v4.11.5

oh-my-claudecode v4.11.5: Bug Fixes & Release Skill

Release Notes

Release with 30+ bug fixes across 50+ merged PRs and 1 new feature.

New Features

• feat(release): rewrite release skill as generic repo-aware assistant (#2501) — /oh-my-claudecode:release now inspects any repo's CI, version files, and release rules on first run and caches them in .omc/RELEASE_RULE.md.

Highlights

• Autopilot/Team stability — surface hidden dependency stalls before /autopilot looks hung; preserve live team workflows when coarse staged state drifts; bound MCP restarts; repair retired team MCP config on upgrade.
• Keyword-detector accuracy — prevent mode activation from quoted reference prose; keep help-style queries informational; preserve activation in mixed command/help prompts.
• Ralph robustness — preserve continuation across interrupted tool turns; silence repeated idle follow-up nudges once backlog is truly zero.
• HUD reliability — prevent setup docs from deleting the installed wrapper; surface import errors; prevent stale root state revival.
• Setup/installer correctness — always update CLAUDE.md on install; avoid hook re-injection for plugin installs; validate and select cache version candidates deterministically.
• tmux centralization — all tmux execution routed through wrapper functions; Windows .cmd availability checks aligned; tmux-utils API compatibility restored.

Bug Fixes

Autopilot / Team

• Surface hidden dependency stalls before /autopilot looks hung
• Preserve live team workflows when coarse staged state drifts
• Bound launcher-backed MCP restarts without changing user intent
• Repair retired team MCP config on upgrade and launch
• Prevent stale team worktrees from blocking startup
• Preserve team state for explicit shutdown instead of terminal auto-cleanup
• Keep bridge autopilot blocker regression aligned with active-session ownership
• Prevent autopilot runtime insight from leaking unrelated team blockers
• Let scale-up workers follow the existing provider launch contract
• Avoid Claude onboarding on default omc launches
• Prefer consensus planning blockers over team-stage continuation
• Back off shipped idle follow-ups once zero backlog is unchanged
• Collapse duplicate native lifecycle bursts for attached tmux sessions (#2494)

Keyword Detector / Modes

• Prevent shipped keyword-detector hooks from re-triggering on explanatory follow-ups
• Prevent mode activation from quoted reference prose
• Prevent explanatory mode references from re-triggering orchestration
• Prevent bundled help-question regexes from collapsing in keyword detection
• Preserve activation in mixed command/help prompts (#2428)
• Keep help-style use queries informational (#2428)
• Prevent stale ralplan terminal states from re-triggering stop enforcement
• Prevent stale stop-hook state from blocking fresh sessions
• Silence repeated idle follow-up nudges once backlog is truly zero

Ralph

• Preserve Ralph continuation across interrupted tool turns

HUD

• Prevent HUD setup docs from deleting the installed wrapper
• Prevent session-recreated HUD panes from reviving stale root state
• Surface HUD import errors from plugin root wrapper (#2457)
• Remove stale inline wrapper from HUD skill, copy from canonical template (#2433)
• Prevent nested tmux HUD panes from surviving cleanup (#2492)

Setup / Installer / Doctor

• Always update claude config CLAUDE.md on install (#2431)
• Avoid hook re-injection for plugin installs (#2430)
• Validate and strictly select cache version candidates (#2422)
• Prefer latest cache version over stale installed path (#2422)
• Detect CLAUDE.md version drift against plugin cache (#2423)
• Support companion version markers and mingw-safe checks (#2423)
• Use deterministic CLAUDE source for version drift check (#2423)
• Remove extra brace in version drift command (#2423)

tmux / CLI

• Centralize all tmux execution through wrapper functions (#2427)
• Keep Windows tmux.cmd execution consistent with availability checks (#2444)
• Restore tmux-utils API compatibility (#2442)
• Allow completed ultrawork sessions to exit cleanly (#2439)

Hooks / Tools

• Avoid .json false positive in source extension matching (#2432)
• Recognize ty in the supported Python LSP registry (#2439)
• Align learned skill templates with flat-file discovery (#2438)

Documentation

• docs: add omc symlink bootstrap and .mcp.json conflict resolution to CONTRIBUTING (#2493)

Stats

• 50+ PRs merged | 1 new feature | 30+ bug fixes | 0 breaking changes

Install / Update

npm install -g oh-my-claude-sisyphus@4.11.5

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.11.4...v4.11.5

v4.11.4

oh-my-claudecode v4.11.3: Bug Fixes

Release Notes

Release with 7 bug fixes across 9 merged PRs.

