oh-my-customcode 1.1.62 → 1.1.63

package/dist/cli/index.js

@@ -243,7 +243,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.62",
+    version: "1.1.63",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {

package/dist/index.js

@@ -2539,7 +2539,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.62",
+  version: "1.1.63",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.62",
+  "version": "1.1.63",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/hooks/scripts/audit-log.sh

@@ -20,14 +20,34 @@ printf '%s' "$input" | jq -e 'type=="object"' >/dev/null 2>&1 || exit 0
 # Extract fields from hook input
 tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name // "unknown"')
 file_path=$(printf '%s\n' "$input" | jq -r '.tool_input.file_path? // .tool_input.command? // ""' | head -c 200)
-agent_type=$(printf '%s\n' "$input" | jq -r '.agent_type // "unknown"')
-model=$(printf '%s\n' "$input" | jq -r '.model // "unknown"')
+# Agent identity and model. PostToolUse has NO top-level `model` at all, and its
+# top-level `agent_type` is present only when the hook fires from inside a subagent
+# (CC 2.1.259 schema: "Present when the hook fires from within a subagent") — so on
+# the main thread both reads resolved to "unknown" on every single entry.
+# Measured replacements (#1656 C): the Agent tool's result object carries
+# `resolvedModel` (892 occurrences in this project's transcript corpus, e.g.
+# "claude-sonnet-5" / "claude-opus-5[1m]") and, on the synchronous shape, `agentType`;
+# the spawn arguments carry `subagent_type`.
+# `?` keeps a scalar-shaped tool_input/tool_response from aborting under `set -euo pipefail`.
+agent_type=$(printf '%s\n' "$input" | jq -r '
+  (.agent_type?
+    // .tool_input?.subagent_type?
+    // .tool_response?.agentType?
+    // "unknown") | tostring
+' 2>/dev/null) || agent_type="unknown"
+model=$(printf '%s\n' "$input" | jq -r '
+  (.model?
+    // .tool_response?.resolvedModel?
+    // "unknown") | tostring
+' 2>/dev/null) || model="unknown"
 # Outcome signal. PostToolUse carries the result under `tool_response`, not
 # `tool_output` (measured 2026-09-03: 1764/1764 PostToolUse payloads had
 # `tool_response`, 0/1764 had `tool_output`), so the old `.tool_output.is_error`
 # read was always absent and every entry was logged as outcome=success.
-# Measured failure signals: `.tool_response.is_error` (generic) and
-# `.tool_response.interrupted` (present on every Bash response).
+# Failure signals read below: `.tool_response.is_error` (generic) and
+# `.tool_response.interrupted`. The latter is present on every Bash response but
+# was never observed true in this corpus (0/1555), so it is defensive coverage —
+# not a signal measured to fire.
 # jq's `//` treats both null and false as absent, so this chain is an OR:
 # the result is true iff at least one signal is true.
 is_error=$(printf '%s\n' "$input" | jq -r '

package/templates/.claude/hooks/scripts/failure-ledger.sh

@@ -52,6 +52,9 @@ ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")
 #   (r007-r008-drift-advisor.sh의 `.role` vs `.message.role`과 동일 계열).
 #   .tool_error / .tool_response.* fallback은 스키마 변화에 대한 방어로만 남긴다 —
 #   tool_response가 문자열인 경우 인덱싱 에러로 레코드가 통째로 유실되므로 type 검사로 감싼다.
+#   .tool_input도 같은 이유로 type 검사를 씌운다 (#1656 A 실측): 스칼라/배열 tool_input이
+#   오면 jq가 인덱싱 에러로 죽고 `2>/dev/null || true` 때문에 **조용히 레코드 전체가
+#   유실**됐다 — rc는 0이고 stderr도 비어 있어 크래시가 아니라 데이터 손실로 나타난다.
 #
 # 단일 라인(<1KB) append 이므로 O_APPEND 원자성에 기대어 병렬 에이전트 환경에서도 안전.
 printf '%s' "$input" \
@@ -61,7 +64,9 @@ printf '%s' "$input" \
         session: (.session_id // ""),
         cwd:     $cwd,
         tool:    (.tool_name // "unknown"),
-        target:  ((.tool_input.command // .tool_input.file_path // "") | tostring | .[0:160]),
+        target:  ((if (.tool_input | type) == "object"
+                    then (.tool_input.command // .tool_input.file_path // "")
+                    else "" end) | tostring | .[0:160]),
         interrupt: (.is_interrupt == true),
         err:     ((.error
                    // .tool_error

package/templates/.claude/hooks/scripts/git-delegation-guard.sh

@@ -14,8 +14,18 @@ command -v jq >/dev/null 2>&1 || exit 0
 
 input=$(cat)
 
-agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type // ""')
-prompt=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt // ""')
+# Guard: non-object stdin (non-JSON / JSON array / empty) — swallow and exit 0
+# instead of reflecting garbage back on stdout. The sibling hooks (audit-log.sh,
+# model-escalation-advisor.sh, task-outcome-recorder.sh) all carry this guard;
+# this one did not, so a non-object payload was echoed through verbatim. (#1656 F)
+printf '%s' "$input" | jq -e 'type=="object"' >/dev/null 2>&1 || exit 0
+
+# `?` suppresses jq's "Cannot index <type> with string" when tool_input arrives as a
+# scalar/array instead of an object (measured #1656 A: the bare form leaked a jq error to
+# stderr on every non-object tool_input). 2>/dev/null + `|| echo ""` keep the hook silent
+# and advisory-only even if jq itself fails for an unrelated reason.
+agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type? // ""' 2>/dev/null || echo "")
+prompt=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt? // ""' 2>/dev/null || echo "")
 
