oh-my-customcode 1.1.58 → 1.1.60

package/dist/cli/index.js

@@ -243,7 +243,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.58",
+    version: "1.1.60",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2539,7 +2539,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.58",
+  version: "1.1.60",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.58",
+  "version": "1.1.60",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/agents/mgr-gitnerd.md

@@ -50,6 +50,27 @@ Types: feat, fix, docs, style, refactor, test, chore
 - ALWAYS check `git reflog` before declaring work lost — most destructive ops are recoverable for 30 days
 - Reference: R001 Destructive Git Commands section, #1146 (v0.136.0 working tree loss incident)
 
+## Commit Timeout Budget (#1645)
+
+`.husky/pre-commit` 는 **메인 워크트리**에서 typecheck + `bun run lint` + `bun test --coverage`
+전체 스위트(실측 약 **165초**) + 커버리지 임계값 + CLAUDE.md 카운트 검증까지 순차 실행한다.
+Bash 도구 기본 타임아웃은 **120000ms(2분)** 이라 `git commit` 이 훅 실행 도중
+**exit 143(SIGTERM)** 으로 끊긴다.
+
+| 상황 | Bash `timeout` |
+|---|---|
+| 메인 워크트리에서 `git commit` | **≥ 400000** (약 6.7분) |
+| git worktree 에서 `git commit` | 기본값으로 충분 (`.husky/pre-commit` **7-12행**이 `[ -f .git ]` 로 분기해 `bun run typecheck` 만 실행하고 `exit 0` — 전체 스위트는 CI 담당) |
+| `git push` / `gh pr` 등 훅 없는 명령 | 기본값 |
+
+**금지**: 타임아웃 회피 목적의 `--no-verify` 사용. 품질 게이트 우회는 상시 금지이며
+오케스트레이터의 사전 승인이 있을 때만 예외다(R010 「품질 게이트 우회 금지」).
+훅이 차단하면 우회하지 말고 **차단 사실과 원인을 보고하고 대기**한다.
+
+**타임아웃으로 끊긴 경우**: exit 143 은 "커밋 실패"의 증거가 아니다 — 훅이 통과한 뒤
+커밋이 성사됐을 수도 있다. 재시도 전 `git log -1 --format=%H%n%s` 로 **실제 HEAD 를 실측**하라
+(R020 「Failure/Interrupt Report ≠ Actual Failure」).
+
 ## Push Rules (R016)
 
 All pushes require prior mgr-sauron:watch verification. If sauron was not run, REFUSE the push.

package/templates/.claude/hooks/scripts/r007-r008-drift-advisor.sh

@@ -304,8 +304,33 @@ if [ -n "$turn_uuid" ] && [ -f "$MARKER_FILE" ]; then
   fi
 fi
 
-advisory_text=$(printf '[R007/R008 Advisory] 직전 응답에서 식별 누락 감지 (R007 헤더=%s, R008 접두사=%s). 이번 응답은 ┌─ Agent: 헤더로 시작하고, 모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오.' \
-  "$r007_violations" "$r008_violations")
+# ── 위반 문구 조립 (#1643 — 판정 로직 불변, 레이블 의미를 문구 자체가 드러내도록 정정) ──
+# 이전 문구 "R007 헤더=%s, R008 접두사=%s"의 %s는 위반 "건수"(0=컴플라이언트)였는데, 레이블
+# "헤더"/"접두사"가 "개수"로 오독되어 "R007 헤더=0"이 "헤더가 없다"로 잘못 읽혔다(#1643 진단
+# 확정 — 실제로는 헤더가 정상 존재하는 컴플라이언트 상태였다). 값이 위반 건수라는 것을 문구
+# 자체가 드러내도록 "누락 N건"으로 표현하고, 위반이 없는 차원은 문구에서 아예 제외한다 — 0건인
+# 차원을 언급하면 그 차원도 위반처럼 오독될 수 있기 때문이다.
+violation_desc=""
+instruction=""
+if [ "$r007_violations" -gt 0 ]; then
+  violation_desc="R007 에이전트 식별 헤더 누락 ${r007_violations}건"
+  instruction="이번 응답은 ┌─ Agent: 헤더로 시작하십시오."
+fi
+if [ "$r008_violations" -gt 0 ]; then
+  if [ -n "$violation_desc" ]; then
+    violation_desc="${violation_desc}, R008 도구 식별 접두사 누락 ${r008_violations}건"
+    instruction="이번 응답은 ┌─ Agent: 헤더로 시작하고, 모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오."
+  else
+    violation_desc="R008 도구 식별 접두사 누락 ${r008_violations}건"
+    instruction="모든 도구 호출에 [agent][model] → Tool: 접두사를 포함하십시오."
+  fi
+fi
+
+if [ -n "$violation_desc" ]; then
+  advisory_text="[R007/R008 Advisory] 직전 응답에서 ${violation_desc} 감지. ${instruction}"
+else
+  advisory_text="[R007/R008 Advisory]"
+fi
 
 if [ "$r008_reverse" -gt 0 ]; then
   advisory_text="${advisory_text} [R009 Self-Check #6] 직전 턴은 도구 호출 ${r008_reverse}건을 예고하고도 tool_use 블록 없이 종료했습니다 — 예고한 호출을 지금 실행하거나, 실행하지 않기로 한 사유를 명시하십시오."

package/templates/.claude/hooks/scripts/session-autofix.sh

@@ -96,18 +96,66 @@ if [ -d "wiki" ]; then
 fi
 
 # ─── Check 6: Broken skill references (lightweight) ───
+# Parses BOTH frontmatter forms (#1640):
+#   inline : skills: [a, b]
+#   block  : skills:
+#              - a
+#              - b
+# Emits one skill name per line. Scans the YAML frontmatter only (stops at the
+# closing "---"), so a "skills:" line in the agent body is never parsed.
+parse_agent_skills() {
+  awk '
+    BEGIN {
+      SQ = sprintf("%c", 39); DQ = sprintf("%c", 34)
+      infm = 0; inskills = 0
+    }
+    function clean(s) {
+      sub(/[[:space:]]*#.*$/, "", s)
+      gsub(SQ, "", s); gsub(DQ, "", s)
+      gsub(/[[:space:]]/, "", s)
+      return s
+    }
+    NR == 1 { if ($0 ~ /^---[[:space:]]*$/) infm = 1; next }
+    infm == 0 { exit }
+    /^---[[:space:]]*$/ { exit }
+    inskills == 1 {
+      if ($0 ~ /^[[:space:]]+-[[:space:]]*/) {
+        item = $0
+        sub(/^[[:space:]]+-[[:space:]]*/, "", item)
+        item = clean(item)
+        if (item != "") print item
+        next
+      }
+      if ($0 ~ /^[[:space:]]*$/) next
+      inskills = 0
+    }
+    /^skills:/ {
+      rest = $0
+      sub(/^skills:[[:space:]]*/, "", rest)
+      sub(/[[:space:]]*#.*$/, "", rest)
+      if (rest ~ /^\[/) {
+        sub(/^\[/, "", rest); sub(/\][[:space:]]*$/, "", rest)
+        n = split(rest, arr, ",")
+        for (i = 1; i <= n; i++) {
+          s = clean(arr[i])
+          if (s != "") print s
+        }
+      } else if (rest == "") {
+        inskills = 1
+      }
+      next
+    }
+  ' "$1"
+}
+
 broken_refs=0
 for agent in .claude/agents/*.md; do
-  skills_line=$(grep -E '^skills:' "$agent" 2>/dev/null | head -1)
-  if [ -n "$skills_line" ]; then
-    skills=$(echo "$skills_line" | sed 's/skills: *\[//;s/\]//;s/,/ /g;s/"//g' | tr -d "'")
-    for skill in $skills; do
-      skill=$(echo "$skill" | tr -d ' ')
-      if [ -n "$skill" ] && [ ! -f ".claude/skills/${skill}/SKILL.md" ]; then
-        broken_refs=$((broken_refs + 1))
-      fi
-    done
-  fi
+  [ -f "$agent" ] || continue
+  while IFS= read -r skill; do
+    if [ -n "$skill" ] && [ ! -f ".claude/skills/${skill}/SKILL.md" ]; then
+      broken_refs=$((broken_refs + 1))
+    fi
+  done <<< "$(parse_agent_skills "$agent")"
 done
 if [ "$broken_refs" -gt 0 ]; then
   add_issue "broken-refs:${broken_refs} broken skill reference(s) in agent frontmatter"

package/templates/.claude/hooks/scripts/stuck-detector.sh

@@ -38,20 +38,96 @@ is_readonly_single_command() {
     return 0
   fi
 
+  # A NEWLINE is a statement separator, so this function — which classifies a
+  # SINGLE statement — must never see one: "read -ra" below stops at the first
+  # newline, so "git status\nrm -rf build" used to be judged on "git status"
+  # alone and came back read-only (#1647 M-5). Callers split on newlines
+  # (Step 6); anything still multi-line here is ambiguous => write.
+  case "$cmd" in
+    *$'\n'*)
+      echo "false"
+      return 0
+      ;;
+  esac
+
   local parts=()
   read -ra parts <<< "$cmd"
   local w1="${parts[0]:-}"
   local w2="${parts[1]:-}"
   local w3="${parts[2]:-}"
 
+  # Variable assignment prefix: "VAR=value" or "VAR=value cmd args".
+  # A bare assignment has no side effect outside the shell; when followed by a
+  # command, classify that command instead. Command substitutions inside the
+  # RHS were already validated and replaced by is_readonly_bash_command (#1641).
+  #
+  # EXCEPTION (#1647 L-1): a few variables change WHICH program runs, or how it
+  # is loaded, so the trailing command's NAME no longer describes what the
+  # command does — "LD_PRELOAD=./evil.so ls" is not "ls", and "PATH=/tmp ls"
+  # runs an arbitrary /tmp/ls. Assignments to those names are writes whether or
+  # not a command follows them; an ordinary "FOO=1 ls" still defers to "ls".
+  #
+  # The git entry is the GLOB "GIT_*", not the three names GIT_DIR /
+  # GIT_WORK_TREE / GIT_INDEX_FILE it replaced: git has many more variables
+  # that run an arbitrary program (GIT_EXTERNAL_DIFF, GIT_PAGER, GIT_EDITOR,
+  # GIT_SSH, GIT_*_COMMAND, ...) or relocate the repository, and enumerating
+  # them one at a time keeps losing that race. GLOBIGNORE (changes which files
+  # a glob expands to) and BASH_XTRACEFD (sends trace output to an arbitrary
+  # descriptor, i.e. a file) are writes for the same reason.
+  case "$w1" in
+    [A-Za-z_]*=*)
+      case "${w1%%=*}" in
+        PATH|LD_*|DYLD_*|BASH_ENV|ENV|IFS|PROMPT_COMMAND|SHELLOPTS|BASHOPTS|GLOBIGNORE|BASH_XTRACEFD|GIT_*)
+          echo "false"
+          return 0
+          ;;
+      esac
+      if [ "${#parts[@]}" -le 1 ]; then
+        echo "true"
+        return 0
+      fi
+      local rest_cmd="${cmd#*"$w1"}"
+      rest_cmd="$(printf '%s' "$rest_cmd" | sed -e 's/^[[:space:]]*//')"
+      is_readonly_single_command "$rest_cmd"
+      return 0
+      ;;
+  esac
+
   case "$w1" in
-    ls|cat|head|tail|grep|rg|wc|jq|md5|md5sum|type|command|which|echo|printf|pwd|date)
+    ls|cat|head|tail|grep|rg|wc|jq|md5|md5sum|type|which|echo|printf|pwd|date)
       echo "true"
       return 0
       ;;
+    command)
+      # "command" used to sit in the whitelist above, which made
+      # "command rm -rf x" read-only (#1647 L-5) — it is a PREFIX around an
+      # arbitrary program, not a program. Only the lookup forms ("command -v",
+      # "command -V") are read-only. "builtin" and "exec" are deliberately
+      # absent from the whitelist for the same reason: they fall through to the
+      # "*)" write default below.
+      case "$w2" in
+        -v|-V)
+          echo "true"
+          ;;
+        *)
+          echo "false"
+          ;;
+      esac
+      return 0
+      ;;
     find)
+      # Writing actions (#1647 L-5): -delete/-exec/-execdir remove or run
+      # things, -ok/-okdir are the interactive forms of -exec, and
+      # -fprint/-fprint0/-fprintf/-fls all CREATE a file. Each pattern is
+      # wrapped in "*" on BOTH sides, so it matches the fragment ANYWHERE in
+      # the command, not just as an option prefix: that is how the "dir"/"0"/
+      # "f" variants ("-execdir", "-fprint0", "-okdir") are covered by a single
+      # entry, and it also means an operand that merely CONTAINS the fragment
+      # (e.g. "find . -name '*-exec*'") is classified as a write. That
+      # over-match is the safe direction — a write verdict only ever tightens
+      # blocking.
       case "$cmd" in
-        *-delete*|*-exec*|*-fprintf*)
+        *-delete*|*-exec*|*-fprint*|*-fls*|*-ok*)
           echo "false"
           ;;
         *)
@@ -77,7 +153,7 @@ is_readonly_single_command() {
               *) ok="false" ;;
             esac
           done
-          echo "$ok"
+          printf '%s\n' "$ok"
           ;;
         *)
           # fetch and all other subcommands (checkout/merge/rebase/push/...) => write
@@ -116,30 +192,261 @@ is_readonly_single_command() {
   esac
 }
 
+# Remove heredoc BODIES ("<<DELIM", "<<-'DELIM'") from a command, keeping the
+# header line. A heredoc body is DATA, not statements: without this, the
+# newline splitting in Step 6 (#1647 M-5) would classify every data line as a
+# command and turn "cat <<'EOF' ... EOF" — read-only before #1647 — into a
+# write. Herestrings ("<<<") are single-line and are NOT heredocs. An
+# UNTERMINATED heredoc is unparseable, so a sentinel word is emitted instead
+# and the caller classifies the command as a write. The same sentinel route is
+# taken when the "<<" turns out to sit INSIDE a quoted string (see below).
+_strip_heredoc_bodies() {
+  local text="$1"
+  local out="" line tok delim="" in_body=0
+  local before_op dq sq
+  while IFS= read -r line; do
+    if [ "$in_body" -eq 1 ]; then
+      # "<<-" allows leading tabs before the terminator; accept leading
+      # whitespace for either form.
+      tok="$(printf '%s' "$line" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+      if [ "$tok" = "$delim" ]; then
+        in_body=0
+      fi
+      continue
+    fi
+    out="${out}${line}"$'\n'
+    # A DELIMITER FORGERY guard: the extraction below has no idea whether the
+    # "<<" it finds is shell syntax or literal text inside a quoted string, so
+    # `echo "a << EOF"` followed by `rm -rf x` and a line reading `EOF` used to
+    # hand the rm to the heredoc BODY — where it was dropped as data — and the
+    # command came back read-only. Quote state is not tracked here, so rather
+    # than guess, count the quotes preceding the "<<": an ODD number of " or '
+    # means the "<<" is quoted, the command is unparseable by this function,
+    # and the sentinel makes the CALLER classify the whole multi-line command
+    # as a write. "${line%<<*}" strips the shortest matching suffix, i.e. it
+    # yields the text before the LAST "<<" — the same occurrence the greedy
+    # extraction regex below settles on.
+    if [ "$line" != "${line%<<*}" ]; then
+      before_op="${line%<<*}"
+      dq="$(printf '%s' "$before_op" | tr -cd '"' | wc -c | tr -d '[:space:]')"
+      sq="$(printf '%s' "$before_op" | tr -cd "'" | wc -c | tr -d '[:space:]')"
+      if [ $((dq % 2)) -eq 1 ] || [ $((sq % 2)) -eq 1 ]; then
+        printf '%s' "${out}__QUOTED_HEREDOC_OPENER__"$'\n'
+        return 0
+      fi
+    fi
+    delim="$(printf '%s' "$line" \
+      | sed -n -E "s/^.*[^<]<<-?[[:space:]]*[\"']?([A-Za-z_][A-Za-z0-9_]*)[\"']?.*\$/\\1/p")"
+    if [ -n "$delim" ]; then
+      in_body=1
+    fi
+  done <<< "$text"
+  if [ "$in_body" -eq 1 ]; then
+    out="${out}__UNTERMINATED_HEREDOC__"$'\n'
+  fi
+  printf '%s' "$out"
+}
+
+# Maximum recursion depth for nested command substitution / loop bodies.
+_RO_MAX_DEPTH=5
+# Maximum command length that is parsed at all (see Step 0 below).
+_RO_MAX_COMMAND_LEN=4000
+
 is_readonly_bash_command() {
   local cmd="$1"
+  local depth="${2:-0}"
+
+  if [ "$depth" -gt "$_RO_MAX_DEPTH" ]; then
+    echo "false"
+    return 0
+  fi
+
+  # --- Step 0: length cap (M-4). The "$(...)" balance scan below walks the
+  # remainder of the command ONE CHARACTER AT A TIME and rebuilds "$inner" on
+  # every iteration, which is O(n^2) in the substitution's length (measured:
+  # 5 KB => 0.9 s, 20 KB => 13.6 s of latency on a PostToolUse hook).
+  # "$raw_command" is the only unbounded field left after the cap on
+  # target_key, so cap it here. Nothing legitimately read-only is 4 KB long;
+  # anything over the cap is classified as a write, i.e. the conservative side
+  # (a read-only classification only ever RELAXES blocking).
+  if [ "${#cmd}" -gt "$_RO_MAX_COMMAND_LEN" ]; then
+    echo "false"
+    return 0
+  fi
+
   cmd="$(printf '%s' "$cmd" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
   if [ -z "$cmd" ]; then
     echo "false"
     return 0
   fi
 
-  # Truly ambiguous constructs: redirection, command/process substitution, or
-  # "||" (conditional-OR — intentionally NOT decomposed into segments, since
-  # its branch that actually runs depends on the first segment's exit code)
-  # => always treated as write.
+  # --- Step 1: process substitution "<(...)" stays ambiguous => write. ---
   case "$cmd" in
-    *'>'*|*'||'*|*'$('*|*'`'*|*'<('*)
+    *'<('*)
       echo "false"
       return 0
       ;;
   esac
 
-  # Compound command: split on "&&", ";", or a single "|" into segments and
-  # require EVERY segment to be read-only (#1629). An empty segment (e.g. a
-  # trailing separator) is treated as ambiguous => write, same as any
-  # segment that fails single-command classification.
-  if [[ "$cmd" == *'&&'* || "$cmd" == *';'* || "$cmd" == *'|'* ]]; then
+  # --- Step 2: command substitution "$(...)" / backticks.
+  # Rather than treating them as an automatic write (#1641), extract the inner
+  # command, classify it RECURSIVELY, and replace the substitution with the
+  # inert placeholder "SUBST". A write inside the substitution (e.g.
+  # "$(rm -rf /tmp/x)", "$(git push)") still makes the whole command a write.
+  while :; do
+    case "$cmd" in
+      *'$('*)
+        local before="${cmd%%'$('*}"
+        local after="${cmd#*'$('}"
+        # Balance-aware scan for the matching ")".
+        local inner="" rest="" d=1 i ch
+        for ((i = 0; i < ${#after}; i++)); do
+          ch="${after:$i:1}"
+          if [ "$ch" = "(" ]; then
+            d=$((d + 1))
+          elif [ "$ch" = ")" ]; then
+            d=$((d - 1))
+            if [ "$d" -eq 0 ]; then
+              rest="${after:$((i + 1))}"
+              break
+            fi
+          fi
+          inner="${inner}${ch}"
+        done
+        if [ "$d" -ne 0 ]; then
+          # Unbalanced => unparseable => conservative write.
+          echo "false"
+          return 0
+        fi
+        if [ "$(is_readonly_bash_command "$inner" $((depth + 1)))" != "true" ]; then
+          echo "false"
+          return 0
+        fi
+        cmd="${before}SUBST${rest}"
+        ;;
+      *'`'*)
+        # Backticks do not nest; take the text between the first pair.
+        local b_before="${cmd%%'`'*}"
+        local b_after="${cmd#*'`'}"
+        case "$b_after" in
+          *'`'*) ;;
+          *) echo "false"; return 0 ;;
+        esac
+        local b_inner="${b_after%%'`'*}"
+        local b_rest="${b_after#*'`'}"
+        if [ "$(is_readonly_bash_command "$b_inner" $((depth + 1)))" != "true" ]; then
+          echo "false"
+          return 0
+        fi
+        cmd="${b_before}SUBST${b_rest}"
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
+
+  # --- Step 3: strip harmless redirections BEFORE the ">" write check.
+  # "2>&1", ">/dev/null", "2>/dev/null", "1>/dev/null", "&>/dev/null" produce no
+  # observable side effect. Any OTHER ">" (a real file write) remains a write.
+  # ">&N" is stripped ONLY for N in {1,2} (stdout/stderr). An arbitrary
+  # descriptor writes wherever that fd was opened, so "cat x >&3" stays a write
+  # (#1647 L-2). The trailing "[^0-9]" / "$" guard stops ">&10" from being read
+  # as ">&1" plus a stray "0"; the two expressions differ only in whether the
+  # redirection is followed by another character or ends the command.
+  local stripped
+  stripped="$(printf '%s' "$cmd" \
+    | sed -E 's/[0-9]?>&[12]([^0-9])/ \1/g; s/[0-9]?>&[12]$/ /; s#[0-9]?&?>[[:space:]]*/dev/null# #g')"
+  case "$stripped" in
+    *'>'*)
+      echo "false"
+      return 0
+      ;;
+  esac
+  cmd="$stripped"
+
+  # --- Step 4: "||" is still NOT decomposed (which branch runs depends on the
+  # first segment's exit code) => write. Preserved from #1629.
+  case "$cmd" in
+    *'||'*)
+      echo "false"
+      return 0
+      ;;
+  esac
+
+  # --- Step 5: for / while loops (#1641).
+  # Normalize ";do" / ";done" spacing, then classify the header and the
+  # "do ... done" body separately. Both must be read-only.
+  case "$cmd" in
+    for\ *|while\ *)
+      local norm
+      norm="$(printf '%s' "$cmd" | sed -E 's/;[[:space:]]*do([[:space:]]|$)/ ; do /g; s/;[[:space:]]*done/ ; done/g')"
+      case "$norm" in
+        *' do '*'done'*) ;;
+        *) echo "false"; return 0 ;;
+      esac
+      local head="${norm%% do *}"
+      local tail_part="${norm#* do }"
+      local body="${tail_part%done*}"
+      head="$(printf '%s' "$head" | sed -e 's/[[:space:]]*;[[:space:]]*$//')"
+      body="$(printf '%s' "$body" | sed -e 's/[[:space:]]*;[[:space:]]*$//')"
+
+      case "$head" in
+        # "for VAR in <words>" — pure iteration, no side effect. The <words>
+        # already had any substitution validated in Step 2.
+        for\ [A-Za-z_]*\ in\ *)
+          ;;
+        while\ *)
+          # The while CONDITION is a real command — classify it.
+          local wcond="${head#while }"
+          if [ "$(is_readonly_bash_command "$wcond" $((depth + 1)))" != "true" ]; then
+            echo "false"
+            return 0
+          fi
+          ;;
+        *)
+          echo "false"
+          return 0
+          ;;
+      esac
+
+      is_readonly_bash_command "$body" $((depth + 1))
+      return 0
+      ;;
+  esac
+
+  # --- Step 6: compound command — split on "&&", ";", a single "|", or a
+  # NEWLINE and require EVERY segment to be read-only (#1629, #1647 M-5).
+  # A newline separates statements exactly like ";"; before #1647 it was not a
+  # separator at all, so a multi-line command fell through to
+  # is_readonly_single_command, whose "read -ra" only ever saw the FIRST line
+  # ("git status\nrm -rf build" => read-only).
+  #
+  # Order matters: the ">" (Step 3) and "||" (Step 4) checks above still ran
+  # against the FULL text including any heredoc body, so those verdicts are
+  # unchanged. Heredoc bodies are dropped only here, right before the split.
+  # CR / CRLF are newlines too.
+  cmd="${cmd//$'\r\n'/$'\n'}"
+  cmd="${cmd//$'\r'/$'\n'}"
+  if [[ "$cmd" == *$'\n'* ]]; then
+    # A heredoc body needs a following line, so only a MULTI-LINE command can
+    # have one — checking "<<" on a single-line command would misread a literal
+    # "<<" (e.g. `echo "a << b"`) as an opener.
+    case "$cmd" in
+      *'<<'*)
+        cmd="$(_strip_heredoc_bodies "$cmd")"
+        ;;
+    esac
+    # A BLANK line is not a statement, so drop blank lines before splitting;
+    # otherwise they would look like an empty — i.e. ambiguous — segment. A
+    # genuinely empty segment from a trailing ";" or "&&" still means write.
+    cmd="$(printf '%s' "$cmd" | sed -e '/^[[:space:]]*$/d')"
+    if [ -z "$cmd" ]; then
+      echo "false"
+      return 0
+    fi
+  fi
+  if [[ "$cmd" == *'&&'* || "$cmd" == *';'* || "$cmd" == *'|'* || "$cmd" == *$'\n'* ]]; then
     local normalized="$cmd"
     normalized="${normalized//&&/$'\n'}"
     normalized="${normalized//;/$'\n'}"
@@ -167,15 +474,81 @@ input=$(cat)
 
 # Extract tool info
 tool_name=$(printf '%s' "$input" | jq -r '.tool_name // "unknown"')
-# 300 (not 120): a 120-char cutoff let two genuinely different long Bash
-# commands collide on their shared 120-char prefix, causing a false-positive
-# same-path/same-tool+target hard-block. 300 chars covers the vast majority
-# of real commands without their differing tail being cut off (#1629).
-file_path=$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 300)
+# Bash commands are NOT files. Feeding tool_input.command into file_path made
+# the hard-block message report a command fragment as a "file" and let Check 1
+# ("Same file ... edited") fire on Bash at all (#1641). Keep the command text in
+# a SEPARATE field (target_key) so tool+target repetition detection (Check 3 /
+# Signal 3) still works, while the file-oriented checks see nothing for Bash.
+#
+# 1000 (was 300, originally 120): a short cutoff let two genuinely different
+# long Bash commands collide on their shared prefix, causing a false-positive
+# same-path/same-tool+target hard-block (#1629). Truncation alone can never
+# remove that collision class, so truncate_key() ALSO appends the ORIGINAL
+# length: two values that share the capped prefix but differ in total length
+# no longer produce the same key (M-3).
+TARGET_KEY_CAP=1000
+
+truncate_key() {
+  local v="$1"
+  if [ "${#v}" -gt "$TARGET_KEY_CAP" ]; then
+    printf '%s' "${v:0:$TARGET_KEY_CAP}#len=${#v}"
+  else
+    printf '%s' "$v"
+  fi
+}
+
+if [ "$tool_name" = "Bash" ]; then
+  file_path=""
+  # ".tool_input.file_path" is a defensive fallback only: the real Bash tool has
+  # no file_path parameter, but a caller (or a test fixture) may still supply one
+  # as the target identifier. The command text wins whenever it is present.
+  target_key=$(truncate_key "$(printf '%s' "$input" | jq -r '.tool_input.command // .tool_input.file_path // ""')")
+else
+  file_path_full=$(printf '%s' "$input" | jq -r '.tool_input.file_path // ""')
+  # file_path is display/guard only (basename in the messages); target_key is
+  # the value matched against history, so only it carries the length tag.
+  # "|| true": same broken-pipe class as output_preview below (#1647 M-6) —
+  # an over-cap file_path would make head close the pipe and take the hook
+  # down through pipefail. The captured bytes are unaffected.
+  file_path=$(printf '%s' "$file_path_full" | head -c "$TARGET_KEY_CAP" || true)
+  target_key=$(truncate_key "$file_path_full")
+fi
 is_error=$(printf '%s' "$input" | jq -r '.tool_output.is_error // false')
-output_preview=$(printf '%s' "$input" | jq -r '.tool_output.output // ""' | head -c 200)
+# "head -c 200" closes the pipe after 200 bytes. Once tool_output.output is
+# larger than the pipe buffer (~64 KB), jq keeps writing, dies of SIGPIPE
+# (exit 141), and "set -o pipefail" + "set -e" aborted the ENTIRE hook before
+# the history entry was ever appended — a 300 KB tool output silently erased
+# the record it was supposed to create (#1647 M-6). Two independent guards:
+# (a) slice inside jq so nothing large is piped at all, and (b) "|| true" so a
+# broken pipe can never again take the hook down. The byte cap is still
+# enforced by head (jq slices by codepoint, head by byte, and 200 codepoints
+# are always >= 200 bytes, so the resulting bytes are unchanged).
+output_preview=$(printf '%s' "$input" \
+  | jq -r '(.tool_output.output // "" | tostring)[0:200]' \
+  | head -c 200 || true)
 raw_command=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
 
+# Distinguish "the same file edited 3 times with DIFFERENT content" (a normal
+# incremental-edit workflow — the #1641 false positive) from "the same edit
+# repeated 3 times" (a genuine stuck loop). Only the latter should hard-block.
+# Alphanumerics-only + length cap: deterministic, platform-independent (no
+# md5sum, absent on macOS) and safe to embed in a grep pattern.
+edit_hash=""
+if [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; then
+  edit_hash=$(printf '%s' "$input" \
+    | jq -r '(.tool_input.old_string // .tool_input.content // .tool_input.new_string // "")
+             | gsub("[^A-Za-z0-9]"; "") | .[0:120]')
+fi
+
+# History entries are written by jq, so their "path" values are JSON-ENCODED.
+# Matching them requires the SAME encoding, not the raw text: a raw value
+# containing a quote (common in Bash commands) can never match the encoded
+# form. The previous BRE escaping was doubly broken — in POSIX BRE "( ) + ? { |"
+# are literals, so escaping them turned them INTO operators and silently
+# stopped matching. Encode once here and match with grep -F (fixed string).
+target_key_json=$(jq -n --arg v "$target_key" '$v')
+path_match="\"path\":${target_key_json}"
+
 is_readonly="false"
 if [ "$tool_name" = "Bash" ]; then
   is_readonly=$(is_readonly_bash_command "$raw_command")
@@ -190,18 +563,22 @@ timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 # Generate error hash for deduplication (first 50 chars of error)
 error_hash=""
 if [ "$is_error" = "true" ]; then
-  error_hash=$(echo "$output_preview" | head -c 50 | md5sum 2>/dev/null | cut -d' ' -f1 || echo "unknown")
+  error_hash=$(printf '%s' "$output_preview" | head -c 50 | md5sum 2>/dev/null | cut -d' ' -f1 || printf '%s\n' "unknown")
 fi
 
+# "path" holds $target_key — a file path for file tools, the command text for
+# Bash (#1641). Keeping Bash commands in this field preserves Check 3 / Signal 3
+# repetition detection while file_path stays empty for Bash.
 entry=$(jq -cn \
   --arg ts "$timestamp" \
   --arg tool "$tool_name" \
-  --arg path "$file_path" \
+  --arg path "$target_key" \
   --arg err "$is_error" \
   --arg hash "$error_hash" \
+  --arg ehash "$edit_hash" \
   --arg preview "$output_preview" \
   --arg readonly "$is_readonly" \
-  '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, preview: $preview, readonly: $readonly}')
+  '{timestamp: $ts, tool: $tool, path: $path, is_error: $err, error_hash: $hash, edit_hash: $ehash, preview: $preview, readonly: $readonly}')
 
 printf '%s\n' "$entry" >> "$HISTORY_FILE"
 
@@ -237,7 +614,7 @@ recovery=""
 
 # Signal 1: Repeated error (same error_hash 3+ times in last 10 entries)
 if [ "$is_error" = "true" ] && [ -n "$error_hash" ]; then
-  error_repeat=$(tail -10 "$HISTORY_FILE" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || echo "0")
+  error_repeat=$(tail -10 "$HISTORY_FILE" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || printf '%s\n' "0")
   if [ "$error_repeat" -ge 3 ]; then
     stuck_detected=true
     signal_type="Repeated error"
@@ -251,12 +628,12 @@ fi
 # Signal 2: Edit loop (same file edited 3+ times in last 8 entries)
 if [ "$stuck_detected" = false ] && { [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; }; then
   if [ -n "$file_path" ]; then
-    escaped_path=$(echo "$file_path" | sed 's/[.[\*^$()+?{|]/\\&/g')
-    edit_repeat=$(tail -8 "$HISTORY_FILE" | grep -c "\"path\":\"${escaped_path}\"" 2>/dev/null || echo "0")
+    edit_repeat=$(tail -8 "$HISTORY_FILE" | grep -cF -e "$path_match" 2>/dev/null || true)
+    [ -n "$edit_repeat" ] || edit_repeat=0
     if [ "$edit_repeat" -ge 3 ]; then
       stuck_detected=true
       signal_type="Edit loop"
-      pattern_desc="$(basename "$file_path") edited ${edit_repeat} times in last 8 calls"
+      pattern_desc="$(basename -- "$file_path") edited ${edit_repeat} times in last 8 calls"
       occurrence_count=$edit_repeat
       threshold=3
       recovery="Try a different file or approach instead of re-editing"
@@ -271,7 +648,7 @@ fi
 # calls (git status / gh view / ls / ...) doesn't inflate the "same tool
 # called N times" advisory.
 if [ "$stuck_detected" = false ] && [ "$is_readonly" != "true" ]; then
-  tool_repeat=$(tail -8 "$HISTORY_FILE" | grep -v "\"readonly\":\"true\"" | grep -c "\"tool\":\"${tool_name}\"" 2>/dev/null || echo "0")
+  tool_repeat=$(tail -8 "$HISTORY_FILE" | grep -v "\"readonly\":\"true\"" | grep -c "\"tool\":\"${tool_name}\"" 2>/dev/null || printf '%s\n' "0")
   if [ "$tool_repeat" -ge 5 ]; then
     stuck_detected=true
     signal_type="Tool loop"
@@ -302,38 +679,64 @@ hard_block_reason=""
 
 if [ -f "$HISTORY_FILE" ]; then
   last_n=$(tail -"$HARD_BLOCK_THRESHOLD" "$HISTORY_FILE" 2>/dev/null)
-  last_n_count=$(echo "$last_n" | wc -l | tr -d ' ')
+  last_n_count=$(printf '%s\n' "$last_n" | wc -l | tr -d ' ')
 
   if [ "$last_n_count" -ge "$HARD_BLOCK_THRESHOLD" ]; then
-    # Check 1: Same file edited HARD_BLOCK_THRESHOLD+ times consecutively
+    # Check 1: Same file edited with the SAME content HARD_BLOCK_THRESHOLD+
+    # times consecutively. Narrowed in #1641: three DIFFERENT edits to one file
+    # is a normal incremental workflow (observed repeatedly on wiki/rule/doc
+    # files), not a stuck loop — only an IDENTICAL repeated edit blocks. Both
+    # the path AND the edit_hash must match.
     # (skip when current call is a read-only Bash command — repeated read-only
     # polling of the same target is not a stuck-loop signal; see #1625)
+    # Bash never reaches here — file_path is empty for Bash (#1641), and
+    # edit_hash is empty too; repeated Bash commands are handled by Check 3
+    # via target_key instead.
     if [ "$is_readonly" != "true" ] && [ -n "$file_path" ]; then
-      escaped_path=$(echo "$file_path" | sed 's/[.[\*^$()+?{|]/\\&/g')
-      consecutive_file=$(echo "$last_n" | grep -c "\"path\":\"${escaped_path}\"" 2>/dev/null || echo "0")
+      consecutive_file=$(printf '%s\n' "$last_n" \
+        | grep -F -e "$path_match" \
+        | grep -cF -e "\"edit_hash\":\"${edit_hash}\"" 2>/dev/null || true)
+      [ -n "$consecutive_file" ] || consecutive_file=0
       if [ "$consecutive_file" -ge "$HARD_BLOCK_THRESHOLD" ]; then
         hard_block=true
-        hard_block_reason="Same file ($(basename "$file_path")) edited ${consecutive_file} consecutive times"
+        hard_block_reason="Same file ($(basename -- "$file_path")) received the identical edit ${consecutive_file} consecutive times"
       fi
     fi
 
     # Check 2: Same error repeated HARD_BLOCK_THRESHOLD+ times consecutively
     if [ "$hard_block" = false ] && [ "$is_error" = "true" ] && [ -n "$error_hash" ]; then
-      consecutive_error=$(echo "$last_n" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || echo "0")
+      consecutive_error=$(printf '%s\n' "$last_n" | grep -c "\"error_hash\":\"${error_hash}\"" 2>/dev/null || printf '%s\n' "0")
       if [ "$consecutive_error" -ge "$HARD_BLOCK_THRESHOLD" ]; then
         hard_block=true
         hard_block_reason="Same error repeated ${consecutive_error} consecutive times"
       fi
     fi
 
-    # Check 3: Same tool+target combination HARD_BLOCK_THRESHOLD+ times consecutively
+    # Check 3: Same tool+target combination HARD_BLOCK_THRESHOLD+ times
+    # consecutively. Uses target_key (a file path for file tools, the command
+    # text for Bash) so repeated identical Bash commands are still blocked
+    # after file_path was emptied for Bash (#1641).
     # (skip when current call is a read-only Bash command — see Check 1 note)
-    if [ "$hard_block" = false ] && [ "$is_readonly" != "true" ] && [ -n "$file_path" ]; then
-      escaped_path=$(echo "$file_path" | sed 's/[.[\*^$()+?{|]/\\&/g')
-      consecutive_tool_target=$(echo "$last_n" | grep "\"tool\":\"${tool_name}\"" | grep -c "\"path\":\"${escaped_path}\"" 2>/dev/null || echo "0")
+    # The edit_hash filter mirrors Check 1's #1641 narrowing: without it this
+    # check re-creates the very false positive Check 1 was narrowed to remove
+    # (tool=Edit + same path fires at 3 regardless of content). For Bash the
+    # filter is a no-op — every Bash history entry carries edit_hash "".
+    if [ "$hard_block" = false ] && [ "$is_readonly" != "true" ] && [ -n "$target_key" ]; then
+      consecutive_tool_target=$(printf '%s\n' "$last_n" \
+        | grep -F -e "\"tool\":\"${tool_name}\"" \
+        | grep -F -e "$path_match" \
+        | grep -cF -e "\"edit_hash\":\"${edit_hash}\"" 2>/dev/null || true)
+      [ -n "$consecutive_tool_target" ] || consecutive_tool_target=0
       if [ "$consecutive_tool_target" -ge "$HARD_BLOCK_THRESHOLD" ]; then
         hard_block=true
-        hard_block_reason="${tool_name} called on $(basename "$file_path") ${consecutive_tool_target} consecutive times"
+        # Do NOT call basename() on a Bash target: a command is not a path, and
+        # basename() on command text produced the misleading "Same file (pr)"
+        # style message reported in #1641.
+        if [ "$tool_name" = "Bash" ]; then
+          hard_block_reason="Identical Bash command repeated ${consecutive_tool_target} times: $(printf '%s' "$target_key" | head -c 60)"
+        else
+          hard_block_reason="${tool_name} called on $(basename -- "$target_key") ${consecutive_tool_target} consecutive times"
+        fi
       fi
     fi
   fi

package/templates/.claude/rules/MUST-agent-identification.md

@@ -117,6 +117,9 @@ Reference issue: #1096.
 | Anti-pattern | Required |
 |--------------|----------|
 | 도구 결과 수신 후 응답 텍스트 없이 turn 종료 ("(no content)") | 최소 1줄 진행 상태 + R007 헤더 출력 후 종료/계속 |
+| 백그라운드 에이전트 완료 통지·task-notification 등 **system-reminder 통지 수신 후** 도구만 호출하고 텍스트 없이 turn 종료 | 통지 처리 턴에도 헤더 + 상태 1줄 출력 후 도구 호출 |
+
+v1.1.58 세션 트랜스크립트 실측 — 응답 22건 중 3건이 텍스트 블록 없이 tool_use만 있었고 전부 통지 수신 직후 턴이었다(#1646).
 
 <!-- Reference issues: #1188 item #2, #1198 item #2, #1409. -->
 

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -338,6 +338,22 @@ Origin: #1563 찐빠 #3 — `gh issue edit --assignee`가 gh 2.86.0에 없는
 
 Origin: #1584 #5 (v1.1.45 세션 — 커밋 위임서에 `develop @ 96ef8f85`로 적었으나 실측은 `f6d3f518`; #1572 머지 후 pull 미반영). R017 「메모리 TODO를 위임 전제로 쓸 때」의 **세션 내 축소판** — 스냅샷의 수명이 세션 간이 아니라 **턴 간**이라는 차이만 있다.
 
+**사전 실측 리터럴 (Origin: #1646)**: 저장소 상태를 기재한 위임서를 작성하기 **직전에** 아래 3줄을 그대로 실행한다.
+
+```
+git rev-parse --abbrev-ref HEAD
+git rev-parse --short HEAD
+git branch --list
+```
+
+이 3줄의 **출력 원문**을 위임서 '사전 실측' 절에 그대로 붙여 넣고, 브랜치 존재·SHA를 예측형으로 적지 않는다 — 도구의 부수효과(예: `gh pr merge --delete-branch`가 체크아웃된 브랜치를 base로 전환·pull·삭제하는 부수효과)를 모른 채 이전 관측을 그대로 옮기면 상태가 어긋난다.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| `gh pr merge --delete-branch` 등 부수효과가 있는 명령 실행 후, 그 이전에 관측한 브랜치/SHA를 위임서에 그대로 기재 | 위임 직전 위 3줄을 재실행하고 출력 원문을 위임서에 붙여 넣음 |
+
+Origin: #1646 (v1.1.58 세션 — 커밋 위임서 `12e74a76` vs 실제 `e101a0b4`, 정리 위임서 '로컬 브랜치 2개 존재' vs 실제 부재; 원인은 `gh pr merge --delete-branch`가 체크아웃된 브랜치를 base로 전환·pull·삭제하는 부수효과였음 — 도구 부수효과를 모른 채 상태를 예측한 사례).
+
 #### 참인 전제 ≠ 참인 함의 — 브랜치 전환 위임 (Origin: #1595 #2)
 
 uncommitted 변경이 있는 상태의 브랜치 전환을 위임할 때, 위임서에 **전환의 결과를 확정형으로 예측해 적지 않는다**. "대상 브랜치에 그 파일이 없다"는 **사실**에서 "전환해도 안전하다"는 **함의**는 도출되지 않는다 — 파일이 **없기 때문에** checkout이 그 파일을 삭제해야 하고, modified 상태면 거부된다.
@@ -428,7 +444,17 @@ The Agent tool defaults to `mode: "acceptEdits"`, which overrides agent frontmat
 ### Self-Check
 
 Before spawning any agent:
-1. Does the Agent tool call include `mode: "bypassPermissions"`? → YES: proceed → NO: add it
+1. **유효 permission mode 확인** — per-call `mode` 파라미터는 v2.1.212+ 에서 무시되고,
+   **프로젝트 scope `permissions.defaultMode` 는 v2.1.257+ 에서도 무시된다(#1644)**.
+   무인 실행 전 실측할 것: `jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json`
+   (user scope) — 이 값 또는 `--permission-mode` 실행 플래그만이 유효하다.
+   bypassPermissions 가 아니면 프롬프트 발생을 전제로 계획한다.
+   하위 호환을 위해 per-call `mode: "bypassPermissions"` 는 계속 포함하되,
+   **그 존재를 무인 실행의 증거로 삼지 않는다**(R020 "attempt ≠ outcome").
+   실측(2026-09-03, `claude -p --debug-file`): `[WARN] settings defaultMode "bypassPermissions"
+   ignored — only policy/user/flag settings may grant bypass mode (projectSettings and
+   localSettings are repo-controllable)` — 무시 동작이 직접 실증되었다. 프로젝트 settings에는
+   `permissions._comment_defaultMode` 안내 키가 추가되었다(v1.1.59).
 2. Is this a new skill that spawns agents? → Add Permission Mode section
 
 ### Common Violation

package/templates/.claude/rules/MUST-permissions.md

@@ -133,3 +133,10 @@ Origin: #1582. Cross-ref: R018(Member TaskUpdate Discipline 대체 규약), R020
 > Canonical source: R010 (MUST-orchestrator-coordination.md) "Universal bypassPermissions" owns the full requirement, rationale, self-check, and version history. Core rule: always pass `mode: "bypassPermissions"` explicitly on every Agent tool call — the Agent tool's default `mode` (`acceptEdits`) overrides agent frontmatter `permissionMode` and causes prompts during unattended execution. Skills that spawn agents MUST include this in their Agent tool call instructions. See R010 for details.
 
 > **v2.1.212+**: CC가 Agent(구 Task) tool의 `mode` 파라미터를 deprecated 처리했습니다(이제 무시) — subagent는 부모 세션의 permission mode를 기본 상속합니다. 위 canonical 요약의 default `mode`(`acceptEdits`)가 frontmatter `permissionMode`를 override한다는 서술 및 항상 `mode: "bypassPermissions"`를 넘기라는 요건은 이 버전부터 stale이며(파라미터가 무시됨), 무인 실행의 실질 게이트는 부모 세션의 permission mode입니다. 요건 재조정은 R010 "Universal bypassPermissions"가 canonical — R002는 이 flag만 유지합니다.
+
+> **v2.1.257+**: 프로젝트 scope `permissions.defaultMode` 가 무시됩니다(user/managed scope 또는
+> `--permission-mode` 플래그만 유효). 위 v2.1.212 노트가 "무인 실행의 실질 게이트는 부모 세션의
+> permission mode"라고 정정했는데, **그 부모 세션 모드를 프로젝트 settings로 지정하는 경로가 이
+> 버전에서 끊겼습니다** — 이 파일 상단 「Deny Rule Glob Patterns」의 v2.1.214 노트(allow 규칙만
+> `<cwd>`로 좁아진 비대칭)와 같은 계열의 **project-scope 축소** 흐름입니다. Canonical owner 는
+> R010 "Universal bypassPermissions" — 상세와 실측 절차는 그쪽을 참조합니다. Origin: #1644.

package/templates/.claude/skills/fsd/SKILL.md

@@ -69,6 +69,14 @@ All PR merge operations are delegated to **mgr-gitnerd** (R010). After merging,
 
 Do NOT merge PRs that require user approval for architectural decisions. Surface them with a short summary and wait.
 
+### `.claude/hooks/**` 이슈 — 무인 루프 분리 스코프
+
+FSD는 사용자가 실시간 응답할 수 없는 무인 루프이므로, scope-selection의 R010 approval-required
+path pre-check(`auto-dev.yaml`)가 `.claude/hooks/**` 대상 이슈를 발견하면 매 이터레이션마다
+즉시 승인을 요청하지 않는다. 대신 그 이슈를 이번 스코프에서 **분리·이월**하고 나머지 적격 이슈로
+계속 진행하며, `/homework` 반복 경계(게이트)에서 이월된 hooks 이슈들을 **1회 묶어** 승인 질문으로
+제시한다. 승인을 받으면 R015 directive persistence로 세션 내 동일 카테고리에 지속 적용한다.
+
 ### Iteration Flow (per iteration)
 
 ```
@@ -169,6 +177,22 @@ If any of those underlying skills evolve, FSD automatically benefits — its onl
 
 When this skill delegates work via Agent tool calls, ALL Agent tool calls MUST include `mode: "bypassPermissions"` per R010 Universal bypassPermissions.
 
+⚠ **그 파라미터는 CC v2.1.212+ 에서 무시되며, 프로젝트 scope `permissions.defaultMode` 역시
+CC v2.1.257+ 에서 무시된다(#1644).** 즉 위 지시를 지켰다는 사실은 **무인 실행의 증거가 아니다**.
+자율 루프 진입 전에 유효 모드를 실측한다:
+
+```bash
+jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo unset
+```
+
+`bypassPermissions` 가 아니면 루프 도중 permission 프롬프트로 정지할 수 있으므로,
+`--permission-mode bypassPermissions` 로 재시작하거나 사람이 지켜보는 실행임을 전제한다.
+(파이프라인 쪽 배선은 `pipeline auto-dev` 의 pre-triage Phase 0.5 가 담당한다.)
+
+⚠ **커밋 위임 타임아웃 (#1645)**: 메인 워크트리의 `.husky/pre-commit` 이 전체 테스트
+스위트(약 165초)를 돌리므로, `git commit` 을 위임할 때는 Bash `timeout: 400000` 을 명시한다.
+기본값 120000ms 로는 exit 143(SIGTERM)으로 끊긴다. `--no-verify` 우회는 금지(R010).
+
 ## Artifact Output
 
 Artifacts from each iteration follow the conventions of the constituent skills:

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -54,6 +54,30 @@ steps:
               "[pre-triage] WARNING: Issue #N references vX.Y.Z (not in git tags) — body may be stale"
             - Output all warnings as advisory log; do NOT halt
 
+      Phase 0.5 — Measure the EFFECTIVE permission mode (advisory, do NOT halt).
+
+      Why: CC v2.1.257 stopped honoring `permissions.defaultMode` declared in PROJECT scope
+      (`.claude/settings.json` / `.claude/settings.local.json`). Only user/managed scope or an
+      explicit `--permission-mode` flag takes effect. R010 「Universal bypassPermissions」 assumes
+      the parent session runs unattended under bypassPermissions; if that assumption is silently
+      false, this pipeline stalls on a permission prompt mid-run with no diagnostic (#1644).
+
+      1. Read the user-scope setting (project scope is NOT authoritative on v2.1.257+):
+         user_mode=$(jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo "unset")
+
+      2. The `--permission-mode` launch flag cannot be read from inside the session. Treat it as
+         UNKNOWN — never infer that it was passed.
+
+      3. Report and, when not bypassPermissions, warn:
+         - user_mode == "bypassPermissions":
+           report: "[pre-triage] effective permission mode: bypassPermissions (user scope)"
+         - otherwise:
+           stderr warning: "[pre-triage] WARNING: effective permission mode is <user_mode>; unattended run may prompt. Project-scope permissions.defaultMode is IGNORED on CC v2.1.257+ (#1644). To run unattended, launch with --permission-mode bypassPermissions or set it in user-scope ~/.claude/settings.json."
+         - Do NOT halt (advisory only — a prompted run still completes with a human present).
+
+      4. Do NOT read, echo, or modify any credential material while checking settings — read the
+         single `permissions.defaultMode` field only (R001).
+
       Phase 1 — Ensure required labels exist, then scan issues.
 
       1. Create labels if missing (idempotent):
@@ -140,6 +164,13 @@ steps:
       If approval was already granted THIS session for the same category+target, do not
       re-request (R015 directive persistence).
 
+      무인 실행(`/fsd` 등 사용자가 실시간 응답할 수 없는 루프)에서는 `.claude/hooks/**` 대상 이슈를
+      이번 스코프에서 **분리·이월**하고 나머지 적격 이슈로 진행하며, 반복 경계(homework 게이트)에서
+      승인 질문을 **1회** 묶어 제시한다. 승인을 받으면 R015 directive persistence로 세션 내 동일
+      카테고리에 지속 적용. 유인 모드에서는 기존대로 즉시 승인 요청. 무인 판별 신호는 "오케스트레이터가
+      `/fsd`로 진입했거나 세션 지침이 autonomous임을 명시한 경우"로 판단한다 — 결정론적 판별 신호
+      확립은 후속 과제로 남긴다.
+
       Output approval_required_paths (list, empty if none) as pipeline state.
 
       Assign scoped issues to milestone.
@@ -170,6 +201,10 @@ steps:
         - plan step: skip release-plan skill; single-response plan instead
         - deep-plan step: skip deep-plan skill; single-response implementation notes instead
         - deep-verify step: skip deep-verify skill; perform self-review checklist instead
+          — 단, 변경 집합에 `.claude/rules/**`(또는 agents/skills frontmatter 등 구조 표면)가
+          포함되면 self-review로 대체하지 않고 mgr-sauron R017 검증을 **단일 목표 위임으로 필수
+          실행**한다(Tier 2 lite의 R017 조항과 동일 원칙; Origin: v1.1.58 세션 — docs-only 티어였으나
+          sauron이 R002/R010 모순 advisory 1건을 포착).
         - Log: "[compression-mode] docs-only compression activated (scope={n}, all docs/yaml labels)"
         - ⚠ Analysis artifacts only. Every step's state-change side effect (milestone create/assign,
           label add/remove, issue assign/comment/close) still runs in full — see "Cross-tier —
@@ -297,6 +332,14 @@ steps:
          develop-bound commit auto-closes the issue on push — BEFORE release/tag/publish (observed v1.1.38,
          07:49:26Z). Close keywords belong ONLY in the release-stage PR body (see release step 3.b) — auto-tag.yml
          greps the PR body, not commit messages, to decide which issues to close.
+             ⚠ Bash timeout (#1645): the main-worktree `.husky/pre-commit` runs typecheck + lint +
+             the FULL `bun test --coverage` suite (~165s measured) before the commit lands. The Bash
+             tool's default timeout is 120000ms, so a `git commit` delegation with the default budget
+             is killed mid-hook with exit 143 (SIGTERM). Delegate `git commit` with an explicit
+             `timeout: 400000` (≈6.7 min). Do NOT work around a timeout with `--no-verify` — that
+             bypasses the quality gate and is on the standing deny list (R010).
+             Note: git worktrees run typecheck only (`.husky/pre-commit` lines 7-12 branch on
+             `[ -f .git ]` and exit 0), so the long budget matters most on the MAIN worktree.
       6. On success: remove in-progress, add verify-ready
       7. On failure: remove in-progress, add needs-review, comment error summary
 
@@ -425,6 +468,9 @@ steps:
               ⚠ do NOT add Closes/Fixes/Resolves keywords to this commit message (#1542) — this commit merges into
               develop later via the release PR; a close keyword here bypasses the PR-body mechanism auto-tag.yml
               relies on (see step 3.b below). Use `Refs #N` if a cross-reference is needed.
+               ⚠ Bash timeout (#1645): delegate this commit with an explicit `timeout: 400000` — the
+               main-worktree pre-commit hook runs the full test suite (~165s) and the Bash default of
+               120000ms kills it with exit 143. `--no-verify` is NOT an acceptable workaround (R010).
            h. mgr-gitnerd push release/v{NEW} to origin — NEVER push this commit to develop directly. Pushing to
               develop here reproduces the diff=0 PR failure this reordering fixes (#1542).
            i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}:

package/templates/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.1.58",
-  "lastUpdated": "2026-09-02T00:00:00.000Z",
+  "version": "1.1.60",
+  "lastUpdated": "2026-09-03",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",
   "components": [

package/templates/workflows/auto-dev.yaml

@@ -54,6 +54,30 @@ steps:
               "[pre-triage] WARNING: Issue #N references vX.Y.Z (not in git tags) — body may be stale"
             - Output all warnings as advisory log; do NOT halt
 
+      Phase 0.5 — Measure the EFFECTIVE permission mode (advisory, do NOT halt).
+
+      Why: CC v2.1.257 stopped honoring `permissions.defaultMode` declared in PROJECT scope
+      (`.claude/settings.json` / `.claude/settings.local.json`). Only user/managed scope or an
+      explicit `--permission-mode` flag takes effect. R010 「Universal bypassPermissions」 assumes
+      the parent session runs unattended under bypassPermissions; if that assumption is silently
+      false, this pipeline stalls on a permission prompt mid-run with no diagnostic (#1644).
+
+      1. Read the user-scope setting (project scope is NOT authoritative on v2.1.257+):
+         user_mode=$(jq -r '.permissions.defaultMode // "unset"' ~/.claude/settings.json 2>/dev/null || echo "unset")
+
+      2. The `--permission-mode` launch flag cannot be read from inside the session. Treat it as
+         UNKNOWN — never infer that it was passed.
+
+      3. Report and, when not bypassPermissions, warn:
+         - user_mode == "bypassPermissions":
+           report: "[pre-triage] effective permission mode: bypassPermissions (user scope)"
+         - otherwise:
+           stderr warning: "[pre-triage] WARNING: effective permission mode is <user_mode>; unattended run may prompt. Project-scope permissions.defaultMode is IGNORED on CC v2.1.257+ (#1644). To run unattended, launch with --permission-mode bypassPermissions or set it in user-scope ~/.claude/settings.json."
+         - Do NOT halt (advisory only — a prompted run still completes with a human present).
+
+      4. Do NOT read, echo, or modify any credential material while checking settings — read the
+         single `permissions.defaultMode` field only (R001).
+
       Phase 1 — Ensure required labels exist, then scan issues.
 
       1. Create labels if missing (idempotent):
@@ -140,6 +164,13 @@ steps:
       If approval was already granted THIS session for the same category+target, do not
       re-request (R015 directive persistence).
 
+      무인 실행(`/fsd` 등 사용자가 실시간 응답할 수 없는 루프)에서는 `.claude/hooks/**` 대상 이슈를
+      이번 스코프에서 **분리·이월**하고 나머지 적격 이슈로 진행하며, 반복 경계(homework 게이트)에서
+      승인 질문을 **1회** 묶어 제시한다. 승인을 받으면 R015 directive persistence로 세션 내 동일
+      카테고리에 지속 적용. 유인 모드에서는 기존대로 즉시 승인 요청. 무인 판별 신호는 "오케스트레이터가
+      `/fsd`로 진입했거나 세션 지침이 autonomous임을 명시한 경우"로 판단한다 — 결정론적 판별 신호
+      확립은 후속 과제로 남긴다.
+
       Output approval_required_paths (list, empty if none) as pipeline state.
 
       Assign scoped issues to milestone.
@@ -170,6 +201,10 @@ steps:
         - plan step: skip release-plan skill; single-response plan instead
         - deep-plan step: skip deep-plan skill; single-response implementation notes instead
         - deep-verify step: skip deep-verify skill; perform self-review checklist instead
+          — 단, 변경 집합에 `.claude/rules/**`(또는 agents/skills frontmatter 등 구조 표면)가
+          포함되면 self-review로 대체하지 않고 mgr-sauron R017 검증을 **단일 목표 위임으로 필수
+          실행**한다(Tier 2 lite의 R017 조항과 동일 원칙; Origin: v1.1.58 세션 — docs-only 티어였으나
+          sauron이 R002/R010 모순 advisory 1건을 포착).
         - Log: "[compression-mode] docs-only compression activated (scope={n}, all docs/yaml labels)"
         - ⚠ Analysis artifacts only. Every step's state-change side effect (milestone create/assign,
           label add/remove, issue assign/comment/close) still runs in full — see "Cross-tier —
@@ -297,6 +332,14 @@ steps:
          develop-bound commit auto-closes the issue on push — BEFORE release/tag/publish (observed v1.1.38,
          07:49:26Z). Close keywords belong ONLY in the release-stage PR body (see release step 3.b) — auto-tag.yml
          greps the PR body, not commit messages, to decide which issues to close.
+             ⚠ Bash timeout (#1645): the main-worktree `.husky/pre-commit` runs typecheck + lint +
+             the FULL `bun test --coverage` suite (~165s measured) before the commit lands. The Bash
+             tool's default timeout is 120000ms, so a `git commit` delegation with the default budget
+             is killed mid-hook with exit 143 (SIGTERM). Delegate `git commit` with an explicit
+             `timeout: 400000` (≈6.7 min). Do NOT work around a timeout with `--no-verify` — that
+             bypasses the quality gate and is on the standing deny list (R010).
+             Note: git worktrees run typecheck only (`.husky/pre-commit` lines 7-12 branch on
+             `[ -f .git ]` and exit 0), so the long budget matters most on the MAIN worktree.
       6. On success: remove in-progress, add verify-ready
       7. On failure: remove in-progress, add needs-review, comment error summary
 
@@ -425,6 +468,9 @@ steps:
               ⚠ do NOT add Closes/Fixes/Resolves keywords to this commit message (#1542) — this commit merges into
               develop later via the release PR; a close keyword here bypasses the PR-body mechanism auto-tag.yml
               relies on (see step 3.b below). Use `Refs #N` if a cross-reference is needed.
+               ⚠ Bash timeout (#1645): delegate this commit with an explicit `timeout: 400000` — the
+               main-worktree pre-commit hook runs the full test suite (~165s) and the Bash default of
+               120000ms kills it with exit 143. `--no-verify` is NOT an acceptable workaround (R010).
            h. mgr-gitnerd push release/v{NEW} to origin — NEVER push this commit to develop directly. Pushing to
               develop here reproduces the diff=0 PR failure this reordering fixes (#1542).
            i. mandatory verification (with existence guard for partial-update safety), run on release/v{NEW}: