oh-my-customcodex 0.5.18 → 0.5.20

package/dist/cli/index.js

@@ -3091,7 +3091,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "0.5.18",
+    version: "0.5.20",
     requiresCC: ">=2.1.121",
     claudeCode: {
       minimumVersion: "2.1.121",

package/dist/index.js

@@ -2316,7 +2316,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "0.5.18",
+  version: "0.5.20",
   requiresCC: ">=2.1.121",
   claudeCode: {
     minimumVersion: "2.1.121",

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "0.5.18",
+  "version": "0.5.20",
   "requiresCC": ">=2.1.121",
   "claudeCode": {
     "minimumVersion": "2.1.121",

package/templates/.claude/hooks/hooks.json

@@ -102,6 +102,16 @@
         ],
         "description": "Block Bash/Write/Edit writes into .claude/ sensitive paths before Claude Code permission prompts fire"
       },
+      {
+        "matcher": "tool == \"Bash\" && tool_input.command matches \"(^|[[:space:];&|])(status|path|argv)[[:space:]]*=\"",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash .codex/hooks/scripts/shell-reserved-var-advisor.sh"
+          }
+        ],
+        "description": "Warn on zsh/bash reserved variable assignments such as status=, path=, or argv= before shell execution (R020/#1491)"
+      },
       {
         "matcher": "tool == \"Bash\"",
         "hooks": [

package/templates/.claude/hooks/scripts/shell-reserved-var-advisor.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# shell-reserved-var-advisor.sh — advisory guard for zsh/bash special variable assignments.
+# Trigger: PreToolUse (Bash matcher)
+
+set -euo pipefail
+
+input=$(cat)
+command=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
+
+if [ -z "$command" ]; then
+  printf '%s' "$input"
+  exit 0
+fi
+
+# zsh exposes several lowercase special parameters as read-only or semantically
+# dangerous. `status=...` is the frequent footgun in polling snippets; `path`
+# and `argv` are arrays/special parameters. Match assignment starts after common
+# shell separators or whitespace, but do not match safe names like run_status=.
+if printf '%s\n' "$command" | grep -Eq '(^|[[:space:];&|])(status|path|argv)[[:space:]]*='; then
+  echo '[Hook] WARNING: reserved shell variable assignment detected (R020/#1491).' >&2
+  echo '[Hook] Avoid zsh/bash special names: status, path, argv.' >&2
+  echo '[Hook] Use safe names such as run_status, cmd_path, or args before executing.' >&2
+fi
+
+printf '%s' "$input"

package/templates/.claude/rules/MUST-completion-verification.md

@@ -85,8 +85,10 @@ Before invoking or registering generated workflow code, run a Tier-1 sanity pass
 
 1. Search for unresolved placeholders, malformed identifiers, and known dead-line patterns.
 2. Assemble the exact script body before execution; do not concatenate facts or guardrails after the call starts.
-3. Run the language parser or the narrowest no-side-effect syntax check available.
-4. If syntax validation is unavailable, read the generated body back and perform a focused self-review before launch.
+3. For compound shell verification or release gates, start the script with `set -euo pipefail`; `set -o pipefail` alone does not stop later sequential gates after an earlier command fails.
+4. For zsh/bash snippets, avoid reserved or special variable names such as `status`, `path`, and `argv`; use `run_status`, `cmd_path`, `args`, or similarly specific names.
+5. Run the language parser or the narrowest no-side-effect syntax check available.
+6. If syntax validation is unavailable, read the generated body back and perform a focused self-review before launch.
 
 This check is mandatory for workflow scripts that will run automation, mutate GitHub state, or gate a release.
 

package/templates/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.18",
+  "version": "0.5.20",
   "requiresCC": ">=2.1.121",
   "claudeCode": {
     "minimumVersion": "2.1.121",

package/templates/workflows/auto-dev.yaml

@@ -126,6 +126,11 @@ steps:
       - If a scoped issue is added or materially changed after verify-build starts, reset this phase and re-run the full verify-build gate for the new aggregate scope.
       - Do not proceed to release from a verify-build result collected before the latest scoped implementation change.
 
+      Shell execution discipline:
+      - Run compound verification commands under `set -euo pipefail` so lint, typecheck, tests, and build halt on the first failed gate.
+      - Do not rely on `set -o pipefail` alone for sequential verification chains.
+      - Avoid reserved shell variable names in polling or status snippets (`status`, `path`, `argv`); use `run_status`, `cmd_path`, or `args` instead.
+
       For Node/Bun projects:
       1. Run `bun install` and halt on lockfile drift.
       2. Run `bun run lint` when available.