 # R010 violation tracking file (PPID-scoped for session persistence)
 VIOLATION_FILE="/tmp/.claude-r010-violations-${PPID}"

package/templates/.claude/hooks/scripts/model-escalation-advisor.sh

@@ -34,13 +34,22 @@ CONSECUTIVE_THRESHOLD=3
 COOLDOWN=5
 
 # Count failures for this agent type
+#
+# `grep -c` COUNT HYGIENE (#1656 E): a no-match `grep -c` prints `0` on stdout AND
+# exits 1, so the old `$(grep -c ... || echo "0")` appended a SECOND zero and the
+# variable became the two-line string "0\n0". Every later `[ "$count" -ge N ]` then
+# failed with "integer expression expected" on stderr — noise indistinguishable
+# from a real hook fault, on the exact path (zero failures) that is the common case.
+# `|| true` keeps grep's own `0` and `${x:-0}` covers an unreadable file.
 agent_failures=0
 if [ -n "$agent_type" ] && [ "$agent_type" != "unknown" ]; then
-  agent_failures=$(grep -c "\"agent_type\":\"${agent_type}\".*\"outcome\":\"failure\"" "$OUTCOME_FILE" 2>/dev/null || echo "0")
+  agent_failures=$(grep -c "\"agent_type\":\"${agent_type}\".*\"outcome\":\"failure\"" "$OUTCOME_FILE" 2>/dev/null || true)
+  agent_failures=${agent_failures:-0}
 fi
 
 # Count consecutive failures (tail entries)
-consecutive_failures=$(tail -${CONSECUTIVE_THRESHOLD} "$OUTCOME_FILE" 2>/dev/null | grep -c '"outcome":"failure"' 2>/dev/null || echo "0")
+consecutive_failures=$(tail -${CONSECUTIVE_THRESHOLD} "$OUTCOME_FILE" 2>/dev/null | grep -c '"outcome":"failure"' 2>/dev/null || true)
+consecutive_failures=${consecutive_failures:-0}
 
 # Escalation path
 # NOTE: Agent tool `model` param is an enum of exactly 4 values: sonnet | opus | haiku | fable.
@@ -90,7 +99,9 @@ fi
 
 # De-escalation check
 if [ "$current_model" != "haiku" ] && [ "$current_model" != "inherit" ] && [ "$current_model" != "" ]; then
-  recent_successes=$(tail -${COOLDOWN} "$OUTCOME_FILE" 2>/dev/null | grep -c '"outcome":"success"' 2>/dev/null || echo "0")
+  # Same `grep -c` hygiene as above (#1656 E).
+  recent_successes=$(tail -${COOLDOWN} "$OUTCOME_FILE" 2>/dev/null | grep -c '"outcome":"success"' 2>/dev/null || true)
+  recent_successes=${recent_successes:-0}
 
   if [ "$recent_successes" -ge "$COOLDOWN" ]; then
     lower_model=""

package/templates/.claude/hooks/scripts/playwright-compress.sh

@@ -12,11 +12,19 @@ input=$(cat)
 # Hooks must never crash (R021); jq parse errors would otherwise abort under `set -e`. (#1650)
 printf '%s' "$input" | jq -e 'type=="object"' >/dev/null 2>&1 || exit 0
 # PostToolUse carries the tool result under `tool_response`, not `tool_output`
-# (measured 2026-09-03: 1764/1764 PostToolUse payloads had `tool_response`,
-# 0/1764 had `tool_output`), so the previous `.tool_output` read always yielded
-# "" and this hook never compressed anything. MCP responses arrive either as a
-# bare string or as `{content: [{type:"text", text:...}]}`; `.tool_output` is
-# kept as a fallback for events still using the older shape.
+# (measured at v1.1.62: every PostToolUse record in this project's transcripts
+# carried `tool_response` and none carried `tool_output`), so the previous
+# `.tool_output` read always yielded "" and this hook never compressed anything.
+# MCP responses arrive either as a bare string or as
+# `{content: [{type:"text", text:...}]}`; `.tool_output` is kept as a fallback
+# for events still using the older shape.
+#
+# MATCHER-SCOPED: `.stdout` and `.file.content` are read here only because this
+# hook's matcher is `mcp__playwright__.*|mcp__claude-in-chrome__.*`, so those
+# branches can never fire on a real Bash or Read result. This is a lossy hook —
+# it REPLACES `.tool_response` with a Haiku summary — so widening the matcher to
+# cover Bash/Read without first dropping those two branches would silently
+# destroy genuine command output and file contents. (#1656 F)
 tool_output=$(printf '%s\n' "$input" | jq -r '
   [
     (.tool_response?   | if type == "string" then . else empty end),

package/templates/.claude/hooks/scripts/r007-r008-drift-advisor.sh

@@ -52,6 +52,9 @@
 #     with no tool_result block) ends a turn.
 #   * `thinking` blocks are interleaved with text/tool_use and never carry an R008 prefix;
 #     they are filtered out before analysis.
+#   * NOTE (#1654, v1.1.63): narration 블록은 트랜스크립트에 type:"thinking"(signature 라벨
+#     narration)으로 직렬화되므로 아래 select(.type? != "thinking")이 함께 배제한다 — 의도된
+#     동작: narration에는 R007/R008 마커가 실리지 않는다(실측 47블록 0건).
 #
 # ── R008 verdict: TURN-LEVEL COUNTING, not block adjacency (#1563 찐빠 #1) ─────────────
 # R008 (`.claude/rules/MUST-tool-identification.md`) says, verbatim:

package/templates/.claude/hooks/scripts/secret-filter.sh

@@ -12,8 +12,8 @@ command -v jq >/dev/null 2>&1 || exit 0
 
 input=$(cat)
 
