* feat(jev): add OMC_JEV_PLAN_MODE to keep Jev from deciding in plan mode
Plugin hook scripts pass the hook payload's permission_mode to the Jev
mode decision. When it is "plan", OMC_JEV_PLAN_MODE=shadow runs opted-in
points in shadow and OMC_JEV_PLAN_MODE=off disables them. Unset keeps
current behavior.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DeKCYwEVRzREUY6v2Kk74w
* chore(inventory): regenerate inventory-graph baseline for the Jev plan-mode change
Anchored to the dev merge-base 51bec397e as the generator header requires.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DeKCYwEVRzREUY6v2Kk74w
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(hooks): read the XDG global config in the code-simplifier Stop hook
The shipped code-simplifier hooks (scripts/ for the plugin, templates/hooks/
for the standalone install) only read ~/.omc/config.json. The TypeScript
hook and docs/REFERENCE.md use getGlobalOmcConfigCandidates: $OMC_HOME,
else ${XDG_CONFIG_HOME:-~/.config}/omc/config.json on Linux/Unix, then the
legacy ~/.omc fallback. A Linux user who enables codeSimplifier where the
docs say got no simplifier at all.
Mirror that lookup in both .mjs copies.
* chore: regenerate inventory for code-simplifier config lookup
* ci: whitelist code-simplifier hook scripts in multirepo-paths gate
These hook scripts legitimately construct global OMC config paths
(~/.omc/config.json), which are per-user and not workspace-scoped.
The gate should not flag global config path construction.
* chore(inventory): regenerate after merging dev
* chore(inventory): regenerate after merging dev
---------
Co-authored-by: gaebal-gajae <clawdbot@users.noreply.github.com>
* fix(windows): bound generic-hook runner timeout ownership and nested git (#3493)
Native Windows generic-hook run.cjs parents survived 30-66 min despite
3-10s manifest budgets. Two runner-side gaps plus unbounded nested git
calls left the generic hook path without reliable termination.
run.cjs (generic branch):
- Replace the blocking spawnSync generic dispatch with an async spawn
child supervisor (runGenericChild) that owns a setTimeout and reaps the
OS process tree while the child is still alive. spawnSync only returns
after the child fully exits, so post-call cleanup was unreachable.
- POSIX: spawn detached and process.kill(-pid, SIGKILL) the group with a
direct-child fallback. Windows: taskkill /T /F /PID bounded by its own
timeout:2000 so the reap cannot hang the handler. Job Object kill-on-
close remains the documented escalation if the Windows PID-survival
test regresses.
- Always arm a runner-owned timer: resolveGenericTimeoutMs falls back to
DEFAULT_GENERIC_TIMEOUT_MS (59500ms = max manifest budget - cushion)
when manifest resolution is null (closes the unbounded Gap A) and is
bypassed when the manifest resolves.
- Pin the exit-code contract (result.status ?? 0 semantics): numeric exit
propagates; signal-only, spawn error, reap failure, and timeout fail
open with 0; single-resolve guard; timer cleared on every terminal path.
- Add a require.main===module guard + module.exports so internals are
unit-testable without executing dispatch. #3490 worker path, allowlist,
provenance, and fail-open are unchanged.
Nested git bounding:
- Add shared BOUNDED_GIT_TIMEOUT_MS=2000 (scripts/lib + templates/hooks/
lib, byte-identical) and apply it at the 8 owned sites: the 4 unbounded
resolveTranscriptPath git calls and the 4 over-budget 5000ms calls
(resolveOmcRoot x2, code-simplifier x2). Already-bounded compliant sites
(context-guard-stop 1000ms, workflow-drift-guard 2000ms) are untouched.
Tests:
- run-cjs-generic-timeout: exports/selection, POSIX group reap, A2 exit
states, single-terminalization.
- windows-prompt-hook-runner: generic-path Windows PID-survival reap
assertion (runs on the windows-latest CI lane).
- bounded-git-timeout-parity: both constant copies match.
- windows-hide-hooks: two-tier static scan (every generic-hook git call
bounded; owned sites must use the shared constant; compliant sites
preserved) with independent-tier negative seeds.
- installer: require bounded-git-timeout.mjs in templates/hooks/lib.
