oh-my-customcodex 1.0.1 → 1.0.3

package/dist/cli/index.js

@@ -3091,7 +3091,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.0.1",
+    version: "1.0.3",
     requiresCC: ">=2.1.121",
     claudeCode: {
       minimumVersion: "2.1.121",

package/dist/index.js

@@ -2316,7 +2316,7 @@ var package_default = {
   workspaces: [
     "packages/*"
   ],
-  version: "1.0.1",
+  version: "1.0.3",
   requiresCC: ">=2.1.121",
   claudeCode: {
     minimumVersion: "2.1.121",

package/package.json

@@ -3,7 +3,7 @@
   "workspaces": [
     "packages/*"
   ],
-  "version": "1.0.1",
+  "version": "1.0.3",
   "requiresCC": ">=2.1.121",
   "claudeCode": {
     "minimumVersion": "2.1.121",

package/templates/.claude/agents/infra-aws-expert.md

@@ -40,10 +40,64 @@ Skills are located at: `.claude/skills/aws-best-practices/`
 
 Guides are located at: `guides/aws/`
 
+## AWS MCP Server Integration (opt-in)
+
+The AWS MCP Server (GA) is a remote MCP server managed by AWS that provides live documentation lookup and real AWS API execution. It complements this agent's offline design/IaC role by filling two gaps: knowledge-cutoff staleness and lack of direct execution.
+
+### Available Tools (when aws-mcp is configured)
+
+| Tool | Purpose | Privilege level |
+|------|---------|----------------|
+| `search_documentation` | Full-text search across latest AWS docs and best practices | Read-only, safe |
+| `read_documentation` | Fetch a specific AWS documentation page | Read-only, safe |
+| `call_aws` | Execute 15,000+ AWS API operations using existing IAM credentials | **HIGH — can create/modify/delete resources** |
+| `run_script` | Run sandboxed Python with IAM permissions (no network/filesystem access) | Sandboxed, IAM-scoped |
+
+### Usage Guidelines
+
+When aws-mcp is available, prioritize live documentation over static knowledge:
+
+1. Use `search_documentation` / `read_documentation` first to verify current AWS API syntax, service limits, and best practices before designing or reviewing architecture.
+2. Use `call_aws` only when the user explicitly requests real AWS operations (describe, create, modify, delete). Default to IaC code generation (CloudFormation/CDK/Terraform) for infrastructure changes.
+3. Use `run_script` for AWS data analysis or resource audits that benefit from programmatic processing.
+
+### R010/R001 Privileged-Scope Boundary (IMPORTANT)
+
+`call_aws` can create, modify, and delete real AWS resources — it is a high-privilege execution tool.
+
+**Required boundary for any `call_aws` operation:**
+
+- (a) Orchestrator MUST NOT call `call_aws` directly — delegate ALL AWS API execution to this infra-aws-expert agent (R010).
+- (b) The delegation prompt MUST explicitly state: approved actions, forbidden actions (e.g., "do NOT delete resources", "do NOT modify production"), and the authorization scope tied to the user request (R010 Pre-Delegation Privileged-Scope Boundary).
+- (c) Prefer IAM-scoped read-only access (Describe*/List* operations) by default. Write/delete operations require explicit user approval per invocation.
+- (d) NEVER echo IAM credentials, access keys, or secret values into the transcript or output (R001). Reference by name only.
+- (e) Prefer read-only verification (`describe-*`, `list-*`) before any write operation to confirm target state.
+
+### Activation (opt-in, user-manual)
+
+R001 prohibits auto-installation. The user must install manually:
+
+```bash
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
+```
+
+`mcp-proxy-for-aws` bridges IAM credentials to MCP OAuth. Regional availability: US East (us-east-1), Europe (eu-central-1). AWS API calls are possible in all regions.
+
+Once installed, add `aws-mcp` to the agent's `mcpServers` in `.mcp.json` or the agent frontmatter to activate. Without installation, this agent falls back to the offline `aws-best-practices` skill and `guides/aws/` documents.
+
+### Security Features
+
+- IAM context key-based granular access control
+- CloudWatch `AWS-MCP` namespace separates agent calls from human calls
+- CloudTrail audit trail for all `call_aws` operations
+- Sandboxed script execution (no network or filesystem access)
+
 ## Workflow
 
 1. Understand requirements
-2. Apply aws-best-practices skill
-3. Reference aws guide for specifics
-4. Design/review architecture
-5. Ensure security, scalability, cost optimization
+2. If aws-mcp is available, use `search_documentation` to verify current AWS documentation for the relevant service
+3. Apply aws-best-practices skill for offline patterns and Well-Architected guidance
+4. Reference aws guide for specifics
+5. Design/review architecture — prefer IaC code generation over live `call_aws` unless user explicitly requests real execution
+6. If real AWS operations are needed, confirm scope with user, then use `call_aws` within approved boundary
+7. Ensure security, scalability, cost optimization

package/templates/.claude/rules/MUST-agent-design.md

@@ -24,11 +24,13 @@ tools: [Read, Write, ...]  # Allowed tools
 | `opus` | claude-opus-4-6 | Complex reasoning, architecture |
 | `opusplan` | claude-opus-4-6 + plan mode | Architecture planning with approval gates |
 | `opus47` | claude-opus-4-7 | Latest Opus model, supports xhigh effort |
-Extended context suffix: `[1m]` (e.g., `claude-opus-4-6[1m]`) — enables 1M token context window.
 
+<!-- DETAIL: Fable and Extended Context Aliases (Claude Code v2.1.170+)
+`fable` resolves to `claude-fable-5` for Claude compatibility only: Mythos-class model, tier above Opus; do not change Codex/OMX routing defaults. Extended context suffix `[1m]` (for example, `claude-opus-4-6[1m]`) enables a 1M token context window. For Fable 5, do not append `[1m]`; Claude Code v2.1.173+ strips it because Fable includes 1M context by default.
+-->
 
 <!-- DETAIL: Fallback Models and Thinking Toggle (Claude Code v2.1.166+)
-Claude compatibility settings can declare up to three `fallbackModel` entries tried in order when the primary Claude model is overloaded or unavailable. `--fallback-model` also applies to interactive Claude sessions. Treat this as platform availability failover, not Codex-native model routing or outcome-based escalation. Claude Code v2.1.166+ also supports disabling default thinking with `MAX_THINKING_TOKENS=0`, `--thinking disabled`, or the per-model thinking toggle. Claude Code v2.1.169+ adds `--safe-mode` / `CLAUDE_CODE_SAFE_MODE` to disable customizations for regression isolation, plus `disableBundledSkills` / `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` to hide bundled skills/workflows/slash commands when they conflict with project skills. Codex-native agents continue to use the OMX model contract and `reasoning_effort` routing. Claude Code v2.1.172+ applies `availableModels` restrictions to subagent `model:` overrides, the agent dispatch model picker, and the advisor model; compatibility allowlists should account for version-specific IDs and 1M suffix handling.
+Claude compatibility settings can declare up to three `fallbackModel` entries tried in order when the primary Claude model is overloaded or unavailable. `--fallback-model` also applies to interactive Claude sessions. Treat this as platform availability failover, not Codex-native model routing or outcome-based escalation. Claude Code v2.1.166+ also supports disabling default thinking with `MAX_THINKING_TOKENS=0`, `--thinking disabled`, or the per-model thinking toggle. Claude Code v2.1.169+ adds `--safe-mode` / `CLAUDE_CODE_SAFE_MODE` to disable customizations for regression isolation, plus `disableBundledSkills` / `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` to hide bundled skills/workflows/slash commands when they conflict with project skills. Codex-native agents continue to use the OMX model contract and `reasoning_effort` routing. Claude Code v2.1.172+ applies `availableModels` restrictions to subagent `model:` overrides, the agent dispatch model picker, and the advisor model; compatibility allowlists should account for version-specific IDs and 1M suffix handling. Claude Code v2.1.173+ auto-normalizes Fable 5 IDs with redundant `[1m]` suffixes. Claude Code v2.1.175+ adds `enforceAvailableModels`, which constrains the resolved Default model as well as subagent overrides and prevents user/project settings from widening a managed allowlist.
 -->
 
 ### Optional Frontmatter
@@ -90,6 +92,8 @@ This Codex port ships `.claude` compatibility templates. When updating those tem
 - v2.1.165: bug-fix/reliability release; no local template change required beyond compatibility confirmation. v2.1.166: fallbackModel availability failover and thinking-disable controls are Claude compatibility settings, not Codex/OMX routing. v2.1.167/v2.1.168: bug-fix-only compatibility confirmation.
 - v2.1.169: `--safe-mode` / `CLAUDE_CODE_SAFE_MODE` disables all customizations for Claude regression isolation; `disableBundledSkills` / `CLAUDE_CODE_DISABLE_BUNDLED_SKILLS` hides bundled skills/workflows/slash commands from the model. Keep distinct from advisory `skills:` frontmatter metadata.
 - v2.1.170: Claude compatibility sessions gain access to the `fable` alias (`claude-fable-5`) and fix a VS Code integrated-terminal transcript persistence bug. Skills that rely on transcript replay (for example `homework`) should prefer v2.1.170+ in Claude-template sessions. No Codex runtime model-routing change.
+- v2.1.173: Fable 5 model IDs carrying `[1m]` are auto-normalized because Fable includes 1M context by default; omit the suffix in packaged Claude compatibility metadata.
+- v2.1.175: managed `enforceAvailableModels` constrains the Default model in addition to subagent model overrides, dispatch picker, and advisor model; document this as Claude enterprise config behavior, not Codex model routing.
 -->
 
 ## Hook Event Types

package/templates/.claude/rules/MUST-completion-verification.md

@@ -270,6 +270,19 @@ Before closing or marking-done a task that claims an infrastructure/resource sta
 
 "Issued the teardown" is not evidence that the resource is down.
 
+## Binary/Rendered-Artifact Completeness (text grep ≠ complete)
+
+> Origin: upstream #1384 (second-brain public-repo redaction retrospective) — text and git-history checks passed, but rendered diagram PNGs and one residual host token still contained redaction targets. Additional force-pushes were required because binary/rendered artifacts were checked only after an early completion claim.
+
+For tasks that claim complete removal or cleanup — redaction, identifier removal, secret scrubbing, content cleanup, migration cleanup — a passing text grep is insufficient. Rendered images, PDFs, generated diagrams, binary blobs, embedded metadata, or EXIF can preserve the same content outside the searchable text layer. Before saying “fully removed,” “clean,” or “complete,” verify both text and binary/rendered artifact surfaces.
+
+| Anti-pattern | Required |
+|--------------|----------|
+| Declare cleanup complete after text grep only | Also scan relevant rendered images, PDFs, binary artifacts, and embedded metadata before completion |
+| Discover redaction variants sequentially and force-push repeatedly | Inventory case-insensitive tokens, substring/hostname variants, binary/rendered artifacts, and reference/orphan status before a single rewrite/push pass |
+
+This extends the UI/browser-render verification principle to security and cleanup work: if rendered or binary artifacts can carry the content, text-layer verification alone is not completion evidence. Cross-reference R001 for secret/identifier safety and R005 for avoiding repeated irreversible rewrites.
+
 ## Integration
 
 | Rule | Interaction |

package/templates/.claude/rules/MUST-orchestrator-coordination.md

@@ -254,6 +254,8 @@ For this Codex port, native Codex/OMX subagents still follow the active Codex ru
 
 Claude Code v2.1.172+ fixes background agents potentially reading another project directory's settings (`.mcp.json` approvals, trust) when dispatched onto a pre-warmed worker, strengthening background-agent isolation for unattended `/bg` flows.
 
+Claude Code v2.1.174+ fixes background sessions inheriting another session's `ANTHROPIC_*` provider environment (gateway URL, custom headers, `/model` aliases) from the shell that started the background daemon. It also fixes pre-warmed background workers failing with `Could not resolve authentication method` after sitting idle. This is a Claude-template isolation improvement; Codex/OMX sessions still keep explicit agent routing and permission boundaries.
+
 ## Agent Capability Pre-Check
 
 Before delegating work, compare the task requirements with the target agent frontmatter:

package/templates/.claude/rules/MUST-tool-identification.md

@@ -51,6 +51,10 @@ Correct parallel: list ALL [agent][model] → Tool/Fetching/Running lines FIRST,
 -->
 
 
+### Workflow Agent Attribution (Claude compatibility)
+
+> **v2.1.174+ Claude compatibility**: Claude Code fixed Workflow tool `agent()` subagents missing per-agent attribution headers. Workflow-spawned agents now carry attribution consistent with R008. When authoring or reviewing Workflow scripts, still reason about each `agent()` fan-out with the same `[agent][model] → Tool:` identification discipline used for parallel Agent tool spawns. Codex-native subagent calls remain governed by the OMX role/`agent_type` contract.
+
 ### Required-Parameter Completeness Check
 
 R008 prefix(announce)와 실제 도구 호출은 분리된 단계다. prefix를 출력한 뒤 호출 payload에서 도구 스키마상 required 파라미터를 누락하면 호출이 실패하거나 빈 동작이 된다. 호출 직전, prefix 존재뿐 아니라 required 파라미터가 모두 채워졌는지 확인한다.

package/templates/.claude/rules/SHOULD-hud-statusline.md

@@ -17,6 +17,10 @@ Format: `─── [Spawn] {subagent_type}:{model} | {description} ───`
 
 > **Claude Code v2.1.141+ compatibility**: Hook JSON output can include `terminalSequence` to emit desktop notifications, window title changes, or terminal bells without a controlling terminal. Treat this as an optional companion to stderr HUD events and the command statusline; do not add terminal-control hook behavior until there is a concrete Codex-compatible UX need.
 
+> **v2.1.174+ Claude compatibility**: The `/usage` account dialog shows usage attribution for cache misses, long context, subagents, and per-skill/agent/plugin/MCP breakdowns over the last 24 hours or 7 days in VS Code. This complements `monitoring-setup`; it is an interactive Claude-client view, not a Codex/OMX telemetry source.
+
+> **v2.1.176+ Claude compatibility**: `footerLinksRegexes` can render regex-matched link badges in the footer row, and session titles are generated in the conversation language when configured. Treat these as Claude-template statusline composition options; keep `.codex/statusline.sh` as the Codex/OMX primary status surface.
+
 > **v2.1.172+ Claude compatibility**: The `claude_code.lines_of_code.count` OTEL metric includes a `model` attribute, so lines-of-code telemetry can be sliced by model when monitoring is enabled. This extends the per-dimension slicing configured through the `monitoring-setup` skill.
 
 <!-- DETAIL: HUD Events full spec

package/templates/.claude/skills/aws-best-practices/SKILL.md

@@ -9,6 +9,8 @@ user-invocable: false
 
 Apply AWS patterns for building scalable, secure, and cost-effective cloud infrastructure.
 
+> **Offline core vs. live documentation**: This skill provides static Well-Architected patterns that work without credentials or network access — the always-available baseline. For real-time AWS documentation, current API syntax, and up-to-date best practices (resolving knowledge-cutoff gaps), use the AWS MCP Server's `search_documentation` / `read_documentation` tools when installed. The two sources are complementary: static patterns for structural guidance; live docs for current specifics. Installation is user-manual (R001 auto-install prohibited) — see `infra-aws-expert` agent for setup instructions.
+
 ## Well-Architected Framework Pillars
 
 ### 1. Operational Excellence

package/templates/AGENTS.md.en

@@ -234,6 +234,7 @@ Task tool + routing skills remain the fallback for simple/cost-sensitive tasks.
 | omx-memory | Session memory persistence (Chroma-based) |
 | semble | Semantic code search MCP for high-recall repository exploration |
 | context7 | Library documentation lookup MCP server when a project needs it |
+| aws-mcp | Optional AWS live documentation and IAM-scoped AWS API execution; delegate privileged calls to `infra-aws-expert` with R010/R001 boundaries |
 
 ### Setup Commands
 
@@ -244,6 +245,11 @@ omx-memory setup
 
 # Optional semantic code search
 uv tool install semble
+
+# Optional AWS MCP (manual, IAM credentials required; do not auto-install)
+# Configure the AWS MCP endpoint in the active Codex/OMX MCP config.
+# For Claude compatibility sessions only:
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
 ```
 
 ### Claude Code Compatibility Note

package/templates/AGENTS.md.ko

@@ -234,6 +234,7 @@ Codex CLI의 Agent Teams 기능이 활성화되어 있으면 (`OMCODEX_AGENT_TEA
 | omx-memory | 세션 메모리 영속성 (Chroma 기반) |
 | semble | 대규모 저장소 탐색용 semantic code search MCP |
 | context7 | 라이브러리 문서 조회용 MCP 서버 (프로젝트 필요 시 설정) |
+| aws-mcp | 선택형 AWS 실시간 문서 조회 및 IAM 범위 AWS API 실행; 고특권 호출은 `infra-aws-expert`에 위임하고 R010/R001 경계를 명시 |
 
 ### 설치 명령어
 
@@ -244,6 +245,11 @@ omx-memory setup
 
 # 선택: semantic code search
 uv tool install semble
+
+# 선택: AWS MCP (수동 설정, IAM 자격증명 필요; auto-install 금지)
+# 활성 Codex/OMX MCP 설정에 AWS MCP endpoint를 수동 등록합니다.
+# Claude 호환 세션에서만:
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
 ```
 
 ### Claude Code 호환 참고

package/templates/CLAUDE.md

@@ -246,6 +246,7 @@ Codex CLI의 Agent Teams 기능이 활성화되어 있으면 (`OMCODEX_AGENT_TEA
 |------|------|
 | omx-memory | 세션 메모리 영속성 |
 | semble | 대규모 저장소 탐색용 semantic code search MCP |
+| aws-mcp | AWS 서비스 인증 접근 — `call_aws`(15,000+ API 실행), `search_documentation`/`read_documentation`(실시간 AWS 문서), `run_script`(샌드박스). 고특권 실행은 `infra-aws-expert` 위임 + R010/R001 특권경계 |
 
 ### 설치 명령어
 
@@ -272,6 +273,10 @@ omx memory doctor
 
 # 선택: semantic code search
 uv tool install semble
+
+# AWS MCP 서버 (IAM 인증 필요, 수동 설치 — R001 auto-install 금지)
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
+# 사전요건: AWS IAM 자격증명 구성. 가용 리전: us-east-1, eu-central-1 (API 호출은 전 리전)
 ```
 
 <!-- omcodex:git-workflow -->

package/templates/CLAUDE.md.en

@@ -241,6 +241,7 @@ Install in Claude Code via `/plugin install <name>`:
 |--------|---------|
 | omx-memory | Session memory persistence |
 | semble | Semantic code search MCP for high-recall repository exploration |
+| aws-mcp | AWS authenticated access — `call_aws` (15,000+ API operations), `search_documentation`/`read_documentation` (live AWS docs), `run_script` (sandbox). Delegate privileged execution to `infra-aws-expert` with R010/R001 boundaries |
 
 ### Claude Code Setup Commands
 
@@ -267,6 +268,10 @@ omx memory doctor
 
 # Optional semantic code search
 uv tool install semble
+
+# AWS MCP server (IAM credentials required, manual install — R001 auto-install prohibited)
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
+# Prerequisite: configured AWS IAM credentials. Endpoint regions: us-east-1, eu-central-1 (API calls can target all AWS regions)
 ```
 
 <!-- omcodex:git-workflow -->

package/templates/CLAUDE.md.ko

@@ -241,6 +241,7 @@ Claude Code 환경에서 `/plugin install <이름>`으로 설치:
 |------|------|
 | omx-memory | 세션 메모리 영속성 |
 | semble | 대규모 저장소 탐색용 semantic code search MCP |
+| aws-mcp | AWS 서비스 인증 접근 — `call_aws`(15,000+ API 실행), `search_documentation`/`read_documentation`(실시간 AWS 문서), `run_script`(샌드박스). 고특권 실행은 `infra-aws-expert` 위임 + R010/R001 특권경계 |
 