-# Non-object stdin guard (#1650 B) — rejects ONLY non-object stdin, which carries
-# no scannable payload anyway; a well-formed object always reaches the scan below.
+# Non-object stdin guard (#1650 B). PostToolUse stdin is always an object; a
+# bare-string stdin is rejected by design, not because it is known to be empty.
 printf '%s' "$input" | jq -e 'type=="object"' >/dev/null 2>&1 || exit 0
 
 tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name? // "unknown"')
@@ -21,19 +21,23 @@ tool_name=$(printf '%s\n' "$input" | jq -r '.tool_name? // "unknown"')
 # Collect every text-bearing field of the payload into one scan buffer.
 #
 # PostToolUse carries the result under `tool_response`, NOT `tool_output`
-# (measured 2026-09-03: 1764 PostToolUse payloads echoed into this project's
-# session transcripts had `tool_response` 1764/1764 and `tool_output` 0/1764;
+# (measured at v1.1.62 against this project's session transcripts: every
+# PostToolUse record carried `tool_response` and none carried `tool_output`;
 # the CC 2.1.259 embedded hook reference documents `"tool_response": {...}
 # // PostToolUse only`). Reading `.tool_output.output` therefore always yielded
 # "" and the scan below never ran — every AWS key, private key and PAT passed
 # through unflagged.
 #
-# Measured text-bearing fields, by tool:
-#   Bash   .tool_response.stdout / .stderr
-#   Read   .tool_response.file.content
-#   Write  .tool_response.content
-#   Agent  .tool_response.prompt
-#   MCP    .tool_response (string) or .tool_response.content[].text
+# Text-bearing fields, by tool. This hook's matcher is `Bash|Read|Grep`, so only
+# the first two rows fire in production; the rest are defensive so a matcher
+# widening does not silently reintroduce the blind spot above.
+#   Bash   .tool_response.stdout / .stderr          (measured, in matcher)
+#   Read   .tool_response.file.content              (measured, in matcher)
+#   Write  .tool_response.content                   (measured, out of matcher)
+#   Agent  .tool_response.prompt / .output          (measured, out of matcher)
+#   MCP    .tool_response (string)
+#          or .tool_response.content[].text         (defensive — unmeasured;
+#                                                    MCP corpus 0 records)
 # `.tool_output.output` and a string-shaped `.tool_output` are kept as
 # fallbacks for events that still use the older shape (e.g. SubagentStop).
 #

package/templates/.claude/hooks/scripts/stuck-detector.sh

@@ -207,6 +207,9 @@ _strip_heredoc_bodies() {
   # A literal single quote cannot be written inside the bracket expression of
   # the quote-counting expansion below, so hold one in a variable.
   local sq_char="'"
+  # Same expression the extraction below used to hand to "sed -n -E", now fed
+  # to bash's own "=~" (see the delimiter scan for why it moved).
+  local delim_re="^.*[^<]<<-?[[:space:]]*[\"']?([A-Za-z_][A-Za-z0-9_]*)[\"']?.*\$"
   while IFS= read -r line; do
     if [ "$in_body" -eq 1 ]; then
       # "<<-" allows leading tabs before the terminator; accept leading
@@ -253,8 +256,18 @@ _strip_heredoc_bodies() {
       printf '%s' "${out}__QUOTED_HEREDOC_OPENER__"$'\n'
       return 0
     fi
-    delim="$(printf '%s' "$line" \
-      | sed -n -E "s/^.*[^<]<<-?[[:space:]]*[\"']?([A-Za-z_][A-Za-z0-9_]*)[\"']?.*\$/\\1/p")"
+    # bash's "=~" runs the SAME POSIX ERE the "sed -n -E" here used to run —
+    # both engines are leftmost-longest, so the greedy "^.*" still settles on
+    # the LAST "<<" (verified against sed over 251 cases, #1656 E). Two forks
+    # per opener line are saved, but the reason it moved is correctness: sed
+    # aborts with "RE error: illegal byte sequence" on a line carrying invalid
+    # UTF-8, and under "set -o pipefail" that non-zero pipeline killed the
+    # whole hook. "=~" simply reports no match there.
+    if [[ "$line" =~ $delim_re ]]; then
+      delim="${BASH_REMATCH[1]}"
+    else
+      delim=""
+    fi
     if [ -n "$delim" ]; then
       in_body=1
     fi
@@ -292,7 +305,28 @@ is_readonly_bash_command() {
     return 0
   fi
 
-  cmd="$(printf '%s' "$cmd" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+  # sed applies "^" and "$" once PER LINE, so this trims every line of a
+  # multi-line command — it is NOT the whole-string parameter-expansion trim
+  # used in Step 6 and in _strip_heredoc_bodies, which is why it survived
+  # #1650 A. The loop below reproduces the per-line form exactly: each line is
+  # trimmed and re-terminated, then the trailing newlines are dropped the same
+  # way the "$( )" around the old pipeline dropped them. Two forks are saved,
+  # but the reason it changed (#1656 E) is correctness: sed aborts a multi-line
+  # command with "RE error: illegal byte sequence" at the first invalid UTF-8
+  # byte, and under "set -o pipefail" that non-zero pipeline killed the hook
+  # outright — so a heredoc body carrying raw bytes could stop the classifier
+  # before it ever reached a trailing "rm -rf". Parameter expansion has no
+  # locale dependency.
+  local trimmed="" tline
+  while IFS= read -r tline; do
+    tline="${tline#"${tline%%[![:space:]]*}"}"
+    tline="${tline%"${tline##*[![:space:]]}"}"
+    trimmed="${trimmed}${tline}"$'\n'
+  done <<< "$cmd"
+  while [ "${trimmed%$'\n'}" != "$trimmed" ]; do
+    trimmed="${trimmed%$'\n'}"
+  done
+  cmd="$trimmed"
   if [ -z "$cmd" ]; then
     echo "false"
     return 0

package/templates/.claude/hooks/scripts/task-outcome-recorder.sh

@@ -5,9 +5,33 @@ set -euo pipefail
 command -v jq >/dev/null 2>&1 || exit 0
 
 # Task/Agent Outcome Recorder Hook
-# Trigger: PostToolUse (tool == "Task" || "Agent") and SubagentStop
-# Purpose: Record task outcomes for model escalation decisions
+# Trigger: SubagentStop (settings.json wires this script to that event and no other)
+# Purpose: Record agent outcomes for model escalation decisions
 # Protocol: stdin JSON -> process -> stdout pass-through, exit 0 always
+#
+# MEASURED SubagentStop payload (CC 2.1.259 embedded hook schema; #1656 B):
+#   session_id, transcript_path, cwd, prompt_id?, permission_mode?, effort?,
+#   hook_event_name:"SubagentStop", stop_hook_active, agent_id,
+#   agent_transcript_path, agent_type,
+#   last_assistant_message?, background_tasks?, session_crons?
+#
+# Note what the event does NOT carry: no `tool_input`, no `tool_output`, no
+# `model`, no `description`, no `prompt`, and no error signal of any kind. The
+# selectors below therefore read the top-level fields first and fall back to
+# `last_assistant_message` — the one text-bearing field SubagentStop provides —
+# for the description and skill-name extraction. The `tool_input`/`tool_output`
+# branches are retained as fallbacks so the script stays correct if it is ever
+# re-wired to PostToolUse.
+#
+# This project's transcript corpus (889 files) holds ZERO SubagentStop hook
+# records — SubagentStop output is not attached to the parent transcript — so
+# the shape above is schema-derived, not corpus-derived.
+#
+# Outcome caveat: SubagentStop exposes no failure signal, so entries recorded
+# from that event are always outcome=success. There is no working hand-off for
+# that gap today: SubagentStop payload carries no failure signal;
+# subagent-failure-advisor.sh currently reads `.tool_output.is_error`, which is
+# absent here, so failure detection on this path is 0 until #1656 G is resolved.
 
 input=$(cat)
 
@@ -15,11 +39,24 @@ input=$(cat)
 # jq's parse error propagates through `set -euo pipefail` as rc=5 without this.
 printf '%s' "$input" | jq -e 'type=="object"' >/dev/null 2>&1 || exit 0
 
-# Extract task info — support both PostToolUse (tool_input.*) and SubagentStop (top-level) shapes.
-# `?` suppresses "Cannot index string with ..." when tool_input arrives as a scalar.
-agent_type=$(printf '%s\n' "$input" | jq -r '.tool_input.subagent_type? // .agent_type? // "unknown"')
-model=$(printf '%s\n' "$input" | jq -r '.tool_input.model? // .model? // "inherit"')
-description=$(printf '%s\n' "$input" | jq -r '.tool_input.description? // .description? // ""' | head -c 80)
+# Extract agent info. Measured SubagentStop fields come first; the PostToolUse
+# `tool_input.*` shape is kept as a fallback.
+# `?` suppresses "Cannot index string with ..." when tool_input arrives as a scalar;
+# `tostring` normalises a scalar (e.g. a numeric agent_type) instead of aborting.
+agent_type=$(printf '%s\n' "$input" | jq -r \
+  '(.agent_type? // .tool_input?.subagent_type? // "unknown") | tostring' 2>/dev/null) \
+  || agent_type="unknown"
+# SubagentStop carries no `model`; this resolves to "inherit" there by design.
+model=$(printf '%s\n' "$input" | jq -r \
+  '(.model? // .tool_input?.model? // "inherit") | tostring' 2>/dev/null) || model="inherit"
+# `strings` drops non-string shapes so an object-valued field degrades to "" rather
+# than dumping raw JSON into the description.
+description=$(printf '%s\n' "$input" | jq -r '
+  [ (.tool_input?.description? | strings),
+    (.description?             | strings),
+    (.last_assistant_message?  | strings) ]
+  | map(select(. != "")) | first // ""
+' 2>/dev/null | head -c 200) || description=""
 
 # Extract skill name from description or prompt
 skill_name=""
@@ -28,18 +65,35 @@ skill_name=""
 if echo "$description" | grep -qiE '(skill:|routing|→.*skill)'; then
   skill_name=$(echo "$description" | grep -oiE '[a-z]+-[a-z]+(-[a-z]+)*-?(routing|skill|practices|detection|decomposition|orchestration|pipeline|guards|cycle|plan|review|refactor|publish|version|audit|exec|analyze|bundle|report|setup|watch|lists|status|help|save|recall)' | head -1 || true)
 fi
-# Fallback: check prompt field for "Skill: {name}" pattern
+# Fallback: check the prompt / last assistant message for a "Skill: {name}" pattern.
+# SubagentStop has no `prompt`, so `last_assistant_message` is the live source here.
 if [ -z "$skill_name" ]; then
-  prompt=$(printf '%s\n' "$input" | jq -r '.tool_input.prompt? // ""' | head -c 500)
-  skill_name=$(echo "$prompt" | grep -oiE 'Skill:\s*[a-z]+-[a-z]+(-[a-z]+)*' | sed 's/[Ss]kill:\s*//' | head -1 || true)
+  prompt=$(printf '%s\n' "$input" | jq -r '
+    [ (.tool_input?.prompt?      | strings),
+      (.last_assistant_message?  | strings) ]
+    | map(select(. != "")) | first // ""
+  ' 2>/dev/null | head -c 500) || prompt=""
+  # POSIX character classes, not `\s`: BSD sed (macOS, this repo's runtime) does not
+  # implement the GNU `\s` escape, so `s/[Ss]kill:\s*//` stripped only the colon and
+  # left a leading space on every extracted skill name. Same family as the BSD `\?`
+  # gap recorded in R005. (#1656 B)
+  skill_name=$(echo "$prompt" | grep -oiE 'Skill:[[:space:]]*[a-z]+-[a-z]+(-[a-z]+)*' | sed 's/[Ss]kill:[[:space:]]*//' | head -1 || true)
 fi
 
-# Determine outcome
-is_error=$(printf '%s\n' "$input" | jq -r '.tool_output.is_error? // false')
+# Determine outcome. SubagentStop carries no error signal, so this is always false
+# there; `.tool_response.is_error` is the measured PostToolUse field (`.tool_output`
+# is the legacy shape) and both are kept for re-wiring safety.
+is_error=$(printf '%s\n' "$input" | jq -r '
+  (.tool_response?.is_error? // .tool_output?.is_error? // false) | tostring
+' 2>/dev/null) || is_error="false"
 
 if [ "$is_error" = "true" ]; then
   outcome="failure"
-  error_summary=$(printf '%s\n' "$input" | jq -r '.tool_output.output? // ""' | head -c 200)
+  error_summary=$(printf '%s\n' "$input" | jq -r '
+    [ (.tool_response?.output? | strings),
+      (.tool_output?.output?   | strings) ]
+    | map(select(. != "")) | first // ""
+  ' 2>/dev/null | head -c 200) || error_summary=""
 else
   outcome="success"
   error_summary=""
@@ -50,11 +104,29 @@ OUTCOME_FILE="/tmp/.claude-task-outcomes-${PPID}"
 TASK_COUNT_FILE="/tmp/.claude-task-count-${PPID}"
 
 # --- Pattern Detection ---
-# Priority: skill-specific patterns > parallel > sequential (default)
-pattern="sequential"
+# Priority: skill-specific patterns > parallel > agent-count inference > default.
+#
+# INPUT SCOPE (#1656 D): the cascade below reads ONLY `tool_input.description` —
+# the spawn argument the orchestrator wrote — never `$description`, which now
+# falls back to `last_assistant_message`, i.e. free-form prose the subagent wrote
+# about itself. A closing summary that merely says "ran the parallel review" or
+# "orchestrator finished" would otherwise be recorded as
+# pattern_used=parallel/orchestrator, fabricating a workflow shape out of English.
+# SubagentStop carries no `tool_input`, so on that event this source is empty and
+# the pattern degrades to the session-level agent-count signal (a real, non-prose
+# signal) and then to "unknown" — an honest absence rather than a default
+# "sequential" that reads as a measurement.
+pattern_source=$(printf '%s\n' "$input" | jq -r '
+  (.tool_input?.description? | strings) // ""
+' 2>/dev/null | head -c 200) || pattern_source=""
+
+if [ -n "$pattern_source" ]; then
+  pattern="sequential"
+else
+  pattern="unknown"
+fi
 
-# Check description for skill-specific workflow patterns
-desc_lower=$(echo "$description" | tr '[:upper:]' '[:lower:]')
+desc_lower=$(printf '%s' "$pattern_source" | tr '[:upper:]' '[:lower:]')
 
 if echo "$desc_lower" | grep -qE '(evaluator.optimizer|evaluator_optimizer)'; then
   pattern="evaluator-optimizer"
@@ -87,9 +159,17 @@ if [ -f "$AGENT_START_FILE" ]; then
   fi
 fi
 
-# Append JSON line entry
+# Append JSON line entry.
+# `-c` (compact) is REQUIRED, not cosmetic: this file is consumed as JSONL by
+# eval-core's outcome-parser (`content.split('\n')` + `JSON.parse(line)`) and by
+# model-escalation-advisor.sh (`grep -c '"agent_type":"X".*"outcome":"failure"'`,
+# `tail -N`), and the ring buffer below trims by `wc -l`. A pretty-printed entry
+# spans 11 lines (measured: 9 fields plus the braces), so it broke every one of
+# those readers and let `tail -50` slice
+# an object in half. Sibling recorders (agent-start-recorder.sh, stuck-detector.sh)
+# already use `jq -cn`. (#1656 B)
 timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-entry=$(jq -n \
+entry=$(jq -cn \
   --arg ts "$timestamp" \
   --arg agent "$agent_type" \
   --arg model "$model" \

package/templates/.claude/rules/MUST-completion-verification.md

@@ -388,6 +388,12 @@ This applies when a change touches a field that participates in an override/prec
 |--------------|----------|
 | Plan a provider/endpoint switch as N commands without reading the config's override chain | Read the full config schema (which field wins, defaults, inheritance) → enumerate EVERY field the switch touches (incl. base_url) → then plan |
 
