oh-my-customcode 1.1.106 → 1.1.107

package/dist/index.js

@@ -416,7 +416,7 @@ var MESSAGES = {
     "update.file_applied": "Applied update to {{path}}",
     "update.lockfile_regenerated": "Lockfile regenerated ({{files}} files tracked)",
     "update.lockfile_failed": "Failed to regenerate lockfile: {{error}}",
-    "update.protected_file_updated": "⟳ Protected file {{file}} in {{component}} updated: {{hint}}",
+    "update.protected_file_updated": "⟳ Protected file {{file}} in {{component}} selected for update: The protected-file policy allows this template update.",
     "update.namespace_synced": "Namespace synced: {{file}} ({{component}})",
     "update.hook_commands_migrated": "Migrated {{count}} hook/statusLine command(s) to CLAUDE_PROJECT_DIR-anchored paths",
     "update.hook_commands_migration_failed": "Failed to migrate hook commands in {{path}}",
@@ -430,18 +430,10 @@ var MESSAGES = {
     "codex.installing_npm": "Installing Codex CLI via npm...",
     "codex.install_failed": "Failed to install Codex CLI: {{error}}",
     "codex.unsupported_os": "Codex CLI auto-install is not supported on {{os}}",
-    "rtk.already_installed": "RTK is already installed",
-    "rtk.installing_brew": "Installing RTK via Homebrew...",
-    "rtk.installing_curl": "Installing RTK via install script...",
-    "rtk.install_failed": "Failed to install RTK: {{error}}",
-    "rtk.unsupported_os": "RTK auto-install is not supported on {{os}}",
     "mcp.ontology_rag_configured": "ontology-rag MCP server configured successfully",
     "install.codex_installing": "Installing Codex CLI...",
     "install.codex_success": "Codex CLI installed successfully",
     "install.codex_already": "Codex CLI is already installed",
-    "install.rtk_installing": "Installing RTK...",
-    "install.rtk_success": "RTK installed successfully",
-    "install.rtk_already": "RTK is already installed",
     "install.preserved": "Preserved {{files}} file(s) and {{dirs}} directory(ies) from the existing installation",
     "install.restored": "Restored {{files}} file(s) and {{dirs}} directory(ies) after installation",
     "install.backup_failed": "Failed to back up {{path}}: {{error}}",
@@ -453,7 +445,6 @@ var MESSAGES = {
     "preserve.restore_failed": "Failed to restore file {{file}}: {{error}}",
     "preserve_files.invalid_path": "Ignored invalid preserve_files entry from {{source}}: {{path}} ({{reason}})",
     "update.codex_missing": "Codex CLI is not installed",
-    "update.rtk_missing": "RTK is not installed",
     "update.self_update_skipped": "Skipped update: source project cannot update itself",
     "update.deprecated_file_invalid_path": "Skipped deprecated file with invalid path: {{path}} ({{reason}})",
     "update.deprecated_file_removed": "Removed deprecated file: {{path}} ({{reason}})",
@@ -461,8 +452,8 @@ var MESSAGES = {
     "update.entry_doc_force_updated": "Entry document force-updated: {{path}}",
     "update.entry_merge_warning": "Entry document merge warning: {{warning}}",
     "update.entry_template_not_found": "Entry document template not found: {{template}}",
-    "update.protected_file_force_overwrite": "Protected file {{file}} in {{component}} overwritten: {{hint}}",
-    "update.protected_file_skipped": "Protected file {{file}} in {{component}} skipped: {{hint}}",
+    "update.protected_file_force_overwrite": "Protected file {{file}} in {{component}} selected for overwrite: The --force-overwrite-all option bypasses the protected-file preservation policy.",
+    "update.protected_file_skipped": "Protected file {{file}} in {{component}} skipped: The protected-file preservation policy skips this update. Use --force-overwrite-all to override.",
