oh-my-customcode 1.1.94 → 1.1.95

package/dist/cli/index.js

@@ -81,6 +81,9 @@ function registryDir() {
 function registryPath() {
   return join(registryDir(), "projects.json");
 }
+function emptyRegistry() {
+  return { projects: {} };
+}
 async function readRegistryRaw() {
   try {
     const content = await readFile(registryPath(), "utf-8");
@@ -88,9 +91,9 @@ async function readRegistryRaw() {
     if (typeof parsed === "object" && parsed !== null && "projects" in parsed && typeof parsed.projects === "object" && parsed.projects !== null) {
       return parsed;
     }
-    return { ...EMPTY_REGISTRY };
+    return emptyRegistry();
   } catch {
-    return { ...EMPTY_REGISTRY };
+    return emptyRegistry();
   }
 }
 async function writeRegistry(registry) {
@@ -203,9 +206,8 @@ async function migrateFromLockfiles(searchDirs) {
   }
   return imported;
 }
-var _registryDirOverride, EMPTY_REGISTRY, SCAN_SKIP_DIRS;
+var _registryDirOverride, SCAN_SKIP_DIRS;
 var init_registry = __esm(() => {
-  EMPTY_REGISTRY = { projects: {} };
   SCAN_SKIP_DIRS = new Set(["node_modules", "dist", "build", ".git"]);
 });
 
@@ -217,7 +219,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.94",
+    version: "1.1.95",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {
@@ -18040,7 +18042,7 @@ var CLASSIFICATION_TABLE = [
     event: "PreToolUse",
     description: "Block rule file deletion — requires individual user confirmation per rule (R001 safety)",
     decision: "drop-condition",
-    reason: 'rule-deletion-guard.sh explicitly re-checks `tool != "Bash"` (passthrough) and re-greps tool_input.command for rm/git rm/mv/unlink AND a .claude/rules path before blocking — matcher condition is redundant'
+    reason: 'rule-deletion-guard.sh explicitly re-checks `tool != "Bash"` (passthrough) and itself decides whether to block: it blocks destructive operations (rm/mv/unlink/find -delete/xargs rm/truncate/git rm|mv|clean/`>` redirect) whose resolved target is inside or an ancestor of the project .claude/rules or templates/.claude/rules, falling back to pattern matching for opaque commands (use the Write/Edit tools to modify rule files) — matcher condition is redundant'
   },
   {
     event: "PostToolUse",

package/dist/index.js

@@ -239,6 +239,9 @@ function registryDir() {
 function registryPath() {
   return join6(registryDir(), "projects.json");
 }
+function emptyRegistry() {
+  return { projects: {} };
+}
 async function readRegistryRaw() {
   try {
     const content = await readFile(registryPath(), "utf-8");
@@ -246,9 +249,9 @@ async function readRegistryRaw() {
     if (typeof parsed === "object" && parsed !== null && "projects" in parsed && typeof parsed.projects === "object" && parsed.projects !== null) {
       return parsed;
     }
-    return { ...EMPTY_REGISTRY };
+    return emptyRegistry();
   } catch {
-    return { ...EMPTY_REGISTRY };
+    return emptyRegistry();
   }
 }
 async function writeRegistry(registry) {
@@ -272,9 +275,8 @@ async function registerProject(projectPath, version) {
   };
   await writeRegistry(registry);
 }
-var _registryDirOverride, EMPTY_REGISTRY, SCAN_SKIP_DIRS;
+var _registryDirOverride, SCAN_SKIP_DIRS;
 var init_registry = __esm(() => {
-  EMPTY_REGISTRY = { projects: {} };
   SCAN_SKIP_DIRS = new Set(["node_modules", "dist", "build", ".git"]);
 });
 
@@ -1784,7 +1786,7 @@ var CLASSIFICATION_TABLE = [
     event: "PreToolUse",
     description: "Block rule file deletion — requires individual user confirmation per rule (R001 safety)",
     decision: "drop-condition",
-    reason: 'rule-deletion-guard.sh explicitly re-checks `tool != "Bash"` (passthrough) and re-greps tool_input.command for rm/git rm/mv/unlink AND a .claude/rules path before blocking — matcher condition is redundant'
+    reason: 'rule-deletion-guard.sh explicitly re-checks `tool != "Bash"` (passthrough) and itself decides whether to block: it blocks destructive operations (rm/mv/unlink/find -delete/xargs rm/truncate/git rm|mv|clean/`>` redirect) whose resolved target is inside or an ancestor of the project .claude/rules or templates/.claude/rules, falling back to pattern matching for opaque commands (use the Write/Edit tools to modify rule files) — matcher condition is redundant'
   },
   {
     event: "PostToolUse",
@@ -2764,7 +2766,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.1.94",
+  version: "1.1.95",
   description: "Batteries-included agent harness for Claude Code",
   type: "module",
   bin: {

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.1.94",
+  "version": "1.1.95",
   "description": "Batteries-included agent harness for Claude Code",
   "type": "module",
   "bin": {

package/templates/.claude/agents/mgr-gitnerd.md

@@ -33,9 +33,16 @@ You are a Git operations specialist following GitHub flow best practices.
 ```
 <type>(<scope>): <subject>
 
-Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
+<trailer string from delegation>
 ```
 
+Example trailer line: `Co-Authored-By: <model from delegation> <noreply@anthropic.com>`
+
+Trailer rules:
+- The trailer comes from the delegation prompt (which takes it from the session's attribution guidance). This agent definition and its examples never contain a model-name literal; the commit itself carries whatever model name the delegation's trailer string contains.
+- When the delegation gives a trailer string, use it verbatim, even if your own environment suggests a different attribution.
+- When the delegation gives no trailer string, do not commit; stop and report that the delegation did not provide a trailer string. Never invent one.
+
 Types: feat, fix, docs, style, refactor, test, chore
 
 ## Safety Rules

package/templates/.claude/hooks/scripts/rule-deletion-guard.sh

@@ -1,60 +1,905 @@
 #!/bin/bash
-# rule-deletion-guard.sh — Block rule file deletion without individual user confirmation
-# Requires: jq
+# rule-deletion-guard.sh — Block rule file deletion without individual user confirmation (#1782)
+#
+# Path-aware (python3): a quote-aware shell lexer resolves rm/mv/unlink/rmdir/shred/truncate,
+# find -delete/-exec, xargs <destructive>, git rm|mv|clean and writing redirects (> >| >> &> &>> >&)
+# against the PROJECT rule dirs (<root>/.claude/rules and <root>/templates/.claude/rules).
+# Inside a rule dir -> block. Ancestor of a rule dir -> block only for recursive delete/move.
+# Structural fail-closed: anything the analyzer does not positively model (unknown wrapper before a
+# destructive verb, destructive verb in a non-head position, unresolvable expansion in a target,
+# opaque constructs such as eval / sh -c / $(...) / backticks / source, parse errors, unknown cwd,
+# analyzer exceptions) -> strict legacy regex check (blocks if the pre-#1782 logic would block).
+# No python3: legacy regex check (needs jq). Neither python3 nor jq: fail-open (exit 0).
 
 set -uo pipefail
 
 input=$(cat)
 
-# Dependency check — allow if jq missing
-if ! command -v jq &>/dev/null; then
-  printf '%s\n' "$input"
-  exit 0
-fi
+# Legacy regex logic (verbatim semantics of the pre-#1782 guard). Arg: command string. Exits 2 on block.
+# Arg 2 = "strict": used after python fallbacks; the verb may also follow a quote/paren/slash
+# (e.g. bash -c 'rm ...', /bin/rm) so the fallback is never weaker than the analyzer's intent.
+legacy_check() {
+  local cmd="$1" targets target_count filename
+  local pre='(^|\s)'
+  [ "${2:-}" = "strict" ] && pre='(^|[^[:alnum:]_-])'
 
-# Parse tool input
-tool=$(printf '%s\n' "$input" | jq -r '.tool_name // .tool // ""' 2>/dev/null) || { printf '%s\n' "$input"; exit 0; }
-cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || { printf '%s\n' "$input"; exit 0; }
+  # Check if command would delete parent directories containing rules
+  if echo "$cmd" | grep -qE "${pre}(rm|git\s+rm|mv|unlink)\s" && echo "$cmd" | grep -qE '\.claude/?(\s|$)'; then
+    echo "[Hook] ⛔ RULE DELETION BLOCKED — Parent directory deletion detected" >&2
+    echo "[Hook] This command combines a delete/move verb with a .claude/ directory reference (pattern check)." >&2
+    echo "[Hook] Delete rules individually with user confirmation." >&2
+    echo "[Hook] 룰 파일 수정은 Write/Edit 도구를 사용하십시오 (셸 리다이렉트/삭제 금지)." >&2
+    exit 2
+  fi
 
-# Only check Bash tool
-if [ "$tool" != "Bash" ]; then
-  printf '%s\n' "$input"
-  exit 0
-fi
+  # Check if command targets .claude/rules/ for deletion (including mv, unlink)
+  if echo "$cmd" | grep -qE "${pre}(rm|git\s+rm|mv|unlink)\s" && echo "$cmd" | grep -qE '\.claude/rules(/|\s|$)'; then
+    targets=$(echo "$cmd" | grep -oE '\.claude/rules/[^ ]+' | tr '\n' ', ' | sed 's/,$//')
+    target_count=$(echo "$cmd" | grep -oE '\.claude/rules/[^ ]+' | wc -l | tr -d ' ')
 
-# Check if command would delete parent directories containing rules
-if echo "$cmd" | grep -qE '(^|\s)(rm|git\s+rm|mv|unlink)\s' && echo "$cmd" | grep -qE '\.claude/?(\s|$)'; then
-  echo "[Hook] ⛔ RULE DELETION BLOCKED — Parent directory deletion detected" >&2
-  echo "[Hook] This command would delete the entire .claude/ directory including all rules." >&2
-  echo "[Hook] Delete rules individually with user confirmation." >&2
-  exit 2
-fi
+    if echo "$cmd" | grep -qE '\.claude/rules/\*|\.claude/rules/[^ ]*\*' || [ "$target_count" -gt 1 ]; then
+      echo "[Hook] ⛔ RULE DELETION BLOCKED — Multiple rules detected" >&2
+      echo "[Hook] Targets: $targets" >&2
+      echo "[Hook] Rule files must be deleted ONE AT A TIME with user confirmation." >&2
+      echo "[Hook] Delete each rule individually after asking: \"정말 {파일명}을(를) 삭제하시겠습니까?\"" >&2
+      echo "[Hook] 룰 파일 수정은 Write/Edit 도구를 사용하십시오 (셸 리다이렉트/삭제 금지)." >&2
+      exit 2
+    fi
 
-# Check if command targets .claude/rules/ for deletion (including mv, unlink)
-if echo "$cmd" | grep -qE '(^|\s)(rm|git\s+rm|mv|unlink)\s' && echo "$cmd" | grep -qE '\.claude/rules(/|\s|$)'; then
-  # Extract target files
-  targets=$(echo "$cmd" | grep -oE '\.claude/rules/[^ ]+' | tr '\n' ', ' | sed 's/,$//')
-  target_count=$(echo "$cmd" | grep -oE '\.claude/rules/[^ ]+' | wc -l | tr -d ' ')
-
-  # Check for glob/wildcard patterns or multiple targets
-  if echo "$cmd" | grep -qE '\.claude/rules/\*|\.claude/rules/[^ ]*\*' || [ "$target_count" -gt 1 ]; then
-    echo "[Hook] ⛔ RULE DELETION BLOCKED — Multiple rules detected" >&2
-    echo "[Hook] Targets: $targets" >&2
-    echo "[Hook] Rule files must be deleted ONE AT A TIME with user confirmation." >&2
-    echo "[Hook] Delete each rule individually after asking: \"정말 {파일명}을(를) 삭제하시겠습니까?\"" >&2
+    filename=$(basename "$targets" 2>/dev/null || echo "$targets")
+    echo "[Hook] ⛔ RULE DELETION BLOCKED" >&2
+    echo "[Hook] Target: $filename" >&2
+    echo "[Hook] Rule files require individual user confirmation before deletion." >&2
+    echo "[Hook] Ask the user: \"정말 ${filename}을(를) 삭제하시겠습니까?\"" >&2
+    echo "[Hook] Only proceed after explicit user approval." >&2
+    echo "[Hook] 룰 파일 수정은 Write/Edit 도구를 사용하십시오 (셸 리다이렉트/삭제 금지)." >&2
     exit 2
   fi
+}
+
+pass() { printf '%s\n' "$input"; exit 0; }
+
+# Analyzer (script on fd 3; stdin carries the hook JSON, so the payload size is not bound by ARG_MAX).
+run_analyzer() {
+  python3 /dev/fd/3 3<<'PY'
+import fnmatch
+import glob as globmod
+import json
+import os
+import re
+import sys
+
+# Exit codes: 0 allow, 2 block (message on stderr), 3 fall back to legacy (stdout = command)
+
+
+class Fallback(Exception):
+    pass
+
+
+class Word(object):
+    __slots__ = ('v', 'exp', 'tilde', 'brace', 'raw')
+
+    def __init__(self, v, exp, tilde, brace, raw):
+        self.v, self.exp, self.tilde, self.brace, self.raw = v, exp, tilde, brace, raw
+
+
+OPAQUE = re.compile(
+    r'(?<![\w-])eval(?![\w-])|\$\(|`'
+    r'|(?<![\w-])(?:ba|z|da|k)?sh\b[^\n;|&]*?\s-\w*c\b'
+    r'|(?<![\w-])(?:ba|z|da|k)?sh\b[^\n;|&]*<<'
+    r'|(?<![\w-])source(?![\w-])'
+)
+VAR = re.compile(r'^[A-Za-z_]\w*=')
+GLOBCH = re.compile(r'[*?\[]')
+OPS = ['<<<', '<<-', '&>>', ';;&', '&&', '||', '|&', ';;', ';&', '>>', '>|', '>&', '<&', '<>', '<<', '&>',
+       ';', '&', '|', '(', ')', '<', '>']
+SEP = {';', '&', '&&', '||', '|', '|&', ';;', ';&', ';;&', '(', ')'}
+WREDIR = {'>', '>|', '>>', '&>', '&>>', '<>'}
+OREDIR = {'<', '<<<', '<&', '<<', '<<-'}
+DESTR = {'rm', 'unlink', 'rmdir', 'shred', 'truncate'}
+DWORDS = DESTR | {'mv', 'xargs'}
+FINDACT = {'-delete', '-exec', '-execdir', '-ok', '-okdir'}
+FINDFILT = {'-name', '-iname', '-path', '-ipath', '-wholename', '-iwholename', '-regex', '-iregex'}
+RESERVED = {'if', 'then', 'do', 'else', 'elif', 'while', 'until', '!', '{', '}'}
+# wrapper -> (options taking a separate value, leading positionals before the command)
+WRAP = {
+    'sudo': ({'-u', '-g', '-h', '-p', '-C', '-D', '-R', '-T', '-U', '-r', '-t'}, 0),
+    'doas': ({'-u', '-C'}, 0),
+    'command': (set(), 0), 'builtin': (set(), 0), 'exec': ({'-a'}, 0),
+    'env': ({'-u', '-C', '-S', '-P', '--unset', '--chdir', '--split-string'}, 0),
+    'nice': ({'-n', '--adjustment'}, 0), 'nohup': (set(), 0), 'time': ({'-f', '-o'}, 0),
+    'timeout': ({'-s', '-k', '--signal', '--kill-after'}, 1),
+    'gtimeout': ({'-s', '-k', '--signal', '--kill-after'}, 1),
+    'stdbuf': ({'-i', '-o', '-e', '--input', '--output', '--error'}, 0),
+    'caffeinate': ({'-t', '-w'}, 0), 'busybox': (set(), 0), 'ionice': ({'-c', '-n', '-p', '-t'}, 0),
+    'chronic': (set(), 0), 'nocorrect': (set(), 0), 'noglob': (set(), 0),
+}
+GIT_VAL = {'-C', '-c', '--git-dir', '--work-tree', '--namespace', '--super-prefix', '--config-env'}
+
+
+def lex(s):
+    """Quote-aware shell tokenizer: [('op', str) | ('w', Word)]. Raises Fallback when unsure."""
+    toks, pend = [], []
+    n, i = len(s), 0
+    st = {'w': None, 'delim': False}
+
+    def start():
+        if st['w'] is None:
+            st['w'] = {'v': [], 'exp': False, 'tilde': False, 'ub': False, 'i': i}
+        return st['w']
+
+    def end(j):
+        w = st['w']
+        if w is None:
+            return
+        v = ''.join(w['v'])
+        brace = w['ub'] and v not in ('{', '}', '{}') and '}' in v and (',' in v or '..' in v)
+        st['w'] = None
+        if st['delim']:
+            pend.append(v)
+            st['delim'] = False
+            return
+        toks.append(('w', Word(v, w['exp'], w['tilde'], brace, s[w['i']:j])))
+
+    while i < n:
+        c = s[i]
+        if c == '#' and st['w'] is None:
+            j = s.find('\n', i)
+            i = n if j < 0 else j
+            continue
+        if c in ' \t':
+            end(i)
+            i += 1
+            continue
+        if c == '\n':
+            end(i)
+            if st['delim']:
+                raise Fallback()
+            toks.append(('op', ';'))
+            i += 1
+            for d in pend:
+                while True:
+                    if i >= n:
+                        raise Fallback()  # unterminated heredoc
+                    j = s.find('\n', i)
+                    line = s[i:] if j < 0 else s[i:j]
+                    i = n if j < 0 else j + 1
+                    if line.strip() == d:
+                        break
+            del pend[:]
+            continue
+        if c in ';&|<>()':
+            w = st['w']
+            if c in '<>' and w is not None and w['v'] and all(ch.isdigit() for ch in w['v']) and s[w['i']:i].isdigit():
+                st['w'] = None  # fd number before a redirect
+            else:
+                end(i)
+            if c in '<>' and i + 1 < n and s[i + 1] == '(':
+                raise Fallback()  # process substitution
+            op = next(o for o in OPS if s.startswith(o, i))
+            if st['delim']:
+                raise Fallback()
+            toks.append(('op', op))
+            if op in ('<<', '<<-'):
+                st['delim'] = True
+            i += len(op)
+            continue
+        if c == '\\':
+            w = start()
+            if i + 1 < n:
+                w['v'].append(s[i + 1])
+            i += 2
+            continue
+        if c == "'":
+            w = start()
+            j = s.find("'", i + 1)
+            if j < 0:
+                raise Fallback()
+            w['v'].append(s[i + 1:j])
+            i = j + 1
+            continue
+        if c == '"' or (c == '$' and s.startswith('$"', i)):
+            w = start()
+            i += 2 if c == '$' else 1
+            while True:
+                if i >= n:
+                    raise Fallback()
+                ch = s[i]
+                if ch == '"':
+                    i += 1
+                    break
+                if ch == '\\' and i + 1 < n and s[i + 1] in '$`"\\\n':
+                    w['v'].append(s[i + 1])
+                    i += 2
+                    continue
+                if ch in '$`':
+                    if ch == '`' or s.startswith('$(', i):
+                        raise Fallback()
+                    w['exp'] = True
+                w['v'].append(ch)
+                i += 1
+            continue
+        if c == '$' and s.startswith("$'", i):
+            w = start()
+            j, buf = i + 2, []
+            while True:
+                if j >= n:
+                    raise Fallback()
+                if s[j] == '\\' and j + 1 < n:
+                    buf.append(s[j:j + 2])
+                    j += 2
+                    continue
+                if s[j] == "'":
+                    break
+                buf.append(s[j])
+                j += 1
+            try:
+                w['v'].append(''.join(buf).encode('latin-1', 'backslashreplace').decode('unicode_escape'))
+            except Exception:
+                w['exp'] = True
+            i = j + 1
+            continue
+        if c == '`' or (c == '$' and s.startswith('$(', i)):
+            raise Fallback()
+        if c == '$':
+            start()['exp'] = True
+        if c == '~' and st['w'] is None:
+            start()['tilde'] = True
+        if c == '{':
+            start()['ub'] = True
+        start()['v'].append(c)
+        i += 1
+    end(n)
+    if st['delim'] or pend:
+        raise Fallback()
+    return toks
+
+
+def low(s):
+    return s.lower()
+
+
+def main(d, cmd):
+    start = d.get('cwd')
+    if isinstance(start, str) and os.path.isdir(start):
+        start = os.path.realpath(start)
+    else:
+        start = os.getcwd()
+    root = os.environ.get('CLAUDE_PROJECT_DIR')
+    if not root:
+        try:
+            import subprocess
+            r = subprocess.run(['git', '-C', start, 'rev-parse', '--show-toplevel'],
+                               capture_output=True, text=True, timeout=5)
+            root = r.stdout.strip() if r.returncode == 0 else ''
+        except Exception:
+            root = ''
+        root = root or start
+    root = os.path.realpath(root)
+    prot = [low(os.path.join(root, '.claude', 'rules')),
+            low(os.path.join(root, 'templates', '.claude', 'rules'))]
+
+    cmd = cmd.replace('\r', '').replace('\\\n', '')
+    if OPAQUE.search(cmd):
+        return 3
+    try:
+        toks = lex(cmd)
+    except Fallback:
+        return 3
+
+    hits = []
+    fb = [False]
+    shvars = {}
+
+    def rp(p):
+        b = os.path.basename(p)
+        if p.endswith('/') or b in ('', '.', '..'):
+            return os.path.realpath(p)
+        return os.path.join(os.path.realpath(os.path.dirname(p)), b)
+
+    def classify(r):
+        rl = low(r).rstrip('/') or '/'
+        for p in prot:
+            if rl == p or rl.startswith(p + '/'):
+                return 'inside'
+        for p in prot:
+            if rl == '/' or p.startswith(rl + '/'):
+                return 'anc'
+        return None
+
+    def value(w):
+        if w.brace:
+            raise Fallback()
+        v = w.v
+        if w.exp:
+            raw = w.raw
+            names = re.findall(r'\$\{(\w+)\}|\$(\w+)', raw)
+            if raw.count('$') != len(names) or "'" in raw or '\\' in raw:
+                raise Fallback()
+            for a, b in names:
+                if shvars.get(a or b) is None:
+                    raise Fallback()
+            v = re.sub(r'\$\{(\w+)\}|\$(\w+)', lambda m: shvars[m.group(1) or m.group(2)], raw).replace('"', '')
+        if w.tilde:
+            if v == '~' or v.startswith('~/'):
+                v = os.path.expanduser(v)
+            else:
+                raise Fallback()
+        return v
+
+    def check(w, cwd, anc):
+        """anc: what an ANCESTOR of a rule dir means here: 'block' | 'fallback' | 'ignore'."""
+        try:
+            v = value(w)
+            if not os.path.isabs(v):
+                if cwd is None:
+                    raise Fallback()
+                v = os.path.join(cwd, v)
+        except Fallback:
+            fb[0] = True
+            return
+        isglob = bool(GLOBCH.search(v))
+        if isglob:
+            static = []
+            for p in v.split('/'):
+                if GLOBCH.search(p):
+                    break
+                static.append(p)
+            pre = os.path.realpath('/'.join(static) or '/')
+            if classify(pre) == 'inside':
+                hits.append((pre, True, 'inside'))
+            paths = [rp(m) for m in globmod.glob(v)]
+        else:
+            paths = [rp(v)]
+        for r in paths:
+            c = classify(r)
+            if c == 'inside':
+                hits.append((r, isglob, 'inside'))
+            elif c == 'anc':
+                if anc == 'block':
+                    hits.append((r, isglob, 'anc'))
+                elif anc == 'fallback':
+                    fb[0] = True
+
+    def names(words):
+        out = set()
+        for w in words:
+            if not w.exp and w.v and not any(ch.isspace() for ch in w.v):
+                out.add(os.path.basename(w.v) or w.v)
+        return out
+
+    def risky(words):
+        """True when an unmodelled position holds a destructive verb word."""
+        nm = names(words)
+        return bool(nm & DWORDS) or ('find' in nm and bool(nm & FINDACT)) or ('git' in nm and 'clean' in nm)
 
-  # Single rule file
-  filename=$(basename "$targets" 2>/dev/null || echo "$targets")
-  echo "[Hook] ⛔ RULE DELETION BLOCKED" >&2
-  echo "[Hook] Target: $filename" >&2
-  echo "[Hook] Rule files require individual user confirmation before deletion." >&2
-  echo "[Hook] Ask the user: \"정말 ${filename}을(를) 삭제하시겠습니까?\"" >&2
-  echo "[Hook] Only proceed after explicit user approval." >&2
-  exit 2
+    def unwrap(argv, cwd):
+        argv = list(argv)
+        while argv:
+            while argv and not argv[0].exp and VAR.match(argv[0].v):
+                argv.pop(0)
+            if not argv or argv[0].exp:
+                break
+            h = argv[0].v
+            if h in RESERVED:
+                argv.pop(0)
+                continue
+            b = os.path.basename(h)
+            if b not in WRAP:
+                break
+            vals, npos = WRAP[b]
+            argv.pop(0)
+            if b == 'busybox':
+                continue
+            while argv and argv[0].v.startswith('-') and not argv[0].exp:
+                o = argv.pop(0).v
+                if o == '--':
+                    break
+                key, _, joined = o.partition('=')
+                if b == 'env' and key in ('-S', '--split-string'):
+                    raise Fallback()
+                if b == 'env' and key in ('-C', '--chdir'):
+                    if not joined:
+                        if not argv:
+                            break
+                        dw = argv.pop(0)
+                    else:
+                        dw = Word(joined, '$' in joined, False, False, joined)
+                    try:
+                        dv = value(dw)
+                        cwd = None if cwd is None and not os.path.isabs(dv) else \
+                            os.path.realpath(dv if os.path.isabs(dv) else os.path.join(cwd, dv))
+                    except Fallback:
+                        cwd = None
+                    continue
+                if o in vals and argv:
+                    argv.pop(0)
+            for _ in range(npos):
+                if argv:
+                    argv.pop(0)
+        return argv, cwd
+
+    def git_split(args, cwd):
+        i = 0
+        while i < len(args) and args[i].v.startswith('-'):
+            o = args[i].v
+            if o in GIT_VAL and i + 1 < len(args):
+                if o == '-C':
+                    try:
+                        p = value(args[i + 1])
+                        cwd = None if (cwd is None and not os.path.isabs(p)) else \
+                            os.path.realpath(p if os.path.isabs(p) else os.path.join(cwd, p))
+                    except Fallback:
+                        cwd = None
+                i += 2
+            else:
+                i += 1
+        if i >= len(args) or args[i].exp:
+            return None, [], cwd
+        return args[i].v, args[i + 1:], cwd
+
+    def kind(argv, cwd):
+        """'destr' | 'risky' | None for a (possibly wrapped) command."""
+        try:
+            argv, _ = unwrap(argv, cwd)
+        except Fallback:
+            return 'risky'
+        if not argv:
+            return None
+        if argv[0].exp:
+            return 'risky'
+        v = os.path.basename(argv[0].v)
+        if v in DESTR or v == 'mv':
+            return 'destr'
+        if v == 'git':
+            sub, _, _ = git_split(argv[1:], cwd)
+            if sub in ('rm', 'mv', 'clean'):
+                return 'destr'
+        return 'risky' if risky(argv[1:]) else None
+
+    def opts_pos(args, valopts=()):
+        opts, posl, i, rest = [], [], 0, False
+        while i < len(args):
+            a = args[i]
+            if rest or a.exp or not a.v.startswith('-') or a.v == '-':
+                posl.append(a)
+            elif a.v == '--':
+                rest = True
+            else:
+                opts.append(a.v)
+                if a.v in valopts and i + 1 < len(args):
+                    i += 1
+            i += 1
+        return opts, posl
+
+    def short_has(opts, ch):
+        return any(o.startswith('-') and not o.startswith('--') and ch in o[1:] for o in opts)
+
+    def mv_targets(args, cwd):
+        dest, plain, i = None, [], 0
+        while i < len(args):
+            a = args[i].v
+            if a in ('-t', '--target-directory') and i + 1 < len(args):
+                dest = args[i + 1]
+                i += 2
+                continue
+            if a.startswith('--target-directory='):
+                j = a.split('=', 1)[1]
+                dest = Word(j, '$' in j, False, False, j)
+            elif a in ('-S', '--suffix') and i + 1 < len(args):
+                i += 2
+                continue
+            else:
+                plain.append(args[i])
+            i += 1
+        _, plain = opts_pos(plain)
+        if dest is None and plain:
+            dest = plain[-1]
+            plain = plain[:-1]
+        for s in plain:
+            check(s, cwd, 'block')
+        if dest is not None:
+            check(dest, cwd, 'ignore')
+
+    class Unsup(Exception):
+        pass
+
+    def find_compile(expr):
+        """Compile a find expression into a predicate over (disp, name, isdir, depth)."""
+        toks = [w.v for w in expr]
+        depth = {'max': None, 'min': 0}
+        pos = [0]
+        TRUEOPS = {'-delete', '-print', '-print0', '-ls', '-depth', '-d', '-xdev', '-mount', '-follow',
+                   '-noleaf', '-ignore_readdir_race', '-true'}
+
+        def peek():
+            return toks[pos[0]] if pos[0] < len(toks) else None
+
+        def take():
+            t = peek()
+            pos[0] += 1
+            return t
+
+        def arg():
+            if pos[0] >= len(toks):
+                raise Unsup()
+            return take()
+
+        def primary():
+            t = take()
+            if t == '(':
+                e = p_or()
+                if take() != ')':
+                    raise Unsup()
+                return e
+            if t in ('-name', '-iname', '-path', '-ipath', '-wholename', '-iwholename'):
+                pat, ci, onpath = arg(), t.startswith('-i'), t not in ('-name', '-iname')
+                if ci:
+                    pat = pat.lower()
+                return lambda c, pat=pat, ci=ci, onpath=onpath: fnmatch.fnmatchcase(
+                    (c[0] if onpath else c[1]).lower() if ci else (c[0] if onpath else c[1]), pat)
+            if t == '-type':
+                ty = arg()
+                if not set(ty.split(',')) <= {'f', 'd'}:
+                    raise Unsup()
+                tys = set(ty.split(','))
+                return lambda c, tys=tys: ('d' if c[2] else 'f') in tys
+            if t in ('-maxdepth', '-mindepth'):
+                n = arg()
+                if not n.isdigit():
+                    raise Unsup()
+                depth['max' if t == '-maxdepth' else 'min'] = int(n)
+                return lambda c: True
+            if t in TRUEOPS:
+                return lambda c: True
+            if t in ('-exec', '-execdir', '-ok', '-okdir'):
+                while peek() is not None and peek() not in (';', '+'):
+                    take()
+                if take() is None:
+                    raise Unsup()
+                return lambda c: True
+            raise Unsup()
+
+        def p_not():
+            if peek() in ('!', '-not'):
+                take()
+                e = p_not()
+                return lambda c, e=e: not e(c)
+            return primary()
+
+        def p_and():
+            e = p_not()
+            while peek() is not None and peek() not in (')', '-o', '-or'):
+                if peek() in ('-a', '-and'):
+                    take()
+                r = p_not()
+                e = (lambda l, r: lambda c: l(c) and r(c))(e, r)
+            return e
+
+        def p_or():
+            e = p_and()
+            while peek() in ('-o', '-or'):
+                take()
+                r = p_and()
+                e = (lambda l, r: lambda c: l(c) or r(c))(e, r)
+            return e
+
+        e = p_or() if toks else (lambda c: True)
+        if pos[0] != len(toks):
+            raise Unsup()
+        return e, depth
+
+    def find_start(a, cwd, expr):
+        try:
+            sv = value(a)
+            sabs = sv if os.path.isabs(sv) else (None if cwd is None else os.path.join(cwd, sv))
+            if sabs is None or GLOBCH.search(sv):
+                raise Fallback()
+        except Fallback:
+            fb[0] = True
+            return
+        sreal = os.path.realpath(sabs)
+        c = classify(sreal)
+        if c is None:
+            return
+        try:
+            pred, depth = find_compile(expr)
+        except Unsup:
+            rl = low(sreal).rstrip('/') or '/'
+            rootl = low(root)
+            if rl == rootl or rootl.startswith(rl.rstrip('/') + '/') or rl == '/':
+                fb[0] = True  # project root or above: legacy decides
+            else:
+                hits.append((sreal, False, c))
+            return
+        sl = low(sreal).rstrip('/')
+        for p in prot:
+            if p == sl or p.startswith(sl + '/'):
+                walk_root = sreal + p[len(sl):]
+            elif sl.startswith(p + '/'):
+                walk_root = sreal
+            else:
+                continue
+            if not os.path.exists(walk_root):
+                continue
+            entries = [(walk_root, os.path.isdir(walk_root))]
+            if os.path.isdir(walk_root) and not os.path.islink(walk_root):
+                for dp, dns, fns in os.walk(walk_root):
+                    entries += [(os.path.join(dp, x), True) for x in dns]
+                    entries += [(os.path.join(dp, x), False) for x in fns]
+            for path, isdir in entries:
+                rel = os.path.relpath(path, sreal)
+                d = 0 if rel == '.' else rel.count(os.sep) + 1
+                if d < depth['min'] or (depth['max'] is not None and d > depth['max']):
+                    continue
+                disp = sv if rel == '.' else (sv.rstrip('/') + '/' + rel)
+                name = os.path.basename(disp.rstrip('/')) or disp
+                if pred((disp, name, isdir, d)):
+                    hits.append((path, False, 'inside'))
+                    return
+
+    xargs_pipes = []
+    segs = []
+
+    def handle(argv, cwd, pipe_id):
+        try:
+            argv, cwd2 = unwrap(argv, cwd)
+        except Fallback:
+            fb[0] = True
+            return cwd
+        if not argv:
+            return cwd
+        if argv[0].exp:
+            fb[0] = True
+            return cwd
+        v = os.path.basename(argv[0].v)
+        args = argv[1:]
+        if v in ('cd', 'pushd', 'popd'):
+            if cwd2 is not cwd:
+                return None
+            if v != 'cd':
+                return None
+            if not args:
+                return os.path.expanduser('~')
+            tgt = [a for a in args if not (a.v.startswith('-') and a.v != '-')]
+            if len(tgt) != 1 or tgt[0].v == '-':
+                return None
+            try:
+                t = value(tgt[0])
+            except Fallback:
+                return None
+            if not os.path.isabs(t):
+                if cwd is None:
+                    return None
+                t = os.path.join(cwd, t)
+            return os.path.realpath(t)
+        shell_cwd, cwd = cwd, cwd2
+        if v in DESTR:
+            opts, posl = opts_pos(args, {'-s', '--size', '-r', '--reference', '-n', '--iterations'}
+                                  if v in ('truncate', 'shred') else ())
+            rec = v == 'rm' and (short_has(opts, 'r') or short_has(opts, 'R') or '--recursive' in opts)
+            for a in posl:
+                check(a, cwd, 'block' if rec else 'fallback')
+        elif v == 'mv':
+            mv_targets(args, cwd)
+        elif v == 'git':
+            sub, rest, gcwd = git_split(args, cwd)
+            if sub is None:
+                if risky(args):
+                    fb[0] = True
+            elif sub == 'rm':
+                opts, posl = opts_pos(rest, {'--pathspec-from-file'})
+                if not ('-n' in opts or '--dry-run' in opts or short_has(opts, 'n')):
+                    rec = short_has(opts, 'r')
+                    for a in posl:
+                        check(a, gcwd, 'block' if rec else 'fallback')
+            elif sub == 'mv':
+                mv_targets(rest, gcwd)
+            elif sub == 'clean':
+                opts, posl = opts_pos(rest, {'-e', '--exclude'})
+                if not (short_has(opts, 'n') or '--dry-run' in opts):
+                    rec = short_has(opts, 'd')
+                    if posl:
+                        for a in posl:
+                            check(a, gcwd, 'block' if rec else 'ignore')
+                    elif gcwd is None:
+                        fb[0] = True
+                    else:
+                        check(Word(gcwd, False, False, False, gcwd), gcwd, 'block' if rec else 'ignore')
+            elif risky(rest):
+                fb[0] = True
+        elif v == 'find':
+            j, destructive = 0, '-delete' in [a.v for a in args]
+            while j < len(args):
+                if args[j].v in ('-exec', '-execdir', '-ok', '-okdir'):
+                    k = j + 1
+                    while k < len(args) and args[k].v not in (';', '+'):
+                        k += 1
+                    body = args[j + 1:k]
+                    kd = kind(body, cwd) if body else None
+                    if kd == 'destr':
+                        destructive = True
+                    elif kd == 'risky':
+                        fb[0] = True
+                    if body:
+                        handle(body, cwd, pipe_id)
+                    j = k
+                j += 1
+            if destructive:
+                k = 0
+                while k < len(args) and args[k].v in ('-H', '-L', '-P', '-D', '-E', '-X', '-d', '-s', '-x') \
+                        or (k < len(args) and args[k].v.startswith('-O')):
+                    k += 2 if args[k].v == '-D' else 1
+                starts = []
+                while k < len(args) and not (args[k].v.startswith('-') or args[k].v in ('(', '!', ')')):
+                    starts.append(args[k])
+                    k += 1
+                expr = args[k:]
+                for a in (starts or [Word('.', False, False, False, '.')]):
+                    find_start(a, cwd, expr)
+        elif v == 'xargs':
+            i = 0
+            valopts = {'-I', '-J', '-L', '-n', '-P', '-R', '-S', '-s', '-E', '-a', '-d',
+                       '--max-args', '--max-procs', '--delimiter', '--arg-file', '--max-chars',
+                       '--process-slot-var'}
+            while i < len(args) and args[i].v.startswith('-') and not args[i].exp:
+                if args[i].v == '--':
+                    i += 1
+                    break
+                i += 2 if args[i].v in valopts else 1
+            inner = args[i:]
+            kd = kind(inner, cwd) if inner else None
+            if kd == 'destr':
+                xargs_pipes.append(pipe_id)
+            elif kd == 'risky':
+                fb[0] = True
+            if inner:
+                handle(inner, cwd, pipe_id)
+        elif risky(args):
+            fb[0] = True
+        return shell_cwd
+
+    cur, pipe_id, stack, cwd = [], 0, [], start
+    pending_redir = [None]
+
+    def flush():
+        nonlocal cwd
+        if pending_redir[0] is not None:
+            raise Fallback()
+        if not cur:
+            return
+        argv = [x for x in cur if not isinstance(x, tuple)]
+        for op, w in [x for x in cur if isinstance(x, tuple)]:
+            if op in WREDIR or (op == '>&' and not re.match(r'^(\d+|-)$', w.v)):
+                check(w, cwd, 'ignore')
+        if argv and all(not w.exp and VAR.match(w.v) for w in argv):
+            for w in argv:
+                k, _, val = w.v.partition('=')
+                shvars[k] = None if (w.brace or w.tilde or GLOBCH.search(val)) else val
+        segs.append((pipe_id, argv, cwd))
+        cwd = handle(argv, cwd, pipe_id)
+        del cur[:]
+
+    try:
+        for kindt, t in toks:
+            if kindt == 'w':
+                if pending_redir[0] is not None:
+                    cur.append((pending_redir[0], t))
+                    pending_redir[0] = None
+                else:
+                    cur.append(t)
+                continue
+            if t in SEP:
+                flush()
+                if t == '(':
+                    stack.append(cwd)
+                elif t == ')' and stack:
+                    cwd = stack.pop()
+                if t not in ('|', '|&'):
+                    pipe_id += 1
+            elif t in ('<<', '<<-'):
+                continue  # delimiter and body already consumed by the lexer
+            elif t in WREDIR or t in OREDIR or t == '>&':
+                if pending_redir[0] is not None:
+                    raise Fallback()
+                pending_redir[0] = t
+            else:
+                raise Fallback()
+        flush()
+    except Fallback:
+        return 3
+
+    for pid in set(xargs_pipes):
+        for sp, sargv, scwd in segs:
+            if sp != pid or not sargv or os.path.basename(sargv[0].v) == 'xargs':
+                continue
+            for a in sargv[1:]:
+                if a.v.startswith('-') or a.exp:
+                    continue
+                check(a, scwd, 'fallback')
+
+    if not hits:
+        return 3 if fb[0] else 0
+
+    anc = [h for h in hits if h[2] == 'anc']
+    hnames = sorted({h[0] for h in hits})
+    if anc:
+        print("[Hook] ⛔ RULE DELETION BLOCKED — Parent directory deletion detected", file=sys.stderr)
+        print("[Hook] Target: %s (an ancestor of the project rule directories)" % anc[0][0], file=sys.stderr)
+        print("[Hook] This recursive delete/move would also remove .claude/rules (or templates/.claude/rules).",
+              file=sys.stderr)
+        print("[Hook] Delete rules individually with user confirmation.", file=sys.stderr)
+        print("[Hook] 룰 파일 수정은 Write/Edit 도구를 사용하십시오 (셸 리다이렉트/삭제 금지).", file=sys.stderr)
+    elif len(hnames) > 1 or any(h[1] for h in hits):
+        print("[Hook] ⛔ RULE DELETION BLOCKED — Multiple rules detected", file=sys.stderr)
+        print("[Hook] Targets: %s" % ", ".join(hnames), file=sys.stderr)
+        print("[Hook] Rule files must be deleted ONE AT A TIME with user confirmation.", file=sys.stderr)
+        print("[Hook] Delete each rule individually after asking: \"정말 {파일명}을(를) 삭제하시겠습니까?\"", file=sys.stderr)
+        print("[Hook] 룰 파일 수정은 Write/Edit 도구를 사용하십시오 (셸 리다이렉트/삭제 금지).", file=sys.stderr)
+    else:
+        fn = os.path.basename(hnames[0]) or hnames[0]
+        print("[Hook] ⛔ RULE DELETION BLOCKED", file=sys.stderr)
+        print("[Hook] Target: %s" % hnames[0], file=sys.stderr)
+        print("[Hook] Rule files require individual user confirmation before deletion.", file=sys.stderr)
+        print("[Hook] Ask the user: \"정말 %s을(를) 삭제하시겠습니까?\"" % fn, file=sys.stderr)
+        print("[Hook] Only proceed after explicit user approval.", file=sys.stderr)
+        print("[Hook] 룰 파일 수정은 Write/Edit 도구를 사용하십시오 (셸 리다이렉트/삭제 금지).", file=sys.stderr)
+    return 2
+
+
+try:
+    data = json.loads(sys.stdin.buffer.read().decode('utf-8', 'replace'))
+except Exception:
+    sys.exit(0)
+if not isinstance(data, dict):
+    sys.exit(0)
+tool = data.get('tool_name') or data.get('tool') or ''
+ti = data.get('tool_input')
+command = ti.get('command') if isinstance(ti, dict) else ''
+if tool != 'Bash' or not isinstance(command, str) or not command:
+    sys.exit(0)
+try:
+    rc = main(data, command)
+except Exception:
+    rc = 3
+if rc == 3:
+    sys.stdout.write(command)
+sys.exit(rc)
+PY
+}
+
+if command -v python3 &>/dev/null; then
+  # Cheap pre-filter: skip the interpreter unless a destructive verb word or '>' appears in the payload.
+  if ! printf '%s' "$input" | grep -qE '(^|[^[:alnum:]_]|\\[nrt]|\\u00)(rm|mv|unlink|rmdir|shred|truncate|find|xargs|clean)([^[:alnum:]_]|$)|>'; then
+    pass
+  fi
+
+  out=$(printf '%s' "$input" | run_analyzer)
+  rc=$?
+  case "$rc" in
+    0) pass ;;
+    2) exit 2 ;;
+    3) legacy_check "$out" strict; pass ;;
+    *)
+      # Unexpected interpreter failure: fall back to legacy via jq if possible, else fail-open
+      if command -v jq &>/dev/null; then
+        cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || pass
+        tool=$(printf '%s\n' "$input" | jq -r '.tool_name // .tool // ""' 2>/dev/null) || pass
+        [ "$tool" = "Bash" ] && legacy_check "$cmd" strict
+      fi
+      pass
+      ;;
+  esac
 fi
 
-# Not a rule deletion — pass through
-printf '%s\n' "$input"
-exit 0
+# python3 absent: legacy regex logic (jq required)
+if ! command -v jq &>/dev/null; then
+  pass
+fi
+tool=$(printf '%s\n' "$input" | jq -r '.tool_name // .tool // ""' 2>/dev/null) || pass
+cmd=$(printf '%s\n' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null) || pass
+if [ "$tool" != "Bash" ]; then
+  pass
+fi
+legacy_check "$cmd"
+pass

package/templates/.claude/skills/claude-native/SKILL.md

@@ -182,13 +182,13 @@ Semver comparison: major → minor → patch (all numeric). Pre-release suffixes
 
 ### Automatic (SessionStart Hook)
 
-Can be integrated into the SessionStart hook to check for new releases at session start:
+Can be integrated into the SessionStart hook to check for new releases at session start (illustrative example — `claude-native-check.sh` is a hypothetical script you would write yourself; it is not shipped or registered in `hooks.json`):
 
 ```json
 {
   "SessionStart": [
     {
-      "command": "bash .claude/hooks/scripts/claude-native-check.sh"
+      "command": "bash \"${CLAUDE_PROJECT_DIR:-.}/.claude/hooks/scripts/claude-native-check.sh\""
     }
   ]
 }

package/templates/.claude/skills/homework/SKILL.md

@@ -145,6 +145,8 @@ Assemble a feedback issue in Korean using the #1266 format:
 
 If `--severity` filter is active, include only findings at or above the threshold. Note the filter in the issue body.
 
+When a 하네스 제안 item contains a runnable command, run it once at draft time (positive and negative fixture where applicable) and record the observed exit code/output next to that proposal; a command that only reports failure must be caught here, not in review (e.g. `bunx biome check` exits 0 inside biome's `files.includes` scope but 1 outside it, so a norm requiring it for all TS/JS reports failure for out-of-scope files regardless of formatting). (#1781 찐빠 #1)
+
 If no findings are discovered, output:
 ```
 [homework] 이번 세션에서 찐빠를 발견하지 못했습니다. (세션 정상 종료)

package/templates/.claude/skills/pipeline/workflows/auto-dev.yaml

@@ -413,7 +413,7 @@ steps:
 
   - name: deep-plan
     skill: deep-plan
-    description: "Research-validated implementation plan (research → plan → verify) — skipped if docs-only, integrated-analysis allowed if lite; independent of tier, MAY run in lightweight mode when compression-mode-eval's 'Cross-tier — Lightweight Skill-Mode Substitution' conditions are met. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). 리서치·계측 위임의 완료 조건에는 결론 수치를 산출물 표에서 jq/awk로 재계산해 병기하도록 명시한다(#1707 #4). 테스트 격리·모듈 모킹 수정을 다루는 리서치·계획 위임에도 대상 src 파일과 All files의 수정 전후 커버리지를 동일 하네스로 비교하도록 완료 조건에 명시합니다(#1778 찐빠 #5, implement 스텝 Rules와 동일 요구)."
+    description: "Research-validated implementation plan (research → plan → verify) — skipped if docs-only, integrated-analysis allowed if lite; independent of tier, MAY run in lightweight mode when compression-mode-eval's 'Cross-tier — Lightweight Skill-Mode Substitution' conditions are met. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). 리서치·계측 위임의 완료 조건에는 결론 수치를 산출물 표에서 jq/awk로 재계산해 병기하도록 명시한다(#1707 #4). 테스트 격리·모듈 모킹 수정을 다루는 리서치·계획 위임에도 대상 src 파일과 All files의 수정 전후 커버리지를 동일 하네스로 비교하도록 완료 조건에 명시합니다(#1778 찐빠 #5, implement 스텝 Rules와 동일 요구). 적용 경계 표에는 각 행마다 이 위치를 읽는 위임 유형/단계 열을 두고 결함이 발생한 단계와 일치하는지 표에서 대조합니다(#1781 찐빠 #2). 기본값·출력 리터럴을 바꾸는 계획은 그 리터럴을 단언하는 기존 테스트를 git grep으로 전수 열거해 웨이브 표의 파일 소유권에 포함합니다(git grep은 untracked 파일을 보지 못하므로 git status --porcelain도 확인합니다, #1786 찐빠 #5)."
     depends_on: plan
 
   - name: implement
@@ -486,6 +486,9 @@ steps:
         its lightweight tier substitute, applying to lite and standard tiers, and
         implement-stage delegation prompts MUST carry the relevant boundary row for each edit
         (회고 제안 묶음 릴리즈의 통합 분석에 적용 경계 표 필수, #1735 찐빠 #4).
+        The table MUST include a column naming which delegation type/step reads each target
+        location and be checked against the step where the defect occurred; a mismatch means
+        the clause must also be placed at the location that step reads (#1781 찐빠 #2).
       - Before dispatching any delegation prompt in an iteration that created or reinforced a rule
         clause, the orchestrator MUST compare that clause's Anti-pattern table rows 1:1 against the
         delegation prompt's sentences and rewrite any match (cause: the R016 「신설 조항의 동일
@@ -502,7 +505,7 @@ steps:
         block: (a) Korean 합쇼체 for new sentences, do not imitate adjacent 반말 — completion
         criteria MUST include THREE deterministic checks, scoped to edited text files (md/yaml)
         and restricted to added lines only (`git diff -U0 -- <edited md/yaml files> | grep
-        '^+'`): family check `grep -cE '(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 "]'`
+        '^+'`): family check `grep -cE '(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 "(]'`
         = 0, line-final auxiliary check `grep -E '다[.。"]?$' | grep -vcE '니다[.。"]?$'` = 0
         (the family list alone misses endings such as 따른다/했다/있다 and unpunctuated
         line-final endings; the line-final check excludes 합쇼체 `-니다` endings so it does not
@@ -521,7 +524,7 @@ steps:
         python3 `re` equivalent of all THREE checks above, reading from the SAME piped stdin as
         (a) (`git diff -U0 -- <edited md/yaml files> | grep '^+' | python3 -c "import re,sys;
         text=sys.stdin.read();
-        fam=len(re.findall(r'(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 \"]', text));
+        fam=len(re.findall(r'(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 \"(]', text));
         lf=len(re.findall(r'다[.。\"]?$', text, re.M)) - len(re.findall(r'니다[.。\"]?$', text, re.M));
         noun=len(re.findall(r'(함|됨|필요)[.。\"]?$', text, re.M));
         print(fam, lf, noun)"`, NOT a file-argument read — the input is the piped diff, never a
@@ -550,7 +553,11 @@ steps:
         delegation creates MUST live under a per-agent-unique path (`$TMPDIR` or the session
         scratchpad), never a fixed shared path (#1722 찐빠 #7). This governs the agent's own
         ad-hoc temp files; temp paths created at runtime by test code are governed by the
-        separate test-code temp-path bullet below (#1778 찐빠 #4).
+        separate test-code temp-path bullet below (#1778 찐빠 #4); (i) when the edit writes a runnable
+        command or code snippet into rule/skill/guide/workflow text, the agent MUST copy that command OUT of the
+        edited file and run it on a positive and a negative fixture, putting both raw outputs in the
+        completion report (the #1752 fixture bullet below, carried here so it reaches the prompt;
+        #1781 찐빠 #1).
       - Any implement-stage delegation that writes an executable command or code snippet into
         rule/skill/guide/workflow TEXT (not a prose-only edit) MUST require, as a completion-report
         item, that the agent copy the command OUT of the edited file and run it once on a positive
@@ -706,6 +713,13 @@ steps:
         measurement; (c) no working around a discovered product or measurement defect to force
         a pass — halt and report instead (R023 「Conditional-Output Verification」 양성/음성 짝
         원칙 확장, #1721 찐빠 #1, #1727 찐빠 #2, #1728 찐빠 #2).
+      - A delegation that adds an item to an existing list or loop (e.g. a sync-file list) MUST
+        require, as a completion item, citing with file:line how that list handles preserveFiles,
+        protection and backup contracts, and judging whether the new item is consistent with the
+        other components in the same run (#1786 찐빠 #1).
+      - A delegation that writes migration/upgrade tests MUST require, as a completion item, that
+        every "old state" fixture be derived from that version's generator output (or real tagged
+        artifacts; cite the call used), never hand-written from source expressions (#1786 찐빠 #2).
       - Delegations (research or implementation) that design or fix test isolation or module
         mocking MUST include in their completion criteria a before/after coverage comparison
         of the target src file(s) AND the All-files total, measured with the SAME harness

package/templates/.claude/skills/playwright-compress/SKILL.md

@@ -50,14 +50,14 @@ MCP tool response (37K+ chars)
 
 ## Hook Configuration
 
-Configured in `.claude/hooks/hooks.json` PostToolUse section:
+Configured in `.claude/hooks/hooks.json` PostToolUse section (the entry whose command runs `playwright-compress.sh`):
 
 ```json
 {
   "matcher": "mcp_tool_name matches \"mcp__playwright__.*\" || mcp_tool_name matches \"mcp__claude-in-chrome__.*\"",
   "hooks": [{
     "type": "command",
-    "command": "bash .claude/hooks/scripts/playwright-compress.sh"
+    "command": "bash \"${CLAUDE_PROJECT_DIR:-.}/.claude/hooks/scripts/playwright-compress.sh\""
   }],
   "description": "Layer 4: Compress Playwright/Chrome MCP output via Haiku summarization"
 }

package/templates/guides/middleware-patterns/README.md

@@ -348,13 +348,13 @@ fi
 exit 0
 ```
 
-hooks.json 등록:
+hooks.json 등록 (illustrative — `your-middleware.sh` is a placeholder, not a shipped script):
 ```json
 {
   "PreToolUse": [
     {
       "matcher": "Bash",
-      "command": ".claude/hooks/your-middleware.sh",
+      "command": "bash \"${CLAUDE_PROJECT_DIR:-.}/.claude/hooks/scripts/your-middleware.sh\"",
       "description": "lifecycle: wrap_tool_call — 위험 패턴 감지"
     }
   ]
@@ -394,7 +394,7 @@ limitations:
 훅 스크립트의 단위 테스트:
 ```bash
 # PreToolUse hook 직접 테스트
-CLAUDE_TOOL_NAME="Bash" CLAUDE_TOOL_INPUT="rm -rf /" .claude/hooks/your-middleware.sh
+CLAUDE_TOOL_NAME="Bash" CLAUDE_TOOL_INPUT="rm -rf /" .claude/hooks/scripts/your-middleware.sh
 echo "Exit: $?"  # 0 또는 2 확인
 ```
 

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.94",
+  "version": "1.1.95",
   "lastUpdated": "2026-09-03",
   "omcustomMinClaudeCode": "2.1.121",
   "omcustomMinClaudeCodeReason": "Sensitive-path direct Write/Edit on .claude/** under bypassPermissions (R010 deprecation, #1101)",

package/templates/workflows/auto-dev.yaml

@@ -413,7 +413,7 @@ steps:
 
   - name: deep-plan
     skill: deep-plan
-    description: "Research-validated implementation plan (research → plan → verify) — skipped if docs-only, integrated-analysis allowed if lite; independent of tier, MAY run in lightweight mode when compression-mode-eval's 'Cross-tier — Lightweight Skill-Mode Substitution' conditions are met. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). 리서치·계측 위임의 완료 조건에는 결론 수치를 산출물 표에서 jq/awk로 재계산해 병기하도록 명시한다(#1707 #4). 테스트 격리·모듈 모킹 수정을 다루는 리서치·계획 위임에도 대상 src 파일과 All files의 수정 전후 커버리지를 동일 하네스로 비교하도록 완료 조건에 명시합니다(#1778 찐빠 #5, implement 스텝 Rules와 동일 요구)."
+    description: "Research-validated implementation plan (research → plan → verify) — skipped if docs-only, integrated-analysis allowed if lite; independent of tier, MAY run in lightweight mode when compression-mode-eval's 'Cross-tier — Lightweight Skill-Mode Substitution' conditions are met. MULTI-PHASE: 스킬을 그대로 spawn하지 말고 R020 「위임 경계를 Phase 개수로 설계」에 따라 단일 목표 위임으로 분할해 순차 발주한다 (#1595 #4). 리서치·계측 위임의 완료 조건에는 결론 수치를 산출물 표에서 jq/awk로 재계산해 병기하도록 명시한다(#1707 #4). 테스트 격리·모듈 모킹 수정을 다루는 리서치·계획 위임에도 대상 src 파일과 All files의 수정 전후 커버리지를 동일 하네스로 비교하도록 완료 조건에 명시합니다(#1778 찐빠 #5, implement 스텝 Rules와 동일 요구). 적용 경계 표에는 각 행마다 이 위치를 읽는 위임 유형/단계 열을 두고 결함이 발생한 단계와 일치하는지 표에서 대조합니다(#1781 찐빠 #2). 기본값·출력 리터럴을 바꾸는 계획은 그 리터럴을 단언하는 기존 테스트를 git grep으로 전수 열거해 웨이브 표의 파일 소유권에 포함합니다(git grep은 untracked 파일을 보지 못하므로 git status --porcelain도 확인합니다, #1786 찐빠 #5)."
     depends_on: plan
 
   - name: implement
@@ -486,6 +486,9 @@ steps:
         its lightweight tier substitute, applying to lite and standard tiers, and
         implement-stage delegation prompts MUST carry the relevant boundary row for each edit
         (회고 제안 묶음 릴리즈의 통합 분석에 적용 경계 표 필수, #1735 찐빠 #4).
+        The table MUST include a column naming which delegation type/step reads each target
+        location and be checked against the step where the defect occurred; a mismatch means
+        the clause must also be placed at the location that step reads (#1781 찐빠 #2).
       - Before dispatching any delegation prompt in an iteration that created or reinforced a rule
         clause, the orchestrator MUST compare that clause's Anti-pattern table rows 1:1 against the
         delegation prompt's sentences and rewrite any match (cause: the R016 「신설 조항의 동일
@@ -502,7 +505,7 @@ steps:
         block: (a) Korean 합쇼체 for new sentences, do not imitate adjacent 반말 — completion
         criteria MUST include THREE deterministic checks, scoped to edited text files (md/yaml)
         and restricted to added lines only (`git diff -U0 -- <edited md/yaml files> | grep
-        '^+'`): family check `grep -cE '(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 "]'`
+        '^+'`): family check `grep -cE '(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 "(]'`
         = 0, line-final auxiliary check `grep -E '다[.。"]?$' | grep -vcE '니다[.。"]?$'` = 0
         (the family list alone misses endings such as 따른다/했다/있다 and unpunctuated
         line-final endings; the line-final check excludes 합쇼체 `-니다` endings so it does not
@@ -521,7 +524,7 @@ steps:
         python3 `re` equivalent of all THREE checks above, reading from the SAME piped stdin as
         (a) (`git diff -U0 -- <edited md/yaml files> | grep '^+' | python3 -c "import re,sys;
         text=sys.stdin.read();
-        fam=len(re.findall(r'(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 \"]', text));
+        fam=len(re.findall(r'(한다|된다|않는다|따른다|했다|있다|없다|넣는다|이다)[.。 \"(]', text));
         lf=len(re.findall(r'다[.。\"]?$', text, re.M)) - len(re.findall(r'니다[.。\"]?$', text, re.M));
         noun=len(re.findall(r'(함|됨|필요)[.。\"]?$', text, re.M));
         print(fam, lf, noun)"`, NOT a file-argument read — the input is the piped diff, never a
@@ -550,7 +553,11 @@ steps:
         delegation creates MUST live under a per-agent-unique path (`$TMPDIR` or the session
         scratchpad), never a fixed shared path (#1722 찐빠 #7). This governs the agent's own
         ad-hoc temp files; temp paths created at runtime by test code are governed by the
-        separate test-code temp-path bullet below (#1778 찐빠 #4).
+        separate test-code temp-path bullet below (#1778 찐빠 #4); (i) when the edit writes a runnable
+        command or code snippet into rule/skill/guide/workflow text, the agent MUST copy that command OUT of the
+        edited file and run it on a positive and a negative fixture, putting both raw outputs in the
+        completion report (the #1752 fixture bullet below, carried here so it reaches the prompt;
+        #1781 찐빠 #1).
       - Any implement-stage delegation that writes an executable command or code snippet into
         rule/skill/guide/workflow TEXT (not a prose-only edit) MUST require, as a completion-report
         item, that the agent copy the command OUT of the edited file and run it once on a positive
@@ -706,6 +713,13 @@ steps:
         measurement; (c) no working around a discovered product or measurement defect to force
         a pass — halt and report instead (R023 「Conditional-Output Verification」 양성/음성 짝
         원칙 확장, #1721 찐빠 #1, #1727 찐빠 #2, #1728 찐빠 #2).
+      - A delegation that adds an item to an existing list or loop (e.g. a sync-file list) MUST
+        require, as a completion item, citing with file:line how that list handles preserveFiles,
+        protection and backup contracts, and judging whether the new item is consistent with the
+        other components in the same run (#1786 찐빠 #1).
+      - A delegation that writes migration/upgrade tests MUST require, as a completion item, that
+        every "old state" fixture be derived from that version's generator output (or real tagged
+        artifacts; cite the call used), never hand-written from source expressions (#1786 찐빠 #2).
       - Delegations (research or implementation) that design or fix test isolation or module
         mocking MUST include in their completion criteria a before/after coverage comparison
         of the target src file(s) AND the All-files total, measured with the SAME harness