+**훅 스크립트 각도 — stdin 필드 형상은 실측 후 편집 (Origin: #1658 #1, v1.1.62)**: 훅 스크립트가 읽는 stdin 필드(`tool_input`/`tool_response`/`agent_id` 등)를 편집·가드·억제하기 전에 **실제 페이로드 형상을 실측**한다 — 트랜스크립트의 `attachment.type=="hook_success"` 레코드에서 `attachment.stdout`이 pass-through 훅이 되돌린 stdin 원문이며, CC 바이너리 내장 훅 문서로 교차검증한다. 처방("가드 추가·`?` 억제")만 위임하면 선택자 결함 위에 가드를 얹어 마지막 실패 신호까지 지운다. 실증: v1.1.62에서 `secret-filter.sh`가 PostToolUse에 존재하지 않는 `tool_output`(0/1764)을 읽어 실제 페이로드를 한 번도 스캔하지 않던 선재 결함 위에 `?` 억제가 추가됐고(rc=5 신호 소멸), 적대적 리뷰가 실측 형상 재현으로 FAIL 판정해 `tool_response`(1764/1764)로 교체했다. 훅 편집 위임서 표준 문안: "스크립트가 읽는 stdin 필드는 `hook_success` 레코드로 형상 실측 후 편집".
+
+| Anti-pattern | Required |
+|--------------|----------|
+| 훅 위임서에 "가드 추가·`?` 억제" 처방만 전달 | 읽는 필드의 실제 형상(`hook_success` stdin 원문 + 바이너리 훅 문서) 실측을 위임서 완료 조건에 포함 |
+
 Sibling discipline to Read-Before-Characterize (that rule governs diagnosis — don't label before reading; this one governs edit-planning completeness — enumerate every interdependent field before editing). Cross-ref: R023 (verification ladder — config completeness is a Tier-1 deterministic pre-check).
 
 ### Degraded-Output Re-Verification Gate (529 / buffering)

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -390,6 +390,8 @@ Origin: #1595 #2 (v1.1.48 세션 — `git checkout -b release/v1.1.48 develop`
 | 파일 소유권만 고지하고 동일 검증 명령을 각 에이전트 완료 조건에 넣어 병렬 발주 | 검증 명령 공유를 고지하거나 검증을 오케스트레이터가 직렬 1회로 회수 |
 | 공유 `$TMPDIR`에 고정 경로로 임시 파일을 쓰고 그 디렉토리를 전수 계수 | 에이전트별 고유 경로 사용 + 그 경로만 계수 |
 
+**순차 위임도 고지 대상 — 직전 완료 변경분의 출처 (Origin: #1658 #4)**: 병렬 형제뿐 아니라 **이미 워킹트리에 있는 미커밋 변경분의 출처**(직전에 완료한 에이전트와 그 담당 파일)를 위임서에 한 줄 고지한다. 고지가 없으면 후속 에이전트가 `git diff`에 보이는 타 변경분을 "형제 담당분"으로 오귀속해 서술한다(v1.1.62 세션 3건 — 행동에는 영향 없었으나 보고가 오염). 문안: "워킹트리의 미커밋 변경 중 X·Y는 직전 에이전트 [N]의 완료분이다 — 건드리지 말고 보고에서도 네 변경분과 구분하라."
+
 > Origin: #1518 (찐빠 #3 — 미고지 git 에이전트가 형제를 "외부 프로세스"로 오귀속; 같은 세션에서 고지한 4개 구현 에이전트는 전원 정확히 구분 보고 — 대조 실증). Cross-ref: R009 (병렬 실행 조건).
 
 > Origin 보강: #1598 — 파일이 완전 disjoint한 병렬 배치에서 위양성 4종 발생(judge.sh 테스트 7건 ENOENT: 두 테스트가 tracked `verdict-schema.json`을 cp→rm→복구 / reviewers.sh 타임아웃 테스트 간헐 실패: CPU 포화 / "임시 파일 누수 1건" 오측정: 형제 잔여물, 격리 셔임 재측정 시 0). **3종의 원인은 오케스트레이터가 위임서에 넣은 완료 조건 자체였다** — 형제 고지의 결함이 아니라 고지 항목의 누락이다.

package/templates/.claude/rules/MUST-tool-identification.md

@@ -125,6 +125,17 @@ Origin: #1595 #5 (v1.1.48 세션 — R008 위반 3건이 단일 턴에 집중. t
 > **v2.1.174+**: Fixed the Workflow tool's `agent()` subagents missing per-agent attribution headers. Workflow-spawned subagents now carry attribution consistent with R008 — when authoring Workflow scripts, each `agent()` call is attributed like a direct Agent tool spawn. Align Workflow orchestration with the R008 `[agent][model] → Tool:` identification discipline: a Workflow `agent()` fan-out should still be reasoned about with the same per-agent identification model as parallel Agent tool spawns.
 -->
 
+## announce와 헤더는 narration이 아니라 visible text 블록으로 (Origin: #1654)
+
+모델 출력에는 `text` 블록과 **narration 블록**(트랜스크립트에 `type:"thinking"` + signature 라벨 `narration`으로 직렬화되는 사용자향 짧은 산문)이 있고, 한 API 메시지에는 **둘 중 하나만** 실린다(v1.1.61~62 세션 실측: 115메시지 중 공존 0). 도구 호출 턴을 narration 요약 한 문장("…했습니다. 이제 …하겠습니다")으로 시작하면 R007 헤더와 R008 접두사는 **어디에도 남지 않는다** — 실측: narration 47블록에 R007 헤더 0건, 대괄호 번호 항목 0건, Tool 표기 0건(조사 문장 인용 제외). advisor는 `type != "thinking"` 필터로 narration을 배제하므로 이 턴들은 전부 누락으로 계상되며, 실제로 v1.1.61 세션 advisory 18건은 **전부 진양성**이었다(직렬화 유실 가설은 advisor가 메시지 직후에 판정했다는 사실로 배제됨).
+
+| Anti-pattern | Required |
+|--------------|----------|
+| 도구 호출 턴을 짧은 요약 산문만으로 시작(narration 채널로 흐름) | 헤더(`┌─ Agent:` 또는 단축 헤더)와 Core Rule 접두사를 **text 블록**으로 명시 — 산문 요약은 그 뒤에 |
+| "announce를 썼다"는 기억으로 advisory를 오탐으로 가정 | 트랜스크립트의 `text` 블록에서 마커를 실측(R020 Self-Violation Counting) |
+
+Iteration 1(Agent 스폰 15메시지 전부 narration)과 Iteration 2(7메시지 text)의 대비는 계수 도구 결함이 아니라 출력 채널 선택의 차이였다. 채널 선택 요인은 미귀속이다.
+
 ## Tier-3 Interaction Tool Prefix (MANDATORY)
 
 R008 "every tool call" applies to Tier-3 interaction tools too — NOT only file/exec tools. Applying the Core Rule prefix form (에이전트·모델 대괄호 다음 화살표와 Tool 표기) to Agent/Bash/Read while omitting it on `AskUserQuestion`, `TodoWrite`, `EnterPlanMode`, etc. is a violation.

package/templates/.claude/rules/SHOULD-verification-ladder.md

@@ -113,6 +113,8 @@ Origin: #1455 #1 (Session 127 회고 찐빠 #1) — cc-release-monitor PR #1449
 |--------------|----------|
 | "변경분 영향 범위"만 보고 검증 항목을 정해 위임 → CI 전용 잡(lint 등) 누락 | 워크플로 잡 목록을 하한선으로 삼아 로컬 대응 명령을 완료 조건에 열거 |
 
+**상한선 — 오케스트레이터 사전 실측 항목은 재실행 금지 (Origin: #1655 제안 2)**: 하한선이 CI 잡 목록이라면 상한선은 "오케스트레이터가 이미 실측한 항목"이다. 검증 위임서에는 사전 실측 결과(테스트 pass/fail, lint·typecheck exit, 스크립트 exit, 미러 md5)를 **재실행 금지 목록**으로 열거하고 재실측 대상만 지정한다 — 서브에이전트가 전체 테스트를 재실행하면 턴 예산이 소진돼 판정 없이 절단된다. 실증: v1.1.61 세션 mgr-sauron 1차 위임(금지 목록 없음)은 `bun test` 재실행으로 25턴 절단, 2차 위임(금지 목록 + 15턴 내 판정 명시)은 16 tool_uses로 PASS 완주(R020 maxTurns 절단 누적 7건째). auto-dev.yaml deep-verify 스텝 description에 같은 문안이 배선돼 있다.
+
 Origin: #1574 (v1.1.44 세션 — 병렬 위임 3건 모두 `bun run lint`를 누락해 verify-build halt, 수정 에이전트 1회 추가 발주). 기존 `feedback_delegation_verify_scope_by_impact`("영향 범위 기준")의 하한선을 명문화한 것이다. Cross-reference: R020(완료 검증 — 선언 전 실제 게이트 통과 확인), R017(커밋 전 검증 게이트).
 
 ## Conditional-Output Verification — Positive/Negative Pair Mandate (Origin: #1563 #2)

package/templates/.claude/skills/fsd/SKILL.md

@@ -131,6 +131,7 @@ Each iteration operates under full project rules — no relaxation because FSD i
 | R015 (intent persistence) | If user explicitly defers a specific PR this session, honor that deferral — do not retry it. |
 | R017 (sync verification) | mgr-sauron passes required before any commit. |
 | R020 (completion verification) | Each release verified via `npm view`, `gh release view`, closed issues before `[Done]`. PR merges verified via `gh pr view` ground-truth before declaring iteration complete. |
+| cost-cap advisory (`cost-cap-advisor.sh`, Conversation Block) | FSD는 사용자가 명시 호출한 다중 릴리즈 루프라 세션 비용이 상한(기본 $5)을 필연적으로 넘는다. advisory 발화는 루프를 멈추는 신호가 아니며, 오케스트레이터는 발화 사실과 누적 비용을 반복 경계(homework 게이트)에서 사용자에게 고지한다. 상한을 올리려면 `CLAUDE_COST_CAP`(v1.1.61 세션 실측: 착수 직후 $5.38에서 발화). |
 
 `/homework` runs as a **retrospective gate** between iterations — findings go through `omcustom-feedback`'s Phase 4A confirmation gate. The loop does NOT skip homework on the grounds that it is "automated". If homework requires user confirmation (e.g., to file a feedback issue), the loop pauses and waits.
 

