oh-my-customcode 1.1.55 → 1.1.57

package/dist/cli/index.js

@@ -243,7 +243,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.55",
+    version: "1.1.57",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {
@@ -28198,10 +28198,14 @@ function analyzeMixedAndExpr(ast, raw) {
   const fieldNode = fieldParts.reduce((acc, part) => acc === null ? part : { kind: "and", left: acc, right: part }, null);
   return { toolRegex, fieldNode };
 }
+var BARE_LITERAL_MATCHER = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 function analyzeMatcher(raw) {
   if (raw === undefined || raw === "*" || raw.trim() === "") {
     return { toolRegex: "*", fieldNode: null };
   }
+  if (BARE_LITERAL_MATCHER.test(raw)) {
+    return { toolRegex: raw, fieldNode: null };
+  }
   let ast;
   try {
     ast = parseMatcherExpr(raw);

package/dist/index.js

@@ -1556,10 +1556,14 @@ function analyzeMixedAndExpr(ast, raw) {
   const fieldNode = fieldParts.reduce((acc, part) => acc === null ? part : { kind: "and", left: acc, right: part }, null);
   return { toolRegex, fieldNode };
 }
+var BARE_LITERAL_MATCHER = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 function analyzeMatcher(raw) {
   if (raw === undefined || raw === "*" || raw.trim() === "") {
     return { toolRegex: "*", fieldNode: null };
   }
+  if (BARE_LITERAL_MATCHER.test(raw)) {
+    return { toolRegex: raw, fieldNode: null };
+  }
   let ast;
   try {
     ast = parseMatcherExpr(raw);
@@ -2535,7 +2539,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.55",
+  version: "1.1.57",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.55",
+  "version": "1.1.57",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/hooks/hooks.json

@@ -17,7 +17,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ncmd=$(echo \"$input\" | jq -r '.tool_input.command // \"\"')\n\n# Block dev servers that aren't run in tmux\necho '[Hook] BLOCKED: Dev server must run in tmux for log access' >&2\necho '[Hook] Use this command instead:' >&2\necho \"[Hook] tmux new-session -d -s dev 'npm run dev'\" >&2\necho '[Hook] Then: tmux attach -t dev' >&2\nexit 1"
+            "command": "#!/bin/bash\ninput=$(cat)\ncmd=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.command // \"\"')\n\n# Block dev servers that aren't run in tmux\necho '[Hook] BLOCKED: Dev server must run in tmux for log access' >&2\necho '[Hook] Use this command instead:' >&2\necho \"[Hook] tmux new-session -d -s dev 'npm run dev'\" >&2\necho '[Hook] Then: tmux attach -t dev' >&2\nexit 1"
           }
         ],
         "description": "Block dev servers outside tmux - ensures you can access logs"
@@ -27,7 +27,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nif [ -z \"$TMUX\" ]; then\n  echo '[Hook] Consider running in tmux for session persistence' >&2\n  echo '[Hook] tmux new -s dev  |  tmux attach -t dev' >&2\nfi\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nif [ -z \"$TMUX\" ]; then\n  echo '[Hook] Consider running in tmux for session persistence' >&2\n  echo '[Hook] tmux new -s dev  |  tmux attach -t dev' >&2\nfi\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Reminder to use tmux for long-running commands"
@@ -47,7 +47,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [[ \"$file_path\" =~ \\.(md|txt)$ ]] && [[ ! \"$file_path\" =~ (README|CLAUDE|AGENT|SKILL)\\.md$ ]]; then\n  echo \"[Hook] BLOCKED: Unnecessary documentation file creation\" >&2\n  echo \"[Hook] File: $file_path\" >&2\n  echo \"[Hook] Use README.md or AGENT.md for documentation instead\" >&2\n  exit 1\nfi\n\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [[ \"$file_path\" =~ \\.(md|txt)$ ]] && [[ ! \"$file_path\" =~ (README|CLAUDE|AGENT|SKILL)\\.md$ ]]; then\n  echo \"[Hook] BLOCKED: Unnecessary documentation file creation\" >&2\n  echo \"[Hook] File: $file_path\" >&2\n  echo \"[Hook] Use README.md or AGENT.md for documentation instead\" >&2\n  exit 1\nfi\n\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Block creation of random .md files - keeps docs consolidated"
@@ -117,7 +117,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(echo \"$input\" | jq -r '.tool_input.subagent_type // \"unknown\"')\nmodel=$(echo \"$input\" | jq -r '.tool_input.model // \"inherit\"')\ndesc=$(echo \"$input\" | jq -r '.tool_input.description // \"\"' | head -c 40)\nresume=$(echo \"$input\" | jq -r '.tool_input.resume // empty')\nif [ -n \"$resume\" ]; then\n  echo \"─── [Resume] ${agent_type}:${model} | ${desc} ───\" >&2\nelse\n  echo \"─── [Spawn] ${agent_type}:${model} | ${desc} ───\" >&2\nfi\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.subagent_type // \"unknown\"')\nmodel=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.model // \"inherit\"')\ndesc=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.description // \"\"' | head -c 40)\nresume=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.resume // empty')\nif [ -n \"$resume\" ]; then\n  echo \"─── [Resume] ${agent_type}:${model} | ${desc} ───\" >&2\nelse\n  echo \"─── [Spawn] ${agent_type}:${model} | ${desc} ───\" >&2\nfi\nprintf '%s\\n' \"$input\""
           },
           {
             "type": "command",
@@ -197,14 +197,14 @@
         "description": "Advisory check for plugin cache directories missing node_modules (#1207)"
       },
       {
-        "matcher": "*",
+        "matcher": "compact",
         "hooks": [
           {
             "type": "command",
             "command": "bash .claude/hooks/scripts/claude-md-reinject.sh"
           }
         ],
-        "description": "Re-inject project CLAUDE.md into model context on session start/resume/clear and compact re-entry — matcher \"*\" covers all SessionStart sources including \"compact\" (#1617)"
+        "description": "Re-inject project CLAUDE.md into model context on compact re-entry only — CC already natively auto-loads CLAUDE.md on startup/resume/clear, so re-injecting there is pure duplication (~13.8KB/session); matcher narrowed to \"compact\" to keep the original #1617 purpose (post-compact amnesia defense) without the startup double-injection (#1626)"
       }
     ],
     "UserPromptSubmit": [
@@ -255,7 +255,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(echo \"$input\" | jq -r '.agent_type // \"unknown\"')\nmodel=$(echo \"$input\" | jq -r '.model // \"inherit\"')\ndesc=$(echo \"$input\" | jq -r '.description // \"\"' | head -c 40)\necho \"─── [SubagentStart] ${agent_type}:${model} | ${desc} ───\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nagent_type=$(printf '%s\\n' \"$input\" | jq -r '.agent_type // \"unknown\"')\nmodel=$(printf '%s\\n' \"$input\" | jq -r '.model // \"inherit\"')\ndesc=$(printf '%s\\n' \"$input\" | jq -r '.description // \"\"' | head -c 40)\necho \"─── [SubagentStart] ${agent_type}:${model} | ${desc} ───\" >&2\nprintf '%s\\n' \"$input\""
           },
           {
             "type": "command",
@@ -286,11 +286,11 @@
             "command": "bash .claude/hooks/scripts/r007-r008-drift-advisor.sh"
           },
           {
-            "type": "prompt",
-            "prompt": "A background subagent just completed. If it FAILED, do NOT auto-continue — report the failure and wait for user input."
+            "type": "command",
+            "command": "bash .claude/hooks/scripts/subagent-failure-advisor.sh"
           }
         ],
-        "description": "Record agent outcomes + auto-continue workflow + R007/R008 drift advisory on subagent completion (autonomous-loop re-entry, #1545)"
+        "description": "Record agent outcomes + auto-continue workflow + R007/R008 drift advisory + failure advisory on subagent completion (autonomous-loop re-entry, #1545; #1631 replaced the self-referential prompt-type judge hook with an advisory-only command hook)"
       }
     ],
     "CwdChanged": [
@@ -323,7 +323,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nmsg=$(echo \"$input\" | jq -r '.message // \"\"' 2>/dev/null)\nif [ -n \"$msg\" ]; then\n  echo \"[Hook] Notification: $msg\" >&2\nfi\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nmsg=$(printf '%s\\n' \"$input\" | jq -r '.message // \"\"' 2>/dev/null)\nif [ -n \"$msg\" ]; then\n  echo \"[Hook] Notification: $msg\" >&2\nfi\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Display notifications for long-running operation completions"
@@ -335,7 +335,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nteammate=$(echo \"$input\" | jq -r '.teammate_id // \"unknown\"' 2>/dev/null)\necho \"[Hook] TeammateIdle: $teammate — available for reassignment\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nteammate=$(printf '%s\\n' \"$input\" | jq -r '.teammate_id // \"unknown\"' 2>/dev/null)\necho \"[Hook] TeammateIdle: $teammate — available for reassignment\" >&2\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Track idle Agent Teams members for work reassignment"
@@ -347,7 +347,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(echo \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\ndesc=$(echo \"$input\" | jq -r '.description // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCreated: $task_id — $desc\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(printf '%s\\n' \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\ndesc=$(printf '%s\\n' \"$input\" | jq -r '.description // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCreated: $task_id — $desc\" >&2\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Log task creation events for Agent Teams coordination"
@@ -359,7 +359,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(echo \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\nresult=$(echo \"$input\" | jq -r '.result // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCompleted: $task_id — $result\" >&2\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\ntask_id=$(printf '%s\\n' \"$input\" | jq -r '.task_id // \"\"' 2>/dev/null)\nresult=$(printf '%s\\n' \"$input\" | jq -r '.result // \"\"' 2>/dev/null | head -c 60)\necho \"[Hook] TaskCompleted: $task_id — $result\" >&2\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Log task completion events for Agent Teams coordination"
@@ -395,7 +395,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\ncmd=$(echo \"$input\" | jq -r '.tool_input.command')\n\nif echo \"$cmd\" | grep -qE 'gh pr create'; then\n  output=$(echo \"$input\" | jq -r '.tool_output.output // \"\"')\n  pr_url=$(echo \"$output\" | grep -oE 'https://github.com/[^/]+/[^/]+/pull/[0-9]+')\n  \n  if [ -n \"$pr_url\" ]; then\n    echo \"[Hook] PR created: $pr_url\" >&2\n    echo \"[Hook] Checking GitHub Actions status...\" >&2\n    repo=$(echo \"$pr_url\" | sed -E 's|https://github.com/([^/]+/[^/]+)/pull/[0-9]+|\\1|')\n    pr_num=$(echo \"$pr_url\" | sed -E 's|.*/pull/([0-9]+)|\\1|')\n    echo \"[Hook] To review PR: gh pr review $pr_num --repo $repo\" >&2\n  fi\nfi\n\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\ncmd=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.command')\n\nif echo \"$cmd\" | grep -qE 'gh pr create'; then\n  output=$(printf '%s\\n' \"$input\" | jq -r '.tool_output.output // \"\"')\n  pr_url=$(echo \"$output\" | grep -oE 'https://github.com/[^/]+/[^/]+/pull/[0-9]+')\n  \n  if [ -n \"$pr_url\" ]; then\n    echo \"[Hook] PR created: $pr_url\" >&2\n    echo \"[Hook] Checking GitHub Actions status...\" >&2\n    repo=$(echo \"$pr_url\" | sed -E 's|https://github.com/([^/]+/[^/]+)/pull/[0-9]+|\\1|')\n    pr_num=$(echo \"$pr_url\" | sed -E 's|.*/pull/([0-9]+)|\\1|')\n    echo \"[Hook] To review PR: gh pr review $pr_num --repo $repo\" >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Log PR URL and provide review command after PR creation"
@@ -405,7 +405,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v prettier >/dev/null 2>&1; then\n    prettier --write \"$file_path\" 2>&1 | head -5 >&2\n  fi\nfi\n\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v prettier >/dev/null 2>&1; then\n    prettier --write \"$file_path\" 2>&1 | head -5 >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Auto-format JS/TS files with Prettier after edits"
@@ -415,7 +415,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  dir=$(dirname \"$file_path\")\n  project_root=\"$dir\"\n  while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/package.json\" ]; do\n    project_root=$(dirname \"$project_root\")\n  done\n  \n  if [ -f \"$project_root/tsconfig.json\" ]; then\n    cd \"$project_root\" && npx tsc --noEmit --pretty false 2>&1 | grep \"$file_path\" | head -10 >&2 || true\n  fi\nfi\n\necho \"$input\"",
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  dir=$(dirname \"$file_path\")\n  project_root=\"$dir\"\n  while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/package.json\" ]; do\n    project_root=$(dirname \"$project_root\")\n  done\n  \n  if [ -f \"$project_root/tsconfig.json\" ]; then\n    cd \"$project_root\" && npx tsc --noEmit --pretty false 2>&1 | grep \"$file_path\" | head -10 >&2 || true\n  fi\nfi\n\nprintf '%s\\n' \"$input\"",
             "continueOnBlock": true
           }
         ],
@@ -426,7 +426,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  console_logs=$(grep -n \"console\\\\.log\" \"$file_path\" 2>/dev/null || true)\n  \n  if [ -n \"$console_logs\" ]; then\n    echo \"[Hook] WARNING: console.log found in $file_path\" >&2\n    echo \"$console_logs\" | head -5 >&2\n    echo \"[Hook] Remove console.log before committing\" >&2\n  fi\nfi\n\necho \"$input\"",
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  console_logs=$(grep -n \"console\\\\.log\" \"$file_path\" 2>/dev/null || true)\n  \n  if [ -n \"$console_logs\" ]; then\n    echo \"[Hook] WARNING: console.log found in $file_path\" >&2\n    echo \"$console_logs\" | head -5 >&2\n    echo \"[Hook] Remove console.log before committing\" >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\"",
             "continueOnBlock": true
           }
         ],
@@ -437,7 +437,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v gofmt >/dev/null 2>&1; then\n    gofmt -w \"$file_path\" 2>&1 >&2\n  fi\nfi\n\necho \"$input\""
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  if command -v gofmt >/dev/null 2>&1; then\n    gofmt -w \"$file_path\" 2>&1 >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\""
           }
         ],
         "description": "Auto-format Go files with gofmt after edits"
@@ -447,7 +447,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Format with ruff\n  if command -v ruff >/dev/null 2>&1; then\n    ruff format --quiet \"$file_path\" 2>&1 >&2\n    ruff check --fix --quiet \"$file_path\" 2>&1 >&2 || true\n    echo \"[Hook] Python formatted with ruff\" >&2\n  fi\nfi\n\necho \"$input\"",
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Format with ruff\n  if command -v ruff >/dev/null 2>&1; then\n    ruff format --quiet \"$file_path\" 2>&1 >&2\n    ruff check --fix --quiet \"$file_path\" 2>&1 >&2 || true\n    echo \"[Hook] Python formatted with ruff\" >&2\n  fi\nfi\n\nprintf '%s\\n' \"$input\"",
             "continueOnBlock": true
           }
         ],
@@ -458,7 +458,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Type check with ty\n  if command -v ty >/dev/null 2>&1; then\n    dir=$(dirname \"$file_path\")\n    project_root=\"$dir\"\n    while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/pyproject.toml\" ]; do\n      project_root=$(dirname \"$project_root\")\n    done\n    \n    if [ -f \"$project_root/pyproject.toml\" ]; then\n      cd \"$project_root\" && ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    else\n      ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    fi\n  fi\nfi\n\necho \"$input\"",
+            "command": "#!/bin/bash\ninput=$(cat)\nfile_path=$(printf '%s\\n' \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif [ -n \"$file_path\" ] && [ -f \"$file_path\" ]; then\n  # Type check with ty\n  if command -v ty >/dev/null 2>&1; then\n    dir=$(dirname \"$file_path\")\n    project_root=\"$dir\"\n    while [ \"$project_root\" != \"/\" ] && [ ! -f \"$project_root/pyproject.toml\" ]; do\n      project_root=$(dirname \"$project_root\")\n    done\n    \n    if [ -f \"$project_root/pyproject.toml\" ]; then\n      cd \"$project_root\" && ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    else\n      ty check \"$file_path\" 2>&1 | head -10 >&2 || true\n    fi\n  fi\nfi\n\nprintf '%s\\n' \"$input\"",
             "continueOnBlock": true
           }
         ],

package/templates/.claude/hooks/scripts/agent-start-recorder.sh

@@ -10,9 +10,9 @@ command -v jq >/dev/null 2>&1 || { cat; exit 0; }
 
 input=$(cat)
 
-agent_type=$(echo "$input" | jq -r '.agent_type // "unknown"')
-model=$(echo "$input" | jq -r '.model // "inherit"')
-description=$(echo "$input" | jq -r '.description // ""' | head -c 80)
+agent_type=$(printf '%s\n' "$input" | jq -r '.agent_type // "unknown"')
+model=$(printf '%s\n' "$input" | jq -r '.model // "inherit"')
+description=$(printf '%s\n' "$input" | jq -r '.description // ""' | head -c 80)
 
 AGENT_START_FILE="/tmp/.claude-agent-starts-${PPID}"
 
@@ -25,7 +25,7 @@ entry=$(jq -cn \
   --arg desc "$description" \
   '{start_epoch: $ts, agent_type: $agent, model: $model, description: $desc}')
 
-echo "$entry" >> "$AGENT_START_FILE"
+printf '%s\n' "$entry" >> "$AGENT_START_FILE"
 
 # Ring buffer: 50 max
 if [ -f "$AGENT_START_FILE" ]; then
@@ -36,5 +36,5 @@ if [ -f "$AGENT_START_FILE" ]; then
   fi
 fi
 
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/agent-teams-advisor.sh

@@ -21,7 +21,7 @@ ENV_STATUS="/tmp/.claude-env-status-${PPID}"
 if [ -f "$ENV_STATUS" ]; then
   teams_status=$(grep "agent_teams=" "$ENV_STATUS" 2>/dev/null | cut -d= -f2 || echo "unknown")
   if [ "$teams_status" != "enabled" ]; then
-    echo "$input"
+    printf '%s\n' "$input"
     exit 0
   fi
 fi
@@ -43,8 +43,8 @@ if [ -f "$RELEASE_PLAN" ]; then
 fi
 
 # Extract task info from input
-agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // "unknown"')
-prompt_preview=$(echo "$input" | jq -r '.tool_input.description // ""' | head -c 60)
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // "unknown"')
+prompt_preview=$(printf '%s\n' "$input" | jq -r '.tool_input.description // ""' | head -c 60)
 
 # Session-scoped counter using parent PID as session identifier
 COUNTER_FILE="/tmp/.claude-task-count-${PPID}"
@@ -77,5 +77,5 @@ elif [ "$COUNT" -ge 2 ]; then
 fi
 
 # Always pass through -- advisory only, never blocks
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/audit-log.sh

@@ -14,11 +14,11 @@ command -v jq >/dev/null 2>&1 || exit 0
 input=$(cat)
 
 # Extract fields from hook input
-tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 200)
-agent_type=$(echo "$input" | jq -r '.agent_type // "unknown"')
-model=$(echo "$input" | jq -r '.model // "unknown"')
-is_error=$(echo "$input" | jq -r '.tool_output.is_error // false')
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
+file_path=$(printf '%s\n' "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 200)
+agent_type=$(printf '%s\n' "$input" | jq -r '.agent_type // "unknown"')
+model=$(printf '%s\n' "$input" | jq -r '.model // "unknown"')
+is_error=$(printf '%s\n' "$input" | jq -r '.tool_output.is_error // false')
 timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 
 # Determine outcome
@@ -55,7 +55,7 @@ if [ -f "$AUDIT_LOG" ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
 if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
   HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))

package/templates/.claude/hooks/scripts/auto-continue-guard.sh

@@ -29,5 +29,5 @@ if [ "$count" -ge 4 ]; then
   echo '[AutoContinue] SAFETY: auto-continue limit (3) reached. Pausing.' >&2
 fi
 
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/auto-dev-token-summary.sh

@@ -32,7 +32,7 @@ summary=$(jq -s -r '
 [ "$summary" = "[]" ] && exit 0
 
 # Totals
-totals=$(echo "$summary" | jq -r '
+totals=$(printf '%s\n' "$summary" | jq -r '
   {
     total_calls: (map(.calls) | add),
     total_in: (map(.tokens_in) | add),
@@ -40,10 +40,10 @@ totals=$(echo "$summary" | jq -r '
     grand: (map(.total) | add)
   }
 ')
-total_calls=$(echo "$totals" | jq -r '.total_calls')
-total_in=$(echo "$totals" | jq -r '.total_in')
-total_out=$(echo "$totals" | jq -r '.total_out')
-grand=$(echo "$totals" | jq -r '.grand')
+total_calls=$(printf '%s\n' "$totals" | jq -r '.total_calls')
+total_in=$(printf '%s\n' "$totals" | jq -r '.total_in')
+total_out=$(printf '%s\n' "$totals" | jq -r '.total_out')
+grand=$(printf '%s\n' "$totals" | jq -r '.grand')
 
 {
   echo ""
@@ -52,7 +52,7 @@ grand=$(echo "$totals" | jq -r '.grand')
   echo ""
   printf "| %-32s | %5s | %10s | %10s | %10s |\n" "Phase" "Calls" "Tokens In" "Tokens Out" "Total"
   printf "| %-32s | %5s | %10s | %10s | %10s |\n" "--------------------------------" "-----" "----------" "----------" "----------"
-  echo "$summary" | jq -r '.[] | "\(.phase)\t\(.calls)\t\(.tokens_in)\t\(.tokens_out)\t\(.total)"' | \
+  printf '%s\n' "$summary" | jq -r '.[] | "\(.phase)\t\(.calls)\t\(.tokens_in)\t\(.tokens_out)\t\(.total)"' | \
     while IFS=$'\t' read -r phase calls tin tout tot; do
       phase_trunc=$(printf "%s" "$phase" | head -c 32)
       printf "| %-32s | %5s | %10s | %10s | %10s |\n" "$phase_trunc" "$calls" "$tin" "$tout" "$tot"

package/templates/.claude/hooks/scripts/auto-dev-token-tracker.sh

@@ -9,7 +9,7 @@ set -euo pipefail
 
 # Always pass through input no matter what
 input=$(cat)
-trap 'echo "$input"' EXIT
+trap 'printf "%s\n" "$input"' EXIT
 
 # Gate: only active during auto-dev pipeline
 PIPELINE_STATE="/tmp/.claude-pipeline-auto-dev-${PPID}.json"
@@ -21,10 +21,10 @@ command -v jq >/dev/null 2>&1 || exit 0
 LOG_FILE="/tmp/auto-dev-spend-${PPID}.json"
 
 # Extract fields (PostToolUse Agent shape)
-agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // "unknown"' 2>/dev/null || echo "unknown")
-description=$(echo "$input" | jq -r '.tool_input.description // ""' 2>/dev/null || echo "")
-prompt_text=$(echo "$input" | jq -r '.tool_input.prompt // ""' 2>/dev/null || echo "")
-output_text=$(echo "$input" | jq -r '.tool_output.output // .tool_output // ""' 2>/dev/null || echo "")
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // "unknown"' 2>/dev/null || echo "unknown")
+description=$(printf '%s\n' "$input" | jq -r '.tool_input.description // ""' 2>/dev/null || echo "")
+prompt_text=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt // ""' 2>/dev/null || echo "")
+output_text=$(printf '%s\n' "$input" | jq -r '.tool_output.output // .tool_output // ""' 2>/dev/null || echo "")
 
 # Derive phase from pipeline state (current_phase) or fallback to description prefix
 phase=$(jq -r '.current_phase // .phase // "unknown"' "$PIPELINE_STATE" 2>/dev/null || echo "unknown")
@@ -52,6 +52,6 @@ entry=$(jq -n -c \
   --argjson tout "$tokens_out" \
   '{ts: $ts, phase: $phase, agent: $agent, tokens_in: $tin, tokens_out: $tout}' 2>/dev/null) || exit 0
 
-echo "$entry" >> "$LOG_FILE" 2>/dev/null || true
+printf '%s\n' "$entry" >> "$LOG_FILE" 2>/dev/null || true
 
 exit 0

package/templates/.claude/hooks/scripts/claude-md-reinject.sh

@@ -6,13 +6,18 @@
 #   규칙 amnesia가 재발한다. 기존 PostCompact 훅(hooks.json)은 "prompt" 타입으로 요약 지침만
 #   재주입할 뿐, CLAUDE.md 원문 전체를 재주입하지 않는다.
 #
-# 배선 이벤트 (Phase 1 판단, #1617):
+# 배선 이벤트 (Phase 1 판단, #1617 / matcher 협소화 #1626):
 #   R006 실측 기준(이 저장소 rules/MUST-agent-design.md) additionalContext 지원 이벤트 목록에
 #   SessionStart는 있고 PostCompact는 없다. 한편 공식 문서(hooks.md, 2026-08-29 재확인)의
 #   SessionStart matcher는 startup / resume / clear / compact 네 가지이며, "compact"는
-#   auto/manual compact 직후를 가리킨다 — 즉 "session start 전체와 compact 재개 이후 재주입"
-#   요구사항은 SessionStart 단일 이벤트(matcher "*")로 전부 커버된다. 별도 PostCompact 배선은
-#   불필요 — 공식 문서 이벤트 목록(### 헤더 스캔)에 PostCompact 자체가 없다(PreCompact만 존재).
+#   auto/manual compact 직후를 가리킨다. 별도 PostCompact 배선은 불필요 — 공식 문서 이벤트
+#   목록(### 헤더 스캔)에 PostCompact 자체가 없다(PreCompact만 존재).
+#
+#   #1626 실측: startup 시점 재주입은 CC의 네이티브 CLAUDE.md 자동 로드와 중복(13,817 B/세션
+#   순수 낭비)이며, resume/clear는 이전 컨텍스트가 그대로 복원되므로 재주입이 불요하다.
+#   원 목적(#1617 — compact 후 규칙 amnesia 방지)은 "compact" 소스만으로 충분히 달성되므로,
+#   hooks.json의 matcher를 "*" → "compact"로 좁혔다. 이 스크립트 자체는 source 필터링을
+#   하지 않으므로(아래 source_field는 로그 헤더용) hooks.json matcher가 유일한 게이트다.
 #
 # 동작:
 #   stdin JSON의 .source(startup/resume/clear/compact/기타)를 로그 헤더에 포함해

package/templates/.claude/hooks/scripts/content-hash-validator.sh

@@ -15,12 +15,12 @@ input=$(cat)
 # Hash store (PPID-scoped, session-only)
 HASH_STORE="/tmp/.claude-content-hashes-${PPID}"
 
-tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
+tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
 
 case "$tool_name" in
   "Read")
     # Store content hash for the file that was just read
-    file_path=$(echo "$input" | jq -r '.tool_input.file_path // ""')
+    file_path=$(printf '%s\n' "$input" | jq -r '.tool_input.file_path // ""')
 
     if [ -n "$file_path" ] && [ -f "$file_path" ]; then
       content_hash=$(md5 -q "$file_path" 2>/dev/null || md5sum "$file_path" 2>/dev/null | cut -d' ' -f1 || echo "unknown")
@@ -43,7 +43,7 @@ case "$tool_name" in
 
   "Edit")
     # Validate that file hasn't changed since last Read
-    file_path=$(echo "$input" | jq -r '.tool_input.file_path // ""')
+    file_path=$(printf '%s\n' "$input" | jq -r '.tool_input.file_path // ""')
 
     if [ -n "$file_path" ] && [ -f "$HASH_STORE" ] && [ -f "$file_path" ]; then
       stored_hash=$(grep "\"path\":\"${file_path}\"" "$HASH_STORE" 2>/dev/null | tail -1 | jq -r '.hash // ""' 2>/dev/null || echo "")
@@ -71,5 +71,5 @@ if [ -f "$HASH_STORE" ]; then
 fi
 
 # Always pass through
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/context-budget-advisor.sh

@@ -33,7 +33,7 @@ read_count=${read_count:-0}
 agent_count=${agent_count:-0}
 
 # Determine tool type from input
-TOOL=$(echo "$input" | jq -r '.tool_name // ""' 2>/dev/null || echo "")
+TOOL=$(printf '%s\n' "$input" | jq -r '.tool_name // ""' 2>/dev/null || echo "")
 tool_count=$((tool_count + 1))
 
 case "$TOOL" in
@@ -95,7 +95,7 @@ if [ "$tool_count" -ge "$THRESHOLD" ] && [ ! -f "$BLOCK_FILE" ]; then
     HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))
     echo "[Hook Perf] $(basename "$0"): ${HOOK_MS}ms" >> "/tmp/.claude-hook-perf-${PPID}.log"
   fi
-  echo "$input"
+  printf '%s\n' "$input"
   exit 2
 fi
 
@@ -112,7 +112,7 @@ if [ "$tool_count" -gt 0 ] && [ $((tool_count % 50)) -eq 0 ]; then
 fi
 
 # Pass through
-echo "$input"
+printf '%s\n' "$input"
 HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
 if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
   HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))

package/templates/.claude/hooks/scripts/cost-cap-advisor.sh

@@ -15,19 +15,19 @@ COST_CAP="${CLAUDE_COST_CAP:-5.00}"
 
 # Check if cost data is available
 if [ ! -f "$COST_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
 # TSV: cost_usd, ctx_pct, timestamp, rl_5h_pct, rl_7d_pct, rl_5h_resets, rl_7d_resets
 IFS=$'\t' read -r cost_usd ctx_pct timestamp _rl_5h _rl_7d _rl_5h_resets _rl_7d_resets < "$COST_FILE" 2>/dev/null || {
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 }
 
 # Validate cost_usd is a number
 if ! printf '%f' "$cost_usd" >/dev/null 2>&1; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -39,7 +39,7 @@ cost_pct=$(echo "scale=0; $cost_usd * 100 / $COST_CAP" | bc 2>/dev/null || echo
 now=$(date +%s)
 age=$((now - ${timestamp:-0}))
 if [ "$age" -gt 60 ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -54,7 +54,7 @@ if [ "$cost_pct" -ge 100 ] && [ "$last_level" != "100" ]; then
   echo "[Cost Cap] Session cost \$${cost_usd} has reached cap \$${COST_CAP} (${cost_pct}%)" >&2
   echo "[Cost Cap] Consider wrapping up or increasing CLAUDE_COST_CAP" >&2
   echo "100" > "$ADVISORY_FILE"
-  echo "$input"
+  printf '%s\n' "$input"
   exit 2
 elif [ "$cost_pct" -ge 90 ] && [ "$last_level" != "90" ] && [ "$last_level" != "100" ]; then
   echo "[Cost Cap] Session cost \$${cost_usd} at 90% of cap \$${COST_CAP}" >&2
@@ -69,5 +69,5 @@ elif [ "$cost_pct" -ge 50 ] && [ -z "$last_level" ]; then
 fi
 
 # Pass through — advisory only
-echo "$input"
+printf '%s\n' "$input"
 exit 0

package/templates/.claude/hooks/scripts/cwd-change-detector.sh

@@ -3,10 +3,10 @@
 # Advisory only — provides context hints when cwd changes
 
 input=$(cat)
-new_cwd=$(echo "$input" | jq -r '.new_cwd // ""' 2>/dev/null)
+new_cwd=$(printf '%s\n' "$input" | jq -r '.new_cwd // ""' 2>/dev/null)
 
 if [ -z "$new_cwd" ] || [ ! -d "$new_cwd" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -33,4 +33,4 @@ if [ -n "$hints" ]; then
   printf "%b" "$hints" >&2
 fi
 
-echo "$input"
+printf '%s\n' "$input"

package/templates/.claude/hooks/scripts/destructive-git-guard.sh

@@ -9,7 +9,7 @@
 
 input=$(cat)
 if command -v jq >/dev/null 2>&1; then
-  command_text=$(echo "$input" | jq -r '.tool_input.command // ""' 2>/dev/null)
+  command_text=$(printf '%s\n' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null)
 elif command -v python3 >/dev/null 2>&1; then
   command_text=$(INPUT_JSON="$input" python3 - <<'PY' 2>/dev/null
 import json, os
@@ -57,4 +57,4 @@ if [ -n "$matched" ]; then
 fi
 
 # Always pass through - this hook is advisory only.
-echo "$input"
+printf '%s\n' "$input"

package/templates/.claude/hooks/scripts/eval-core-batch-save.sh

@@ -14,7 +14,7 @@ PPID_FILE="/tmp/.claude-task-outcomes-${PPID}"
 
 # Only attempt collection if outcome file exists
 if [ ! -f "$PPID_FILE" ]; then
-  echo "$input"
+  printf '%s\n' "$input"
   exit 0
 fi
 
@@ -42,5 +42,5 @@ if [ -n "$EVAL_CORE" ]; then
 fi
 
 # Always pass through input and exit 0 (advisory only)
-echo "$input"
+printf '%s\n' "$input"
 exit 0