Highlights

• fix(node): prefer PATH node over unstable execPath (#2400)
• fix(hooks): prevent .js false positives in .json/.jsonl source extension check (#2395)
• fix(autoresearch): strip TMUX env for nested tmux compatibility (#2385)

Bug Fixes

• fix(node): prefer PATH node over unstable execPath (#2400)
• fix(hooks): prevent .js false positives in .json/.jsonl source extension check (#2395)
• fix(autoresearch): strip TMUX env for nested tmux compatibility (#2385)
• fix: resolve asymmetric symlink path resolution (#2372)
• fix(installer): detect enabledPlugins (Claude Code 1.x) in hasEnabledOmcPlugin (#2252 follow-up) (#2371)
• fix: deactivate stale ralplan stop enforcement after consensus completion (#2370)
• fix(hud): fall back to path-based version when package.json is missing (#2362)

Documentation

• docs: document --plugin-dir and add CONTRIBUTING.md for local development (#2399)
• docs(getting-started): document plugin + npm CLI as two coexisting surfaces (#2367)

Stats

• 9 PRs merged | 0 new features | 7 bug fixes | 0 security/hardening improvements | 0 other changes

Install / Update

npm install -g oh-my-claude-sisyphus@4.11.3

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.11.2...v4.11.3

Contributors

Thank you to all contributors who made this release possible!

@DdangJin @kushalsai-01 @nextor2k @pgagarinov @Yeachan-Heo

v4.11.3

oh-my-claudecode v4.11.3: Bug Fixes

Release Notes

Release with 7 bug fixes across 9 merged PRs.

Highlights

• fix(node): prefer PATH node over unstable execPath (#2400)
• fix(hooks): prevent .js false positives in .json/.jsonl source extension check (#2395)
• fix(autoresearch): strip TMUX env for nested tmux compatibility (#2385)

Bug Fixes

• fix(node): prefer PATH node over unstable execPath (#2400)
• fix(hooks): prevent .js false positives in .json/.jsonl source extension check (#2395)
• fix(autoresearch): strip TMUX env for nested tmux compatibility (#2385)
• fix: resolve asymmetric symlink path resolution (#2372)
• fix(installer): detect enabledPlugins (Claude Code 1.x) in hasEnabledOmcPlugin (#2252 follow-up) (#2371)
• fix: deactivate stale ralplan stop enforcement after consensus completion (#2370)
• fix(hud): fall back to path-based version when package.json is missing (#2362)

Documentation

• docs: document --plugin-dir and add CONTRIBUTING.md for local development (#2399)
• docs(getting-started): document plugin + npm CLI as two coexisting surfaces (#2367)

Stats

• 9 PRs merged | 0 new features | 7 bug fixes | 0 security/hardening improvements | 0 other changes

Install / Update

npm install -g oh-my-claude-sisyphus@4.11.3

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.11.2...v4.11.3

Contributors

Thank you to all contributors who made this release possible!

@DdangJin @kushalsai-01 @nextor2k @pgagarinov @Yeachan-Heo

v4.11.2

oh-my-claudecode v4.11.1: add gitStatus working-tree, add hostname element, cwd folder format

Release Notes

Release with 3 new features, 8 security improvements, 33 bug fixes, 1 other change across 45 merged PRs.

Highlights

• feat(hud): add gitStatus working-tree indicator element (#2247)
• feat(hud): add hostname element for multi-host SSH workflows (#2246)
• feat(hud): cwd folder format shows parent/leaf instead of just leaf (#2238)
• fix(security): clamp hardMaxIterations and enforce in autopilot (#2331)
• fix(security): delegate gitea URL validation to validateUrlForSSRF (#2336)
• fix(security): enforce disableExternalLLM in omc ask command (#2324)

New Features

• feat(hud): add gitStatus working-tree indicator element (#2247)
• feat(hud): add hostname element for multi-host SSH workflows (#2246)
• feat(hud): cwd folder format shows parent/leaf instead of just leaf (#2238)

Security & Hardening

• fix(security): clamp hardMaxIterations and enforce in autopilot (#2331)
• fix(security): delegate gitea URL validation to validateUrlForSSRF (#2336)
• fix(security): enforce disableExternalLLM in omc ask command (#2324)
• fix(security): sanitize trigger_message control characters before tmux send-keys (#2323)
• fix(security): check iteration directly against hardMax independent of max_iterations (#2322)
• fix(security): reject non-positive hardMaxIterations in strict mode (#2321)
• fix(security): enforce hardMaxIterations for ultrawork persistent mode (#2320)
• fix(security): block all tmux subcommands in worker context (#2316)

Bug Fixes

• fix(installer): use getPackageDir() instead of __dirname for HUD helper copies (#2347)
• fix(team): lock unregisterMcpWorker and registerInConfig read-modify-write paths (#2333)
• fix(shared-memory): add retry timeout to writeEntry lock acquisition (#2342)
• fix: guard against fd leak in tryAcquireSync on write failure (#2341)
• fix(team): use randomUUID in MCP team-server job ID generation (#2340)
• fix(cancel,team): add skill-active cleanup to bash fallback and guard startTeamV2 events (#2339)
• fix(i18n): prevent Korean keyword false positives for 설명서 and 랄프로렌 (#2337)
• fix(state-tools): correct cancel signal path and add legacy fallback (#2335)
• fix: guard Atomics.wait with try/catch in session-registry and subagent-tracker (#2334)
• fix(cancel): write legacy cancel signal to .omc/state/ instead of worktree root (#2332)
• fix(worktree-paths): include dot in project path encoding regex (#2329)
• fix(team): add locking to teamUpdateTask for concurrent safety (#2330)
• fix(hud): apply wrap mode when terminal width is auto-detected (#2338)
• fix(hud): handle ST-terminated OSC 8 sequences in ANSI regex (#2319)
• fix(prompt-prerequisites): use suffix matching for file path comparison (#2314)
• fix(prompt-prerequisites): require path prefix or file extension in isLikelyPath (#2313)
• fix(prompt-prerequisites): move progress recording after blocking check (#2312)
• fix(setup): clean up preserve-mode artifacts on overwrite (#2298)
• fix(launch): mirror keybindings.json and rules/ to runtime config dir (#2297)
• fix(team): sync worker_count after canonicalization dedup (#2296)
• fix(team): skip past colliding worker names in scaleUp (#2295)
• fix(skill-state): add recency check to orchestrator idle bypass (#2287)
• fix(wiki): normalize CRLF in parseFrontmatter for Windows compatibility (#2285)
• fix(wiki): escape newlines in title to prevent frontmatter corruption (#2284)
• fix(wiki): guard writePageUnsafe against reserved filenames (#2283)
• fix(pre-tool-enforcer): strip UTF-8 BOM before frontmatter parsing (#2276)
• fix(wiki): titleToSlug produces bare .md for non-ASCII titles (#2270)
• fix(wiki): keyword search returns 0 results for CJK text (#2263)
• fix(skills): clarify ralph step 7 chaining and ai-slop-cleaner skill invocation (#2245)
• fix(persistent-mode): relax overly-strict ralph/ultrawork session-id check (#2244)
• fix(hud): correctly mark background agents as completed in transcript parser (#2243)
• fix: ignore HTML comments in keyword detector (#2249)
• fix(launch): forward env vars into tmux sessions & respect CLAUDE_CONFIG_DIR (#2204)

Other Changes

• Make artifact-first handoffs explicit for interop and prompt persistence (#2257)

Stats

• 45 PRs merged | 3 new features | 33 bug fixes | 8 security/hardening improvements | 1 other change

Install / Update

npm install -g oh-my-claude-sisyphus@4.11.1

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.11.0...v4.11.1

Contributors

Thank you to all contributors who made this release possible!

@pgagarinov @shaun0927 @Yeachan-Heo

v4.11.1

oh-my-claudecode v4.11.1: add gitStatus working-tree, add hostname element, cwd folder format

Release Notes

Release with 3 new features, 8 security improvements, 33 bug fixes, 1 other change across 45 merged PRs.

Highlights

• feat(hud): add gitStatus working-tree indicator element (#2247)
• feat(hud): add hostname element for multi-host SSH workflows (#2246)
• feat(hud): cwd folder format shows parent/leaf instead of just leaf (#2238)
• fix(security): clamp hardMaxIterations and enforce in autopilot (#2331)
• fix(security): delegate gitea URL validation to validateUrlForSSRF (#2336)
• fix(security): enforce disableExternalLLM in omc ask command (#2324)

New Features

• feat(hud): add gitStatus working-tree indicator element (#2247)
• feat(hud): add hostname element for multi-host SSH workflows (#2246)
• feat(hud): cwd folder format shows parent/leaf instead of just leaf (#2238)

Security & Hardening

• fix(security): clamp hardMaxIterations and enforce in autopilot (#2331)
• fix(security): delegate gitea URL validation to validateUrlForSSRF (#2336)
• fix(security): enforce disableExternalLLM in omc ask command (#2324)
• fix(security): sanitize trigger_message control characters before tmux send-keys (#2323)
• fix(security): check iteration directly against hardMax independent of max_iterations (#2322)
• fix(security): reject non-positive hardMaxIterations in strict mode (#2321)
• fix(security): enforce hardMaxIterations for ultrawork persistent mode (#2320)
• fix(security): block all tmux subcommands in worker context (#2316)

Bug Fixes

• fix(installer): use getPackageDir() instead of __dirname for HUD helper copies (#2347)
• fix(team): lock unregisterMcpWorker and registerInConfig read-modify-write paths (#2333)
• fix(shared-memory): add retry timeout to writeEntry lock acquisition (#2342)
• fix: guard against fd leak in tryAcquireSync on write failure (#2341)
• fix(team): use randomUUID in MCP team-server job ID generation (#2340)
• fix(cancel,team): add skill-active cleanup to bash fallback and guard startTeamV2 events (#2339)
• fix(i18n): prevent Korean keyword false positives for 설명서 and 랄프로렌 (#2337)
• fix(state-tools): correct cancel signal path and add legacy fallback (#2335)
• fix: guard Atomics.wait with try/catch in session-registry and subagent-tracker (#2334)
• fix(cancel): write legacy cancel signal to .omc/state/ instead of worktree root (#2332)
• fix(worktree-paths): include dot in project path encoding regex (#2329)
• fix(team): add locking to teamUpdateTask for concurrent safety (#2330)
• fix(hud): apply wrap mode when terminal width is auto-detected (#2338)
• fix(hud): handle ST-terminated OSC 8 sequences in ANSI regex (#2319)
• fix(prompt-prerequisites): use suffix matching for file path comparison (#2314)
• fix(prompt-prerequisites): require path prefix or file extension in isLikelyPath (#2313)
• fix(prompt-prerequisites): move progress recording after blocking check (#2312)
• fix(setup): clean up preserve-mode artifacts on overwrite (#2298)
• fix(launch): mirror keybindings.json and rules/ to runtime config dir (#2297)
• fix(team): sync worker_count after canonicalization dedup (#2296)
• fix(team): skip past colliding worker names in scaleUp (#2295)
• fix(skill-state): add recency check to orchestrator idle bypass (#2287)
• fix(wiki): normalize CRLF in parseFrontmatter for Windows compatibility (#2285)
• fix(wiki): escape newlines in title to prevent frontmatter corruption (#2284)
• fix(wiki): guard writePageUnsafe against reserved filenames (#2283)
• fix(pre-tool-enforcer): strip UTF-8 BOM before frontmatter parsing (#2276)
• fix(wiki): titleToSlug produces bare .md for non-ASCII titles (#2270)
• fix(wiki): keyword search returns 0 results for CJK text (#2263)
• fix(skills): clarify ralph step 7 chaining and ai-slop-cleaner skill invocation (#2245)
• fix(persistent-mode): relax overly-strict ralph/ultrawork session-id check (#2244)
• fix(hud): correctly mark background agents as completed in transcript parser (#2243)
• fix: ignore HTML comments in keyword detector (#2249)
• fix(launch): forward env vars into tmux sessions & respect CLAUDE_CONFIG_DIR (#2204)

Other Changes

• Make artifact-first handoffs explicit for interop and prompt persistence (#2257)

Stats

• 45 PRs merged | 3 new features | 33 bug fixes | 8 security/hardening improvements | 1 other change

Install / Update

npm install -g oh-my-claude-sisyphus@4.11.1

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.11.0...v4.11.1

Contributors

Thank you to all contributors who made this release possible!

@pgagarinov @shaun0927 @Yeachan-Heo

v4.11.0

oh-my-claudecode v4.11.0: add LLM Wiki, inject Codex availability

Release Notes

Release with 2 new features, 16 bug fixes, 9 other changes across 27 merged PRs.

Highlights

• feat(wiki): add LLM Wiki knowledge layer (#2214)
• feat(skills): inject Codex availability for ralplan/plan/ralph, harden detection (#2134)

New Features

• feat(wiki): add LLM Wiki knowledge layer (#2214)
• feat(skills): inject Codex availability for ralplan/plan/ralph, harden detection (#2134)

Bug Fixes

• fix(team): harden worker startup delivery in tmux mode (#2225)
• fix(windows): resolve bash from PATH for explore wrapper (#2216)
• fix(team): stop double-sending startup inbox on team init (#2209)
• fix(installer): ensure hooks/lib is copied with correct permissions (fixes #2185) (#2188)
• fix: restore dev CI for hooks escaping and pre-tool preflight (#2189)
• fix(hooks): use PreToolUse deny API in preflight context guard (#2177)
• fix(scripts): replace sed -i with perl for macOS compatibility (#2179)
• fix(hooks): prevent fd leak in estimateContextPercent (#2178)
• fix(hooks): align post-tool file_path extraction with pre-tool handler (#2176)
• fix(team): change sendToWorker fallback from fail-open to fail-closed (#2175)
• fix: copy hooks/lib/ directory during omc setup (#2131)
• fix: expire stale awaiting_confirmation flags for persistent modes (#2099)
• fix: respect CLAUDE_CONFIG_DIR across remaining code paths (#2156)
• fix(setup-hook): heal stdin.mjs symlink with safe replace strategy (#2159)
• fix(hooks): catch EEXIST on Windows concurrent mkdir race (#2172)
• fix: correct release note generation for merged PRs (#2167)

Other Changes

• Fix empty hook injections after agent completion (#2219)
• Fix standalone slash-skill sync for npm installs (#2211)
• Fix issue #2180 preemptive compaction warnings (#2212)
• Fix /team role shorthand for executor workers (#2210)
• Clarify README CLI commands vs in-session skills (#2200)
• Fix omc setup local skill install fallback (#2195)
• Fix deep-interview ambiguityThreshold runtime loading (#2194)
• Fix tmux attach disconnect cleanup for issue #2197 (#2199)
• chore: sync main back to dev after 4.10.2 release (#2163)

Stats

• 27 PRs merged | 2 new features | 16 bug fixes | 0 security/hardening improvements | 9 other changes

Install / Update

npm install -g oh-my-claude-sisyphus@4.11.0

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.10.2...v4.11.0

Reference

• LLM Wiki inspiration: https://gist.github.com/karpathy/442a6bf555914893e9891c11519de94f

Contributors

Thank you to all contributors who made this release possible!

@HelloAlexPan @i0r3k @jonckr @kushalsai-01 @namgiho-kristin @namgiho96 @relvinhas @wwenrr @Yeachan-Heo

v4.10.2

oh-my-claudecode v4.10.2

Highlights

• HUD global npm install lookup fix outside Node projects (#2149)
• Configurable HUD call-count icon rendering (#2151)
• Safer global setup / CLAUDE.md preservation and overwrite flow (#2144, #2146)
• Bedrock pre-tool-enforcer hardening for invalid bare Anthropic model IDs (#2107)
• Cancel flow now clears skill-active state correctly (#2122)
• HUD diagnostics now show a clearer install-time failure path (#2129)
• Worktree display now shows the actual worktree name instead of volatile main HEAD (#2127)
• Team pane geometry + bundled agent path resolution fixes (#2137)

Install / Update

npm install -g oh-my-claude-sisyphus@4.10.2

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

What's Changed

• fix(hud): show worktree name instead of volatile main repo HEAD (#2127)
• fix(hud): replace misleading CLI error with installation diagnostic (#2129)
• fix(state-tools): add skill-active to STATE_TOOL_MODES so cancel can clear it (#2122)
• chore: enforce dev base branch and gitignore build artifacts (#2108)
• fix(pre-tool-enforcer): deny subagent_type calls whose agent definition has a bare Anthropic model ID on Bedrock (#2107)
• fix team tmux pane geometry collapse and bundled agent path resolution (#2137)
• fix: preserve existing global CLAUDE.md during setup (#2144)
• fix: resolve global HUD npm package lookup outside Node projects (#2149)
• feat(hud): make call-count icon rendering configurable (#2151)
• fix: explicit overwrite choice + omc launch profile follow-up (#2146)

Full Changelog: v4.10.1...v4.10.2

v4.10.1

oh-my-claudecode v4.10.1

Release Notes

Patch release for a packaging mistake in v4.10.0.

Fixed

• rebuilt and shipped the missing dist/ HUD layout artifacts so the layout/worktree ordering changes from #2083 are actually present in the published package
• restores released parity between src/ and dist/ for the HUD layout path

Install / Update

npm install -g oh-my-claude-sisyphus@4.10.1

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.10.0...v4.10.1

Full Changelog: v4.10.0...v4.10.1

v4.10.0

oh-my-claudecode v4.10.0: HUD upgrades, LSP diagnostics, security hardening, and workflow polish

Release Notes

Release 4.10.0 delivers a meaningful usability bump across the HUD, LSP integrations, security boundaries, and hook/runtime correctness. Highlights include configurable HUD layouts with worktree awareness, Kotlin LSP 3.17 pull diagnostics support, stronger worker/security enforcement, better setup reliability, and several fixes around persistent modes, skill state cleanup, and installed-build behavior.

Highlights

• feat(hud): add worktree detection and configurable element ordering — adds worktree-aware HUD context plus layout customization for element ordering and grouping. (#2083)
• feat(lsp): support LSP 3.17 pull diagnostics for kotlin-lsp — expands editor/runtime tooling support for Kotlin workflows. (#2007)
• feat(skill): add self-improve autonomous code improvement skill — introduces a new builtin workflow for autonomous code improvement loops. (#2074)
• fix(security): harden worker/tool boundaries and sandbox behavior — tightens Python sandboxing, worker command constraints, and external LLM enforcement. (#2047, #2028, #2022, #2010, #2009, #2005)
• fix(runtime): resolve persistent-mode, stop-hook, and installed-build edge cases — improves session continuation safety, skill-state cleanup, CLAUDE config profile handling, and installed HUD fallback behavior. (#2104, #2088, #2086, #2066, #2050)

HUD & UX Improvements

• feat(hud): add worktree detection and configurable element ordering (#2083)
• feat(hud): show elapsed time since prompt instead of clock timestamp (#1934)
• feat(hud): add per-model weekly quota display (sn:/op:) (#1935)
• feat(hud): add last tool name display (tool:Read) (#1947)
• feat(hud): add OSC 8 terminal hyperlinks for cwd element (#1948)
• fix(hud): canonicalize git paths and validate layout arrays
• fix(hud): support detail elements moved to inline groups via layout
• fix(hud): support inline elements moved to detail group via layout
• fix(hud): pass layout through config merge and fix detail ordering
• fix(hud): preserve legacy detail line ordering for agents multiline
• fix(hud): respect explicit safeMode: false on Windows (#2037)
• fix(hud): mark stale background tasks as failed before filtering (#1968)
• fix(hud): resolve autopilot phase undefined display (#2039)
• fix(hud): npm package fallback for installed builds (#2066)

Tools, Skills & Workflow

• feat(lsp): support LSP 3.17 pull diagnostics for kotlin-lsp (#2007)
• feat(skill): add self-improve autonomous code improvement skill (#2074)
• feat(ralph): enforce prompt prerequisite sections as blocking gates (#2044)
• feat(teleport): symlink node_modules from parent repo (#2043)
• improve(skill): improve skill discoverability from frontmatter hints (#2080)
• internal(workflows): expose skininthegamebros-only builtin workflows for internal users (#2078)
• fix(keyword-detector): inject skill content directly instead of Skill tool dependency (#2068)
• fix(keyword-detector): prevent mode-message keywords from dispatching as missing skills (#2055)
• fix: prevent nested skill invocations from orphaning skill-active-state (#2025)

Runtime, Hooks & Reliability

• fix: prevent stale Skill state from blocking session stop (#2104)
• fix: prevent Ralph stop-hook cancels from trapping continued sessions (#2088)
• fix: respect custom Claude config profiles during setup (#2086)
• fix(state-tools): write cancel signal in state_clear when no session_id provided (#2102)
• fix(pre-tool-enforcer): allow tier aliases when OMC_SUBAGENT_MODEL is set (#2064, #2041)
• fix(installer): update CLAUDE.md even when running in plugin context (#2002)
• fix(hooks): consolidate state management patterns across template hooks (#1986)
• fix(ask): strip CLAUDECODE env from advisor spawns (#1984)
• fix(ci/scripts): make version sync and release prep more reliable across platforms (#2021)

Security & Hardening

• fix(security): harden python sandbox module blocklist (v2) (#2047)
• fix(security): block tmux send-keys in worker bash commands (#2028)
• fix(security): enforce disableExternalLLM in team worker contracts (#2022)
• fix(security): add hard max iteration limit for persistent modes (#2010)
• fix(security): add sandbox mode for python_repl (#2009)
• refactor(security): unify security config with OMC_SECURITY=strict (#2006)
• fix(security): restrict ast_grep_search/replace path to project root (#2005)
• fix: resolve security vulnerabilities, lint warnings, and CJS runtime bug (#1994)

Documentation

• docs: restore shared/ directory (referenced by skills) (#2046)
• docs: add Getting Started, Hooks, and Tools guides (#2029)
• docs(security): add SECURITY.md with deployment guide (#2023)
• docs: fix REFERENCE.md accuracy and remove stale files (#2035)
• docs: remove unreferenced docs/ko/ translations (#2032)
• docs: remove stale partials/ and ANALYTICS-SYSTEM.md (#2030)
• docs: fix agent count in README (32 → 19) (#2027)

Stats

• 35+ merged PRs | 8 major user-facing feature improvements | 20+ bug/runtime fixes | 7 security/hardening improvements

Install / Update

npm install -g oh-my-claude-sisyphus@4.10.0

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.9.3...v4.10.0

Contributors

Thank you to all contributors who made this release possible!

@Yeachan-Heo @blue-int @2233admin @EthanJStark @lonj7798 @ZHbin0 @devswha @DdangJin @Songgyubin @riftzen-bit @sercankaya @tjsingleton

What's Changed

• fix(ask): strip CLAUDECODE env from advisor spawns by @Yeachan-Heo in #1984
• Fix child-agent model inheritance when forceInherit is enabled by @Yeachan-Heo in #1992
• fix(hud): mark stale background tasks as failed before filtering by @riftzen-bit in #1968
• fix(hooks): consolidate state management patterns across template hooks by @lifrary in #1986
• fix: resolve security vulnerabilities, lint warnings, and CJS runtime bug by @riftzen-bit in #1994
• feat(hud): add OSC 8 terminal hyperlinks for cwd element by @2233admin in #1948
• feat(hud): add last tool name display (tool:Read) by @2233admin in #1947
• feat(hud): add per-model weekly quota display (sn:/op:) by @2233admin in #1935
• feat(hud): show elapsed time since prompt instead of clock timestamp by @2233admin in #1934
• fix(test): prevent timing race in background-cleanup boundary test by @Yeachan-Heo in #1995
• fix(daemon): add NODE_EXTRA_CA_CERTS to daemon env allowlist by @Yeachan-Heo in #1999
• fix(security): restrict ast_grep path to project root by @blue-int in #2005
• refactor(security): unify security config with OMC_SECURITY=strict by @blue-int in #2006
• feat(lsp): support LSP 3.17 pull diagnostics for kotlin-lsp by @blue-int in #2007
• fix(security): add sandbox mode for python_repl by @blue-int in #2009
• fix(security): add hard max iteration limit for persistent modes by @blue-int in #2010
• fix(installer): update CLAUDE.md even when running in plugin context by @Songgyubin in #2002
• fix(scripts): cross-platform sed -i in sync-version.sh by @Yeachan-Heo in #2021
• fix(security): enforce disableExternalLLM in team worker contracts by @blue-int in #2022
• docs(security): add SECURITY.md with deployment guide by @blue-int in #2023
• fix: prevent nested skill invocations from orphaning skill-active-state by @DdangJin in #2025
• docs: fix agent count in README (32 → 19) by @devswha in #2027
• fix(security): block tmux send-keys in worker bash commands by @blue-int in #2028
• docs: add Getting Started, Hooks, and Tools guides by @devswha in #2029
• docs: remove stale partials/ and ANALYTICS-SYSTEM.md by @devswha in #2030
• docs: remove unreferenced docs/ko/ translations by @devswha in #2032
• docs: fix REFERENCE.md accuracy and remove stale files by @devswha in #2035
• fix(hud): respect explicit safeMode: false on Windows by @2233admin in #2037
• fix(hud): resolve autopilot phase undefined display by @Yeachan-Heo in #2039
• fix(pre-tool-enforcer): allow tier aliases when OMC_SUBAGENT_MODEL is set by @EthanJStark in #2041
• feat(teleport): symlink node_modules from parent repo ...

v4.9.3 — MCP Bridge Fix, 30+ Bug Fixes & Hardening

oh-my-claudecode v4.9.3: MCP Bridge Fix, 30+ Bug Fixes & Hardening

🔥 Critical Fix

MCP bridge server crash on startup — setRequestHandler was extracted without .bind(server), causing this === undefined in strict mode. All MCP tools (state_clear, state_list_active, lsp_diagnostics) were broken in v4.9.2. Fixed. (#1979)

Release Notes

Hotfix release with 1 critical MCP fix, 30+ bug fixes, and release pipeline improvements across 32 merged PRs.

Highlights

• fix: MCP bridge crash — unbound this in setRequestHandler (#1979)
• fix(team): parse only complete lines in outbox-reader (#1982)
• fix(hooks): escape regex metacharacters in detectPipelineSignal (#1977)
• fix(lib): guard against prototype pollution in deepMerge (#1955)
• fix(installer): strip corrupted markers to prevent mergeClaudeMd unbounded growth (#1966)

Bug Fixes

• fix: bind server context in standalone MCP handler registration (#1979)
• fix(team): parse only complete lines in outbox-reader (#1982)
• fix(team): strip tmux- prefix and add claude to provider type (#1981)
• fix(notifications): move clearTimeout to finally block in sendCustomWebhook (#1980)
• fix(hud): preserve session fields when clearing background tasks (#1978)
• fix(hooks): escape regex metacharacters in detectPipelineSignal (#1977)
• fix(hooks): use correct field name for ralph mode in keyword-detector (#1970)
• fix(lib): accept dots in extractRepoSlug for repos like next.js (#1976)
• fix(hooks): clear timeout in finally block for session-start scripts (#1975)
• fix(hud): add PID tracking to prevent session-summary process accumulation (#1974)
• fix(team): count both failed and error tasks in team status (#1973)
• fix(notifications): remove Slack fallback to prevent unrelated session injection (#1972)
• fix(team): add locking to teamCreateTask for safe concurrent task creation (#1971)
• fix(team): add file locking to removeWorkerWorktree metadata update (#1962)
• fix(scripts): use tail reading in persistent-mode to prevent OOM on large transcripts (#1967)
• fix(installer): strip corrupted markers to prevent mergeClaudeMd unbounded growth (#1966)
• fix(tools): escape $ replacement patterns in AST grep replace (#1965)
• fix(interop): add file locking to updateSharedTask (#1964)
• fix(cli): increase generateJobId entropy from 4 to 8 hex chars (#1963)
• fix(hud): propagate directory parameter to initializeHUDState (#1961)
• fix(model-routing): replace require() with ESM import to prevent crash (#1960)
• fix(lib): add RALPLAN to mode name maps (#1959)
• fix(providers): include auth token in Gitea REST API fallback (#1957)
• fix(notifications): add Slack user authorization with fail-closed pattern (#1956)
• fix(lib): guard against prototype pollution in deepMerge (#1955)
• fix(team): revert task to pending when tmux pane creation fails (#1940)
• fix(lib): use atomicWriteJsonSync in mode-state-io to prevent race condition (#1938)
• fix(hooks): return fresh:false for missing heartbeat file (#1937)
• fix(setup): remove duplicate dev paths in plugin-setup (#1943)
• fix(team): run dedup check before writing worker inbox (#1942)

Infrastructure

• fix(release): add version sync hook to prevent satellite file drift
• fix(release): generate fresh release notes at tag time (no more stale body)
• fix(ci): sync version markers to 4.9.3

Stats

• 32+ PRs merged | 30+ bug fixes | 1 critical MCP fix | 3 infrastructure improvements

Install / Update

npm install -g oh-my-claude-sisyphus@4.9.3

Or reinstall the plugin:

claude /install-plugin oh-my-claudecode

Full Changelog: v4.9.2...v4.9.3

Contributors

Thank you to all contributors: @sercankaya @riftzen-bit