oh-my-customcode 1.1.58 → 1.1.59

package/dist/cli/index.js

@@ -243,7 +243,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.58",
+    version: "1.1.59",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2539,7 +2539,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.58",
+  version: "1.1.59",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.58",
+  "version": "1.1.59",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/agents/mgr-gitnerd.md

@@ -50,6 +50,27 @@ Types: feat, fix, docs, style, refactor, test, chore
 - ALWAYS check `git reflog` before declaring work lost — most destructive ops are recoverable for 30 days
 - Reference: R001 Destructive Git Commands section, #1146 (v0.136.0 working tree loss incident)
 
+## Commit Timeout Budget (#1645)
+
+`.husky/pre-commit` 는 **메인 워크트리**에서 typecheck + `bun run lint` + `bun test --coverage`
+전체 스위트(실측 약 **165초**) + 커버리지 임계값 + CLAUDE.md 카운트 검증까지 순차 실행한다.
+Bash 도구 기본 타임아웃은 **120000ms(2분)** 이라 `git commit` 이 훅 실행 도중
+**exit 143(SIGTERM)** 으로 끊긴다.
+
+| 상황 | Bash `timeout` |
+|---|---|
+| 메인 워크트리에서 `git commit` | **≥ 400000** (약 6.7분) |
+| git worktree 에서 `git commit` | 기본값으로 충분 (`.husky/pre-commit` **7-12행**이 `[ -f .git ]` 로 분기해 `bun run typecheck` 만 실행하고 `exit 0` — 전체 스위트는 CI 담당) |
+| `git push` / `gh pr` 등 훅 없는 명령 | 기본값 |
+
+**금지**: 타임아웃 회피 목적의 `--no-verify` 사용. 품질 게이트 우회는 상시 금지이며
+오케스트레이터의 사전 승인이 있을 때만 예외다(R010 「품질 게이트 우회 금지」).
+훅이 차단하면 우회하지 말고 **차단 사실과 원인을 보고하고 대기**한다.
+
+**타임아웃으로 끊긴 경우**: exit 143 은 "커밋 실패"의 증거가 아니다 — 훅이 통과한 뒤
+커밋이 성사됐을 수도 있다. 재시도 전 `git log -1 --format=%H%n%s` 로 **실제 HEAD 를 실측**하라
+(R020 「Failure/Interrupt Report ≠ Actual Failure」).
+
 ## Push Rules (R016)
 
 All pushes require prior mgr-sauron:watch verification. If sauron was not run, REFUSE the push.

package/templates/.claude/hooks/scripts/r007-r008-drift-advisor.sh

@@ -304,8 +304,33 @@ if [ -n "$turn_uuid" ] && [ -f "$MARKER_FILE" ]; then
   fi
 fi
 
-advisory_text=$(printf '[R007/R008 Advisory] 직전 응답에서 식별 누락 감지 (R007 헤더=%s, R008 접두사=%s). 이번 응답은 ┌─ Agent: 헤더로 시작하고, 모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오.' \
-  "$r007_violations" "$r008_violations")
+# ── 위반 문구 조립 (#1643 — 판정 로직 불변, 레이블 의미를 문구 자체가 드러내도록 정정) ──
+# 이전 문구 "R007 헤더=%s, R008 접두사=%s"의 %s는 위반 "건수"(0=컴플라이언트)였는데, 레이블
+# "헤더"/"접두사"가 "개수"로 오독되어 "R007 헤더=0"이 "헤더가 없다"로 잘못 읽혔다(#1643 진단
+# 확정 — 실제로는 헤더가 정상 존재하는 컴플라이언트 상태였다). 값이 위반 건수라는 것을 문구
+# 자체가 드러내도록 "누락 N건"으로 표현하고, 위반이 없는 차원은 문구에서 아예 제외한다 — 0건인
+# 차원을 언급하면 그 차원도 위반처럼 오독될 수 있기 때문이다.
+violation_desc=""
+instruction=""
+if [ "$r007_violations" -gt 0 ]; then
+  violation_desc="R007 에이전트 식별 헤더 누락 ${r007_violations}건"
+  instruction="이번 응답은 ┌─ Agent: 헤더로 시작하십시오."
+fi
+if [ "$r008_violations" -gt 0 ]; then
+  if [ -n "$violation_desc" ]; then
+    violation_desc="${violation_desc}, R008 도구 식별 접두사 누락 ${r008_violations}건"
+    instruction="이번 응답은 ┌─ Agent: 헤더로 시작하고, 모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오."
+  else
+    violation_desc="R008 도구 식별 접두사 누락 ${r008_violations}건"
+    instruction="모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오."
+  fi
+fi
+
+if [ -n "$violation_desc" ]; then
+  advisory_text="[R007/R008 Advisory] 직전 응답에서 ${violation_desc} 감지. ${instruction}"
+else
+  advisory_text="[R007/R008 Advisory]"
+fi
 
 if [ "$r008_reverse" -gt 0 ]; then
   advisory_text="${advisory_text} [R009 Self-Check #6] 직전 턴은 도구 호출 ${r008_reverse}건을 예고하고도 tool_use 블록 없이 종료했습니다 — 예고한 호출을 지금 실행하거나, 실행하지 않기로 한 사유를 명시하십시오."

package/templates/.claude/hooks/scripts/session-autofix.sh

@@ -96,18 +96,66 @@ if [ -d "wiki" ]; then
 fi
 
 # ─── Check 6: Broken skill references (lightweight) ───
+# Parses BOTH frontmatter forms (#1640):
+#   inline : skills: [a, b]
+#   block  : skills:
+#              - a
+#              - b
+# Emits one skill name per line. Scans the YAML frontmatter only (stops at the
+# closing "---"), so a "skills:" line in the agent body is never parsed.
+parse_agent_skills() {
+  awk '
+    BEGIN {
+      SQ = sprintf("%c", 39); DQ = sprintf("%c", 34)
+      infm = 0; inskills = 0
+    }
+    function clean(s) {
+      sub(/[[:space:]]*#.*$/, "", s)
+      gsub(SQ, "", s); gsub(DQ, "", s)
+      gsub(/[[:space:]]/, "", s)
+      return s
+    }
+    NR == 1 { if ($0 ~ /^---[[:space:]]*$/) infm = 1; next }
+    infm == 0 { exit }
+    /^---[[:space:]]*$/ { exit }
+    inskills == 1 {
+      if ($0 ~ /^[[:space:]]+-[[:space:]]*/) {
+        item = $0
+        sub(/^[[:space:]]+-[[:space:]]*/, "", item)
+        item = clean(item)
+        if (item != "") print item
+        next
+      }
+      if ($0 ~ /^[[:space:]]*$/) next
+      inskills = 0
+    }
+    /^skills:/ {
+      rest = $0
+      sub(/^skills:[[:space:]]*/, "", rest)
+      sub(/[[:space:]]*#.*$/, "", rest)
+      if (rest ~ /^\[/) {
+        sub(/^\[/, "", rest); sub(/\][[:space:]]*$/, "", rest)
+        n = split(rest, arr, ",")
+        for (i = 1; i <= n; i++) {
+          s = clean(arr[i])
+          if (s != "") print s
+        }
+      } else if (rest == "") {
+        inskills = 1
+      }
+      next
+    }
+  ' "$1"
+}
+
 broken_refs=0
 for agent in .claude/agents/*.md; do
-  skills_line=$(grep -E '^skills:' "$agent" 2>/dev/null | head -1)
-  if [ -n "$skills_line" ]; then
-    skills=$(echo "$skills_line" | sed 's/skills: *\[//;s/\]//;s/,/ /g;s/"//g' | tr -d "'")
-    for skill in $skills; do
-      skill=$(echo "$skill" | tr -d ' ')
-      if [ -n "$skill" ] && [ ! -f ".claude/skills/${skill}/SKILL.md" ]; then
-        broken_refs=$((broken_refs + 1))
-      fi
-    done
-  fi
+  [ -f "$agent" ] || continue
+  while IFS= read -r skill; do
+    if [ -n "$skill" ] && [ ! -f ".claude/skills/${skill}/SKILL.md" ]; then
+      broken_refs=$((broken_refs + 1))
+    fi
+  done <<< "$(parse_agent_skills "$agent")"
 done
 if [ "$broken_refs" -gt 0 ]; then
   add_issue "broken-refs:${broken_refs} broken skill reference(s) in agent frontmatter"

package/templates/.claude/hooks/scripts/stuck-detector.sh

@@ -44,6 +44,23 @@ is_readonly_single_command() {
   local w2="${parts[1]:-}"
   local w3="${parts[2]:-}"
 
+  # Variable assignment prefix: "VAR=value" or "VAR=value cmd args".
+  # A bare assignment has no side effect outside the shell; when followed by a
+  # command, classify that command instead. Command substitutions inside the
+  # RHS were already validated and replaced by is_readonly_bash_command (#1641).
+  case "$w1" in
+    [A-Za-z_]*=*)
+      if [ "${#parts[@]}" -le 1 ]; then
+        echo "true"
+        return 0
+      fi
+      local rest_cmd="${cmd#*"$w1"}"
+      rest_cmd="$(printf '%s' "$rest_cmd" | sed -e 's/^[[:space:]]*//')"
+      is_readonly_single_command "$rest_cmd"
+      return 0
+      ;;
+  esac
+
   case "$w1" in
     ls|cat|head|tail|grep|rg|wc|jq|md5|md5sum|type|command|which|echo|printf|pwd|date)
       echo "true"
@@ -77,7 +94,7 @@ is_readonly_single_command() {
               *) ok="false" ;;
             esac
           done
-          echo "$ok"
+          printf '%s\n' "$ok"
           ;;
         *)
           # fetch and all other subcommands (checkout/merge/rebase/push/...) => write
@@ -116,29 +133,172 @@ is_readonly_single_command() {
   esac
 }
 
+# Maximum recursion depth for nested command substitution / loop bodies.
+_RO_MAX_DEPTH=5
+# Maximum command length that is parsed at all (see Step 0 below).
+_RO_MAX_COMMAND_LEN=4000
+
 is_readonly_bash_command() {
   local cmd="$1"
+  local depth="${2:-0}"
+
+  if [ "$depth" -gt "$_RO_MAX_DEPTH" ]; then
+    echo "false"
+    return 0
+  fi
+
+  # --- Step 0: length cap (M-4). The "$(...)" balance scan below walks the
+  # remainder of the command ONE CHARACTER AT A TIME and rebuilds "$inner" on
+  # every iteration, which is O(n^2) in the substitution's length (measured:
+  # 5 KB => 0.9 s, 20 KB => 13.6 s of latency on a PostToolUse hook).
+  # "$raw_command" is the only unbounded field left after the cap on
+  # target_key, so cap it here. Nothing legitimately read-only is 4 KB long;
+  # anything over the cap is classified as a write, i.e. the conservative side
+  # (a read-only classification only ever RELAXES blocking).
+  if [ "${#cmd}" -gt "$_RO_MAX_COMMAND_LEN" ]; then
+    echo "false"
+    return 0
+  fi
+
   cmd="$(printf '%s' "$cmd" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
   if [ -z "$cmd" ]; then
     echo "false"
     return 0
   fi
 
-  # Truly ambiguous constructs: redirection, command/process substitution, or
-  # "||" (conditional-OR — intentionally NOT decomposed into segments, since
-  # its branch that actually runs depends on the first segment's exit code)
-  # => always treated as write.
+  # --- Step 1: process substitution "<(...)" stays ambiguous => write. ---
+  case "$cmd" in
+    *'<('*)
+      echo "false"
+      return 0
+      ;;
+  esac
+
+  # --- Step 2: command substitution "$(...)" / backticks.
+  # Rather than treating them as an automatic write (#1641), extract the inner
+  # command, classify it RECURSIVELY, and replace the substitution with the
+  # inert placeholder "SUBST". A write inside the substitution (e.g.
+  # "$(rm -rf /tmp/x)", "$(git push)") still makes the whole command a write.
+  while :; do
+    case "$cmd" in
+      *'$('*)
+        local before="${cmd%%'$('*}"
+        local after="${cmd#*'$('}"
+        # Balance-aware scan for the matching ")".
+        local inner="" rest="" d=1 i ch
+        for ((i = 0; i < ${#after}; i++)); do
+          ch="${after:$i:1}"
+          if [ "$ch" = "(" ]; then
+            d=$((d + 1))
+          elif [ "$ch" = ")" ]; then
+            d=$((d - 1))
+            if [ "$d" -eq 0 ]; then
+              rest="${after:$((i + 1))}"
+              break
+            fi
+          fi
+          inner="${inner}${ch}"
+        done
+        if [ "$d" -ne 0 ]; then
+          # Unbalanced => unparseable => conservative write.
+          echo "false"
+          return 0
+        fi
+        if [ "$(is_readonly_bash_command "$inner" $((depth + 1)))" != "true" ]; then
+          echo "false"
+          return 0
+        fi
+        cmd="${before}SUBST${rest}"
+        ;;
+      *'`'*)
+        # Backticks do not nest; take the text between the first pair.
+        local b_before="${cmd%%'`'*}"
+        local b_after="${cmd#*'`'}"
+        case "$b_after" in
+          *'`'*) ;;
+          *) echo "false"; return 0 ;;
+        esac
+        local b_inner="${b_after%%'`'*}"
+        local b_rest="${b_after#*'`'}"
+        if [ "$(is_readonly_bash_command "$b_inner" $((depth + 1)))" != "true" ]; then
+          echo "false"
+          return 0
+        fi
+        cmd="${b_before}SUBST${b_rest}"
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
+
+  # --- Step 3: strip harmless redirections BEFORE the ">" write check.
+  # "2>&1", ">/dev/null", "2>/dev/null", "1>/dev/null", "&>/dev/null" produce no
+  # observable side effect. Any OTHER ">" (a real file write) remains a write.
+  local stripped
+  stripped="$(printf '%s' "$cmd" \
+    | sed -E 's/[0-9]?>&[0-9]/ /g; s#[0-9]?&?>[[:space:]]*/dev/null# #g')"
+  case "$stripped" in
+    *'>'*)
+      echo "false"
+      return 0
+      ;;
+  esac
+  cmd="$stripped"
+
+  # --- Step 4: "||" is still NOT decomposed (which branch runs depends on the
+  # first segment's exit code) => write. Preserved from #1629.
   case "$cmd" in
-    *'>'*|*'||'*|*'$('*|*'`'*|*'<('*)
+    *'||'*)
       echo "false"
       return 0
       ;;
   esac
 
-  # Compound command: split on "&&", ";", or a single "|" into segments and
+  # --- Step 5: for / while loops (#1641).
+  # Normalize ";do" / ";done" spacing, then classify the header and the
+  # "do ... done" body separately. Both must be read-only.
+  case "$cmd" in
+    for\ *|while\ *)
+      local norm
+      norm="$(printf '%s' "$cmd" | sed -E 's/;[[:space:]]*do([[:space:]]|$)/ ; do /g; s/;[[:space:]]*done/ ; done/g')"
+      case "$norm" in
+        *' do '*'done'*) ;;
+        *) echo "false"; return 0 ;;
+      esac
+      local head="${norm%% do *}"
+      local tail_part="${norm#* do }"
+      local body="${tail_part%done*}"
+      head="$(printf '%s' "$head" | sed -e 's/[[:space:]]*;[[:space:]]*$//')"
+      body="$(printf '%s' "$body" | sed -e 's/[[:space:]]*;[[:space:]]*$//')"
+
+      case "$head" in
+        # "for VAR in <words>" — pure iteration, no side effect. The <words>
+        # already had any substitution validated in Step 2.
+        for\ [A-Za-z_]*\ in\ *)
+          ;;
+        while\ *)
+          # The while CONDITION is a real command — classify it.
+          local wcond="${head#while }"
+          if [ "$(is_readonly_bash_command "$wcond" $((depth + 1)))" != "true" ]; then
+            echo "false"
+            return 0
+          fi
+          ;;
+        *)
+          echo "false"
+          return 0
+          ;;
+      esac
+
+      is_readonly_bash_command "$body" $((depth + 1))
+      return 0
+      ;;
+  esac
+
+  # --- Step 6: compound command — split on "&&", ";", or a single "|" and
   # require EVERY segment to be read-only (#1629). An empty segment (e.g. a
-  # trailing separator) is treated as ambiguous => write, same as any
-  # segment that fails single-command classification.
+  # trailing separator) is ambiguous => write.
   if [[ "$cmd" == *'&&'* || "$cmd" == *';'* || "$cmd" == *'|'* ]]; then
     local normalized="$cmd"
     normalized="${normalized//&&/$'\n'}"
@@ -167,15 +327,67 @@ input=$(cat)
 
 # Extract tool info
 tool_name=$(printf '%s' "$input" | jq -r '.tool_name // "unknown"')
-# 300 (not 120): a 120-char cutoff let two genuinely different long Bash
-# commands collide on their shared 120-char prefix, causing a false-positive
-# same-path/same-tool+target hard-block. 300 chars covers the vast majority
-# of real commands without their differing tail being cut off (#1629).
-file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 300)
+# Bash commands are NOT files. Feeding tool_input.command into file_path made
+# the hard-block message report a command fragment as a "file" and let Check 1
+# ("Same file ... edited") fire on Bash at all (#1641). Keep the command text in
+# a SEPARATE field (target_key) so tool+target repetition detection (Check 3 /
+# Signal 3) still works, while the file-oriented checks see nothing for Bash.
+#
+# 1000 (was 300, originally 120): a short cutoff let two genuinely different
+# long Bash commands collide on their shared prefix, causing a false-positive
+# same-path/same-tool+target hard-block (#1629). Truncation alone can never
+# remove that collision class, so truncate_key() ALSO appends the ORIGINAL
+# length: two values that share the capped prefix but differ in total length
+# no longer produce the same key (M-3).
+TARGET_KEY_CAP=1000
+
+truncate_key() {
+  local v="$1"
+  if [ "${#v}" -gt "$TARGET_KEY_CAP" ]; then
+    printf '%s' "${v:0:$TARGET_KEY_CAP}#len=${#v}"
+  else
+    printf '%s' "$v"
+  fi
+}
+
+if [ "$tool_name" = "Bash" ]; then
+  file_path=""
+  # ".tool_input.file_path" is a defensive fallback only: the real Bash tool has
+  # no file_path parameter, but a caller (or a test fixture) may still supply one
+  # as the target identifier. The command text wins whenever it is present.
+  target_key=$(truncate_key "$(printf '%s' "$input" | jq -r '.tool_input.command // .tool_input.file_path // ""')")
+else
+  file_path_full=$(printf '%s' "$input" | jq -r '.tool_input.file_path // ""')
+  # file_path is display/guard only (basename in the messages); target_key is
+  # the value matched against history, so only it carries the length tag.
+  file_path=$(printf '%s' "$file_path_full" | head -c "$TARGET_KEY_CAP")
+  target_key=$(truncate_key "$file_path_full")
+fi
 is_error=$(printf '%s' "$input" | jq -r '.tool_output.is_error // false')
 output_preview=$(printf '%s' "$input" | jq -r '.tool_output.output // ""' | head -c 200)
 raw_command=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
 
+# Distinguish "the same file edited 3 times with DIFFERENT content" (a normal
+# incremental-edit workflow — the #1641 false positive) from "the same edit
+# repeated 3 times" (a genuine stuck loop). Only the latter should hard-block.
+# Alphanumerics-only + length cap: deterministic, platform-independent (no
+# md5sum, absent on macOS) and safe to embed in a grep pattern.
+edit_hash=""
+if [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; then
+  edit_hash=$(printf '%s' "$input" \
+    | jq -r '(.tool_input.old_string // .tool_input.content // .tool_input.new_string // "")
+             | gsub("[^A-Za-z0-9]"; "") | .[0:120]')
+fi
+
+# History entries are written by jq, so their "path" values are JSON-ENCODED.
+# Matching them requires the SAME encoding, not the raw text: a raw value
+# containing a quote (common in Bash commands) can never match the encoded
+# form. The previous BRE escaping was doubly broken — in POSIX BRE "( ) + ? { |"
+# are literals, so escaping them turned them INTO operators and silently
+# stopped matching. Encode once here and match with grep -F (fixed string).
+target_key_json=$(jq -n --arg v "$target_key" '$v')
+path_match="\"path\":${target_key_json}"
+
 is_readonly="false"
 if [ "$tool_name" = "Bash" ]; then
   is_readonly=$(is_readonly_bash_command "$raw_command")
@@ -190,18 +402,22 @@ timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 # Generate error hash for deduplication (first 50 chars of error)
 error_hash=""
 if [ "$is_error" = "true" ]; then
-  error_hash=$(echo "$output_preview" | head -c 50 | md5sum 2>/dev/null | cut -d' ' -f1 || echo "unknown")
+  error_hash=$(printf '%s' "$output_preview" | head -c 50 | md5sum 2>/dev/null | cut -d' ' -f1 || printf '%s\n' "unknown")
 fi
 
+# "path" holds $target_key — a file path for file tools, the command text for
+# Bash (#1641). Keeping Bash commands in this field preserves Check 3 / Signal 3
+# repetition detection while file_path stays empty for Bash.
 entry=$(jq -cn \
   --arg ts "$timestamp" \
   --arg tool "$tool_name" \
-  --arg path "$file_path" \
+  --arg path "$target_key" \
   --arg err "$is_error" \
   --arg hash "$error_hash" \
+  --arg ehash "$edit_hash" \
   --arg preview "$output_preview" \
   --arg readonly "$is_readonly" \
-  '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, preview: $preview, readonly: $readonly}')
+  '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, edit_hash: $ehash, preview: $preview, readonly: $readonly}')
 
 printf '%s\n' "$entry" >> "$HISTORY_FILE"
 
@@ -237,7 +453,7 @@ recovery=""
 
 # Signal 1: Repeated error (same error_hash 3+ times in last 10 entries)
 if [ "$is_error" = "true" ] && [ -n "$error_hash" ]; then
-  error_repeat=$(tail -10 "$HISTORY_FILE" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || echo "0")
+  error_repeat=$(tail -10 "$HISTORY_FILE" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || printf '%s\n' "0")
   if [ "$error_repeat" -ge 3 ]; then
     stuck_detected=true
     signal_type="Repeated error"
@@ -251,12 +467,12 @@ fi
 # Signal 2: Edit loop (same file edited 3+ times in last 8 entries)
 if [ "$stuck_detected" = false ] && { [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; }; then
   if [ -n "$file_path" ]; then
-    escaped_path=$(echo "$file_path" | sed 's/[.[\*^$()+?{|]/\\&/g')
-    edit_repeat=$(tail -8 "$HISTORY_FILE" | grep -c "\"path\":\"${escaped_path}\"" 2>/dev/null || echo "0")
+    edit_repeat=$(tail -8 "$HISTORY_FILE" | grep -cF -e "$path_match" 2>/dev/null || true)
+    [ -n "$edit_repeat" ] || edit_repeat=0
     if [ "$edit_repeat" -ge 3 ]; then
       stuck_detected=true
       signal_type="Edit loop"
-      pattern_desc="$(basename "$file_path") edited ${edit_repeat} times in last 8 calls"
+      pattern_desc="$(basename -- "$file_path") edited ${edit_repeat} times in last 8 calls"
       occurrence_count=$edit_repeat
       threshold=3
       recovery="Try a different file or approach instead of re-editing"
@@ -271,7 +487,7 @@ fi
 # calls (git status / gh view / ls / ...) doesn't inflate the "same tool
 # called N times" advisory.
 if [ "$stuck_detected" = false ] && [ "$is_readonly" != "true" ]; then
-  tool_repeat=$(tail -8 "$HISTORY_FILE" | grep -v "\"readonly\":\"true\"" | grep -c "\"tool\":\"${tool_name}\"" 2>/dev/null || echo "0")
+  tool_repeat=$(tail -8 "$HISTORY_FILE" | grep -v "\"readonly\":\"true\"" | grep -c "\"tool\":\"${tool_name}\"" 2>/dev/null || printf '%s\n' "0")
   if [ "$tool_repeat" -ge 5 ]; then
     stuck_detected=true
     signal_type="Tool loop"
@@ -302,38 +518,64 @@ hard_block_reason=""
 
 if [ -f "$HISTORY_FILE" ]; then
   last_n=$(tail -"$HARD_BLOCK_THRESHOLD" "$HISTORY_FILE" 2>/dev/null)
-  last_n_count=$(echo "$last_n" | wc -l | tr -d ' ')
+  last_n_count=$(printf '%s\n' "$last_n" | wc -l | tr -d ' ')
 
   if [ "$last_n_count" -ge "$HARD_BLOCK_THRESHOLD" ]; then
-    # Check 1: Same file edited HARD_BLOCK_THRESHOLD+ times consecutively
+    # Check 1: Same file edited with the SAME content HARD_BLOCK_THRESHOLD+
+    # times consecutively. Narrowed in #1641: three DIFFERENT edits to one file
+    # is a normal incremental workflow (observed repeatedly on wiki/rule/doc
+    # files), not a stuck loop — only an IDENTICAL repeated edit blocks. Both
+    # the path AND the edit_hash must match.
     # (skip when current call is a read-only Bash command — repeated read-only
     # polling of the same target is not a stuck-loop signal; see #1625)
+    # Bash never reaches here — file_path is empty for Bash (#1641), and
+    # edit_hash is empty too; repeated Bash commands are handled by Check 3
+    # via target_key instead.
     if [ "$is_readonly" != "true" ] && [ -n "$file_path" ]; then
-      escaped_path=$(echo "$file_path" | sed 's/[.[\*^$()+?{|]/\\&/g')
-      consecutive_file=$(echo "$last_n" | grep -c "\"path\":\"${escaped_path}\"" 2>/dev/null || echo "0")
+      consecutive_file=$(printf '%s\n' "$last_n" \
+        | grep -F -e "$path_match" \
+        | grep -cF -e "\"edit_hash\":\"${edit_hash}\"" 2>/dev/null || true)
+      [ -n "$consecutive_file" ] || consecutive_file=0
       if [ "$consecutive_file" -ge "$HARD_BLOCK_THRESHOLD" ]; then
         hard_block=true
-        hard_block_reason="Same file ($(basename "$file_path")) edited ${consecutive_file} consecutive times"
+        hard_block_reason="Same file ($(basename -- "$file_path")) received the identical edit ${consecutive_file} consecutive times"
       fi
     fi
 
     # Check 2: Same error repeated HARD_BLOCK_THRESHOLD+ times consecutively
     if [ "$hard_block" = false ] && [ "$is_error" = "true" ] && [ -n "$error_hash" ]; then
-      consecutive_error=$(echo "$last_n" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || echo "0")
+      consecutive_error=$(printf '%s\n' "$last_n" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || printf '%s\n' "0")
       if [ "$consecutive_error" -ge "$HARD_BLOCK_THRESHOLD" ]; then
         hard_block=true
         hard_block_reason="Same error repeated ${consecutive_error} consecutive times"
       fi
     fi
 
-    # Check 3: Same tool+target combination HARD_BLOCK_THRESHOLD+ times consecutively
+    # Check 3: Same tool+target combination HARD_BLOCK_THRESHOLD+ times
+    # consecutively. Uses target_key (a file path for file tools, the command
+    # text for Bash) so repeated identical Bash commands are still blocked
+    # after file_path was emptied for Bash (#1641).
     # (skip when current call is a read-only Bash command — see Check 1 note)
-    if [ "$hard_block" = false ] && [ "$is_readonly" != "true" ] && [ -n "$file_path" ]; then
-      escaped_path=$(echo "$file_path" | sed 's/[.[\*^$()+?{|]/\\&/g')
-      consecutive_tool_target=$(echo "$last_n" | grep "\"tool\":\"${tool_name}\"" | grep -c "\"path\":\"${escaped_path}\"" 2>/dev/null || echo "0")
+    # The edit_hash filter mirrors Check 1's #1641 narrowing: without it this
+    # check re-creates the very false positive Check 1 was narrowed to remove
+    # (tool=Edit + same path fires at 3 regardless of content). For Bash the
+    # filter is a no-op — every Bash history entry carries edit_hash "".
+    if [ "$hard_block" = false ] && [ "$is_readonly" != "true" ] && [ -n "$target_key" ]; then
+      consecutive_tool_target=$(printf '%s\n' "$last_n" \
+        | grep -F -e "\"tool\":\"${tool_name}\"" \
+        | grep -F -e "$path_match" \
+        | grep -cF -e "\"edit_hash\":\"${edit_hash}\"" 2>/dev/null || true)
+      [ -n "$consecutive_tool_target" ] || consecutive_tool_target=0
       if [ "$consecutive_tool_target" -ge "$HARD_BLOCK_THRESHOLD" ]; then
         hard_block=true
-        hard_block_reason="${tool_name} called on $(basename "$file_path") ${consecutive_tool_target} consecutive times"
+        # Do NOT call basename() on a Bash target: a command is not a path, and
+        # basename() on command text produced the misleading "Same file (pr)"
+        # style message reported in #1641.
+        if [ "$tool_name" = "Bash" ]; then
+          hard_block_reason="Identical Bash command repeated ${consecutive_tool_target} times: $(printf '%s' "$target_key" | head -c 60)"
+        else
+          hard_block_reason="${tool_name} called on $(basename -- "$target_key") ${consecutive_tool_target} consecutive times"
+        fi
       fi
     fi
   fi

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -428,7 +428,17 @@ The Agent tool defaults to `mode: "acceptEdits"`, which overrides agent frontmat
 ### Self-Check
 
 Before spawning any agent:
-1. Does the Agent tool call include `mode: "bypassPermissions"`? → YES: proceed → NO: add it
+1. **유효 permission mode 확인** — per-call `mode` 파라미터는 v2.1.212+ 에서 무시되고,
+   **프로젝트 scope `permissions.defaultMode` 는 v2.1.257+ 에서도 무시된다(#1644)**.
+   무인 실행 전 실측할 것: `jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json`
+   (user scope) — 이 값 또는 `--permission-mode` 실행 플래그만이 유효하다.
+   bypassPermissions 가 아니면 프롬프트 발생을 전제로 계획한다.
+   하위 호환을 위해 per-call `mode: "bypassPermissions"` 는 계속 포함하되,
+   **그 존재를 무인 실행의 증거로 삼지 않는다**(R020 "attempt ≠ outcome").
+   실측(2026-09-03, `claude -p --debug-file`): `[WARN] settings defaultMode "bypassPermissions"
+   ignored — only policy/user/flag settings may grant bypass mode (projectSettings and
+   localSettings are repo-controllable)` — 무시 동작이 직접 실증되었다. 프로젝트 settings에는
+   `permissions._comment_defaultMode` 안내 키가 추가되었다(v1.1.59).
 2. Is this a new skill that spawns agents? → Add Permission Mode section
 
 ### Common Violation

package/templates/.claude/rules/MUST-permissions.md

@@ -133,3 +133,10 @@ Origin: #1582. Cross-ref: R018(Member TaskUpdate Discipline 대체 규약), R020
 > Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions" owns the full requirement, rationale, self-check, and version history. Core rule: always pass `mode: "bypassPermissions"` explicitly on every Agent tool call — the Agent tool's default `mode` (`acceptEdits`) overrides agent frontmatter `permissionMode` and causes prompts during unattended execution. Skills that spawn agents MUST include this in their Agent tool call instructions. See R010 for details.
 
 > **v2.1.212+**: CC가 Agent(구 Task) tool의 `mode` 파라미터를 deprecated 처리했습니다(이제 무시) — subagent는 부모 세션의 permission mode를 기본 상속합니다. 위 canonical 요약의 default `mode`(`acceptEdits`)가 frontmatter `permissionMode`를 override한다는 서술 및 항상 `mode: "bypassPermissions"`를 넘기라는 요건은 이 버전부터 stale이며(파라미터가 무시됨), 무인 실행의 실질 게이트는 부모 세션의 permission mode입니다. 요건 재조정은 R010 "Universal bypassPermissions"가 canonical — R002는 이 flag만 유지합니다.
+
+> **v2.1.257+**: 프로젝트 scope `permissions.defaultMode` 가 무시됩니다(user/managed scope 또는
+> `--permission-mode` 플래그만 유효). 위 v2.1.212 노트가 "무인 실행의 실질 게이트는 부모 세션의
+> permission mode"라고 정정했는데, **그 부모 세션 모드를 프로젝트 settings로 지정하는 경로가 이
+> 버전에서 끊겼습니다** — 이 파일 상단 「Deny Rule Glob Patterns」의 v2.1.214 노트(allow 규칙만
+> `<cwd>`로 좁아진 비대칭)와 같은 계열의 **project-scope 축소** 흐름입니다. Canonical owner 는
+> R010 "Universal bypassPermissions" — 상세와 실측 절차는 그쪽을 참조합니다. Origin: #1644.

package/templates/.claude/skills/fsd/SKILL.md

@@ -169,6 +169,22 @@ If any of those underlying skills evolve, FSD automatically benefits — its onl
 
 When this skill delegates work via Agent tool calls, ALL Agent tool calls MUST include `mode: "bypassPermissions"` per R010 Universal bypassPermissions.
 
+⚠ **그 파라미터는 CC v2.1.212+ 에서 무시되며, 프로젝트 scope `permissions.defaultMode` 역시
+CC v2.1.257+ 에서 무시된다(#1644).** 즉 위 지시를 지켰다는 사실은 **무인 실행의 증거가 아니다**.
+자율 루프 진입 전에 유효 모드를 실측한다:
+
+```bash
+jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo unset
+```
+
+`bypassPermissions` 가 아니면 루프 도중 permission 프롬프트로 정지할 수 있으므로,
+`--permission-mode bypassPermissions` 로 재시작하거나 사람이 지켜보는 실행임을 전제한다.
+(파이프라인 쪽 배선은 `pipeline auto-dev` 의 pre-triage Phase 0.5 가 담당한다.)
+
+⚠ **커밋 위임 타임아웃 (#1645)**: 메인 워크트리의 `.husky/pre-commit` 이 전체 테스트
+스위트(약 165초)를 돌리므로, `git commit` 을 위임할 때는 Bash `timeout: 400000` 을 명시한다.
+기본값 120000ms 로는 exit 143(SIGTERM)으로 끊긴다. `--no-verify` 우회는 금지(R010).
+
 ## Artifact Output
 
 Artifacts from each iteration follow the conventions of the constituent skills:

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -54,6 +54,30 @@ steps:
               "[pre-triage] WARNING: Issue #N references vX.Y.Z (not in git tags) — body may be stale"
             - Output all warnings as advisory log; do NOT halt
 
+      Phase 0.5 — Measure the EFFECTIVE permission mode (advisory, do NOT halt).
+
+      Why: CC v2.1.257 stopped honoring `permissions.defaultMode` declared in PROJECT scope
+      (`.claude/settings.json` / `.claude/settings.local.json`). Only user/managed scope or an
+      explicit `--permission-mode` flag takes effect. R010 「Universal bypassPermissions」 assumes
+      the parent session runs unattended under bypassPermissions; if that assumption is silently
+      false, this pipeline stalls on a permission prompt mid-run with no diagnostic (#1644).
+
+      1. Read the user-scope setting (project scope is NOT authoritative on v2.1.257+):
+         user_mode=$(jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo "unset")
+
+      2. The `--permission-mode` launch flag cannot be read from inside the session. Treat it as
+         UNKNOWN — never infer that it was passed.
+
+      3. Report and, when not bypassPermissions, warn:
+         - user_mode == "bypassPermissions":
+           report: "[pre-triage] effective permission mode: bypassPermissions (user scope)"
+         - otherwise:
+           stderr warning: "[pre-triage] WARNING: effective permission mode is <user_mode>; unattended run may prompt. Project-scope permissions.defaultMode is IGNORED on CC v2.1.257+ (#1644). To run unattended, launch with --permission-mode bypassPermissions or set it in user-scope ~/.claude/settings.json."
+         - Do NOT halt (advisory only — a prompted run still completes with a human present).
+
+      4. Do NOT read, echo, or modify any credential material while checking settings — read the
+         single `permissions.defaultMode` field only (R001).
+
       Phase 1 — Ensure required labels exist, then scan issues.
 
       1. Create labels if missing (idempotent):
@@ -297,6 +321,14 @@ steps:
          develop-bound commit auto-closes the issue on push — BEFORE release/tag/publish (observed v1.1.38,
          07:49:26Z). Close keywords belong ONLY in the release-stage PR body (see release step 3.b) — auto-tag.yml
          greps the PR body, not commit messages, to decide which issues to close.
+             ⚠ Bash timeout (#1645): the main-worktree `.husky/pre-commit` runs typecheck + lint +
+             the FULL `bun test --coverage` suite (~165s measured) before the commit lands. The Bash
+             tool's default timeout is 120000ms, so a `git commit` delegation with the default budget
+             is killed mid-hook with exit 143 (SIGTERM). Delegate `git commit` with an explicit
+             `timeout: 400000` (≈6.7 min). Do NOT work around a timeout with `--no-verify` — that
+             bypasses the quality gate and is on the standing deny list (R010).
+             Note: git worktrees run typecheck only (`.husky/pre-commit` lines 7-12 branch on
+             `[ -f .git ]` and exit 0), so the long budget matters most on the MAIN worktree.
       6. On success: remove in-progress, add verify-ready
       7. On failure: remove in-progress, add needs-review, comment error summary
 
@@ -425,6 +457,9 @@ steps:
               ⚠ do NOT add Closes/Fixes/Resolves keywords to this commit message (#1542) — this commit merges into
               develop later via the release PR; a close keyword here bypasses the PR-body mechanism auto-tag.yml
               relies on (see step 3.b below). Use `Refs #N` if a cross-reference is needed.
+               ⚠ Bash timeout (#1645): delegate this commit with an explicit `timeout: 400000` — the
+               main-worktree pre-commit hook runs the full test suite (~165s) and the Bash default of
+               120000ms kills it with exit 143. `--no-verify` is NOT an acceptable workaround (R010).
            h. mgr-gitnerd push release/v{NEW} to origin — NEVER push this commit to develop directly. Pushing to
               develop here reproduces the diff=0 PR failure this reordering fixes (#1542).
            i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}:

package/templates/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.1.58",
-  "lastUpdated": "2026-09-02T00:00:00.000Z",
+  "version": "1.1.59",
+  "lastUpdated": "2026-09-03",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",
   "components": [

package/templates/workflows/auto-dev.yaml

@@ -54,6 +54,30 @@ steps:
               "[pre-triage] WARNING: Issue #N references vX.Y.Z (not in git tags) — body may be stale"
             - Output all warnings as advisory log; do NOT halt
 
+      Phase 0.5 — Measure the EFFECTIVE permission mode (advisory, do NOT halt).
+
+      Why: CC v2.1.257 stopped honoring `permissions.defaultMode` declared in PROJECT scope
+      (`.claude/settings.json` / `.claude/settings.local.json`). Only user/managed scope or an
+      explicit `--permission-mode` flag takes effect. R010 「Universal bypassPermissions」 assumes
+      the parent session runs unattended under bypassPermissions; if that assumption is silently
+      false, this pipeline stalls on a permission prompt mid-run with no diagnostic (#1644).
+
+      1. Read the user-scope setting (project scope is NOT authoritative on v2.1.257+):
+         user_mode=$(jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo "unset")
+
+      2. The `--permission-mode` launch flag cannot be read from inside the session. Treat it as
+         UNKNOWN — never infer that it was passed.
+
+      3. Report and, when not bypassPermissions, warn:
+         - user_mode == "bypassPermissions":
+           report: "[pre-triage] effective permission mode: bypassPermissions (user scope)"
+         - otherwise:
+           stderr warning: "[pre-triage] WARNING: effective permission mode is <user_mode>; unattended run may prompt. Project-scope permissions.defaultMode is IGNORED on CC v2.1.257+ (#1644). To run unattended, launch with --permission-mode bypassPermissions or set it in user-scope ~/.claude/settings.json."
+         - Do NOT halt (advisory only — a prompted run still completes with a human present).
+
+      4. Do NOT read, echo, or modify any credential material while checking settings — read the
+         single `permissions.defaultMode` field only (R001).
+
       Phase 1 — Ensure required labels exist, then scan issues.
 
       1. Create labels if missing (idempotent):
@@ -297,6 +321,14 @@ steps:
          develop-bound commit auto-closes the issue on push — BEFORE release/tag/publish (observed v1.1.38,
          07:49:26Z). Close keywords belong ONLY in the release-stage PR body (see release step 3.b) — auto-tag.yml
          greps the PR body, not commit messages, to decide which issues to close.
+             ⚠ Bash timeout (#1645): the main-worktree `.husky/pre-commit` runs typecheck + lint +
+             the FULL `bun test --coverage` suite (~165s measured) before the commit lands. The Bash
+             tool's default timeout is 120000ms, so a `git commit` delegation with the default budget
+             is killed mid-hook with exit 143 (SIGTERM). Delegate `git commit` with an explicit
+             `timeout: 400000` (≈6.7 min). Do NOT work around a timeout with `--no-verify` — that
+             bypasses the quality gate and is on the standing deny list (R010).
+             Note: git worktrees run typecheck only (`.husky/pre-commit` lines 7-12 branch on
+             `[ -f .git ]` and exit 0), so the long budget matters most on the MAIN worktree.
       6. On success: remove in-progress, add verify-ready
       7. On failure: remove in-progress, add needs-review, comment error summary
 
@@ -425,6 +457,9 @@ steps:
               ⚠ do NOT add Closes/Fixes/Resolves keywords to this commit message (#1542) — this commit merges into
               develop later via the release PR; a close keyword here bypasses the PR-body mechanism auto-tag.yml
               relies on (see step 3.b below). Use `Refs #N` if a cross-reference is needed.
+               ⚠ Bash timeout (#1645): delegate this commit with an explicit `timeout: 400000` — the
+               main-worktree pre-commit hook runs the full test suite (~165s) and the Bash default of
+               120000ms kills it with exit 143. `--no-verify` is NOT an acceptable workaround (R010).
            h. mgr-gitnerd push release/v{NEW} to origin — NEVER push this commit to develop directly. Pushing to
               develop here reproduces the diff=0 PR failure this reordering fixes (#1542).
            i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}: