Commit e2b5da8
chore(release): release v4.8.0 (#1605)
* feat(lsp): add Verilog/SystemVerilog support via verible-verilog-ls
- Add verible-verilog-ls to LSP_SERVERS (.v, .vh, .sv, .svh)
- Fix commandExists() to handle absolute paths via fs.existsSync
- Add language mappings: verilog, systemverilog, sv, v
- Update tests: 18 → 19 servers, add file/language resolution cases
Closes #1550
* fix(hooks): use correct npm package name in session-start update check (#1556)
* fix: patch 21 security vulnerabilities and logic bugs (#1558)
* fix: patch 21 security vulnerabilities and logic bugs
Security fixes:
- SSRF guard bypass via IPv6-mapped IPv4 addresses (::ffff:127.0.0.1)
- Command injection in tmux launchCmd (shell metacharacter validation)
- Prototype pollution in deepMerge (block __proto__/constructor/prototype)
- Shell injection in tsc-runner (execSync → execFileSync)
Concurrency & data integrity fixes:
- Shared state mutation in magic-keywords (deep clone builtInMagicKeywords)
- Task file rollback without lock in runtime.ts (wrap in withTaskLock)
- Silent lockless write fallback in updateTask (now throws)
- Promise double-settle in socket-client (settled guard)
- Timer/resource leak in LSP client disconnect
Logic & correctness fixes:
- Missing nodeBinary field in auto-update config
- Duplicate 'planner' condition in magic-keywords (→ 'planning')
- JSONC parser only handling \" escape (now handles all escape sequences)
- Mismatched parentheses in trace-tools string building
- Unconditional sleep in killWorkerPanes (check panes alive first)
- pid undefined guard in bridge-manager BridgeMeta construction
Hook fixes:
- Non-atomic file write in persistent-mode (temp + rename pattern)
- Windows path compatibility in stop-continuation (pathToFileURL)
- Flawed path containment check in post-tool-use-failure
- Missing regex escaping in session-start extractSection
- Unsafe Number() coercion in session-start compareVersions
Test update:
- task-file-ops test updated to match new throw-on-lock-failure behavior
* fix(trace): scope hook result case block
---------
Co-authored-by: Yeachan-Heo <hurrc04@gmail.com>
* fix(update): resolve Windows reconcile binary via omc.cmd (#1560)
* fix(hud): keep skill statusLine guidance portable (#1562)
* fix: skip stop-hook protection for non-OMC skills (#1559)
* fix: skip stop-hook protection for non-OMC skills
Non-OMC skills (e.g., Anthropic example-skills, document-skills,
superpowers) were incorrectly assigned 'light' protection by the
fallback in getSkillProtection(), causing the persistent-mode Stop
hook to block session termination after invoking external skills
like xlsx, pdf, pptx, etc.
Fix: check for the 'oh-my-claudecode:' prefix before applying
protection. Skills without the prefix are external and return 'none'.
* fix: change fallback to 'none' for unregistered skills
Address review feedback from Codex: bridge.ts strips the
'oh-my-claudecode:' prefix before calling getSkillProtection(),
so prefix-based detection would break OMC skill protection.
Simpler fix: change the fallback from 'light' to 'none'.
Registered OMC skills keep their explicit protection levels.
Unregistered skills (external plugins) get 'none' and are not blocked.
Trade-off: if a new OMC skill is added without updating
SKILL_PROTECTION, it won't have stop-hook protection. This is
acceptable because (1) the map update is part of the same PR that
adds the skill, and (2) the previous 'light' fallback caused
false positives for ALL external plugin skills.
* fix: register missing OMC skills in SKILL_PROTECTION
Address second Codex review: 5 built-in OMC skills were missing
from the protection map (omc-plan, ai-slop-cleaner, ask, release,
setup/psm). These were relying on the old 'light' fallback.
Now all 28 built-in skills are explicitly registered, so changing
the fallback to 'none' has no regression on OMC skill protection.
* fix(team): harden pane stall heuristics (#1566)
* fix(team): harden pane stall heuristics
* test: align skill-state expectations with #1559
* feat(trace): add tracer agent and trace skill (#1568)
* feat(trace): add tracer agent and trace skill
* fix(docs): align REFERENCE agent toc count
* test(hud): lock Windows-safe HUD imports (#1573)
* fix(setup): preserve canonical CLAUDE markers (#1574)
* docs(trace): harden tracer evidence protocol (#1576)
* fix: clean stale team runtime state after team clear (#1577)
* feat(setup): sync unified MCP registry to codex config (#1579)
* fix(team): remove double shell-escaping of env vars in worker spawn (#1415) (#1580)
buildWorkerStartCommand applied shellEscape twice to env var values:
once in the envAssignments construction (KEY=shellEscape(value)), and
again via .map(shellEscape) on the final array. This caused `env` to
receive values wrapped in literal single quotes (e.g.
ANTHROPIC_MODEL='us.anthropic...[1m]' instead of
ANTHROPIC_MODEL=us.anthropic...[1m]).
On Bedrock, this corrupted CLAUDE_CODE_USE_BEDROCK ('1' !== '1') and
ANTHROPIC_MODEL (invalid with literal quotes), causing spawned team
workers to fall back to Claude Code's built-in default model
(claude-sonnet-4-6), which Bedrock rejects with a 400 error.
Fix: exclude already-escaped envAssignments from the final
.map(shellEscape) pass. Add regression tests with Bedrock model IDs
containing brackets and slashes.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(skill-state): default unknown skills to no protection (#1582)
* fix(windows): harden omc-setup HUD statusline flow (#1586)
* fix(config): replace hard-coded absolute path in vitest alias (#1588)
* Backport OMX runtime hardening for leader nudges and team governance (#1584)
* Improve leader nudge next-action guidance
* Split team governance from transport policy
* fix(hooks): deactivate ultrawork state on max reinforcements and clean mission-state on session-end (#1591)
Three related fixes for ultrawork state not being cleaned up:
1. persistent-mode.cjs: Set active=false when max reinforcements reached,
preventing stale state from persisting after the stop hook gives up.
2. persistent-mode.cjs: Use stronger cancel directive ("You MUST invoke")
when reinforcement >= 5 with no incomplete tasks, improving LLM
compliance with the cancel instruction.
3. session-end/index.ts: Add cleanupMissionState() to remove session-scoped
mission entries from mission-state.json on session end, preventing the
HUD from showing stale mode information in subsequent sessions.
Closes #1590
* Add HUD last-request token usage (#1592)
* fix(team): sync codex worker startup with task lifecycle
* feat(hud): add optional transcript token totals
* fix(notifications): use nullish coalescing for parseInt fallback in reply config
`parseInt(env || "") || fallback` treats `0` as falsy, silently
ignoring an explicit zero value and falling through to the default.
Replace with a `parseIntSafe` helper that validates via
`Number.isFinite()` and use `??` so that `0` is preserved as a
valid configuration value. Also adds explicit radix 10 to
`parseInt` calls.
* fix(hooks): unblock ExitPlanMode in high-context flows
* fix: surface codex-aware deep-interview recommendations
* fix(hooks): preserve Windows hook paths with spaces
* chore(skills): refresh ai-slop-cleaner guidance
* chore(release): bump version to v4.8.0
Release v4.8.0 includes:
**New Features:**
- Tracer agent and trace skill for evidence-driven causal tracing (#1568)
- HUD real-time token usage tracking (#1589, #1592)
- Unified MCP registry sync to codex config (#1579)
- Verilog/SystemVerilog LSP support (#1551)
- OMX team governance backport with leader nudges (#1584)
**Security:**
- Patch 21 security vulnerabilities and logic bugs (#1558)
**Bug Fixes:**
- Windows hook paths with spaces (#1602)
- ExitPlanMode context safety (#1597)
- Codex worker status sync (#1593)
- Various team runtime and hook fixes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Wooklae-cho <126464940+Wooklae-cho@users.noreply.github.com>
Co-authored-by: Paul <139470135+riftzen-bit@users.noreply.github.com>
Co-authored-by: Seonho Kim <ksseono@gmail.com>
Co-authored-by: Carlos Cubas <5140314+carlos-cubas@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dongmin <ehdals45454@naver.com>
Co-authored-by: 2233admin <57929895+2233admin@users.noreply.github.com>
Co-authored-by: ChoKho <chokhoou@gmail.com>1 parent fc226e7 commit e2b5da8
File tree
361 files changed
+34789
-26293
lines changed- .claude-plugin
- agents
- bridge
- dist
- __tests__
- hud
- agents
- cli
- commands
- __tests__
- config
- features
- builtin-skills
- hooks
- auto-slash-command
- persistent-mode
- session-end
- __tests__
- setup
- __tests__
- skill-state
- __tests__
- hud
- elements
- installer
- __tests__
- interop
- notifications
- skills/__tests__
- team
- __tests__
- tools
- __tests__
- diagnostics
- lsp
- python-repl
- utils
- docs
- hooks
- scripts
- skills
- ai-slop-cleaner
- hud
- omc-setup
- phases
- plan
- ralplan
- trace
- src
- __tests__
- hud
- agents
- cli
- commands
- __tests__
- config
- features
- builtin-skills
- hooks
- auto-slash-command
- persistent-mode
- session-end
- __tests__
- setup
- __tests__
- skill-state
- __tests__
- hud
- elements
- installer
- __tests__
- interop
- notifications
- skills/__tests__
- team
- __tests__
- tools
- __tests__
- diagnostics
- lsp
- python-repl
- utils
- templates/hooks
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
361 files changed
+34789
-26293
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
13 | | - | |
| 13 | + | |
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
| |||
27 | 27 | | |
28 | 28 | | |
29 | 29 | | |
30 | | - | |
| 30 | + | |
31 | 31 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| |||
Large diffs are not rendered by default.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
| 126 | + | |
| 127 | + | |
| 128 | + | |
| 129 | + | |
| 130 | + | |
| 131 | + | |
| 132 | + | |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
| 138 | + | |
| 139 | + | |
| 140 | + | |
| 141 | + | |
| 142 | + | |
| 143 | + | |
| 144 | + | |
| 145 | + | |
| 146 | + | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
| 150 | + | |
| 151 | + | |
| 152 | + | |
| 153 | + | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
| 160 | + | |
0 commit comments