     "update.settings_local_backfill_failed": "Failed to backfill statusLine refreshInterval in {{path}}",
     "general.done": "Done!",
     "general.failed": "Failed",
@@ -538,7 +529,7 @@ var MESSAGES = {
     "update.file_applied": "{{path}} 업데이트 적용",
     "update.lockfile_regenerated": "잠금 파일 재생성 완료 ({{files}}개 파일 추적)",
     "update.lockfile_failed": "잠금 파일 재생성 실패: {{error}}",
-    "update.protected_file_updated": "⟳ 보호 파일 {{file}} ({{component}}) 업데이트됨: {{hint}}",
+    "update.protected_file_updated": "⟳ 보호 파일 {{file}} ({{component}}) 업데이트 대상: 보호 파일 정책에 따라 템플릿 업데이트가 허용됩니다.",
     "update.namespace_synced": "네임스페이스 동기화: {{file}} ({{component}})",
     "update.hook_commands_migrated": "CLAUDE_PROJECT_DIR 기준 경로로 훅/상태줄 명령 {{count}}개를 마이그레이션했습니다",
     "update.hook_commands_migration_failed": "{{path}}의 훅 명령 마이그레이션에 실패했습니다",
@@ -552,18 +543,10 @@ var MESSAGES = {
     "codex.installing_npm": "npm으로 Codex CLI를 설치합니다...",
     "codex.install_failed": "Codex CLI 설치에 실패했습니다: {{error}}",
     "codex.unsupported_os": "{{os}}에서는 Codex CLI 자동 설치를 지원하지 않습니다",
-    "rtk.already_installed": "RTK가 이미 설치되어 있습니다",
-    "rtk.installing_brew": "Homebrew로 RTK를 설치합니다...",
-    "rtk.installing_curl": "설치 스크립트로 RTK를 설치합니다...",
-    "rtk.install_failed": "RTK 설치에 실패했습니다: {{error}}",
-    "rtk.unsupported_os": "{{os}}에서는 RTK 자동 설치를 지원하지 않습니다",
     "mcp.ontology_rag_configured": "ontology-rag MCP 서버 구성을 완료했습니다",
     "install.codex_installing": "Codex CLI를 설치합니다...",
     "install.codex_success": "Codex CLI를 설치했습니다",
     "install.codex_already": "Codex CLI가 이미 설치되어 있습니다",
-    "install.rtk_installing": "RTK를 설치합니다...",
-    "install.rtk_success": "RTK를 설치했습니다",
-    "install.rtk_already": "RTK가 이미 설치되어 있습니다",
     "install.preserved": "기존 설치에서 파일 {{files}}개와 디렉토리 {{dirs}}개를 보존했습니다",
     "install.restored": "설치 후 파일 {{files}}개와 디렉토리 {{dirs}}개를 복원했습니다",
     "install.backup_failed": "{{path}} 백업에 실패했습니다: {{error}}",
@@ -575,7 +558,6 @@ var MESSAGES = {
     "preserve.restore_failed": "파일 {{file}} 복원에 실패했습니다: {{error}}",
     "preserve_files.invalid_path": "{{source}}의 유효하지 않은 preserve_files 항목을 무시했습니다: {{path}} ({{reason}})",
     "update.codex_missing": "Codex CLI가 설치되어 있지 않습니다",
-    "update.rtk_missing": "RTK가 설치되어 있지 않습니다",
     "update.self_update_skipped": "업데이트를 건너뜁니다: 소스 프로젝트는 스스로 업데이트할 수 없습니다",
     "update.deprecated_file_invalid_path": "경로가 유효하지 않아 지원 중단 파일을 건너뜁니다: {{path}} ({{reason}})",
     "update.deprecated_file_removed": "지원 중단 파일을 삭제했습니다: {{path}} ({{reason}})",
@@ -583,8 +565,8 @@ var MESSAGES = {
     "update.entry_doc_force_updated": "진입 문서를 강제로 업데이트했습니다: {{path}}",
     "update.entry_merge_warning": "진입 문서 병합 경고: {{warning}}",
     "update.entry_template_not_found": "진입 문서 템플릿을 찾을 수 없습니다: {{template}}",
-    "update.protected_file_force_overwrite": "{{component}}의 보호 파일 {{file}}을(를) 덮어썼습니다: {{hint}}",
-    "update.protected_file_skipped": "{{component}}의 보호 파일 {{file}}을(를) 건너뜁니다: {{hint}}",
+    "update.protected_file_force_overwrite": "{{component}}의 보호 파일 {{file}} 덮어쓰기 대상: --force-overwrite-all 옵션에 따라 보호 파일 보존 정책을 적용하지 않습니다.",
+    "update.protected_file_skipped": "{{component}}의 보호 파일 {{file}}을(를) 건너뜁니다: 보호 파일 보존 정책에 따라 업데이트를 건너뜁니다. 덮어쓰려면 --force-overwrite-all 옵션을 사용하십시오.",
     "update.settings_local_backfill_failed": "{{path}}의 statusLine refreshInterval 보충에 실패했습니다",
     "general.done": "완료!",
     "general.failed": "실패",
@@ -1173,6 +1155,7 @@ var LEGACY_OMCUSTOM_DESCRIPTIONS = [
 ];
 var STANDALONE_SCRIPT_COMMAND = /^(?:bash )?(?:"(?:\$\{CLAUDE_PROJECT_DIR:-\.\}\/|\.\/)?\.claude\/hooks\/((?:scripts\/)?[A-Za-z0-9._-]+\.sh)"|(?:\.\/)?\.claude\/hooks\/((?:scripts\/)?[A-Za-z0-9._-]+\.sh))$/;
 var SCRIPT_REFERENCE = /\.claude\/hooks\/((?:scripts\/)?[A-Za-z0-9._-]+\.sh)/g;
+var RETIRED_RTK_DESCRIPTION = "RTK auto-intercept — transparently rewrites CLI commands through RTK proxy when available (R013 advisory)";
 function matcherKey(group) {
   return typeof group.matcher === "string" ? group.matcher : "";
 }
@@ -1234,15 +1217,52 @@ function isOwnedCommand(hook, owned) {
   const script = match?.[1] ?? match?.[2];
   return script !== undefined && owned.scripts.has(script);
 }
-function userResidual(group, owned, ownership) {
+function isRetiredRtkCommand(hook, event, matcher) {
+  if (event !== "PreToolUse" || matcher !== "Bash" || !isRecord(hook) || hook.type !== "command" || typeof hook.command !== "string") {
+    return false;
+  }
+  const match = STANDALONE_SCRIPT_COMMAND.exec(hook.command);
+  return (match?.[1] ?? match?.[2]) === "scripts/rtk-intercept.sh";
+}
+function retireRtkGroup(group, event) {
+  if (!isRecord(group) || !Array.isArray(group.hooks)) {
+    return [group];
+  }
+  const remaining = group.hooks.filter((hook) => !isRetiredRtkCommand(hook, event, matcherKey(group)));
+  if (remaining.length === group.hooks.length) {
+    return [group];
+  }
+  return remaining.length === 0 ? [] : [{ ...group, hooks: remaining }];
+}
+function retireRtkHookBlocks(existing) {
+  if (!isRecord(existing)) {
+    return existing;
+  }
+  const updates = {};
+  for (const [event, value] of Object.entries(existing)) {
+    if (!Array.isArray(value)) {
+      continue;
+    }
+    const residual = value.flatMap((group) => retireRtkGroup(group, event));
+    if (residual.length !== value.length || residual.some((group, index) => group !== value[index])) {
+      updates[event] = residual;
+    }
+  }
+  return Object.keys(updates).length === 0 ? existing : { ...existing, ...updates };
+}
+function userResidual(group, event, owned, ownership) {
   if (!isRecord(group) || !Array.isArray(group.hooks)) {
     return [group];
   }
+  const matcher = matcherKey(group);
+  if (group.description === RETIRED_RTK_DESCRIPTION) {
+    return retireRtkGroup(group, event);
+  }
   if (typeof group.description === "string" && ownership.descriptions.has(group.description)) {
     return [];
   }
-  const ownedForMatcher = owned?.get(matcherKey(group));
-  const remaining = group.hooks.filter((hook) => !isOwnedCommand(hook, ownedForMatcher));
+  const ownedForMatcher = owned?.get(matcher);
+  const remaining = group.hooks.filter((hook) => !isRetiredRtkCommand(hook, event, matcher) && !isOwnedCommand(hook, ownedForMatcher));
   if (remaining.length === group.hooks.length) {
     return [group];
   }
@@ -1265,7 +1285,7 @@ function mergeHookBlocks(existing, generated) {
       continue;
     }
     const owned = ownership.events.get(event);
-    const residual = value.flatMap((group) => userResidual(group, owned, ownership));
+    const residual = value.flatMap((group) => userResidual(group, event, owned, ownership));
     if (residual.length === 0) {
       continue;
     }
@@ -2221,8 +2241,23 @@ function sortFilesByPath(files) {
   const sorted = Object.keys(files).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
   return Object.fromEntries(sorted.map((key) => [key, files[key]]));
 }
+var RETIRED_RTK_PATHS = [
+  ".claude/skills/rtk-exec/SKILL.md",
+  ".claude/skills/rtk-exec/scripts/rtk-wrapper.cjs",
+  ".claude/hooks/scripts/rtk-intercept.sh"
+];
+function getRetiredPaths(options) {
+  const retiredPaths = new Set([...RETIRED_RTK_PATHS, ...options.retiredPaths ?? []]);
+  for (const path of retiredPaths) {
+    if (typeof path !== "string" || /[\\:*?[\]{}\0]/.test(path) || path.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+      throw new Error("retiredPaths must contain exact canonical relative file paths");
+    }