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -441,7 +441,7 @@ steps:
 
   - name: deep-verify
     skill: deep-verify
-    description: "Multi-angle release quality verification — self-review checklist if docs-only; mgr-sauron R017 + core self-check if lite. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). lite 분할 표준(#1652 #3-4): (1) mgr-sauron R017 구조 검증 단일 목표 위임 1건 + (2) 변경 성격별 적대적 리뷰 단일 목표 위임 1건 — 스크립트 변경이면 실행 재현 기반 adversarial-review, 룰/스킬/yaml 텍스트 변경이면 문구 정합·배선 리뷰. 근거: v1.1.59/60 두 반복 연속 적대적 리뷰가 신규 회귀(M-3/M-4, heredoc 위조)를 실행 재현으로 포착."
+    description: "Multi-angle release quality verification — self-review checklist if docs-only; mgr-sauron R017 + core self-check if lite. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). lite 분할 표준(#1652 #3-4): (1) mgr-sauron R017 구조 검증 단일 목표 위임 1건 + (2) 변경 성격별 적대적 리뷰 단일 목표 위임 1건 — 스크립트 변경이면 실행 재현 기반 adversarial-review, 룰/스킬/yaml 텍스트 변경이면 문구 정합·배선 리뷰. 근거: v1.1.59/60 두 반복 연속 적대적 리뷰가 신규 회귀(M-3/M-4, heredoc 위조)를 실행 재현으로 포착. 검증 위임 표준 문안: 오케스트레이터가 이미 실측한 항목(bun test·lint·typecheck·template-sync·wiki-sync·validate-docs·미러 md5)은 위임서에 재실행 금지 목록으로 열거하고 재실측 대상만 지정한다 — v1.1.61 세션에서 금지 목록 없는 sauron 위임이 bun test를 재실행하다 25턴 절단됐고, 금지 목록을 명시한 재위임은 16 tool_uses로 완주했다(R020 maxTurns 절단 누적 7건째)."
     depends_on: verify-build
 
   - name: release
@@ -585,6 +585,10 @@ steps:
          - If failures: diagnose, fix, re-verify
       3. For npm projects with auto-tag.yml: MANDATORY additional check:
          gh run list --workflow auto-tag.yml --limit 1 --json conclusion,displayTitle
+         ⚠ auto-tag.yml run의 `headSha`는 **release 브랜치 head(PR head SHA)**이지 머지 커밋이 아니다 — 폴링 종료
+         조건을 머지 커밋 SHA로 걸면 영원히 미일치해 타임아웃까지 전량 소진한다(v1.1.61 세션 실측: 40회/10분 전량
+         소진, v1.1.62에서 PR head로 정정 → 22회 정상 종료). release.yml run은 `displayTitle`에 PR 번호/브랜치명이
+         들어가므로 그것으로 식별한다.
          → conclusion MUST be "success" before declaring release complete.
          If auto-tag.yml concluded "failure": diagnose root cause. Do NOT retry with manual git tag.
          Common causes:

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.62",
+  "version": "1.1.63",
   "lastUpdated": "2026-09-03",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",

package/templates/workflows/auto-dev.yaml

@@ -441,7 +441,7 @@ steps:
 
   - name: deep-verify
     skill: deep-verify
-    description: "Multi-angle release quality verification — self-review checklist if docs-only; mgr-sauron R017 + core self-check if lite. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). lite 분할 표준(#1652 #3-4): (1) mgr-sauron R017 구조 검증 단일 목표 위임 1건 + (2) 변경 성격별 적대적 리뷰 단일 목표 위임 1건 — 스크립트 변경이면 실행 재현 기반 adversarial-review, 룰/스킬/yaml 텍스트 변경이면 문구 정합·배선 리뷰. 근거: v1.1.59/60 두 반복 연속 적대적 리뷰가 신규 회귀(M-3/M-4, heredoc 위조)를 실행 재현으로 포착."
+    description: "Multi-angle release quality verification — self-review checklist if docs-only; mgr-sauron R017 + core self-check if lite. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). lite 분할 표준(#1652 #3-4): (1) mgr-sauron R017 구조 검증 단일 목표 위임 1건 + (2) 변경 성격별 적대적 리뷰 단일 목표 위임 1건 — 스크립트 변경이면 실행 재현 기반 adversarial-review, 룰/스킬/yaml 텍스트 변경이면 문구 정합·배선 리뷰. 근거: v1.1.59/60 두 반복 연속 적대적 리뷰가 신규 회귀(M-3/M-4, heredoc 위조)를 실행 재현으로 포착. 검증 위임 표준 문안: 오케스트레이터가 이미 실측한 항목(bun test·lint·typecheck·template-sync·wiki-sync·validate-docs·미러 md5)은 위임서에 재실행 금지 목록으로 열거하고 재실측 대상만 지정한다 — v1.1.61 세션에서 금지 목록 없는 sauron 위임이 bun test를 재실행하다 25턴 절단됐고, 금지 목록을 명시한 재위임은 16 tool_uses로 완주했다(R020 maxTurns 절단 누적 7건째)."
     depends_on: verify-build
 
   - name: release
@@ -585,6 +585,10 @@ steps:
          - If failures: diagnose, fix, re-verify
       3. For npm projects with auto-tag.yml: MANDATORY additional check:
          gh run list --workflow auto-tag.yml --limit 1 --json conclusion,displayTitle
+         ⚠ auto-tag.yml run의 `headSha`는 **release 브랜치 head(PR head SHA)**이지 머지 커밋이 아니다 — 폴링 종료
+         조건을 머지 커밋 SHA로 걸면 영원히 미일치해 타임아웃까지 전량 소진한다(v1.1.61 세션 실측: 40회/10분 전량
+         소진, v1.1.62에서 PR head로 정정 → 22회 정상 종료). release.yml run은 `displayTitle`에 PR 번호/브랜치명이
+         들어가므로 그것으로 식별한다.
          → conclusion MUST be "success" before declaring release complete.
          If auto-tag.yml concluded "failure": diagnose root cause. Do NOT retry with manual git tag.
          Common causes: