked status is the next row) — capability check alone does not catch a missing/renamed file |
 | Task targets an EXISTING file for editing/commit (not a newly-created file) | The path is git-tracked (`git ls-files <path>` non-empty) — an existing-but-untracked target needs an explicit scope decision before delegation |
 
 <!-- DETAIL: path-existence clarification (restated by Required Checks row)
@@ -797,6 +808,7 @@ Before delegating a task to a subagent, MUST verify the target agent's tool capa
 | Agent | Limitation | Workaround |
 |-------|-----------|-----------|
 | `arch-documenter` | `disallowedTools: [Bash]` — cannot run `gh`, shell scripts, `diff`/`md5`/`verify-*.sh` | Pre-collect data via orchestrator, pass as content; OR use `general-purpose` for the Bash-needing portion. **Completion-condition guard (#1593 #1)**: do NOT put `diff` / `md5` / `verify-*.sh` execution into arch-documenter's completion criteria — the orchestrator must run these itself, or split off a `general-purpose` agent for the Bash-needing verification |
+| `arch-documenter`, `fe-design-expert`, `mgr-supplier`, `qa-planner`, `qa-writer`, `sys-naggy` (frontmatter parse: `Bash` in `disallowedTools`) | No Bash, so every search path is the dedicated `Grep`/`Glob` listed in their `tools:` (`sys-naggy` lists `Grep` only). Measured 2026-10-05 on CC 2.1.289: a spawned `qa-writer` received `Read`, `Write`, `Edit`, `Grep`, `Glob` — consistent with 2.1.162 ("explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search"); the main session, which has no explicit list, lacks them (2.1.117). The other five were not spawned to measure | Do not remove `Grep`/`Glob` from these agents' `tools:` — without Bash they would have no search path left |
 | `qa-engineer` | (verify each invocation) | — |
 
 ### Common Violation
@@ -818,9 +830,7 @@ Reference issues: #1202 item #2, `feedback_arch_documenter_no_bash.md`.
 > **Status**: Deprecated as of CC v2.1.121 (2026-04-28) and further relaxed in v2.1.126 (2026-05-01). Direct Write/Edit/Bash on `.claude/`, `.git/`, `.vscode/` works without prompts under `bypassPermissions` mode in CC v2.1.121+ (issue #1101).
 -->
 
-Current CC versions (>=2.1.121): direct Write/Edit/Bash on `.claude/**` paths are permitted under `mode: "bypassPermissions"`. The `/tmp/*.sh` script wrapping pattern previously required is no longer necessary. Catastrophic operations (e.g., `rm -rf /`) remain blocked by independent safety guards.
-
-`mode: "bypassPermissions"` on every Agent tool call is still required (see "Universal bypassPermissions" above).
+Current CC versions (>=2.1.121): direct Write/Edit/Bash on `.claude/**` paths are permitted when the effective permission mode is `bypassPermissions`. The `/tmp/*.sh` script wrapping pattern previously required is no longer necessary. Catastrophic operations (e.g., `rm -rf /`) remain blocked by independent safety guards.
 
 <!-- DETAIL: legacy /tmp bypass pointer (historical)
 **For CC < v2.1.121 only**: see git history of this rule for the legacy `/tmp/*.sh` bypass pattern (commit before v0.126.0).
@@ -861,7 +871,7 @@ After restart/compaction: re-read CLAUDE.md, all delegation rules still apply. N
 | Unmatched specialized task | mgr-creator → dynamic agent creation |
 
 **Rules:**
-- All file modifications MUST be delegated (orchestrator only uses Read/Glob/Grep)
+- All file modifications MUST be delegated (orchestrator only uses read-only tools — Read, Glob/Grep when present, otherwise read-only Bash such as `git grep`/`find`)
 - Use specialized agents, not general-purpose, when one exists
 - general-purpose only for truly generic tasks (file moves, simple scripts)
 - No exceptions for "small" or "quick" changes
@@ -926,7 +936,7 @@ The following paths MUST be created or structurally modified ONLY through `mgr-c
 ## Exception: Simple Tasks
 
 Subagent NOT required for:
-- Reading files for analysis (Read, Glob, Grep only)
+- Reading files for analysis (read-only tools only — see Rules above; dedicated Glob/Grep may be absent)
 - Simple file searches
 - Direct questions answered by main conversation
 
@@ -1053,6 +1063,8 @@ See **R018 (MUST-agent-teams.md)** for the Detection table, complete decision ma
 **Quick rule** (applies only when active): 3+ agents OR review cycle OR 2+ issues in same batch → use Agent Teams.
 Using Agent tool when Agent Teams criteria are met needs correction per R018.
 
+Exception to the Core Rule ("Subagents MUST NOT spawn other subagents"), only when R018 Detection = Yes: Agent Teams members are peers, not hierarchical subagents (Agent Teams Exception — narrowed by #1817). When Detection = No, every agent spawned via the Agent tool is a subagent under the Core Rule. Members spawn sub-agents or message peers only if `Agent`/`SendMessage` are in their tool list; otherwise the orchestrator relays via files and spawns on their behalf (R018 「멤버 도구 부재 시 대체 규약」).
+
 <!-- DETAIL: Announcement Format
 ```
 [Routing] Using {routing-skill} for {task}

package/templates/.claude/rules/MUST-permissions.md

@@ -6,7 +6,7 @@
 
 | Tier | Tools | Policy |
 |------|-------|--------|
-| 1: Always | Read, Glob, Grep, ToolSearch | Free use, read-only |
+| 1: Always | Read, Glob‡, Grep‡, ToolSearch§ | Free use, read-only |
 | 2: Default | Write, Edit, NotebookEdit | State changes explicitly, notify before modifying important files |
 | 3: Context | Agent, Skill, EnterPlanMode, ExitPlanMode, EnterWorktree, ExitWorktree, LSP, Monitor, TodoWrite†, AskUserQuestion, PushNotification | Context-dependent, no user approval needed |
 | 4: Approval | Bash, PowerShell, WebFetch, WebSearch | Request user approval on first use |
@@ -15,6 +15,10 @@
 
 > **†** 현행 모델의 기본 실행 환경에 **존재하지 않는다** — 아래 v2.1.233 노트 참조. 이 표는 **도구 카탈로그**이지 가용성 보증이 아니므로, 규칙이 특정 도구 호출을 의무화하기 전에 실측(도구 목록 / `ToolSearch`)으로 존재를 확인한다.
 
+> **‡** 네이티브 빌드(macOS/Linux)에서는 전용 `Glob`/`Grep`이 Bash 내장 `bfs`/`ugrep`으로 대체되고(CHANGELOG 2.1.117: "the `Glob` and `Grep` tools are replaced by embedded `bfs` and `ugrep` available through the Bash tool"), `--tools`로 명시하면 전용 도구가 제공된다(2.1.162: "explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search"). 실측(CC 2.1.289, 2026-10-05): frontmatter `tools:`에 Grep/Glob을 명시한 `qa-writer`는 전용 `Grep`/`Glob`을 받았고(Bash 없음), 명시 목록이 없는 메인 세션에는 없었다 — frontmatter 명시가 `--tools` 명시와 같은 효과라는 일반화는 이 1건에 근거한 추정이다. 전용 도구가 없으면 읽기 전용 Bash(`git grep`·`find`)로 대체한다(R005: 가용성 미확인 시 Bash 우선 #1307, 전수조사 `git grep` 표준 #1590). 이 대체는 Tier 1 작업을 Tier 4로 옮기므로 Tier 4 정책("Request user approval on first use")이 적용된다. Bash도, frontmatter에 명시된 해당 검색 도구도 없는 경우(예: `sys-naggy`는 Grep만 명시 — Glob 검색)에만 오케스트레이터가 사전 수집해 내용으로 전달한다(R010 「Known Limitations (Active Cache)」).
+
+> **§** `ToolSearch`도 멤버 실행 환경에 없을 수 있다(#1817 QA teammate 관측) — 없으면 지연 도구를 로드할 수 없으므로 그 지연 도구는 부재로 취급한다(R018 「멤버 도구 부재 시 대체 규약」).
+
 ## File Access
 
 | Operation | Allowed | Prohibited |
@@ -157,25 +161,24 @@ CHANGELOG v2.1.233 원문: *"Todo/task-tracking tools (TaskCreate/Get/Update/Lis
 
 `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`은 복구 수단이나 **환경 설정 사안**이므로 규칙이 그 설정을 전제하지 않는다. 공식 settings 문서(`code.claude.com/docs/en/settings`)에는 2026-08-15 기준 미수록 — 현재 근거는 CHANGELOG 원문 + 위 실측이다.
 
-Origin: #1582. Cross-ref: R018(Member TaskUpdate Discipline 대체 규약), R020("도구가 있다"는 가정도 실측 대상).
+Origin: #1582. Cross-ref: R018 「Task 도구 부재 시 대체 규약」(Member TaskUpdate Discipline 하위 절), R020("도구가 있다"는 가정도 실측 대상).
 -->
 `TeamCreate`/`TeamDelete`도 별도로 부재 — R018은 이 환경에서 비활성입니다(R018 Detection). 규칙은 **존재하지 않는 도구의 호출을 의무화하지 않으며**, 도구 의존 의무를 쓸 때는 부재 시 대체 규약을 함께 규정합니다(R018 Member TaskUpdate Discipline이 그 예). `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`은 환경 설정 사안이므로 규칙이 전제하지 않습니다. Origin: #1582.
 
 ## Agent Tool Permission Mode
 
-> Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions" owns the full requirement, rationale, self-check, and version history. Core rule: always pass `mode: "bypassPermissions"` explicitly on every Agent tool call — the Agent tool's default `mode` (`acceptEdits`) overrides agent frontmatter `permissionMode` and causes prompts during unattended execution. Skills that spawn agents MUST include this in their Agent tool call instructions. See R010 for details.
-
-**주의**: v2.1.212+부터 `mode` 파라미터는 무시되며 유효 모드는 부모 세션이 결정합니다 — 실측은 R010 Self-Check를 참조합니다.
+> Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions" owns the guidance, self-check, and version history. Core: below CC 2.1.212, per-call `mode: "bypassPermissions"` is required (the Agent tool's default `acceptEdits` overrides frontmatter `permissionMode`); from 2.1.212 it is ignored and subagents inherit the parent session's mode, which frontmatter `permissionMode` may override. Keep passing `mode` for compatibility, but measure the effective mode before unattended runs (R010 Self-Check 1).
 
 <!-- DETAIL: Agent tool mode deprecation rationale (canonical: R010)
 > **v2.1.212+**: CC가 Agent(구 Task) tool의 `mode` 파라미터를 deprecated 처리했습니다(이제 무시) — subagent는 부모 세션의 permission mode를 기본 상속합니다. 위 canonical 요약의 default `mode`(`acceptEdits`)가 frontmatter `permissionMode`를 override한다는 서술 및 항상 `mode: "bypassPermissions"`를 넘기라는 요건은 이 버전부터 stale이며(파라미터가 무시됨), 무인 실행의 실질 게이트는 부모 세션의 permission mode입니다. 요건 재조정은 R010 "Universal bypassPermissions"가 canonical — R002는 이 flag만 유지합니다.
 -->
 
 <!-- DETAIL: defaultMode project-scope-ignored rationale (canonical: R010)
-> **v2.1.257+**: 프로젝트 scope `permissions.defaultMode` 가 무시됩니다(user/managed scope 또는
-> `--permission-mode` 플래그만 유효). 위 v2.1.212 노트가 "무인 실행의 실질 게이트는 부모 세션의
-> permission mode"라고 정정했는데, **그 부모 세션 모드를 프로젝트 settings로 지정하는 경로가 이
-> 버전에서 끊겼습니다** — 이 파일 상단 「Deny Rule Glob Patterns」의 v2.1.214 노트(allow 규칙만
+> **v2.1.257+**: `.claude/settings.json`·`.claude/settings.local.json`의 `defaultMode: "bypassPermissions"`
+> 값이 `"auto"`처럼 무시됩니다(CHANGELOG 2.1.257 — 다른 값은 이 항목의 대상이 아님; bypass는 user/managed
+> settings 또는 `--permission-mode`로 지정). 위 v2.1.212 노트가 "무인 실행의 실질 게이트는 부모 세션의
+> permission mode"라고 정정했는데, **그 부모 세션 모드를 프로젝트 settings로 `bypassPermissions`로
+> 지정하는 경로가 이 버전에서 끊겼습니다** — 이 파일 상단 「Deny Rule Glob Patterns」의 v2.1.214 노트(allow 규칙만
 > `<cwd>`로 좁아진 비대칭)와 같은 계열의 **project-scope 축소** 흐름입니다. Canonical owner 는
 > R010 "Universal bypassPermissions" — 상세와 실측 절차는 그쪽을 참조합니다. Origin: #1644.
 -->

package/templates/.claude/skills/action-validator/SKILL.md

@@ -109,11 +109,11 @@ When a synthesized harness exists for an agent (`.claude/outputs/harnesses/{agen
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write action-validator results under `.claude/outputs/sessions/`:
 
-1. Write the artifact body directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/action-validator-$(date +%H%M%S).md` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/action-validator-$(date +%H%M%S).md` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.

package/templates/.claude/skills/adaptive-harness/SKILL.md

@@ -187,11 +187,11 @@ Append a record to `.claude/outputs/harness-adaptations/YYYY-MM-DD.md`:
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write adaptive-harness results under `.claude/outputs/`:
 
-1. Write the artifact body directly to `.claude/outputs/harness-adaptations/$(date +%Y-%m-%d).md` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/harness-adaptations/$(date +%Y-%m-%d).md` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.

package/templates/.claude/skills/adversarial-review/SKILL.md

@@ -102,4 +102,4 @@ Refs: #1171 (CRG 통합), #1180 (본 cross-ref 추가)
 
 ## Permission Mode
 
-When spawning agents via the Agent tool during this skill's execution, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".

package/templates/.claude/skills/agent-eval-framework/SKILL.md

@@ -75,11 +75,11 @@ Use this taxonomy to **select representative tasks per category** when building
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write eval trajectories or result reports under `.claude/outputs/evals/`:
 
-1. Write the artifact body directly to `.claude/outputs/evals/{trajectories,sessions}/...` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/evals/{trajectories,sessions}/...` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.

package/templates/.claude/skills/de-lead-routing/SKILL.md

@@ -9,7 +9,7 @@ context: fork
 
 When this skill spawns a subagent via the Agent tool, the spawned prompt MUST include this directive verbatim (or equivalent):
 
-> 이 스킬이 Agent tool로 서브에이전트를 스폰할 때 mode: "bypassPermissions"를 반드시 포함한다. 서브에이전트는 .claude/ 경로에 직접 Write/Edit/Bash를 사용한다(/tmp 우회 불필요, CC v2.1.121+). See R010.
+> 호환을 위해 Agent 호출에 `mode: "bypassPermissions"`를 전달하십시오. CC 2.1.212 미만에서는 필수이며(호출별 기본값 `acceptEdits`가 에이전트 frontmatter `permissionMode`를 덮어씁니다), 2.1.212+에서는 무시되고 서브에이전트가 부모 세션의 권한 모드를 상속합니다(에이전트 frontmatter `permissionMode`로 조정 가능). 무인 실행 전 유효 모드 확인은 R010 「Universal bypassPermissions」 참조. bypassPermissions 세션에서 서브에이전트는 .claude/ 경로에 직접 Write/Edit/Bash를 사용합니다(/tmp 우회 불필요, CC v2.1.121+).
 
 This directive is preserved inline because Agent-tool prompt synthesis can drop SKILL.md notes; inline mandatory directives survive (#1046 lesson).
 
@@ -75,7 +75,7 @@ When Detection resolves to **No**, skip this step — route via the Agent tool u
 ### Step 2: Expert Selection
 Route to appropriate DE expert based on tool/framework detection.
 
-> **Permission Mode**: When spawning agents via Agent tool, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+> **Permission Mode**: Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".
 
 ### Step 4: Ontology-RAG Enrichment (R019)
 

package/templates/.claude/skills/deep-plan/SKILL.md

@@ -81,14 +81,14 @@ When a plan's Phase 1/2 measures a search or retrieval experiment (a new lane, r
 
 Phase 3 verification report path: `.claude/outputs/sessions/{YYYY-MM-DD}/deep-plan-{HHmmss}.md`
 
-Under `mode: "bypassPermissions"`, subagents write directly to `.claude/outputs/` with Write/Edit — no temp-script wrapping is needed (CC v2.1.121+, #1101). When spawning the final synthesis agent to write this artifact, include verbatim in the agent prompt:
+Under the `bypassPermissions` permission mode, subagents write directly to `.claude/outputs/` with Write/Edit — no temp-script wrapping is needed (CC v2.1.121+, #1101). When spawning the final synthesis agent to write this artifact, include verbatim in the agent prompt:
 
 ```
 **Artifact output (for this task)**
 
 Write the verification report to `.claude/outputs/sessions/<date>/deep-plan-<HHmmss>.md`
-using the Write tool directly (create the directory if needed). Your Agent tool call
-runs under `mode: "bypassPermissions"`, so direct Write/Edit on `.claude/` is permitted.
+using the Write tool directly (create the directory if needed). If your session runs under the
+`bypassPermissions` permission mode, direct Write/Edit on `.claude/` is permitted.
 ```
 
 See R006 "Sensitive Path Handling" (CC v2.1.121+ direct-write convention).
@@ -113,4 +113,4 @@ After PASS verdict:
 
 ## Permission Mode
 
-When spawning agents via the Agent tool during this skill's execution, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".

package/templates/.claude/skills/deep-verify/SKILL.md

@@ -84,9 +84,9 @@ Run these checks before declaring release READY. Any match is a release blocker.
 
 | Guard | Detection Command | Severity | Remediation |
 |-------|-------------------|----------|-------------|
-| Residual deprecated `/tmp` sensitive-path bypass narrative | `grep -rnE -e 'regardless of[[:space:]]+.?bypassPermissions' -e '(MUST|MANDATORY|Mandatory)[^\n]{0,80}/tmp/\*\.sh' -e '/tmp/\*\.sh[^\n]{0,80}(MANDATORY|MUST be used|bypass script)' .claude/skills/ templates/.claude/skills/ .claude/agents/ templates/.claude/agents/ 2>/dev/null` | **BLOCK** | Remove the deprecated temp-script bypass narrative — it was retired in CC v2.1.121 (#1101). Under `mode: "bypassPermissions"`, write directly to `.claude/` with Write/Edit. See R006 "Sensitive Path Handling" |
+| Residual deprecated `/tmp` sensitive-path bypass narrative | `grep -rnE -e 'regardless of[[:space:]]+.?bypassPermissions' -e '(MUST|MANDATORY|Mandatory)[^\n]{0,80}/tmp/\*\.sh' -e '/tmp/\*\.sh[^\n]{0,80}(MANDATORY|MUST be used|bypass script)' .claude/skills/ templates/.claude/skills/ .claude/agents/ templates/.claude/agents/ 2>/dev/null` | **BLOCK** | Remove the deprecated temp-script bypass narrative — it was retired in CC v2.1.121 (#1101). Under the `bypassPermissions` permission mode, write directly to `.claude/` with Write/Edit. See R006 "Sensitive Path Handling" |
 
-> **Why**: The temp-script sensitive-path bypass for `.claude/` paths was deprecated in CC v2.1.121 (2026-04-28, #1101). Direct Write/Edit/Bash on `.claude/**` works under `mode: "bypassPermissions"`; only catastrophic shell operations (`rm -rf /`) remain independently blocked. Residual bypass procedures or false "guard blocks bypassPermissions" claims in skills/agents are now defects — this guard catches them with a cheap deterministic grep (R023 shift-left: catch stale platform procedures before they reach expensive review).
+> **Why**: The temp-script sensitive-path bypass for `.claude/` paths was deprecated in CC v2.1.121 (2026-04-28, #1101). Direct Write/Edit/Bash on `.claude/**` works under the `bypassPermissions` permission mode; only catastrophic shell operations (`rm -rf /`) remain independently blocked. Residual bypass procedures or false "guard blocks bypassPermissions" claims in skills/agents are now defects — this guard catches them with a cheap deterministic grep (R023 shift-left: catch stale platform procedures before they reach expensive review).
 
 ## Output Format
 
@@ -122,4 +122,4 @@ Run these checks before declaring release READY. Any match is a release blocker.
 
 ## Permission Mode
 
-When spawning agents via the Agent tool during this skill's execution, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".

package/templates/.claude/skills/design-shotgun/SKILL.md

@@ -97,7 +97,7 @@ User selects preferred variation(s). Selected design can be:
 
 ## Permission Mode
 
-When spawning agents via the Agent tool during this skill's execution, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".
 
 ## Source
 

package/templates/.claude/skills/dev-lead-routing/SKILL.md

@@ -9,7 +9,7 @@ context: fork
 
 When this skill spawns a subagent via the Agent tool, the spawned prompt MUST include this directive verbatim (or equivalent):
 
-> 이 스킬이 Agent tool로 서브에이전트를 스폰할 때 mode: "bypassPermissions"를 반드시 포함한다. 서브에이전트는 .claude/ 경로에 직접 Write/Edit/Bash를 사용한다(/tmp 우회 불필요, CC v2.1.121+). See R010.
+> 호환을 위해 Agent 호출에 `mode: "bypassPermissions"`를 전달하십시오. CC 2.1.212 미만에서는 필수이며(호출별 기본값 `acceptEdits`가 에이전트 frontmatter `permissionMode`를 덮어씁니다), 2.1.212+에서는 무시되고 서브에이전트가 부모 세션의 권한 모드를 상속합니다(에이전트 frontmatter `permissionMode`로 조정 가능). 무인 실행 전 유효 모드 확인은 R010 「Universal bypassPermissions」 참조. bypassPermissions 세션에서 서브에이전트는 .claude/ 경로에 직접 Write/Edit/Bash를 사용합니다(/tmp 우회 불필요, CC v2.1.121+).
 
 This directive is preserved inline because Agent-tool prompt synthesis can drop SKILL.md notes; inline mandatory directives survive (#1046 lesson).
 
@@ -114,7 +114,7 @@ When Detection resolves to **No**, skip this step — route via the Agent tool u
 ### Step 2: Expert Agent Selection
 Route to appropriate language/framework expert based on file extension and keyword mapping.
 
-> **Permission Mode**: When spawning agents via Agent tool, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+> **Permission Mode**: Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".
 
 ### Step 4: Ontology-RAG Enrichment (R019)
 

package/templates/.claude/skills/dev-review/SKILL.md

@@ -116,11 +116,11 @@ If only PASS/INFO: proceed automatically.
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write dev-review results under `.claude/outputs/sessions/`:
 
-1. Write the artifact body directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/dev-review-$(date +%H%M%S).md` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/dev-review-$(date +%H%M%S).md` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.

package/templates/.claude/skills/evaluator-optimizer/SKILL.md

@@ -420,7 +420,7 @@ Integration: Works with [impeccable-design](/skills/impeccable-design) skill for
 
 The `harness-eval` skill provides a structured 15-task SE benchmark rubric that can be used as a preset for the evaluator-optimizer pipeline. When invoked via `/harness-eval`, the harness rubric dimensions (Test Coverage 30%, Architecture 25%, Error Handling 25%, Extensibility 20%) are loaded as the sprint contract criteria.
 
-When spawning agents via the Agent tool during this skill's execution, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".
 
 ## Efficiency Gate (added v0.113.0, #1025)
 

package/templates/.claude/skills/fsd/SKILL.md

@@ -236,11 +236,10 @@ If any of those underlying skills evolve, FSD automatically benefits — its onl
 
 ## Permission Mode Note
 
-When this skill delegates work via Agent tool calls, ALL Agent tool calls MUST include `mode: "bypassPermissions"` per R010 Universal bypassPermissions.
+호환을 위해 Agent 호출에 `mode: "bypassPermissions"`를 전달하십시오. CC 2.1.212 미만에서는 필수이며(호출별 기본값 `acceptEdits`가 에이전트 frontmatter `permissionMode`를 덮어씁니다), 2.1.212+에서는 무시되고 서브에이전트가 부모 세션의 권한 모드를 상속합니다(에이전트 frontmatter `permissionMode`로 조정 가능). 무인 실행 전 유효 모드 확인은 R010 「Universal bypassPermissions」 참조.
 
-⚠ **그 파라미터는 CC v2.1.212+ 에서 무시되며, 프로젝트 scope `permissions.defaultMode` 역시
-CC v2.1.257+ 에서 무시된다(#1644).** 즉 위 지시를 지켰다는 사실은 **무인 실행의 증거가 아니다**.
-자율 루프 진입 전에 유효 모드를 실측한다:
+⚠ 프로젝트 scope `permissions.defaultMode` 역시 CC v2.1.257+ 에서 무시됩니다(#1644). 즉 `mode` 파라미터를 넘겼다는 사실은 **무인 실행의 증거가 아닙니다**.
+자율 루프 진입 전에 유효 모드를 실측합니다:
 
 ```bash
 jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo unset

package/templates/.claude/skills/harness-eval/SKILL.md

@@ -92,7 +92,7 @@ Results saved to `.claude/outputs/sessions/{YYYY-MM-DD}/harness-eval-{HHmmss}.md
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths (including `.claude/outputs/sessions/`) is permitted (CC v2.1.121+, #1101) — no `/tmp` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths (including `.claude/outputs/sessions/`) is permitted (CC v2.1.121+, #1101) — no `/tmp` wrapping is needed.
 
 Write harness-eval results directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/harness-eval-$(date +%H%M%S).md`. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification. Catastrophic shell operations (e.g., `rm -rf /`) remain blocked by independent safety guards. For CC < v2.1.121, see git history for the legacy `/tmp/*.sh` bypass pattern.
 

package/templates/.claude/skills/harness-synthesizer/SKILL.md

@@ -96,7 +96,7 @@ harness:
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths (including `.claude/outputs/sessions/`) is permitted (CC v2.1.121+, #1101) — no `/tmp` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths (including `.claude/outputs/sessions/`) is permitted (CC v2.1.121+, #1101) — no `/tmp` wrapping is needed.
 
 Write harness-synthesizer results directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/harness-synthesizer-$(date +%H%M%S).md`. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification. Catastrophic shell operations (e.g., `rm -rf /`) remain blocked by independent safety guards. For CC < v2.1.121, see git history for the legacy `/tmp/*.sh` bypass pattern.
 

package/templates/.claude/skills/homework/SKILL.md

@@ -101,7 +101,7 @@ Categorize each finding with the following structure (mirror #1266 format):
 |-------|----------|---------|
 | Critical | Safety classifier trip, credential exposure, scope-creep into privileged domains, working-tree loss | R001 violation, secret dump, unauthorized infra action |
 | High | Rule violation with downstream impact, hallucinated fact acted upon, premature hypothesis causing permanent change | R020 Parallel Read+Change, wrong root cause → wrong fix |
-| Medium | Process gap, missed convention, advisory rule ignored | R007 header missing, bypassPermissions omitted, count sync missed |
+| Medium | Process gap, missed convention, advisory rule ignored | R007 header missing, effective permission mode not verified before unattended run, count sync missed |
 | Low | Minor style drift, non-impactful oversight | honorific regression, ecomode token waste |
 
 **Mistake categories to look for:**
@@ -112,7 +112,7 @@ Categorize each finding with the following structure (mirror #1266 format):
 | Scope-creep | Subagent task expanding beyond its named scope (R010 Subagent Scope-Creep STOP Protocol) |
 | Hallucinated facts | External UI fields stated as fact (R003 Unverifiable External Product UI), in-cluster hostnames, unverified URLs |
 | Premature hypotheses | Diagnosis before reading evidence (R020 Read-Before-Characterize), parallel Read+permanent-change dispatch (R020 Variant) |
-| Missed conventions | Count sync drift (3-way sync), template mirror omitted, bypassPermissions missing |
+| Missed conventions | Count sync drift (3-way sync), template mirror omitted, effective permission mode not verified before unattended run |
 | Over-claim completion | [Done] without verification (R020), test-skip masking failures |
 
 **Do NOT over-claim.** If evidence for a finding is weak or based on recall only, mark it `[recall, low-confidence]` and note what would be needed to confirm it. R020 read-before-characterize applies to this analysis itself.
@@ -224,7 +224,7 @@ If Phase 5 is skipped (`--dry-run`), the draft issue body is written to this art
 
 ## Permission Mode Note
 
-This skill does not spawn subagents directly. If future versions delegate analysis to subagents, ALL Agent tool calls MUST include `mode: "bypassPermissions"` per R010 Universal bypassPermissions.
+This skill does not spawn subagents directly, but future versions may delegate analysis to subagents. Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".
 
 ## Context Fork Note
 

package/templates/.claude/skills/idea/SKILL.md

@@ -32,7 +32,9 @@ Extract the core intent from the natural language input.
 
 ### Phase 3: Feasibility Analysis
 
-Analyze using a sonnet agent (always spawn with `mode: "bypassPermissions"`):
+Analyze using a sonnet agent:
+
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".
 
 - **Scope**: Which modules/files would be affected
 - **Complexity**: XS/S/M/L effort estimate
@@ -73,7 +75,7 @@ The JSON block MUST be wrapped in triple backtick json fence for parsing.
 | Rule | How |
 |------|-----|
 | R009 | Single agent for analysis |
-| R010 | Orchestrator manages phases; analysis delegated to agent with `mode: "bypassPermissions"` |
+| R010 | Orchestrator manages phases; analysis delegated to an agent (permission mode per R010 "Universal bypassPermissions") |
 
 ## Output Format