oh-my-customcode 1.1.102 → 1.1.104

package/dist/index.js

@@ -404,6 +404,7 @@ var MESSAGES = {
     "lockfile.component_dir_missing": "Component directory missing: {{path}}",
     "lockfile.hash_failed": "Failed to hash file: {{path}} — {{error}}",
     "lockfile.entry_added": "Lockfile entry added: {{path}} ({{component}})",
+    "lockfile.entry_git_excluded": "Lockfile entry skipped (not in git listing): {{path}}",
     "update.start": "Checking for updates...",
     "update.success": "Updated from {{from}} to {{to}}",
     "update.components_synced": "Components synced (version {{version}}): {{components}}",
@@ -525,6 +526,7 @@ var MESSAGES = {
     "lockfile.component_dir_missing": "컴포넌트 디렉토리 없음: {{path}}",
     "lockfile.hash_failed": "파일 해시 실패: {{path}} — {{error}}",
     "lockfile.entry_added": "잠금 파일 항목 추가: {{path}} ({{component}})",
+    "lockfile.entry_git_excluded": "잠금 파일 항목 제외 (git 목록에 없음): {{path}}",
     "update.start": "업데이트 확인 중...",
     "update.success": "{{from}}에서 {{to}}로 업데이트 완료",
     "update.components_synced": "컴포넌트 동기화 완료 (버전 {{version}}): {{components}}",
@@ -2035,10 +2037,12 @@ function getComponentPath(component) {
 
 // src/core/lockfile.ts
 init_fs();
+import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { readdir, stat } from "node:fs/promises";
+import { readdir, realpath, stat } from "node:fs/promises";
 import { join as join4, relative as relative2 } from "node:path";
+import { promisify } from "node:util";
 var LOCKFILE_NAME = ".omcustom.lock.json";
 var LOCKFILE_VERSION = 1;
 var LOCKFILE_COMPONENTS = [
@@ -2051,6 +2055,87 @@ var LOCKFILE_COMPONENTS = [
   "guides"
 ];
 var COMPONENT_PATHS = LOCKFILE_COMPONENTS.map((component) => [getComponentPath(component), component]);
+var execFileAsync = promisify(execFile);
+var GIT_LOCATION_ENV_KEYS = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_PREFIX",
+  "GIT_COMMON_DIR"
+];
+var GIT_INJECTED_CONFIG_ENV_KEYS = ["GIT_CONFIG_PARAMETERS", "GIT_CONFIG_COUNT"];
+var GIT_INJECTED_CONFIG_ENV_PREFIXES = ["GIT_CONFIG_KEY_", "GIT_CONFIG_VALUE_"];
+var GIT_REQUIRED_HINT = "build from a git checkout: excluding ignored local files from the lockfile requires git (#1819)";
+function gitChildEnv() {
+  const env = { ...process.env };
+  for (const key of [...GIT_LOCATION_ENV_KEYS, ...GIT_INJECTED_CONFIG_ENV_KEYS]) {
+    delete env[key];
+  }
+  for (const key of Object.keys(env)) {
+    if (GIT_INJECTED_CONFIG_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) {
+      delete env[key];
+    }
+  }
+  return env;
+}
+async function runGit(targetDir, args, env) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd: targetDir,
+      env,
+      encoding: "utf-8",
+      maxBuffer: 256 * 1024 * 1024
+    });
+    return stdout;
+  } catch (err) {
+    const detail = err instanceof Error ? err.message.trim() : String(err);
+    throw new Error(`git ${args[0]} failed in ${targetDir}: ${detail} — ${GIT_REQUIRED_HINT}`);
+  }
+}
+function foldCase(nfcPath) {
+  return nfcPath.toLowerCase();
+}
+function isGitVisible(visible, relativePath) {
+  if (visible.exact.has(relativePath)) {
+    return true;
+  }
+  const nfc = relativePath.normalize("NFC");
+  if (visible.nfc.has(nfc)) {
+    return true;
+  }
+  return visible.folded?.has(foldCase(nfc)) ?? false;
+}
+function stripFinalNewline(output) {
+  return output.endsWith(`
+`) ? output.slice(0, -1) : output;
+}
+async function assertGitWorkTreeRoot(targetDir, env) {
+  const topLevel = stripFinalNewline(await runGit(targetDir, ["rev-parse", "--show-toplevel"], env));
+  let realTop;
+  let realTarget;
+  try {
+    [realTop, realTarget] = await Promise.all([realpath(topLevel), realpath(targetDir)]);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new Error(`cannot resolve the git work tree root of ${targetDir}: ${detail} — ${GIT_REQUIRED_HINT}`);
+  }
+  if (realTop !== realTarget) {
+    throw new Error(`${targetDir} is not the root of its git work tree (root: ${topLevel}) — ${GIT_REQUIRED_HINT}`);
+  }
+}
+async function listGitVisiblePaths(targetDir) {
+  const env = gitChildEnv();
+  await assertGitWorkTreeRoot(targetDir, env);
+  const pathspecs = COMPONENT_PATHS.map(([prefix]) => prefix);
+  const [listing, ignoreCase] = await Promise.all([
+    runGit(targetDir, ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...pathspecs], env),
+    runGit(targetDir, ["config", "--type=bool", "--default=false", "--get", "core.ignorecase"], env)
+  ]);
+  const exact = new Set(listing.split("\x00").filter((entry) => entry.length > 0));
+  const nfc = new Set([...exact].map((entry) => entry.normalize("NFC")));
+  const folded = stripFinalNewline(ignoreCase) === "true" ? new Set([...nfc].map(foldCase)) : null;
+  return { exact, nfc, folded };
+}
 function computeFileHash(filePath) {
   return new Promise((resolve, reject) => {
     const hash = createHash("sha256");
@@ -2136,8 +2221,9 @@ function sortFilesByPath(files) {
   const sorted = Object.keys(files).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
   return Object.fromEntries(sorted.map((key) => [key, files[key]]));
 }
-async function generateLockfile(targetDir, generatorVersion, templateVersion) {
+async function generateLockfile(targetDir, generatorVersion, templateVersion, options = {}) {
   const files = {};
+  const gitVisible = options.excludeGitIgnored ? await listGitVisiblePaths(targetDir) : null;
   const componentRoots = COMPONENT_PATHS.map(([prefix]) => join4(targetDir, prefix));
   for (const componentRoot of componentRoots) {
     const exists = await fileExists(componentRoot);
@@ -2148,6 +2234,10 @@ async function generateLockfile(targetDir, generatorVersion, templateVersion) {
     const allFiles = await collectFiles(componentRoot, targetDir, false);
     for (const absolutePath of allFiles) {
       const relativePath = relative2(targetDir, absolutePath).replace(/\\/g, "/");
+      if (gitVisible !== null && !isGitVisible(gitVisible, relativePath)) {
+        debug("lockfile.entry_git_excluded", { path: relativePath });
+        continue;
+      }
       let hash;
       let size;
       try {
@@ -2208,12 +2298,12 @@ function preserveGeneratedAt(next, previous) {
   }
   return { ...next, generatedAt: previous.generatedAt };
 }
-async function generateAndWriteLockfileForDir(targetDir) {
+async function generateAndWriteLockfileForDir(targetDir, options = {}) {
   try {
     const packageRoot = getPackageRoot();
     const manifest = await readJsonFile(join4(packageRoot, "templates", "manifest.json"));
     const { version: generatorVersion } = await readJsonFile(join4(packageRoot, "package.json"));
-    const generated = await generateLockfile(targetDir, generatorVersion, manifest.version);
+    const generated = await generateLockfile(targetDir, generatorVersion, manifest.version, options);
     const previous = await readLockfile(targetDir);
     const lockfile = preserveGeneratedAt(generated, previous);
     await writeLockfile(targetDir, lockfile);
@@ -2853,7 +2943,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.102",
+  version: "1.1.104",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.102",
+  "version": "1.1.104",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/output-styles/korean-engineer.md

@@ -56,7 +56,7 @@ ecomode 활성 시 자동으로 concise 모드로 전환 (R013).
 
 ## 위임 모델 (R010)
 
-오케스트레이터(메인 대화)는 파일 수정 금지 → 서브에이전트에 위임. Agent tool 호출 시 항상 `mode: "bypassPermissions"` 명시.
+오케스트레이터(메인 대화)는 파일 수정 금지 → 서브에이전트에 위임. CC < 2.1.212에서는 Agent 도구 호출 시 `mode: "bypassPermissions"`가 필요하므로 호환을 위해 명시합니다. 2.1.212+에서는 `mode`가 무시되고 서브에이전트가 부모 세션의 권한 모드를 상속합니다(frontmatter `permissionMode`로 조정 가능). 무인 실행 전 유효 모드는 R010 「Universal bypassPermissions」 절차로 실측합니다.
 
 ## 작업 완료 검증 (R020)
 

package/templates/.claude/rules/MUST-agent-design.md

@@ -371,7 +371,7 @@ RETIRED (은퇴 릴리즈 v1.1.50, 보존 기준 v2.1.230 미만): > **v2.1.204+
 
 ## Permission Mode Guidance
 
-> Canonical source for the bypassPermissions requirement: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions". CC defaults `mode` to `acceptEdits` if not specified — always pass `mode: "bypassPermissions"` explicitly in Agent tool calls. See R010 for the full requirement, rationale, and self-check. Note: as of v2.1.212+, the Agent tool's `mode` parameter is ignored — subagents inherit the parent session's permission mode instead (canonical: R010 Self-Check).
+> Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions". Below CC 2.1.212, CC defaults per-call `mode` to `acceptEdits` — pass `mode: "bypassPermissions"` explicitly. From 2.1.212 the parameter is ignored: subagents inherit the parent session's mode, and frontmatter `permissionMode` (modes in the table below) may override it. Keep passing `mode` for compatibility; see R010 for the version table and self-check.
 
 | Mode | Behavior |
 |------|----------|
@@ -390,7 +390,7 @@ RETIRED (은퇴 릴리즈 v1.1.50, 보존 기준 v2.1.230 미만): > **v2.1.204+
 > **v2.1.212+**: Agent(구 Task) tool의 `mode` 파라미터가 **deprecated되어 무시됩니다** — subagent는 **기본적으로** 부모(오케스트레이터) 세션의 permission mode를 상속합니다. 위 "CC defaults `mode` to `acceptEdits`" 서술과 R010 Universal bypassPermissions의 per-call `mode: "bypassPermissions"` 지정은 플랫폼 레벨에서 no-op가 됩니다(명시 지정 자체는 무해). 무인 실행의 실제 bypass 여부는 이제 부모 세션 mode가 결정하므로, 오케스트레이터 세션을 bypassPermissions로 유지하는 것이 핵심입니다. Canonical owner는 R010.
 -->
 
-<!-- DETAIL: Permission Mode Guidance (reasoning)
+<!-- DETAIL (applies to CC < 2.1.212 only, #1818): Permission Mode Guidance (reasoning)
 When spawning agents via the Agent tool, CC applies a default `mode` of `acceptEdits` if not explicitly specified. To maintain consistent permission behavior:
 
 1. **Agent frontmatter `permissionMode`**: Declares the agent's intended permission level. CC respects this when the agent is spawned via Agent tool.

package/templates/.claude/rules/MUST-agent-teams.md

@@ -19,10 +19,10 @@ Agent Teams is active only when the **team-creation path actually exists** — `
 | Observed state | Teams active? |
 |----------------|---------------|
 | `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` **and** `TeamCreate` present | Yes |
-| env var set, `TeamCreate` **absent** | **No** — no team creatable, no member spawnable |
+| env var set, `TeamCreate` **absent** | **No** — no team creatable. A named `Agent` spawn (`name:`) still creates a teammate of the session's implicit team (CC 2.1.289 measured), but without `TeamCreate`/`TeamDelete` in the session (main or teammate) it is governed by R009/R010 as a subagent |
 | `SendMessage` present, `TeamCreate` absent | **No** — peer/cross-session messaging is separate (see Scope), not Teams evidence |
 
-<!-- DETAIL: Detection table rows, original wording
+<!-- DETAIL: Detection table rows, original wording — superseded by #1827 (CC 2.1.289 measured) — do not restore as-is
 | env var set, `TeamCreate` **absent** | **No** — a team cannot be created, so no member can be spawned |
 | `SendMessage` present, `TeamCreate` absent | **No** — peer/cross-session messaging is a separate capability (see Scope below), not evidence of Teams |
 -->
@@ -33,7 +33,7 @@ Rationale: v2.1.233+부터 `TeamCreate`/`TeamDelete`가 부재하다(R002). env
 Rationale: since v2.1.233, `TeamCreate`/`TeamDelete` are absent from the tool list in this runtime (measured — R002 "Todo/Task 도구 기본 제거"), so a set env var cannot make teams creatable. Detection therefore rests on the tools actually being present, not on the env var alone — "the tool exists" is itself a claim requiring measurement (R020).
 -->
 
-When Detection resolves to **No**, this entire rule is dormant and R009/R010 govern.
+When Detection resolves to **No**, this entire rule is dormant and R009/R010 govern (the named-spawn note in 「멤버 도구 부재 시 대체 규약」 restates R010 policy and applies under R010).
 
 ## Decision Matrix
 
@@ -65,9 +65,9 @@ When Detection resolves to **No**, this entire rule is dormant and R009/R010 gov
 
 ### Scope: Intra-Session vs Cross-Session
 
-Intra-session: `SendMessage`(Agent Teams), peer-to-peer, `TeamCreate` 필요. Cross-session: `send_message`(claude-peers-mcp), broker 경유, 별도 프로세스 간.
+Intra-session: `SendMessage`. 메인→이름 붙인 멤버 전달은 `TeamCreate` 없이 동작(CC 2.1.289 실측, general-purpose 팀원 1건); 멤버→멤버 peer-to-peer는 `[가설]` 미관측. Cross-session: `send_message`(claude-peers-mcp), broker 경유, 별도 프로세스 간.
 
-<!-- DETAIL: Scope table and mechanism-distinction paragraph, original wording
+<!-- DETAIL: Scope table and mechanism-distinction paragraph, original wording — superseded by #1827 (CC 2.1.289 measured) — do not restore as-is
 | Scope | Tool | Protocol | Use Case |
 |-------|------|----------|----------|
 | Intra-session | `SendMessage` (Agent Teams) | Peer-to-peer within team | Multi-agent collaboration in one session |
@@ -448,10 +448,10 @@ Agent Teams 멤버는 long-running 작업 중 TaskUpdate 로 진행 상태를
 Agent Teams 멤버는 long-running 작업 중 진행 상태를 TaskUpdate 로 명시적으로 알려야 한다. 침묵은 코디네이터가 죽었거나 멤버가 막혔다고 오인하게 만든다.
 -->
 
-`TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 미제공(R002) — 가용 시 아래 표, 부재 시 「대체 규약」을 따른다.
+`TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 미제공(R002) — 가용 시 아래 표, 부재 시 「Task 도구 부재 시 대체 규약」을 따른다. 가용성은 모델을 따른다 — haiku 팀원 1건은 `ToolSearch`로 로드, sonnet-5-5 팀원 1건과 `claude-opus-5-5` 메인은 불가(CC 2.1.289 실측).
 
 <!-- DETAIL: Task tool availability measurement note, original wording
-> **도구 가용성 선확인 (v2.1.233+)**: `TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 제거되어 이 저장소 실행 환경에 **존재하지 않는다** — 실측은 R002 「Todo/Task 도구 기본 제거」. 아래 표는 Task 도구가 가용할 때(구모델 또는 `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`)의 규정이며, **부재 시 아래 대체 규약을 따른다**. 없는 도구의 호출을 의무로 남겨두면 실행 불가능한 규정이 된다.
+> **도구 가용성 선확인 (v2.1.233+)**: `TaskCreate/Get/Update/List`는 현행 모델(Opus 4.8 / Sonnet 5 / Fable 5 / Mythos 5 이상)에서 기본 제거되어 이 저장소 실행 환경에 **존재하지 않는다** — 실측은 R002 「Todo/Task 도구 기본 제거」. 아래 표는 Task 도구가 가용할 때(구모델 또는 `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`)의 규정이며, **부재 시 아래 「Task 도구 부재 시 대체 규약」을 따른다**. 없는 도구의 호출을 의무로 남겨두면 실행 불가능한 규정이 된다.
 -->
 
 | 시점 | 호출 |
@@ -487,6 +487,17 @@ Reference issue: #1087.
 `TaskList` 부재로 **공유 작업 목록이라는 조율 기반 자체가 사라지므로**, 아래 Member Completion Verification의 "보고는 신호일 뿐, 판정은 실측"이 보조 원칙이 아니라 **유일한 방어선**이 된다.
 -->
 
+### 멤버 도구 부재 시 대체 규약 (Origin: #1817)
+
+멤버의 도구 구성은 그 에이전트의 frontmatter `tools:`와 실행 환경에 좌우되는 것으로 추정된다(#1817 "추정 원인 (미검증)") — `SendMessage`·`Agent`·`ToolSearch`가 있다고 가정하지 않는다(#1817: 멤버 3종에서 일부 부재 관측). 전용 `Glob`/`Grep`은 실측됐다(R002 ‡, CC 2.1.289): frontmatter `tools:`에 명시한 `qa-writer`는 받았고, 명시 목록이 없는 메인 세션에는 없었다 — 명시되지 않은 쪽은 부재로 전제한다. Detection = No일 때 이름 붙인 멤버(general-purpose 팀원 1건 실측)는 직접 도구에 `Agent`가 있어도(CC 2.1.289) R010 Core Rule상 서브에이전트를 스폰하지 않는다 — 이는 도구 부재가 아니라 프로젝트 정책이며(Detection = Yes 멤버는 R010의 Agent Teams 예외를 따른다), `SendMessage`는 직접 목록에는 없으나 `ToolSearch`(query "select:SendMessage")로 지연 로드해 `team-lead`에게 전달됐다(CC 2.1.289 실측) — 따라서 `SendMessage` 부재를 전제하지 말고 먼저 로드를 시도한다. 멤버→멤버 메시징은 `[가설]` 미관측이다. 멤버 측 `SendMessage` 지시(위 「Task 도구 부재 시 대체 규약」 표, TaskUpdate 표의 "차단 시" 행, 「Blocked Agent Behavior」의 "Post-completion: SendMessage + wait silently")는 모두 `SendMessage` 부재 시 아래 표를 따른다.
+
+| 부재 도구 | 대체 수단 |
+|-----------|-----------|
+| `SendMessage` | 아티팩트 파일 채널(R006 Artifact Channel Protocol) — 오케스트레이터가 경로를 중계 |
+| `Agent` | 멤버는 필요한 스폰(예: R017 `mgr-sauron:watch`)을 보고하고 오케스트레이터가 스폰 |
+| `ToolSearch` | 로드할 수 없는 지연 도구는 부재로 취급하고 이 표의 해당 행을 따른다(R002 §) |
+| 전용 `Glob`/`Grep` (명시 목록에 없음) | 읽기 전용 Bash(`git grep`·`find`, R002 Tier 4 승인 정책 적용). Bash도 없으면 오케스트레이터가 사전 수집해 내용으로 전달(R010 「Known Limitations (Active Cache)」) |
+
 ## Member Completion Verification (deterministic ground-truth)
 
 Agent Teams member completion MUST be verified by deterministic ground-truth — NOT by SendMessage reports or TaskList status alone. Members may edit files without updating task status (task stays `pending`) or go idle without executing at all.

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -11,11 +11,12 @@ The main conversation is the **sole orchestrator**. It uses routing skills to de
 -->
 
 <!-- DETAIL: Agent Teams Exception detail (restated in ARCHIVED note below)
-**Agent Teams Exception**: Agent Teams members are peers, not hierarchical subagents. Teams members CAN spawn sub-agents via the Agent tool to execute complex workflows (e.g., research teams, verification teams). This enables Teams-compatible skills like `/research` and `/deep-plan` to run inside Team members. The Teams member acts as a local orchestrator for its own sub-tasks.
+**Agent Teams Exception** (conditional, #1817): Agent Teams members are peers, not hierarchical subagents. A member MAY spawn sub-agents via the Agent tool only when `Agent` is actually in its tool list (presumably decided by its frontmatter `tools:` and the execution environment — #1817 "추정 원인 (미검증)"; the documented cause of dedicated Glob/Grep absence is CC 2.1.117, which replaces them with Bash-embedded bfs/ugrep on native builds — #1817 observed members without `Agent`/`SendMessage`/`ToolSearch`). When present, the member acts as a local orchestrator for its own sub-tasks (e.g., `/research`, `/deep-plan` inside a member). When absent, use the R018 「멤버 도구 부재 시 대체 규약」: file channel + orchestrator relay/spawn.
+Original wording (pre-#1817): "Teams members CAN spawn sub-agents via the Agent tool to execute complex workflows (e.g., research teams, verification teams)."
 -->
 
 <!-- ARCHIVED CC version note (historical):
-> **v2.1.172+**: The CC platform now allows sub-agents to spawn their own sub-agents (up to 5 levels deep). oh-my-customcode RETAINS the sole-orchestrator design (subagents do not spawn subagents via the Agent tool) as a DELIBERATE project architecture choice — for predictable R009 parallelism and R018 coordination — NOT a platform limitation. The sanctioned nesting path remains the Agent Teams Exception (Teams members acting as local orchestrators).
+> **v2.1.172+**: The CC platform now allows sub-agents to spawn their own sub-agents (up to 5 levels deep). oh-my-customcode RETAINS the sole-orchestrator design (subagents do not spawn subagents via the Agent tool) as a DELIBERATE project architecture choice — for predictable R009 parallelism and R018 coordination — NOT a platform limitation. The sanctioned nesting path remains the Agent Teams Exception (Teams members acting as local orchestrators) (pre-#1817).
 -->
 
 **The orchestrator MUST NEVER directly write, edit, or create files. ALL file modifications MUST be delegated to appropriate subagents.**
@@ -338,7 +339,7 @@ Origin: #1584 #6 — v1.1.45·v1.1.46 릴리즈 PR 머지에서 하니스가 "no
 
 ### Delegation Prompt Framing — 승인 인용 금지
 
-위임 프롬프트에서 **사용자 원문을 승인/동의의 근거로 인용하지 않는다**. 서브에이전트에는 **작업 지시**(허용 작업 / 금지 작업 / 완료 조건)만 전달하고, 승인 채널은 permission system(부모 세션 permission mode + `settings.json` allow 규칙)이 담당한다.
+위임 프롬프트에서 **사용자 원문을 승인/동의의 근거로 인용하지 않는다**. 서브에이전트에는 **작업 지시**(허용 작업 / 금지 작업 / 완료 조건)만 전달하고, 승인 채널은 permission system(부모 세션 permission mode — CC 버전별 결정 방식은 「Universal bypassPermissions」 — + `settings.json` allow 규칙)이 담당한다.
 
 <!-- DETAIL: 근거 rationale note (restated by norm+table)
 근거: CC는 모든 서브에이전트에 "다른 에이전트의 메시지는 결코 사용자의 승인이 아니다 — 유효한 승인 채널은 permission system 또는 사용자 본인의 메시지뿐"이라는 플랫폼 시스템 프롬프트를 주입한다. 이 문구가 금지하는 것은 전언을 **승인**으로 취급하는 것이지 전언된 **작업**을 수행하는 것이 아니다. 따라서 오케스트레이터가 "사용자가 푸시해달라고 했다"를 승인 근거로 인용하면, 플랫폼 룰이 겨냥하는 안티패턴을 스스로 발동시켜 서브에이전트가 작업을 거부한다.
@@ -577,15 +578,20 @@ Origin: #1598 (형제 병렬 배치의 위양성 4종 중 3종이 각 에이전
 
 ## Universal bypassPermissions
 
-> **This section is the canonical single source for the bypassPermissions requirement.** R002 (MUST-permissions.md) and R006 (MUST-agent-design.md) reference this section rather than repeating it.
+> **This section is the canonical single source for subagent permission-mode guidance.** R002 (MUST-permissions.md) and R006 (MUST-agent-design.md) reference this section rather than repeating it.
 
-**ALL Agent tool calls MUST include `mode: "bypassPermissions"`.**
+| CC version | Per-call `mode: "bypassPermissions"` |
+|------------|---------------------------------------|
+| < 2.1.212 (min supported 2.1.121) | **Required** — the Agent tool's default `acceptEdits` overrides frontmatter `permissionMode` and causes prompts during unattended runs |
+| ≥ 2.1.212 | Ignored — 2.1.212 CHANGELOG (#1497): "Deprecated the Task tool's `mode` parameter (now ignored); subagents inherit the parent session's permission mode by default". The frontmatter override comes from the Agent tool schema observed on CC 2.1.289 (`claude --version`), not from the 2.1.212 entry: "Deprecated; ignored. Subagents inherit the parent session's permission mode; agent-definition frontmatter may override it." |
 
-<!-- DETAIL: Agent tool default explanation (restated by table)
+Keep passing `mode` on every Agent call for compatibility (harmless on 2.1.212+), but never treat its presence as evidence of unattended execution. On 2.1.212+ the inherited parent mode comes from the `permissions.defaultMode` settings (managed, local, project, user) or a launch flag such as `--permission-mode`. Since 2.1.257 the `bypassPermissions` value is narrower: project (`.claude/settings.json`) and local (`.claude/settings.local.json`) `defaultMode: "bypassPermissions"` is ignored, like `"auto"` (2.1.257 CHANGELOG), and an ignored project/local `bypassPermissions` is dropped, so that scope resolves to `default` and overrides a non-bypass user value (user `plan`/`auto`/`acceptEdits` → `default`), whereas with user `bypassPermissions` the result stays `bypassPermissions` (no ignore WARN observed); other values there (measured: `default`, `acceptEdits`; `auto` is ignored per the same CHANGELOG entry, unmeasured `[가설]`; `plan`/`dontAsk` unmeasured) still apply and override the user value, with precedence local > project > user (a project `"default"` overrides a user `auto`/`bypassPermissions`; an absent key leaves the user value in effect) — measured via `claude -p` init `permissionMode` (#1828 comments 5997497206 (E1–E8) / 5998595610 (C0–C9), CC 2.1.289, 2026-10-06). `[가설]` (unobserved): interactive TTY sessions (the 2026-09-02 DETAIL record below, user=auto + project·local=bypass → "auto mode is active", is not reconciled with the `-p` result; a launch flag such as an alias's `--enable-auto-mode` is only a hypothesis), whether `default` actually prompts, managed policy/`--settings` scopes, other CC versions, subagent inheritance. Bypass can still be granted elsewhere, e.g. user or managed settings, `--permission-mode`, or `--dangerously-skip-permissions` (`claude --help` on 2.1.289: "Bypass all permission checks.") (#1644).
+
+<!-- DETAIL (applies to CC < 2.1.212 only, #1818): Agent tool default explanation
 The Agent tool defaults to `mode: "acceptEdits"`, which overrides agent frontmatter `permissionMode` and causes permission prompts during unattended execution. This is a CC platform behavior, not a configuration error.
 -->
 
-<!-- DETAIL: bypassPermissions Aspect/Detail table
+<!-- DETAIL (applies to CC < 2.1.212 only, #1818): bypassPermissions Aspect/Detail table
 | Aspect | Detail |
 |--------|--------|
 | Scope | Every Agent tool call, without exception |
@@ -594,32 +600,42 @@ The Agent tool defaults to `mode: "acceptEdits"`, which overrides agent frontmat
 | Enforcement | Prompt-based (R021); all agent-spawning skills include instruction |
 -->
 
-### Self-Check
-
-Before spawning any agent:
-1. **유효 permission mode 확인** — per-call `mode` 파라미터는 v2.1.212+ 에서 무시되고,
-   **프로젝트 scope `permissions.defaultMode` 는 v2.1.257+ 에서도 무시된다(#1644)**.
-   무인 실행 전 실측할 것: `jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json`
-   (user scope) — 이 값 또는 `--permission-mode` 실행 플래그만이 유효하다.
+### Self-Check (MUST)
+
+Before unattended execution (item 1) and when authoring a skill that spawns agents (item 2):
+1. **유효 permission mode 실측** — CC ≥ 2.1.212: 부모 모드는 `permissions.defaultMode`(managed·local·
+   project·user 범위)와 실행 플래그(`--permission-mode` 등)가 정한다. 2.1.257+에서 무시되는 것은
+   project/local의 `bypassPermissions` 값(CHANGELOG상 `auto`도, 미측정 `[가설]`)이며 그 범위의 다른 값(예: 사용자가 project에 둔 `"default"`)은
+   여전히 원천이다(위 문단). 세 파일을 함께 실측한다 —
+   `jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json .claude/settings.json .claude/settings.local.json`
+   (출력 순서 user·project·local) — managed 설정과 실행 플래그도 원천이므로 별도로 확인한다. 범위 간
+   우선순위는 local > project > user이며 project의 `"default"`는 user의 `auto`/`bypassPermissions`를 덮는다
+   (#1828 comments 5997497206 (E1–E8) / 5998595610 (C0–C9), CC 2.1.289, 2026-10-06, `claude -p` init `permissionMode` 실측). 키가 없으면 user 값이 유지되고,
+   project/local `bypassPermissions`는 무시되어 그 범위는 `default`로 귀결되고 bypass가 아닌 user 값
+   (`plan`/`auto`/`acceptEdits`)을 덮는다; user가 `bypassPermissions`이면 결과는 `bypassPermissions`다.
+   TTY 세션(2026-09-02 DETAIL 기록과 미조정)·`default`의 실제 프롬프트 여부·managed/`--settings`·다른 버전·
+   서브에이전트 상속은 `[가설]` — 미관측.
+   대상 에이전트 frontmatter `permissionMode`가 위에서 실측한 유효 부모 모드를 덮어쓸 수 있다 — 근거는 CHANGELOG 항목이 아니라
+   CC 2.1.289에서 관측한 Agent tool 스키마("agent-definition frontmatter may override it")다. 이 구간에서
+   per-call `mode` 값은 무인 실행의 증거가 아니다(R020 "actual outcome ≠ attempt").
+   CC < 2.1.212: per-call `mode`가 서브에이전트 모드를 정한다 — 생략하면 기본값 `acceptEdits`가
+   frontmatter `permissionMode`를 덮어쓴다(위 버전 표). 어느 구간이든 유효 모드가
    bypassPermissions 가 아니면 프롬프트 발생을 전제로 계획한다.
-   하위 호환을 위해 per-call `mode: "bypassPermissions"` 는 계속 포함하되,
-   **그 존재를 무인 실행의 증거로 삼지 않는다**(R020 "attempt ≠ outcome").
 <!-- DETAIL: defaultMode ignored measurement evidence
    실측(2026-09-03, `claude -p --debug-file`): `[WARN] settings defaultMode "bypassPermissions"
    ignored — only policy/user/flag settings may grant bypass mode (projectSettings and
    localSettings are repo-controllable)` — 무시 동작이 직접 실증되었다. 프로젝트 settings에는
    `permissions._comment_defaultMode` 안내 키가 추가되었다(v1.1.59).
 -->
-2. Is this a new skill that spawns agents? → Add Permission Mode section
+2. Is this a new skill that spawns agents? → Include `mode: "bypassPermissions"` in its Agent calls (required below 2.1.212) and point to this section for the version split
 
 ### Common Violation
 
 ```
-❌ WRONG: Agent tool call without mode parameter
-   Agent(subagent_type: "lang-golang-expert", prompt: "...")
-
-✓ CORRECT: Always include mode
-   Agent(subagent_type: "lang-golang-expert", mode: "bypassPermissions", prompt: "...")
+❌ WRONG (CC < 2.1.212): Agent call without mode → acceptEdits default, prompts mid-run
+❌ WRONG (CC ≥ 2.1.212): Prompt appears → assume a missing mode is the cause
+✓ CORRECT: Always pass mode, and diagnose 2.1.212+ prompts via the parent's effective mode
+   and the agent's frontmatter permissionMode
 ```
 
 
@@ -637,7 +653,7 @@ Before spawning any agent:
 | >= v2.1.141 | Preserves current permission mode — `/bg` flows no longer need extra workaround |
 -->
 
-`mode: "bypassPermissions"` on every Agent tool call is still required (applies to Agent tool, not `/bg` shell command).
+Background agents (`/bg`, `←←`) keep the current session's permission mode (v2.1.141+); Agent tool calls still follow the CC-version table at the top of 「Universal bypassPermissions」 (per-call `mode` required below 2.1.212, ignored from 2.1.212).
 
 <!-- ARCHIVED CC version note (historical):
 > **v2.1.172+**: Fixed background agents potentially reading another directory's project settings (`.mcp.json` approvals, trust) when dispatched onto a pre-warmed worker. Strengthens background-agent isolation — a `/bg`-dispatched agent now reads the correct project's settings.
@@ -737,7 +753,7 @@ Before delegating a task to a subagent, MUST verify the target agent's tool capa
 | `Read` external files | `tools:` includes Read |
 | `Write` files | `tools:` includes Write (and target path not in `disallowedTools` scope) |
 | MCP server calls | `mcpServers:` includes the required server |
-| Task targets a specific file path | The path EXISTS (`Glob`/`ls`) — capability check alone does not catch a missing/renamed file |
+| Task targets a specific file path | The path EXISTS (`ls`/`find`, or `Glob` when present — not `git ls-files`, which reports an existing untracked path as absent; tracked status is the next row) — capability check alone does not catch a missing/renamed file |
 | Task targets an EXISTING file for editing/commit (not a newly-created file) | The path is git-tracked (`git ls-files <path>` non-empty) — an existing-but-untracked target needs an explicit scope decision before delegation |
 
 <!-- DETAIL: path-existence clarification (restated by Required Checks row)
@@ -797,6 +813,7 @@ Before delegating a task to a subagent, MUST verify the target agent's tool capa
 | Agent | Limitation | Workaround |
 |-------|-----------|-----------|
 | `arch-documenter` | `disallowedTools: [Bash]` — cannot run `gh`, shell scripts, `diff`/`md5`/`verify-*.sh` | Pre-collect data via orchestrator, pass as content; OR use `general-purpose` for the Bash-needing portion. **Completion-condition guard (#1593 #1)**: do NOT put `diff` / `md5` / `verify-*.sh` execution into arch-documenter's completion criteria — the orchestrator must run these itself, or split off a `general-purpose` agent for the Bash-needing verification |
+| `arch-documenter`, `fe-design-expert`, `mgr-supplier`, `qa-planner`, `qa-writer`, `sys-naggy` (frontmatter parse: `Bash` in `disallowedTools`) | No Bash, so every search path is the dedicated `Grep`/`Glob` listed in their `tools:` (`sys-naggy` lists `Grep` only). Measured 2026-10-05 on CC 2.1.289: a spawned `qa-writer` received `Read`, `Write`, `Edit`, `Grep`, `Glob` — consistent with 2.1.162 ("explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search"); the main session, which has no explicit list, lacks them (2.1.117). The other five were not spawned to measure | Do not remove `Grep`/`Glob` from these agents' `tools:` — without Bash they would have no search path left |
 | `qa-engineer` | (verify each invocation) | — |
 
 ### Common Violation
@@ -818,9 +835,7 @@ Reference issues: #1202 item #2, `feedback_arch_documenter_no_bash.md`.
 > **Status**: Deprecated as of CC v2.1.121 (2026-04-28) and further relaxed in v2.1.126 (2026-05-01). Direct Write/Edit/Bash on `.claude/`, `.git/`, `.vscode/` works without prompts under `bypassPermissions` mode in CC v2.1.121+ (issue #1101).
 -->
 
-Current CC versions (>=2.1.121): direct Write/Edit/Bash on `.claude/**` paths are permitted under `mode: "bypassPermissions"`. The `/tmp/*.sh` script wrapping pattern previously required is no longer necessary. Catastrophic operations (e.g., `rm -rf /`) remain blocked by independent safety guards.
-
-`mode: "bypassPermissions"` on every Agent tool call is still required (see "Universal bypassPermissions" above).
+Current CC versions (>=2.1.121): direct Write/Edit/Bash on `.claude/**` paths are permitted when the effective permission mode is `bypassPermissions`. The `/tmp/*.sh` script wrapping pattern previously required is no longer necessary. Catastrophic operations (e.g., `rm -rf /`) remain blocked by independent safety guards.
 
 <!-- DETAIL: legacy /tmp bypass pointer (historical)
 **For CC < v2.1.121 only**: see git history of this rule for the legacy `/tmp/*.sh` bypass pattern (commit before v0.126.0).
@@ -861,7 +876,7 @@ After restart/compaction: re-read CLAUDE.md, all delegation rules still apply. N
 | Unmatched specialized task | mgr-creator → dynamic agent creation |
 
 **Rules:**
-- All file modifications MUST be delegated (orchestrator only uses Read/Glob/Grep)
+- All file modifications MUST be delegated (orchestrator only uses read-only tools — Read, Glob/Grep when present, otherwise read-only Bash such as `git grep`/`find`)
 - Use specialized agents, not general-purpose, when one exists
 - general-purpose only for truly generic tasks (file moves, simple scripts)
 - No exceptions for "small" or "quick" changes
@@ -926,7 +941,7 @@ The following paths MUST be created or structurally modified ONLY through `mgr-c
 ## Exception: Simple Tasks
 
 Subagent NOT required for:
-- Reading files for analysis (Read, Glob, Grep only)
+- Reading files for analysis (read-only tools only — see Rules above; dedicated Glob/Grep may be absent)
 - Simple file searches
 - Direct questions answered by main conversation
 
@@ -1053,6 +1068,8 @@ See **R018 (MUST-agent-teams.md)** for the Detection table, complete decision ma
 **Quick rule** (applies only when active): 3+ agents OR review cycle OR 2+ issues in same batch → use Agent Teams.
 Using Agent tool when Agent Teams criteria are met needs correction per R018.
 
+Exception to the Core Rule ("Subagents MUST NOT spawn other subagents"), only when R018 Detection = Yes: Agent Teams members are peers, not hierarchical subagents (Agent Teams Exception — narrowed by #1817). When Detection = No, every agent spawned via the Agent tool is treated as a subagent under the Core Rule by policy (even if a named spawn appears as a Teammate in `ListAgents`). Members spawn sub-agents or message peers only if `Agent`/`SendMessage` are available to them (directly or loadable via `ToolSearch`); otherwise the orchestrator relays via files and spawns on their behalf (R018 「멤버 도구 부재 시 대체 규약」).
+
 <!-- DETAIL: Announcement Format
 ```
 [Routing] Using {routing-skill} for {task}

package/templates/.claude/rules/MUST-permissions.md

@@ -6,15 +6,19 @@
 
 | Tier | Tools | Policy |
 |------|-------|--------|
-| 1: Always | Read, Glob, Grep, ToolSearch | Free use, read-only |
+| 1: Always | Read, Glob‡, Grep‡, ToolSearch§ | Free use, read-only |
 | 2: Default | Write, Edit, NotebookEdit | State changes explicitly, notify before modifying important files |
 | 3: Context | Agent, Skill, EnterPlanMode, ExitPlanMode, EnterWorktree, ExitWorktree, LSP, Monitor, TodoWrite†, AskUserQuestion, PushNotification | Context-dependent, no user approval needed |
 | 4: Approval | Bash, PowerShell, WebFetch, WebSearch | Request user approval on first use |
-| 5: Conditional | TeamCreate†, TeamDelete†, SendMessage, TaskCreate†, TaskGet†, TaskList†, TaskUpdate†, TaskStop | Available when Agent Teams enabled (TaskOutput 제거됨, v2.1.277+ — 아래 참조) |
+| 5: Conditional | TeamCreate†, TeamDelete†, SendMessage, TaskCreate†, TaskGet†, TaskList†, TaskUpdate†, TaskStop | Available when Agent Teams enabled; `SendMessage` to a named agent also delivered without `TeamCreate` (CC 2.1.289 measured) (TaskOutput 제거됨, v2.1.277+ — 아래 참조) |
 | 6: MCP | ListMcpResourcesTool, ReadMcpResourceTool, CronCreate, CronDelete, CronList, RemoteTrigger | MCP/extension tools, available when servers configured |
 
 > **†** 현행 모델의 기본 실행 환경에 **존재하지 않는다** — 아래 v2.1.233 노트 참조. 이 표는 **도구 카탈로그**이지 가용성 보증이 아니므로, 규칙이 특정 도구 호출을 의무화하기 전에 실측(도구 목록 / `ToolSearch`)으로 존재를 확인한다.
 
+> **‡** 네이티브 빌드(macOS/Linux)에서는 전용 `Glob`/`Grep`이 Bash 내장 `bfs`/`ugrep`으로 대체되고(CHANGELOG 2.1.117: "the `Glob` and `Grep` tools are replaced by embedded `bfs` and `ugrep` available through the Bash tool"), `--tools`로 명시하면 전용 도구가 제공된다(2.1.162: "explicitly listing Grep/Glob now provides the dedicated search tools on native builds with embedded search"). 실측(CC 2.1.289, 2026-10-05): frontmatter `tools:`에 Grep/Glob을 명시한 `qa-writer`는 전용 `Grep`/`Glob`을 받았고(Bash 없음), 명시 목록이 없는 메인 세션에는 없었다 — frontmatter 명시가 `--tools` 명시와 같은 효과라는 일반화는 이 1건에 근거한 추정이다. 전용 도구가 없으면 읽기 전용 Bash(`git grep`·`find`)로 대체한다(R005: 가용성 미확인 시 Bash 우선 #1307, 전수조사 `git grep` 표준 #1590). 이 대체는 Tier 1 작업을 Tier 4로 옮기므로 Tier 4 정책("Request user approval on first use")이 적용된다. Bash도, frontmatter에 명시된 해당 검색 도구도 없는 경우(예: `sys-naggy`는 Grep만 명시 — Glob 검색)에만 오케스트레이터가 사전 수집해 내용으로 전달한다(R010 「Known Limitations (Active Cache)」).
+
+> **§** `ToolSearch`도 멤버 실행 환경에 없을 수 있다(#1817 QA teammate 관측) — 없으면 지연 도구를 로드할 수 없으므로 그 지연 도구는 부재로 취급한다(R018 「멤버 도구 부재 시 대체 규약」).
+
 ## File Access
 
 | Operation | Allowed | Prohibited |
@@ -147,6 +151,8 @@ CHANGELOG v2.1.233 원문: *"Todo/task-tracking tools (TaskCreate/Get/Update/Lis
 | 잔존 | `TaskStop`, `SendMessage` |
 | 제거됨 (v2.1.277+) | `TaskOutput` — background task output은 Read로 직접 읽는다; `taskOutputMaxChars`/`TASK_MAX_OUTPUT_LENGTH` 무효 |
 
+이 표(2026-08-15, `claude-opus-5[1m]`/`claude-sonnet-5`)는 2026-10-06 재측정 `claude-opus-5-5` 메인에서도 같았다 — haiku 팀원 1건은 `ToolSearch`로 `TaskCreate`/`TaskList`/`TaskUpdate`/`TaskGet`을 로드했고 sonnet-5-5 팀원 1건은 불가였으며, `TeamCreate`/`TeamDelete`는 측정한 셋 모두 불가였다(CC 2.1.289 실측).
+
 <!-- DETAIL: TaskOutput 2026-08-15 측정 당시 잔존 표기(v2.1.233 기준) — CC v2.1.277 CHANGELOG: "Removed the deprecated TaskOutput tool; Claude reads a background task's output file with Read instead, and the `taskOutputMaxChars` setting and `TASK_MAX_OUTPUT_LENGTH` no longer have any effect" Origin: #1714.
 -->
 
@@ -157,25 +163,24 @@ CHANGELOG v2.1.233 원문: *"Todo/task-tracking tools (TaskCreate/Get/Update/Lis
 
 `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`은 복구 수단이나 **환경 설정 사안**이므로 규칙이 그 설정을 전제하지 않는다. 공식 settings 문서(`code.claude.com/docs/en/settings`)에는 2026-08-15 기준 미수록 — 현재 근거는 CHANGELOG 원문 + 위 실측이다.
 
-Origin: #1582. Cross-ref: R018(Member TaskUpdate Discipline 대체 규약), R020("도구가 있다"는 가정도 실측 대상).
+Origin: #1582. Cross-ref: R018 「Task 도구 부재 시 대체 규약」(Member TaskUpdate Discipline 하위 절), R020("도구가 있다"는 가정도 실측 대상).
 -->
 `TeamCreate`/`TeamDelete`도 별도로 부재 — R018은 이 환경에서 비활성입니다(R018 Detection). 규칙은 **존재하지 않는 도구의 호출을 의무화하지 않으며**, 도구 의존 의무를 쓸 때는 부재 시 대체 규약을 함께 규정합니다(R018 Member TaskUpdate Discipline이 그 예). `CLAUDE_CODE_ENABLE_TODO_TOOLS=1`은 환경 설정 사안이므로 규칙이 전제하지 않습니다. Origin: #1582.
 
 ## Agent Tool Permission Mode
 
-> Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions" owns the full requirement, rationale, self-check, and version history. Core rule: always pass `mode: "bypassPermissions"` explicitly on every Agent tool call — the Agent tool's default `mode` (`acceptEdits`) overrides agent frontmatter `permissionMode` and causes prompts during unattended execution. Skills that spawn agents MUST include this in their Agent tool call instructions. See R010 for details.
-
-**주의**: v2.1.212+부터 `mode` 파라미터는 무시되며 유효 모드는 부모 세션이 결정합니다 — 실측은 R010 Self-Check를 참조합니다.
+> Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions" owns the guidance, self-check, and version history. Core: below CC 2.1.212, per-call `mode: "bypassPermissions"` is required (the Agent tool's default `acceptEdits` overrides frontmatter `permissionMode`); from 2.1.212 it is ignored and subagents inherit the parent session's mode, which frontmatter `permissionMode` may override. Keep passing `mode` for compatibility, but measure the effective mode before unattended runs (R010 Self-Check 1).
 
 <!-- DETAIL: Agent tool mode deprecation rationale (canonical: R010)
 > **v2.1.212+**: CC가 Agent(구 Task) tool의 `mode` 파라미터를 deprecated 처리했습니다(이제 무시) — subagent는 부모 세션의 permission mode를 기본 상속합니다. 위 canonical 요약의 default `mode`(`acceptEdits`)가 frontmatter `permissionMode`를 override한다는 서술 및 항상 `mode: "bypassPermissions"`를 넘기라는 요건은 이 버전부터 stale이며(파라미터가 무시됨), 무인 실행의 실질 게이트는 부모 세션의 permission mode입니다. 요건 재조정은 R010 "Universal bypassPermissions"가 canonical — R002는 이 flag만 유지합니다.
 -->
 
 <!-- DETAIL: defaultMode project-scope-ignored rationale (canonical: R010)
-> **v2.1.257+**: 프로젝트 scope `permissions.defaultMode` 가 무시됩니다(user/managed scope 또는
-> `--permission-mode` 플래그만 유효). 위 v2.1.212 노트가 "무인 실행의 실질 게이트는 부모 세션의
-> permission mode"라고 정정했는데, **그 부모 세션 모드를 프로젝트 settings로 지정하는 경로가 이
-> 버전에서 끊겼습니다** — 이 파일 상단 「Deny Rule Glob Patterns」의 v2.1.214 노트(allow 규칙만
+> **v2.1.257+**: `.claude/settings.json`·`.claude/settings.local.json`의 `defaultMode: "bypassPermissions"`
+> 값이 `"auto"`처럼 무시됩니다(CHANGELOG 2.1.257 — 다른 값은 이 항목의 대상이 아님; bypass는 user/managed
+> settings 또는 `--permission-mode`로 지정). 위 v2.1.212 노트가 "무인 실행의 실질 게이트는 부모 세션의
+> permission mode"라고 정정했는데, **그 부모 세션 모드를 프로젝트 settings로 `bypassPermissions`로
+> 지정하는 경로가 이 버전에서 끊겼습니다** — 이 파일 상단 「Deny Rule Glob Patterns」의 v2.1.214 노트(allow 규칙만
 > `<cwd>`로 좁아진 비대칭)와 같은 계열의 **project-scope 축소** 흐름입니다. Canonical owner 는
 > R010 "Universal bypassPermissions" — 상세와 실측 절차는 그쪽을 참조합니다. Origin: #1644.
 -->

package/templates/.claude/settings.json

@@ -1,7 +1,4 @@
 {
-  "permissions": {
-    "defaultMode": "default"
-  },
   "hooks": {
     "PreToolUse": [
       {

package/templates/.claude/skills/action-validator/SKILL.md

@@ -109,11 +109,11 @@ When a synthesized harness exists for an agent (`.claude/outputs/harnesses/{agen
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write action-validator results under `.claude/outputs/sessions/`:
 
-1. Write the artifact body directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/action-validator-$(date +%H%M%S).md` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/sessions/$(date +%Y-%m-%d)/action-validator-$(date +%H%M%S).md` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.

package/templates/.claude/skills/adaptive-harness/SKILL.md

@@ -187,11 +187,11 @@ Append a record to `.claude/outputs/harness-adaptations/YYYY-MM-DD.md`:
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write adaptive-harness results under `.claude/outputs/`:
 
-1. Write the artifact body directly to `.claude/outputs/harness-adaptations/$(date +%Y-%m-%d).md` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/harness-adaptations/$(date +%Y-%m-%d).md` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.

package/templates/.claude/skills/adversarial-review/SKILL.md

@@ -102,4 +102,4 @@ Refs: #1171 (CRG 통합), #1180 (본 cross-ref 추가)
 
 ## Permission Mode
 
-When spawning agents via the Agent tool during this skill's execution, always pass `mode: "bypassPermissions"`. The Agent tool default (`acceptEdits`) overrides agent frontmatter `permissionMode`, causing permission prompts during unattended execution.
+Pass `mode: "bypassPermissions"` on Agent calls for compatibility: it is required on CC < 2.1.212 (the per-call default, `acceptEdits`, overrides agent frontmatter `permissionMode`) and ignored on 2.1.212+, where subagents inherit the parent session's permission mode (adjustable via agent frontmatter `permissionMode`). Verify the effective mode before unattended runs: see R010 "Universal bypassPermissions".

package/templates/.claude/skills/agent-eval-framework/SKILL.md

@@ -75,11 +75,11 @@ Use this taxonomy to **select representative tasks per category** when building
 
 ### Tool: Writing artifacts under .claude/outputs/
 
-Under `mode: "bypassPermissions"`, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
+Under the `bypassPermissions` permission mode, direct Write/Edit/Bash on `.claude/**` paths is permitted (CC v2.1.121+, #1101) — no `/tmp/*.sh` wrapping is needed.
 
 To write eval trajectories or result reports under `.claude/outputs/evals/`:
 
-1. Write the artifact body directly to `.claude/outputs/evals/{trajectories,sessions}/...` with the Write tool (every Agent tool call includes `mode: "bypassPermissions"`, R010)
+1. Write the artifact body directly to `.claude/outputs/evals/{trajectories,sessions}/...` with the Write tool (under the `bypassPermissions` permission mode, R010)
 2. Read-only Bash on `.claude/outputs/` (e.g., `cat`, `head`, `wc`) is allowed for verification
 
 Reference: R006/R010 sensitive-path handling (CC v2.1.121+), #1101.