 ### Claude Code 설치 명령어
 
@@ -267,6 +268,10 @@ omx memory doctor
 
 # 선택: semantic code search
 uv tool install semble
+
+# AWS MCP 서버 (IAM 인증 필요, 수동 설치 — R001 auto-install 금지)
+claude mcp add-json aws-mcp --scope user '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
+# 사전요건: AWS IAM 자격증명 구성. 가용 리전: us-east-1, eu-central-1 (API 호출은 전 리전)
 ```
 
 <!-- omcodex:git-workflow -->

package/templates/guides/aws/index.yaml

@@ -12,15 +12,49 @@ source:
     - https://docs.aws.amazon.com/
     - https://aws.amazon.com/architecture/
   last_fetched: "2026-01-22"
+  note: >
+    Static documents below were last fetched 2026-01-22 and may be stale.
+    For current AWS documentation, use the AWS MCP Server (mcp_server section below)
+    which provides real-time lookup with no knowledge-cutoff limitation.
+
+mcp_server:
+  name: aws-mcp
+  type: remote
+  managed_by: AWS
+  endpoint: https://aws-mcp.us-east-1.api.aws/mcp
+  availability:
+    - us-east-1  # US East (N. Virginia)
+    - eu-central-1  # Europe (Frankfurt)
+  note: >
+    Live source — takes precedence over static documents below for current API syntax,
+    service limits, and best practices. Requires user-manual installation (R001 auto-install
+    prohibited). AWS API calls via call_aws are possible in all regions regardless of
+    MCP endpoint region.
+  tools:
+    - name: search_documentation
+      description: Full-text search across latest AWS docs and best practices (read-only, safe)
+    - name: read_documentation
+      description: Fetch a specific AWS documentation page (read-only, safe)
+    - name: call_aws
+      description: >
+        Execute 15,000+ AWS API operations using existing IAM credentials.
+        HIGH PRIVILEGE — can create/modify/delete resources. Delegate to infra-aws-expert
+        only; orchestrator must NOT call directly (R010). Requires explicit user approval
+        for write/delete operations. IAM credentials must not be echoed to transcript (R001).
+    - name: run_script
+      description: Run sandboxed Python with IAM permissions (no network/filesystem access)
+  install_command: >
+    claude mcp add-json aws-mcp --scope user
+    '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"]}'
 
 documents:
   - name: well-architected
     path: ./well-architected.md
-    description: AWS Well-Architected Framework summary
+    description: AWS Well-Architected Framework summary (static, last_fetched 2026-01-22)
 
   - name: common-patterns
     path: ./common-patterns.md
-    description: Common AWS architecture patterns
+    description: Common AWS architecture patterns (static, last_fetched 2026-01-22)
 
 used_by:
   - infra-aws-expert

package/templates/guides/claude-code/15-version-compatibility.md

@@ -2,6 +2,38 @@
 
 This guide records Claude Code release-note impact that affects the Claude compatibility template. The Codex-native runtime still uses `.codex/**` and OMX as the primary surface.
 
+## v2.1.177
+
+| Change | Impact | oh-my-customcodex action |
+|--------|--------|---------------------------|
+| Bug-fix/reliability release following v2.1.176 | No new Codex/OMX runtime contract. | Record compatibility confirmation; no package behavior change. |
+
+## v2.1.176
+
+| Change | Impact | oh-my-customcodex action |
+|--------|--------|---------------------------|
+| `footerLinksRegexes` renders regex-matched footer link badges; session titles are generated in the conversation language when configured | Useful for packaged Claude compatibility statusline UX. | Document in R012; keep `.codex/statusline.sh` as the Codex/OMX primary status surface. |
+
+## v2.1.175
+
+| Change | Impact | oh-my-customcodex action |
+|--------|--------|---------------------------|
+| Managed `enforceAvailableModels` constrains the resolved Default model as well as subagent model overrides, dispatch picker, and advisor model | Enterprise Claude templates can prevent user/project settings from widening model allowlists. | Document in R006 as Claude enterprise config behavior; do not change Codex native model routing. |
+
+## v2.1.174
+
+| Change | Impact | oh-my-customcodex action |
+|--------|--------|---------------------------|
