oh-my-customcode 1.1.54 → 1.1.56

package/templates/.claude/hooks/scripts/stuck-detector.sh

@@ -16,29 +16,28 @@ command -v jq >/dev/null 2>&1 || exit 0
 HARD_BLOCK_THRESHOLD=${CLAUDE_STUCK_THRESHOLD:-3}
 
 # Determine if a Bash command is read-only (metadata/query only, no side effects).
-# Conservative: any ambiguity (chaining, redirection, substitution, or an
+# Conservative: any ambiguity (redirection, substitution, "||", or an
 # unrecognized command/subcommand) is treated as NOT read-only (write).
-# Used ONLY to exclude read-only Bash polling from Hard Block Checks 1 and 3
-# (same-path / same-tool+target consecutive-repeat blocking) below — Signal 1
-# (repeated-error advisory) and Hard Block Check 2 (same error hash) are
-# intentionally unaffected: repeated errors are a genuine stuck signal
-# regardless of read/write (issue #1625).
-is_readonly_bash_command() {
+# Compound commands chained with "&&", ";", or a single "|" are split into
+# segments (#1629) — the whole command is read-only ONLY when EVERY segment
+# is read-only; one write segment (or one unparseable/empty segment) makes
+# the whole command a write.
+# Used to exclude read-only Bash polling from Hard Block Checks 1 and 3
+# (same-path / same-tool+target consecutive-repeat blocking) AND the Signal 3
+# tool-spam advisory below — Signal 1 (repeated-error advisory) and Hard
+# Block Check 2 (same error hash) are intentionally unaffected: repeated
+# errors are a genuine stuck signal regardless of read/write (issue #1625).
+
+# Classify a SINGLE (non-compound) command segment as read-only. Callers
+# (is_readonly_bash_command) are responsible for stripping ambiguous
+# constructs and splitting compound commands before invoking this directly.
+is_readonly_single_command() {
   local cmd="$1"
-  cmd="$(printf '%s' "$cmd" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
   if [ -z "$cmd" ]; then
     echo "false"
     return 0
   fi
 
-  # Any chaining/redirection/substitution metachar => ambiguous, treat as write
-  case "$cmd" in
-    *'>'*|*'|'*|*'&&'*|*';'*|*'$('*|*'`'*|*'<('*)
-      echo "false"
-      return 0
-      ;;
-  esac
-
   local parts=()
   read -ra parts <<< "$cmd"
   local w1="${parts[0]:-}"
@@ -117,11 +116,62 @@ is_readonly_bash_command() {
   esac
 }
 
+is_readonly_bash_command() {
+  local cmd="$1"
+  cmd="$(printf '%s' "$cmd" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+  if [ -z "$cmd" ]; then
+    echo "false"
+    return 0
+  fi
+
+  # Truly ambiguous constructs: redirection, command/process substitution, or
+  # "||" (conditional-OR — intentionally NOT decomposed into segments, since
+  # its branch that actually runs depends on the first segment's exit code)
+  # => always treated as write.
+  case "$cmd" in
+    *'>'*|*'||'*|*'$('*|*'`'*|*'<('*)
+      echo "false"
+      return 0
+      ;;
+  esac
+
+  # Compound command: split on "&&", ";", or a single "|" into segments and
+  # require EVERY segment to be read-only (#1629). An empty segment (e.g. a
+  # trailing separator) is treated as ambiguous => write, same as any
+  # segment that fails single-command classification.
+  if [[ "$cmd" == *'&&'* || "$cmd" == *';'* || "$cmd" == *'|'* ]]; then
+    local normalized="$cmd"
+    normalized="${normalized//&&/$'\n'}"
+    normalized="${normalized//;/$'\n'}"
+    normalized="${normalized//|/$'\n'}"
+    local seg
+    while IFS= read -r seg; do
+      seg="$(printf '%s' "$seg" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+      if [ -z "$seg" ]; then
+        echo "false"
+        return 0
+      fi
+      if [ "$(is_readonly_single_command "$seg")" != "true" ]; then
+        echo "false"
+        return 0
+      fi
+    done <<< "$normalized"
+    echo "true"
+    return 0
+  fi
+
+  is_readonly_single_command "$cmd"
+}
+
 input=$(cat)
 
 # Extract tool info
 tool_name=$(printf '%s' "$input" | jq -r '.tool_name // "unknown"')
-file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 120)
+# 300 (not 120): a 120-char cutoff let two genuinely different long Bash
+# commands collide on their shared 120-char prefix, causing a false-positive
+# same-path/same-tool+target hard-block. 300 chars covers the vast majority
+# of real commands without their differing tail being cut off (#1629).
+file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 300)
 is_error=$(printf '%s' "$input" | jq -r '.tool_output.is_error // false')
 output_preview=$(printf '%s' "$input" | jq -r '.tool_output.output // ""' | head -c 200)
 raw_command=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
@@ -150,9 +200,10 @@ entry=$(jq -cn \
   --arg err "$is_error" \
   --arg hash "$error_hash" \
   --arg preview "$output_preview" \
-  '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, preview: $preview}')
+  --arg readonly "$is_readonly" \
+  '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, preview: $preview, readonly: $readonly}')
 
-echo "$entry" >> "$HISTORY_FILE"
+printf '%s\n' "$entry" >> "$HISTORY_FILE"
 
 # Ring buffer: keep last 100 entries
 if [ -f "$HISTORY_FILE" ]; then
@@ -167,13 +218,13 @@ fi
 
 # Only check for patterns if we have enough history
 if [ ! -f "$HISTORY_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 recent_count=$(wc -l < "$HISTORY_FILE")
 if [ "$recent_count" -lt 3 ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -214,8 +265,13 @@ if [ "$stuck_detected" = false ] && { [ "$tool_name" = "Edit" ] || [ "$tool_name
 fi
 
 # Signal 3: Tool spam (same tool 5+ times in last 8 entries)
-if [ "$stuck_detected" = false ]; then
-  tool_repeat=$(tail -8 "$HISTORY_FILE" | grep -c "\"tool\":\"${tool_name}\"" 2>/dev/null || echo "0")
+# Read-only Bash polling is excluded from this count (issue #1629): skip
+# entirely when the CURRENT call is read-only, and exclude prior read-only
+# entries from the historical count so a mix of harmless read-only Bash
+# calls (git status / gh view / ls / ...) doesn't inflate the "same tool
+# called N times" advisory.
+if [ "$stuck_detected" = false ] && [ "$is_readonly" != "true" ]; then
+  tool_repeat=$(tail -8 "$HISTORY_FILE" | grep -v "\"readonly\":\"true\"" | grep -c "\"tool\":\"${tool_name}\"" 2>/dev/null || echo "0")
   if [ "$tool_repeat" -ge 5 ]; then
     stuck_detected=true
     signal_type="Tool loop"
@@ -291,7 +347,7 @@ if [ "$hard_block" = true ]; then
   echo "  Action: Blocking this tool call to break the stuck loop." >&2
   echo "  Recovery: Step back, re-read the error, and try a fundamentally different approach." >&2
   echo "=====================================" >&2
-  echo "$input"
+  printf '%s\n' "$input"
   HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
   if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
     HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))
@@ -301,7 +357,7 @@ if [ "$hard_block" = true ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
 if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
   HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))

package/templates/.claude/hooks/scripts/subagent-failure-advisor.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+# Dependency check: exit silently if jq not available
+command -v jq >/dev/null 2>&1 || exit 0
+
+# Subagent Failure Advisor Hook
+# Trigger: SubagentStop
+# Purpose: Advisory-only replacement for the removed `type: "prompt"` SubagentStop hook
+#   (#1631). The prompt hook asked an LLM judge whether the CURRENT session's own
+#   background_tasks entry had transitioned to "completed" before allowing Stop —
+#   but that transition only happens AFTER the SubagentStop hook chain resolves, so the
+#   judgment was structurally always "not yet completed" for a subagent evaluating its
+#   OWN stop. That produced a self-referential `Stop hook feedback:` re-injection loop
+#   with no dedup, observed to repeat 8-10x per session before manual override.
+# Fix: replace the blocking LLM judge with a plain stderr-only warning that never
+#   triggers the Stop-hook-feedback re-injection path. No block, no LLM call, no loop.
+# Protocol: stdin JSON -> read tool_output.is_error -> stderr warning if failed -> pass through -> exit 0 (always)
+
+input=$(cat)
+
+is_error=$(printf '%s\n' "$input" | jq -r '.tool_output.is_error // false' 2>/dev/null || echo "false")
+
+if [ "$is_error" = "true" ]; then
+  agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // .agent_type // "unknown"' 2>/dev/null || echo "unknown")
+  error_summary=$(printf '%s\n' "$input" | jq -r '.tool_output.output // ""' 2>/dev/null | head -c 200)
+  echo "" >&2
+  echo "--- [Subagent Failure Advisor] background subagent (${agent_type}) reported an error ---" >&2
+  echo "  ${error_summary}" >&2
+  echo "  If it FAILED, do NOT auto-continue -- report the failure and wait for user input." >&2
+  echo "-----------------------------------------------------------------------------------" >&2
+fi
+
+# Always pass through -- advisory only, never blocks, never triggers Stop hook feedback re-injection
+printf '%s\n' "$input"
+exit 0

package/templates/.claude/hooks/scripts/task-outcome-recorder.sh

@@ -12,9 +12,9 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract task info — support both PostToolUse (tool_input.*) and SubagentStop (top-level) shapes
-agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // .agent_type // "unknown"')
-model=$(echo "$input" | jq -r '.tool_input.model // .model // "inherit"')
-description=$(echo "$input" | jq -r '.tool_input.description // .description // ""' | head -c 80)
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // .agent_type // "unknown"')
+model=$(printf '%s\n' "$input" | jq -r '.tool_input.model // .model // "inherit"')
+description=$(printf '%s\n' "$input" | jq -r '.tool_input.description // .description // ""' | head -c 80)
 
 # Extract skill name from description or prompt
 skill_name=""
@@ -23,16 +23,16 @@ if echo "$description" | grep -qiE '(skill:|routing|→.*skill)'; then
 fi
 # Fallback: check prompt field for "Skill: {name}" pattern
 if [ -z "$skill_name" ]; then
-  prompt=$(echo "$input" | jq -r '.tool_input.prompt // ""' | head -c 500)
+  prompt=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt // ""' | head -c 500)
   skill_name=$(echo "$prompt" | grep -oiE 'Skill:\s*[a-z]+-[a-z]+(-[a-z]+)*' | sed 's/[Ss]kill:\s*//' | head -1)
 fi
 
 # Determine outcome
-is_error=$(echo "$input" | jq -r '.tool_output.is_error // false')
+is_error=$(printf '%s\n' "$input" | jq -r '.tool_output.is_error // false')
 
 if [ "$is_error" = "true" ]; then
   outcome="failure"
-  error_summary=$(echo "$input" | jq -r '.tool_output.output // ""' | head -c 200)
+  error_summary=$(printf '%s\n' "$input" | jq -r '.tool_output.output // ""' | head -c 200)
 else
   outcome="success"
   error_summary=""
@@ -94,7 +94,7 @@ entry=$(jq -n \
   --arg dur "$duration_seconds" \
   '{timestamp: $ts, agent_type: $agent, model: $model, outcome: $outcome, pattern_used: $pattern, skill: $skill, description: $desc, error_summary: $err, duration_seconds: ($dur | tonumber)}')
 
-echo "$entry" >> "$OUTCOME_FILE"
+printf '%s\n' "$entry" >> "$OUTCOME_FILE"
 
 # Ring buffer: keep last 50 entries
 if [ -f "$OUTCOME_FILE" ]; then
@@ -115,5 +115,5 @@ if [ "$outcome" = "failure" ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/task-state-precompact.sh

@@ -49,7 +49,7 @@ collect_state() {
 state=$(collect_state 2>/dev/null)
 
 if [ -n "$state" ] && [ "$state" != "{}" ]; then
-  echo "$state" > "$STATE_FILE"
+  printf '%s\n' "$state" > "$STATE_FILE"
   echo "[PreCompact] Task state saved to $STATE_FILE" >&2
 else
   echo "[PreCompact] No active task state to save" >&2

package/templates/.claude/settings.json

@@ -18,7 +18,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.command // \"\") | test(\"(npm run dev|pnpm( run)? dev|yarn dev|bun run dev)\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\ncmd=$(echo \"$input\" | jq -r '.tool_input.command // \"\"')\n\n# Block dev servers that aren't run in tmux\necho '[Hook] BLOCKED: Dev server must run in tmux for log access' >&2\necho '[Hook] Use this command instead:' >&2\necho \"[Hook] tmux new-session -d -s dev 'npm run dev'\" >&2\necho '[Hook] Then: tmux attach -t dev' >&2\nexit 1\n  )\nelse\n  printf '%s' \"$input\"\nfi"
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.command // \"\") | test(\"(npm run dev|pnpm( run)? dev|yarn dev|bun run dev)\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\ncmd=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.command // \"\"')\n\n# Block dev servers that aren't run in tmux\necho '[Hook] BLOCKED: Dev server must run in tmux for log access' >&2\necho '[Hook] Use this command instead:' >&2\necho \"[Hook] tmux new-session -d -s dev 'npm run dev'\" >&2\necho '[Hook] Then: tmux attach -t dev' >&2\nexit 1\n  )\nelse\n  printf '%s' \"$input\"\nfi"
           }
         ],
         "matcher": "Bash",
@@ -28,7 +28,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.command // \"\") | test(\"(npm (install|test)|pnpm (install|test)|yarn (install|test)|bun (install|test)|cargo build|make|docker|pytest|vitest|playwright)\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nif [ -z \"$TMUX\" ]; then\n  echo '[Hook] Consider running in tmux for session persistence' >&2\n  echo '[Hook] tmux new -s dev  |  tmux attach -t dev' >&2\nfi\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi"
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.command // \"\") | test(\"(npm (install|test)|pnpm (install|test)|yarn (install|test)|bun (install|test)|cargo build|make|docker|pytest|vitest|playwright)\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nif [ -z \"$TMUX\" ]; then\n  echo '[Hook] Consider running in tmux for session persistence' >&2\n  echo '[Hook] tmux new -s dev  |  tmux attach -t dev' >&2\nfi\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi"
           }
         ],
         "matcher": "Bash",
@@ -48,7 +48,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [[ \"$file_path\" =~ \\.(md|txt)$ ]] && [[ ! \"$file_path\" =~ (README|CLAUDE|AGENT|SKILL)\\.md$ ]]; then\n  echo \"[Hook] BLOCKED: Unnecessary documentation file creation\" >&2\n  echo \"[Hook] File: $file_path\" >&2\n  echo \"[Hook] Use README.md or AGENT.md for documentation instead\" >&2\n  exit 1\nfi\n\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [[ \"$file_path\" =~ \\.(md|txt)$ ]] && [[ ! \"$file_path\" =~ (README|CLAUDE|AGENT|SKILL)\\.md$ ]]; then\n  echo \"[Hook] BLOCKED: Unnecessary documentation file creation\" >&2\n  echo \"[Hook] File: $file_path\" >&2\n  echo \"[Hook] Use README.md or AGENT.md for documentation instead\" >&2\n  exit 1\nfi\n\nprintf '%s\\n' \"$input\""
           }
         ],
         "matcher": "Write",
@@ -118,7 +118,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(echo \"$input\" | jq -r '.tool_input.subagent_type // \"unknown\"')\nmodel=$(echo \"$input\" | jq -r '.tool_input.model // \"inherit\"')\ndesc=$(echo \"$input\" | jq -r '.tool_input.description // \"\"' | head -c 40)\nresume=$(echo \"$input\" | jq -r '.tool_input.resume // empty')\nif [ -n \"$resume\" ]; then\n  echo \"─── [Resume] ${agent_type}:${model} | ${desc} ───\" >&2\nelse\n  echo \"─── [Spawn] ${agent_type}:${model} | ${desc} ───\" >&2\nfi\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.subagent_type // \"unknown\"')\nmodel=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.model // \"inherit\"')\ndesc=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.description // \"\"' | head -c 40)\nresume=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.resume // empty')\nif [ -n \"$resume\" ]; then\n  echo \"─── [Resume] ${agent_type}:${model} | ${desc} ───\" >&2\nelse\n  echo \"─── [Spawn] ${agent_type}:${model} | ${desc} ───\" >&2\nfi\nprintf '%s\\n' \"$input\""
           },
           {
             "type": "command",
@@ -256,7 +256,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(echo \"$input\" | jq -r '.agent_type // \"unknown\"')\nmodel=$(echo \"$input\" | jq -r '.model // \"inherit\"')\ndesc=$(echo \"$input\" | jq -r '.description // \"\"' | head -c 40)\necho \"─── [SubagentStart] ${agent_type}:${model} | ${desc} ───\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(printf '%s\\n' \"$input\" | jq -r '.agent_type // \"unknown\"')\nmodel=$(printf '%s\\n' \"$input\" | jq -r '.model // \"inherit\"')\ndesc=$(printf '%s\\n' \"$input\" | jq -r '.description // \"\"' | head -c 40)\necho \"─── [SubagentStart] ${agent_type}:${model} | ${desc} ───\" >&2\nprintf '%s\\n' \"$input\""
           },
           {
             "type": "command",
@@ -287,12 +287,12 @@
             "command": "bash .claude/hooks/scripts/r007-r008-drift-advisor.sh"
           },
           {
-            "type": "prompt",
-            "prompt": "A background subagent just completed. If it FAILED, do NOT auto-continue — report the failure and wait for user input."
+            "type": "command",
+            "command": "bash .claude/hooks/scripts/subagent-failure-advisor.sh"
           }
         ],
         "matcher": "*",
-        "description": "Record agent outcomes + auto-continue workflow + R007/R008 drift advisory on subagent completion (autonomous-loop re-entry, #1545)"
+        "description": "Record agent outcomes + auto-continue workflow + R007/R008 drift advisory + failure advisory on subagent completion (autonomous-loop re-entry, #1545; #1631 replaced the self-referential prompt-type judge hook with an advisory-only command hook)"
       }
     ],
     "CwdChanged": [
@@ -324,7 +324,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nmsg=$(echo \"$input\" | jq -r '.message // \"\"' 2>/dev/null)\nif [ -n \"$msg\" ]; then\n  echo \"[Hook] Notification: $msg\" >&2\nfi\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nmsg=$(printf '%s\\n' \"$input\" | jq -r '.message // \"\"' 2>/dev/null)\nif [ -n \"$msg\" ]; then\n  echo \"[Hook] Notification: $msg\" >&2\nfi\nprintf '%s\\n' \"$input\""
           }
         ],
         "matcher": "*",
@@ -336,7 +336,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nteammate=$(echo \"$input\" | jq -r '.teammate_id // \"unknown\"' 2>/dev/null)\necho \"[Hook] TeammateIdle: $teammate — available for reassignment\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nteammate=$(printf '%s\\n' \"$input\" | jq -r '.teammate_id // \"unknown\"' 2>/dev/null)\necho \"[Hook] TeammateIdle: $teammate — available for reassignment\" >&2\nprintf '%s\\n' \"$input\""
           }
         ],
         "matcher": "*",
@@ -348,7 +348,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(echo \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\ndesc=$(echo \"$input\" | jq -r '.description // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCreated: $task_id — $desc\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(printf '%s\\n' \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\ndesc=$(printf '%s\\n' \"$input\" | jq -r '.description // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCreated: $task_id — $desc\" >&2\nprintf '%s\\n' \"$input\""
           }
         ],
         "matcher": "*",
@@ -360,7 +360,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(echo \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\nresult=$(echo \"$input\" | jq -r '.result // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCompleted: $task_id — $result\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(printf '%s\\n' \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\nresult=$(printf '%s\\n' \"$input\" | jq -r '.result // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCompleted: $task_id — $result\" >&2\nprintf '%s\\n' \"$input\""
           }
         ],
         "matcher": "*",
@@ -396,7 +396,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ncmd=$(echo \"$input\" | jq -r '.tool_input.command')\n\nif echo \"$cmd\" | grep -qE 'gh pr create'; then\n  output=$(echo \"$input\" | jq -r '.tool_output.output // \"\"')\n  pr_url=$(echo \"$output\" | grep -oE 'https://github.com/[^/]+/[^/]+/pull/[0-9]+')\n  \n  if [ -n \"$pr_url\" ]; then\n    echo \"[Hook] PR created: $pr_url\" >&2\n    echo \"[Hook] Checking GitHub Actions status...\" >&2\n    repo=$(echo \"$pr_url\" | sed -E 's|https://github.com/([^/]+/[^/]+)/pull/[0-9]+|\\1|')\n    pr_num=$(echo \"$pr_url\" | sed -E 's|.*/pull/([0-9]+)|\\1|')\n    echo \"[Hook] To review PR: gh pr review $pr_num --repo $repo\" >&2\n  fi\nfi\n\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\ncmd=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.command')\n\nif echo \"$cmd\" | grep -qE 'gh pr create'; then\n  output=$(printf '%s\\n' \"$input\" | jq -r '.tool_output.output // \"\"')\n  pr_url=$(echo \"$output\" | grep -oE 'https://github.com/[^/]+/[^/]+/pull/[0-9]+')\n  \n  if [ -n \"$pr_url\" ]; then\n    echo \"[Hook] PR created: $pr_url\" >&2\n    echo \"[Hook] Checking GitHub Actions status...\" >&2\n    repo=$(echo \"$pr_url\" | sed -E 's|https://github.com/([^/]+/[^/]+)/pull/[0-9]+|\\1|')\n    pr_num=$(echo \"$pr_url\" | sed -E 's|.*/pull/([0-9]+)|\\1|')\n    echo \"[Hook] To review PR: gh pr review $pr_num --repo $repo\" >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\""
           }
         ],
         "matcher": "Bash",
@@ -406,7 +406,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(ts|tsx|js|jsx)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v prettier >/dev/null 2>&1; then\n    prettier --write \"$file_path\" 2>&1 | head -5 >&2\n  fi\nfi\n\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi"
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(ts|tsx|js|jsx)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v prettier >/dev/null 2>&1; then\n    prettier --write \"$file_path\" 2>&1 | head -5 >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi"
           }
         ],
         "matcher": "Edit",
@@ -416,7 +416,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(ts|tsx)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  dir=$(dirname \"$file_path\")\n  project_root=\"$dir\"\n  while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/package.json\" ]; do\n    project_root=$(dirname \"$project_root\")\n  done\n  \n  if [ -f \"$project_root/tsconfig.json\" ]; then\n    cd \"$project_root\" && npx tsc --noEmit --pretty false 2>&1 | grep \"$file_path\" | head -10 >&2 || true\n  fi\nfi\n\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(ts|tsx)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  dir=$(dirname \"$file_path\")\n  project_root=\"$dir\"\n  while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/package.json\" ]; do\n    project_root=$(dirname \"$project_root\")\n  done\n  \n  if [ -f \"$project_root/tsconfig.json\" ]; then\n    cd \"$project_root\" && npx tsc --noEmit --pretty false 2>&1 | grep \"$file_path\" | head -10 >&2 || true\n  fi\nfi\n\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
             "continueOnBlock": true
           }
         ],
@@ -427,7 +427,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(ts|tsx|js|jsx)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  console_logs=$(grep -n \"console\\\\.log\" \"$file_path\" 2>/dev/null || true)\n  \n  if [ -n \"$console_logs\" ]; then\n    echo \"[Hook] WARNING: console.log found in $file_path\" >&2\n    echo \"$console_logs\" | head -5 >&2\n    echo \"[Hook] Remove console.log before committing\" >&2\n  fi\nfi\n\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(ts|tsx|js|jsx)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  console_logs=$(grep -n \"console\\\\.log\" \"$file_path\" 2>/dev/null || true)\n  \n  if [ -n \"$console_logs\" ]; then\n    echo \"[Hook] WARNING: console.log found in $file_path\" >&2\n    echo \"$console_logs\" | head -5 >&2\n    echo \"[Hook] Remove console.log before committing\" >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
             "continueOnBlock": true
           }
         ],
@@ -438,7 +438,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(go)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v gofmt >/dev/null 2>&1; then\n    gofmt -w \"$file_path\" 2>&1 >&2\n  fi\nfi\n\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi"
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(go)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v gofmt >/dev/null 2>&1; then\n    gofmt -w \"$file_path\" 2>&1 >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi"
           }
         ],
         "matcher": "Edit",
@@ -448,7 +448,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(py)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Format with ruff\n  if command -v ruff >/dev/null 2>&1; then\n    ruff format --quiet \"$file_path\" 2>&1 >&2\n    ruff check --fix --quiet \"$file_path\" 2>&1 >&2 || true\n    echo \"[Hook] Python formatted with ruff\" >&2\n  fi\nfi\n\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(py)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Format with ruff\n  if command -v ruff >/dev/null 2>&1; then\n    ruff format --quiet \"$file_path\" 2>&1 >&2\n    ruff check --fix --quiet \"$file_path\" 2>&1 >&2 || true\n    echo \"[Hook] Python formatted with ruff\" >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
             "continueOnBlock": true
           }
         ],
@@ -459,7 +459,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(py)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Type check with ty\n  if command -v ty >/dev/null 2>&1; then\n    dir=$(dirname \"$file_path\")\n    project_root=\"$dir\"\n    while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/pyproject.toml\" ]; do\n      project_root=$(dirname \"$project_root\")\n    done\n    \n    if [ -f \"$project_root/pyproject.toml\" ]; then\n      cd \"$project_root\" && ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    else\n      ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    fi\n  fi\nfi\n\necho \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
+            "command": "input=$(cat)\nif printf '%s' \"$input\" | jq -e '((.tool_input.file_path // \"\") | test(\"\\\\.(py)$\"))' >/dev/null 2>&1; then\n  printf '%s' \"$input\" | (\n#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Type check with ty\n  if command -v ty >/dev/null 2>&1; then\n    dir=$(dirname \"$file_path\")\n    project_root=\"$dir\"\n    while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/pyproject.toml\" ]; do\n      project_root=$(dirname \"$project_root\")\n    done\n    \n    if [ -f \"$project_root/pyproject.toml\" ]; then\n      cd \"$project_root\" && ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    else\n      ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    fi\n  fi\nfi\n\nprintf '%s\\n' \"$input\"\n  )\nelse\n  printf '%s' \"$input\"\nfi",
             "continueOnBlock": true
           }
         ],

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.54",
+  "version": "1.1.56",
   "lastUpdated": "2026-07-14T00:00:00.000Z",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",