+  }
+  return retiredPaths;
+}
 async function generateLockfile(targetDir, generatorVersion, templateVersion, options = {}) {
   const files = {};
+  const retiredPaths = getRetiredPaths(options);
   const gitVisible = options.excludeGitIgnored ? await listGitVisiblePaths(targetDir) : null;
   const componentRoots = COMPONENT_PATHS.map(([prefix]) => join4(targetDir, prefix));
   for (const componentRoot of componentRoots) {
@@ -2231,7 +2266,7 @@ async function generateLockfile(targetDir, generatorVersion, templateVersion, op
       debug("lockfile.component_dir_missing", { path: componentRoot });
       continue;
     }
-    const allFiles = await collectFiles(componentRoot, targetDir, false);
+    const allFiles = (await collectFiles(componentRoot, targetDir, false)).filter((absolutePath) => !retiredPaths.has(relative2(targetDir, absolutePath).replace(/\\/g, "/")));
     for (const absolutePath of allFiles) {
       const relativePath = relative2(targetDir, absolutePath).replace(/\\/g, "/");
       if (gitVisible !== null && !isGitVisible(gitVisible, relativePath)) {
@@ -2314,65 +2349,6 @@ async function generateAndWriteLockfileForDir(targetDir, options = {}) {
   }
 }
 
-// src/core/rtk-installer.ts
-import { execSync as execSync2 } from "node:child_process";
-import { platform as platform2 } from "node:os";
-var defaultDeps2 = {
-  exec: execSync2,
-  getPlatform: platform2
-};
-function isRtkInstalled(deps = defaultDeps2) {
-  try {
-    deps.exec("which rtk", { stdio: "pipe", timeout: 3000 });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function installRtk(deps = defaultDeps2) {
-  if (process.env.CI || false || false) {
-    return false;
-  }
-  if (isRtkInstalled(deps)) {
-    info("rtk.already_installed");
-    return true;
-  }
-  const os = deps.getPlatform();
-  try {
-    if (os === "darwin") {
-      try {
-        info("rtk.installing_brew");
-        deps.exec("brew install rtk-ai/tap/rtk", {
-          stdio: "inherit",
-          timeout: 120000
-        });
-        return true;
-      } catch {
-        info("rtk.installing_curl");
-        deps.exec("curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh", {
-          stdio: "inherit",
-          timeout: 120000
-        });
-        return isRtkInstalled(deps);
-      }
-    } else if (os === "linux") {
-      info("rtk.installing_curl");
-      deps.exec("curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh", {
-        stdio: "inherit",
-        timeout: 120000
-      });
-      return isRtkInstalled(deps);
-    } else {
-      warn("rtk.unsupported_os", { os });
-      return false;
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    warn("rtk.install_failed", { error: message });
-    return false;
-  }
-}
-
 // src/core/scope-filter.ts
 function getSkillScope(content) {
   const cleaned = content.replace(/^\uFEFF/, "");
@@ -2661,19 +2637,6 @@ async function updateInstallConfig(targetDir, options, installedComponents) {
   config.installedComponents = installedComponents;
   await saveConfig(targetDir, config);
 }
-function installRtkIfNeeded(result) {
-  if (!isRtkInstalled()) {
-    info("install.rtk_installing");
-    const rtkInstalled = installRtk();
-    if (rtkInstalled) {
-      info("install.rtk_success");
-    } else {
-      result.warnings.push("RTK installation failed — install manually: brew install rtk-ai/tap/rtk");
-    }
-  } else {
-    info("install.rtk_already");
-  }
-}
 function installCodexIfNeeded(result) {
   if (!isCodexInstalled()) {
     info("install.codex_installing");
@@ -2728,7 +2691,6 @@ async function install(options) {
     } else {
       info("install.lockfile_generated", { files: String(lockfileResult.fileCount) });
     }
-    installRtkIfNeeded(result);
     installCodexIfNeeded(result);
     result.success = true;
     success("install.success");
@@ -2936,14 +2898,15 @@ async function detectProvider(_options = {}) {
   };
 }
 // src/core/updater.ts
-import { join as join8 } from "node:path";
+import { lstat, realpath as realpath2, unlink } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join8, relative as relative3, resolve as resolve3, sep as sep4 } from "node:path";
 // package.json
 var package_default = {
   name: "oh-my-customcode",
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.106",
+  version: "1.1.107",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {
@@ -5589,6 +5552,86 @@ ${MANAGED_END}`;
 
 // src/core/updater.ts
 var CUSTOMIZATION_MANIFEST_FILE = ".omcustom-customizations.json";
+var RETIRED_RTK_FILES = [
+  { path: ".claude/skills/rtk-exec/SKILL.md", component: "skills" },
+  { path: ".claude/skills/rtk-exec/scripts/rtk-wrapper.cjs", component: "skills" },
+  { path: ".claude/hooks/scripts/rtk-intercept.sh", component: "hooks" }
+];
+function getRtkRetirement(result) {
+  result.rtkRetirement ??= {
+    removed: [],
+    wouldRemove: [],
+    preserved: [],
+    settingsChanged: [],
+    wouldChangeSettings: [],
+    settingsConflicts: []
+  };
+  return result.rtkRetirement;
+}
+async function validateRtkTarget(targetDir, path) {
+  const validation = validatePreserveFilePath(path, targetDir);
+  if (!validation.valid)
+    throw new Error("path escapes project");
+  const fullPath = resolve3(targetDir, path);
+  const fileStat = await lstat(fullPath);
+  if (!fileStat.isFile() || fileStat.isSymbolicLink())
+    throw new Error("not a regular owned file");
+  const root = await realpath2(targetDir);
+  const resolvedFile = await realpath2(fullPath);
+  const within = relative3(root, resolvedFile);
+  if (within === "" || within === ".." || within.startsWith(`..${sep4}`) || isAbsolute3(within)) {
+    throw new Error("resolved path escapes project");
+  }
+}
+function isRtkPathPreserved(path, config, customizations) {
+  const paths = [
+    ...config.preserveFiles ?? [],
+    ...customizations?.preserveFiles ?? [],
+    ...customizations?.modifiedFiles ?? [],
+    ...(config.customComponents ?? []).map((component) => component.path)
+  ];
+  return paths.some((preserved) => path === preserved || path.startsWith(`${preserved}/`));
+}
+async function retireRtkFile(path, options, lockfile, result, preserved) {
+  const retirement = getRtkRetirement(result);
+  try {
+    await validateRtkTarget(options.targetDir, path);
+    if (preserved)
+      throw new Error("explicitly preserved");
+    if (retirement.settingsConflicts.length > 0)
+      throw new Error("settings retirement conflict");
+    const entry = lockfile?.files[path];
+    if (!entry || typeof entry.templateHash !== "string" || !/^[a-f0-9]{64}$/.test(entry.templateHash)) {
+      throw new Error("missing or invalid old ownership");
+    }
+    const fullPath = join8(options.targetDir, path);
+    if (await computeFileHash(fullPath) !== entry.templateHash)
+      throw new Error("user-modified file");
+    if (options.dryRun) {
+      retirement.wouldRemove.push(path);
+      return;
+    }
+    await validateRtkTarget(options.targetDir, path);
+    await unlink(fullPath);
+    retirement.removed.push(path);
+    result.removedDeprecatedFiles.push(path);
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return;
+    const reason = err instanceof Error ? err.message : "unreadable ownership or file";
+    retirement.preserved.push({ path, reason });
+    result.preservedFiles.push(path);
+    result.warnings.push(`RTK retirement preserved ${path}: ${reason}`);
+  }
+}
+async function retireRtkFiles(options, lockfile, result, config, customizations) {
+  const fullUpdate = !options.components || options.components.length === 0;
+  const files = RETIRED_RTK_FILES.filter((file) => fullUpdate || options.components?.includes(file.component));
+  for (const file of files) {
+    await retireRtkFile(file.path, options, lockfile, result, isRtkPathPreserved(file.path, config, customizations));
+  }
+  return RETIRED_RTK_FILES.map((file) => file.path);
+}
 function createUpdateResult() {
   return {
     success: false,
@@ -5776,32 +5819,52 @@ async function backfillStatusLineRefreshInterval(targetDir, options) {
     });
   }
 }
-async function migrateHookCommandsInSettingsLocal(targetDir, options) {
-  if (options.dryRun) {
-    return;
+async function migrateHookCommandsInSettingsLocal(targetDir, options, result) {
+  for (const name of ["settings.json", "settings.local.json"]) {
+    await migrateRtkSettingsFile(targetDir, options, result, name);
   }
+}
+async function migrateRtkSettingsFile(targetDir, options, result, name) {
   const layout = getProviderLayout();
-  const settingsPath = join8(targetDir, layout.rootDir, "settings.local.json");
-  if (!await fileExists(settingsPath)) {
-    return;
-  }
+  const path = `${layout.rootDir}/${name}`;
+  const settingsPath = join8(targetDir, path);
+  const retirement = getRtkRetirement(result);
   try {
+    await validateRtkTarget(targetDir, path);
     const raw = await readTextFile(settingsPath);
     const bom = raw.startsWith("\uFEFF") ? "\uFEFF" : "";
     const parsed = JSON.parse(bom ? raw.slice(bom.length) : raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error("unknown settings shape");
+    }
+    const current = parsed;
+    const hooks = retireRtkHookBlocks(current.hooks);
+    const retired = hooks !== current.hooks;
+    const input = retired ? { ...current, hooks } : current;
+    const { settings, rewritten } = name === "settings.local.json" ? migrateHookCommands(input) : { settings: input, rewritten: 0 };
+    if (JSON.stringify(settings.hooks)?.includes("rtk-intercept.sh")) {
+      retirement.settingsConflicts.push(path);
+      result.warnings.push(`RTK retirement retained user or unknown wiring in ${path}`);
+    }
+    if (!retired && rewritten === 0) {
       return;
     }
-    const { settings, rewritten } = migrateHookCommands(parsed);
-    if (rewritten === 0) {
+    if (options.dryRun) {
+      retirement.wouldChangeSettings.push(path);
       return;
     }
     const trailingNewline = raw.endsWith(`
 `) ? `
 ` : "";
+    await validateRtkTarget(targetDir, path);
     await writeTextFile(settingsPath, `${bom}${JSON.stringify(settings, null, 2)}${trailingNewline}`);
+    retirement.settingsChanged.push(path);
     info("update.hook_commands_migrated", { count: String(rewritten) });
-  } catch {
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return;
+    retirement.settingsConflicts.push(path);
+    result.warnings.push(`RTK retirement could not safely migrate ${path}`);
     warn("update.hook_commands_migration_failed", {
       path: settingsPath
     });
@@ -5821,7 +5884,7 @@ async function runFullUpdatePostProcessing(options, result, config, customizatio
     }
   }
   if (isFullUpdate || options.components?.includes("hooks")) {
-    await migrateHookCommandsInSettingsLocal(options.targetDir, options);
+    await migrateHookCommandsInSettingsLocal(options.targetDir, options, result);
   }
   if (!options.dryRun) {
     config.version = result.newVersion;
@@ -5838,6 +5901,29 @@ async function runFullUpdatePostProcessing(options, result, config, customizatio
     });
   }
 }
+async function getUpdateVersionDecision(installedVersion, cliVersion) {
+  if (!(installedVersion !== "0.0.0" && compareSemver(installedVersion, cliVersion) > 0)) {
+    return "standard";
+  }
+  if (installedVersion !== "2.0.0") {
+    return "blocked";
+  }
+  const match = /^1\.1\.(0|[1-9]\d*)$/.exec(cliVersion);
+  if (!match) {
+    return "blocked";
+  }
+  const patch = Number(match[1]);
+  if (!Number.isSafeInteger(patch) || patch < 107) {
+    return "blocked";
+  }
+  const manifestPath = resolveTemplatePath(getProviderLayout().manifestFile);
+  if (!await fileExists(manifestPath)) {
+    return "blocked";
+  }
+  const manifest = await readJsonFile(manifestPath);
+  const correctionAllowed = typeof manifest === "object" && manifest !== null && !Array.isArray(manifest) && "version" in manifest && manifest.version === cliVersion;
+  return correctionAllowed ? "correction" : "blocked";
+}
 function compareSemver(a, b) {
   const pa = a.split(".").map(Number);
   const pb = b.split(".").map(Number);
@@ -5848,24 +5934,16 @@ function compareSemver(a, b) {
   }
   return 0;
 }
-function checkAndInstallRtkAfterUpdate() {
-  if (!isRtkInstalled()) {
-    warn("update.rtk_missing");
-    console.log(i18n.t("cli.update.rtkMissing"));
-    const rtkInstalled = installRtk();
-    if (rtkInstalled) {
-      console.log(i18n.t("cli.update.rtkInstalled"));
-    }
-  }
-}
 async function updateProjectRegistry(targetDir, newVersion) {
   try {
     await Promise.resolve().then(() => init_registry());
     await registerProject(targetDir, newVersion);
   } catch {}
 }
-async function regenerateLockfile(targetDir, result) {
-  const lockfileResult = await generateAndWriteLockfileForDir(targetDir);
+async function regenerateLockfile(options, result, retiredPaths) {
+  if (options.dryRun)
+    return;
+  const lockfileResult = await generateAndWriteLockfileForDir(options.targetDir, { retiredPaths });
   if (lockfileResult.warning) {
     result.warnings.push(lockfileResult.warning);
     warn("update.lockfile_failed", { error: lockfileResult.warning });
@@ -5906,7 +5984,8 @@ async function update(options) {
     const config = await loadConfig(options.targetDir);
     result.previousVersion = config.version;
     const cliVersion = package_default.version;
-    if (result.previousVersion !== "0.0.0" && compareSemver(result.previousVersion, cliVersion) > 0) {
+    const versionDecision = await getUpdateVersionDecision(result.previousVersion, cliVersion);
+    if (versionDecision === "blocked") {
       result.success = false;
       result.error = `Downgrade prevented: project has v${result.previousVersion} but CLI is v${cliVersion}. Update the CLI first: npm install -g oh-my-customcode@latest`;
       return result;
@@ -5915,6 +5994,11 @@ async function update(options) {
       return result;
     }
     const updateCheck = await checkForUpdates(options.targetDir);
+    if (versionDecision === "correction" && updateCheck.latestVersion !== cliVersion) {
+      result.success = false;
+      result.error = `Version correction prevented: CLI is v${cliVersion} but templates are v${updateCheck.latestVersion}. Reinstall the CLI: npm install -g oh-my-customcode@latest`;
+      return result;
+    }
     result.newVersion = updateCheck.latestVersion;
     if (!updateCheck.hasUpdates && !options.force) {
       info("update.no_updates");
@@ -5922,7 +6006,7 @@ async function update(options) {
       result.skippedComponents = options.components || getAllUpdateComponents();
       return result;
     }
-    await handleBackupIfRequested(options.targetDir, !!options.backup, result);
+    await handleBackupIfRequested(options.targetDir, !!options.backup && !options.dryRun, result);
     const manifestCustomizations = await resolveManifestCustomizations(options, options.targetDir);
     const configPreserveFiles = resolveConfigPreserveFiles(options, config);
     const customizations = resolveCustomizations(manifestCustomizations, configPreserveFiles, options.targetDir);
@@ -5930,9 +6014,10 @@ async function update(options) {
     const components = options.components || getAllUpdateComponents();
     await updateAllComponents(options.targetDir, components, updateCheck, customizations, options, result, config, lockfile);
     await runFullUpdatePostProcessing(options, result, config, customizations);
-    await regenerateLockfile(options.targetDir, result);
-    checkAndInstallRtkAfterUpdate();
-    checkAndInstallCodexAfterUpdate();
+    const retiredPaths = await retireRtkFiles(options, lockfile, result, config, customizations);
+    await regenerateLockfile(options, result, retiredPaths);
+    if (!options.dryRun)
+      checkAndInstallCodexAfterUpdate();
     if (result.success && !options.dryRun) {
       await updateProjectRegistry(options.targetDir, result.newVersion);
     }
@@ -6108,22 +6193,19 @@ async function updateComponent(targetDir, component, customizations, options, co
     if (options.forceOverwriteAll) {
       warn("update.protected_file_force_overwrite", {
         file: protectedPath,
-        component,
-        hint: "File contains AI behavioral constraints. Overwriting because --force-overwrite-all was set."
+        component
       });
     } else {
       warn("update.protected_file_skipped", {
         file: protectedPath,
-        component,
-        hint: "File was modified by user and preserved. Use --force-overwrite-all to override."
+        component
       });
     }
   }
   for (const updatedPath of protectedUpdatedPaths) {
     info("update.protected_file_updated", {
       file: updatedPath,
-      component,
-      hint: "Protected file updated (unmodified by user, matches lockfile hash)."
+      component
     });
   }
   skipPaths.push(...protectedSkipPaths);

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.106",
+  "version": "1.1.107",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/hooks/hooks.json

@@ -82,16 +82,6 @@
         ],
         "description": "Schema-based tool input validation — Phase 1 advisory only"
       },
-      {
-        "matcher": "tool == \"Bash\"",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "bash \"${CLAUDE_PROJECT_DIR:-.}/.claude/hooks/scripts/rtk-intercept.sh\""
-          }
-        ],
-        "description": "RTK auto-intercept — transparently rewrites CLI commands through RTK proxy when available (R013 advisory)"
-      },
       {
         "matcher": "tool == \"Bash\" && tool_input.command matches \"git (reset|clean|checkout|restore|switch|rebase|merge)\"",
         "hooks": [

package/templates/.claude/hooks/scripts/claude-md-reinject.sh

@@ -38,7 +38,13 @@ fi
 
 source_field=$(printf '%s' "$input" | jq -r '.source // "unknown"' 2>/dev/null) || source_field="unknown"
 
-# #1770: honor CLAUDE_PROJECT_DIR first; fallback git toplevel (or pwd), not script location.
+# #1770 / B-L1: nonempty CLAUDE_PROJECT_DIR selects the anchor. When manually
+# running inside a Git monorepo package, set it to that package to select its
+# CLAUDE.md; unset/empty instead selects the Git toplevel, then pwd if Git fails.
+# The script location is never the fallback project anchor.
+# B-L2: a nonempty invalid anchor is authoritative; there is no Git/cwd retry.
+# If its CLAUDE.md is missing (including a missing directory or a file anchor),
+# the file check below returns silently with exit 0, preserving advisory behavior.
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 CLAUDE_MD="$PROJECT_ROOT/CLAUDE.md"