Fixes#3493
* fix(windows): reap detached generic-hook tree on runner termination (#3493)
Hostile review found that runGenericChild detached the hook into its own
POSIX process group but reaped only from the inner timeout callback. If
run.cjs was terminated or cancelled BEFORE its timer fired (outer
hooks.json timeout, Ctrl-C, parent kill), the detached hook tree was
orphaned - reintroducing the #3493 orphan class for the outer-termination
path and regressing prior POSIX cancellation behavior.
- Register SIGTERM/SIGINT/SIGHUP and process 'exit' handlers while the
generic child is live; on runner termination reap the process tree
(idempotent, single-terminal guard) before exiting fail-open.
- Remove the handlers on every terminal path (timeout/exit/error) so no
listeners leak across in-process supervisor calls.
- reapTree now returns success/failure and inspects the Windows taskkill
status.
- Add a POSIX subprocess test that kills the runner before its timeout and
asserts the detached child and grandchild are reaped.
* fix(windows): guarantee runner exit on failed reap; non-blocking taskkill (#3493)
Second hostile review found the timeout path could still leave run.cjs
alive on Windows: reapTree returned false when taskkill was missing/denied/
timed out, but the live ChildProcess handle kept the event loop alive, so
run.cjs never exited — the exact "run.cjs parent alive" symptom of #3493.
- Add child.unref() on the timeout path so the runner ALWAYS exits fail-open
even when the best-effort tree reap does not complete.
- Make the Windows reap non-blocking: spawn `taskkill /T /F` detached +
unref'd (fire-and-forget) instead of a synchronous spawnSync that could
block up to 2000ms past the outer hooks.json budget. POSIX group-kill is
already instantaneous.
- Drop the now-unused spawnSync import.
- Clarify the POSIX outer-cancellation test comment (Windows programmatic
SIGTERM force-terminates rather than delivering a catchable signal, so that
path is POSIX-specific; killing the grandchild proves the whole group,
including the direct hook child, was reaped).
---------
Co-authored-by: clawdbot <clawdbot@users.noreply.github.com>
Adapt OMC state, hooks, HUD, and session tracking to operate correctly
across multiple git repos that share one logical workspace, instead of
assuming "single repo == single state root".
Core:
- `.omc-workspace` marker anchors `.omc/` at a non-git parent dir.
Resolution order: `OMC_STATE_DIR` > `.omc-workspace` > git root > cwd
(src/lib/worktree-paths.ts).
- Session-scoped state via `resolveSessionStatePaths(name, sessionId, dir)`
returning branded `ReadPath`/`WritePath`, so a read path can never be
silently used as a write path. An ESLint `no-restricted-syntax` rule bans
casting these brands outside worktree-paths.ts.
- `resolveSessionId()` centralizes session-id resolution (hook payload wins
for hooks, env wins for CLI) in src/lib/session-id.ts.
- Opt-in legacy state migration via `OMC_MIGRATE_LEGACY_STATE=1`; nothing is
copied by default.
Concurrency and isolation:
- session-start hook uses PID-aware liveness: a dead owner session no longer
suppresses state restore.
- subagent-tracker migrated to session-scoped paths plus `withFileLockSync`,
keeping the hot-path lock scope minimal (read, update, write). Perf bench
records Windows p99 around 3.0 to 3.7 ms, under the Linux budget.
- New concurrent ralph-session and project-memory integration tests.
HUD:
- Multi-repo workspace chip showing subrepo and active-session counts
(src/hud/elements/multi-repo.ts).
- "L" suffix on the OMC version when running from a local fork; local installs
are detected even when the fork is copied (not symlinked) into the plugin
cache.
Other:
- ultragoal artifacts made workspace-aware.
- CI guard (scripts/ci/check-multirepo-paths.mjs wired into ci.yml) plus audit
and smoke scripts that keep new code on the canonical path helpers.
Constraint: dist/ and bridge/ are tracked in this repo, so artifacts were
rebuilt against dev and committed.
Directive: session-scoped state must go through resolveSessionStatePaths();
do not cast ReadPath/WritePath.
Confidence: high
Scope-risk: broad
* feat(setup): add rtk token optimization integration
* revert(setup): remove RTK integration from PR #1489
* fix(hooks): fail open on critical context exhaustion
* fix(skill): harden omc-teams tmux and agent validation
* Add Ralph critic selection for verification
* fix(doctor): accept supported omc config keys
* feat(openclaw): normalize native clawhip signals
* fix: skip legacy agent sync when plugin agents exist
* fix(hud): preserve stale usage limits on API failures
* Reduce startup OMC guidance context
* fix: clean up stale transient files on session end (#1510)
- session-end: cleanupTransientState now removes agent-replay-*.jsonl,
last-tool-error.json, hud-state.json, hud-stdin-cache.json,
idle-notif-cooldown.json, *-stop-breaker.json, cancel-signal files
inside session dirs, and empty session directories
- keyword-detector: activateState adds project_path field for parity
with TypeScript activateUltrawork in bridge.ts
- persistent-mode: readStateFileWithSession adds fallback scan of all
session directories when session-scoped path lookup fails
* fix(hud): reduce transient usage API retry hammering (#1513)
* fix(hooks): add missing continue: false to persistent-mode.cjs Stop hook
The .cjs Stop hook outputs `{ decision: "block" }` without
`continue: false` when blocking stops for active modes. The original
fix (#1216) added `continue: false` to the .mjs scripts but the .cjs
version was never updated, and subsequent commits (#1306, #1330, #1374,
#1480, #1482) did not carry over this fix.
Since hooks.json references the .cjs version, the plugin Stop hook has
been missing hard-block capability, allowing sessions to end mid-execution.
- Add `continue: false` to all 12 blocking outputs in persistent-mode.cjs
- Add `continue: false` to context-guard-stop.mjs (1 output)
- Add `continue: false` to code-simplifier.mjs and its template (1 each)
Closes#1516
* feat(doc-specialist): add first-pass context hub guidance (#1519)
* Add skill pipeline handoff metadata (#1520)
* chore: remove stale root development artifacts (#1526)
* docs(rebrand): update scoped guidance docs (#1527)
* docs: rebrand main README to oh-my-openagent (#1528)
* docs: rebrand localized readmes to oh-my-openagent (#1529)
* revert: undo unauthorized rebrand PRs 1527-1529
* docs: fix outdated install references in REFERENCE.md
- Update platform support table: "curl or npm" → "Claude Code Plugin"
for macOS/Linux, consistent with the deprecation notice at the top
of the Installation section
- Replace deprecated curl uninstall one-liner with the plugin uninstall
command (/plugin uninstall oh-my-claudecode@oh-my-claudecode)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: remove stale analytics references
* fix(team): port startup hardening from omx
* fix(team): finish runtime hardening port
* fix(team): resolve worktree mailbox trigger paths
* fix(hud): avoid repeated watch mode initialization
* feat: add session history search
* fix(team): require real startup evidence
* fix(routing): normalize explicit model IDs in all code paths (#1415)
The prior fix (PR #1464) only normalized auto-injected models but missed
two paths where full model IDs like 'claude-sonnet-4-6' leaked through:
1. enforceModel() passed explicitly-provided models as-is without
normalizing to CC aliases (sonnet/opus/haiku)
2. buildLaunchArgs() in model-contract.ts passed model directly to
--model flag for team worker launches
Extract normalizeToCcAlias() helper and apply it in both paths.
Add 5 tests covering explicit ID normalization and Bedrock ID handling.
Closes#1415
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(release): bump version to v4.7.10
Version bumps:
- package.json: 4.7.9 → 4.7.10
- .claude-plugin/plugin.json: 4.7.9 → 4.7.10
- .claude-plugin/marketplace.json: 4.7.9 → 4.7.10
- CHANGELOG.md: Updated release header
Includes rebuilt dist artifacts for:
- Bedrock model routing fixes
- Team runtime hardening
- Session history search feature
- Lazy agent loading
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: ChoKhoOu <38033263+ChoKhoOu@users.noreply.github.com>
Co-authored-by: Yong <yong@levvels.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Carlos Cubas <carloscubas82@gmail.com>
- Add scripts/post-tool-use-failure.mjs with static ESM imports (from template)
- Add scripts/code-simplifier.mjs with static ESM imports (from template)
- Add scripts/lib/atomic-write.mjs (mirrors templates/hooks/lib/atomic-write.mjs)
- Add PostToolUseFailure hook entry to hooks/hooks.json
- Add code-simplifier as third Stop hook entry in hooks/hooks.json
- Remove getHookScripts() calls that wrote scripts to ~/.claude/hooks/
- Remove getHooksSettingsConfig() call that wrote hook entries to settings.json
- Add migration: clean up legacy /.claude/hooks/ entries from settings.json
- Mark getHooksSettingsConfig() and getHookScripts() as @deprecated in hooks.ts
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