+| `/usage` shows attribution for cache misses, long context, subagents, and per-skill/agent/plugin/MCP usage | Better Claude-client cost diagnostics without standing up OTEL. | Document in R012; keep `monitoring-setup` as the Codex/OMX telemetry path. |
+| Workflow `agent()` subagents include per-agent attribution headers | Aligns Workflow fan-out with R008 traceability expectations. | Document in R008; Codex-native subagents still require explicit OMX `agent_type`. |
+| Background sessions stop inheriting foreign `ANTHROPIC_*` provider env and pre-warmed workers recover auth correctly | Reduces Claude `/bg` isolation/auth false blockers. | Document in R010; keep explicit Codex/OMX routing and permission boundaries. |
+
+## v2.1.173
+
+| Change | Impact | oh-my-customcodex action |
+|--------|--------|---------------------------|
+| Fable 5 model IDs with redundant `[1m]` suffix are auto-normalized because Fable includes 1M context by default | Avoids confusing Claude compatibility model strings. | Document in R006; omit `[1m]` from Fable metadata while leaving Opus/Sonnet extended context suffix guidance intact. |
+
 ## v2.1.170
 
 Published: 2026-06-10.

package/templates/guides/openai-codex/01-version-compatibility.md

@@ -2,6 +2,20 @@
 
 This guide records OpenAI Codex release-note impact decisions for oh-my-customcodex. Use it for Codex/OMX runtime compatibility notes; keep Claude-only release notes in `guides/claude-code/15-version-compatibility.md`.
 
+## rust-v0.140.0 / CLI 0.140.0
+
+Source: upstream OpenAI Codex release `rust-v0.140.0`, Codex-port issue #1522.
+
+| Change | Impact on oh-my-customcodex | Action |
+| --- | --- | --- |
+| `/usage` adds daily, weekly, and cumulative account token activity views | Useful runtime cost signal, but not a packaged `omcustomcodex` telemetry contract. | Keep Codex usage evidence source-specific; continue using OMX/status/trace or local command evidence for package workflows. |
+| Native `/goal` preserves oversized text, large pasted blocks, and image attachments, including remote app-server sessions | Reduces data loss in Codex-native goal tracking while this package keeps its namespaced `omcustomcodex:goal` workflow. | Do not shadow native `/goal`; keep long objective handoff text in artifacts when package workflows need durable release evidence. |
+| `codex delete`, `/delete`, and app-server `thread/delete` can permanently delete sessions with safeguards and subagent cleanup | Destructive lifecycle operation outside this package's installed template surface. | Treat permanent thread deletion as an explicit user-authorized runtime action; do not automate it from package skills. |
+| `/import` selectively imports setup, project configuration, and recent chats from Claude Code | Helpful migration path for operators moving Claude context into Codex. | Keep `omcustomcodex init/update` as the package-owned template path; mention import only as a Codex runtime migration helper, not as a replacement for template sync. |
+| Typing `@` opens a unified mentions menu for files, plugins, and skills | Matches connector/plugin/skill routing vocabulary in current instructions. | No template change; continue to prefer exact file, plugin, and skill references when a task depends on them. |
+| Managed Amazon Bedrock API-key auth and encrypted local storage for CLI/MCP OAuth credentials | Improves Codex credential handling but does not change this package's credential boundary. | Keep R001 metadata-only credential diagnostics; never read or echo stored credential values. |
+| SQLite recovery, MCP startup/auth fixes, remote plugin uninstall fixes, update-dismissal persistence, stale hook cleanup, and interruptible non-TTY background commands | Runtime reliability improvements that reduce false blockers during package workflows. | No package dependency or config migration required beyond this compatibility record. |
+
 ## rust-v0.139.0 / CLI 0.139.0
 
 Source: upstream OpenAI Codex release `rust-v0.139.0`, Codex-port issue #1498.

package/templates/manifest.json

@@ -1,11 +1,11 @@
 {
-  "version": "1.0.1",
+  "version": "1.0.3",
   "requiresCC": ">=2.1.121",
   "claudeCode": {
     "minimumVersion": "2.1.121",
     "protectedPathBypassVersion": "2.1.126"
   },
-  "lastUpdated": "2026-06-11",
+  "lastUpdated": "2026-06-17",
   "components": [
     {
       "name": "rules",