Skip to content

v8.1.4

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 06:15
· 42 commits to main since this release
v8.1.4
3d1f1a6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release for the CCC-HQ batch (#246), finished auto-routing (#247) and the Hermes CCC batch (#245). Bumps the pinned plugin version so claude plugin update picks these up.

Security

  • Status line: the status line no longer evals Claude Code's JSON. Fields are parsed positionally and numbers coerced, so a quote, $() or backtick in a directory, model or agent name can no longer run shell code (CC-2110, H1).
  • Elicitation hooks: the Elicitation and ElicitationResult hooks log only the documented identifiers (MCP server, mode, elicitation id, action) and never the message, URL, schema or submitted content, which can carry credentials (CC-2115, H2).

Changed

  • Load on demand: 32 skills stay model-visible and 52 load on demand (disable-model-invocation), cutting the skill listing from about 22.6k to 7.3k characters. The router offers hidden skills as a menu the user types, and npm run measure:listing / check:listing guard the budget (CC-2112).
  • Network and telemetry: telemetry is opt-in and off by default. CCC_OFFLINE=1 blocks every outbound call, and the CI ticker's gh lookup runs only with CCC_CI_TICKER=1. All outbound calls go through lib/network-mode.js (CC-2111).
  • Defaults: the cost ceiling is off unless set, and when set it denies with a reason. 72 model: and 84 effort: frontmatter pins were removed so skills inherit the session's model (CC-2115).
  • Hosted MCP server: posthog-node is removed. /v1/events validates, rate-limits, acknowledges and discards events, with /metrics counters (CC-2119).
  • Docs: README, BIBLE, CHEATSHEET and mintlify use generated counts. check:parity keeps 105+ files consistent. There is a plugin icon, and the README has example prompts, privacy and support (CC-2113, CC-2117).

Added

  • Directory mirror: a publisher builds the cc-commander directory mirror, triggered by a tag. It stays dormant until the mirror repo and secret exist (CC-2114).
  • Auto-routing: route-hints.json takes an integer priority that breaks score ties (higher first, default 0; then skills before agents). npm run build:routes now fails, naming the route, when a routable skill or agent has no trigger, pattern, path or "Use when … says" phrase, so a route that can never fire is caught at build time (CC-2060).
  • Auto-routing: the routing mode can be saved per lane: /ccc-settings → Auto-routing writes routeMode (auto, suggest or off) to <config dir>/commander/config.json, and both the prompt router and the what-next menu read it. A valid CCC_ROUTE_MODE still wins; unknown values fall back to auto (CC-2061).
  • Auto-routing: npm run eval:routes (scripts/route-eval.js) runs the routing eval as one command and reports recall, false triggers, wrong-route fires, wrong auto-runs, explicit requests that no longer auto-run and routes that never fire, with --json and --fixtures <file>. A route with labelled prompts that fires on none of them now fails, even when aggregate recall is still 90% or higher. npm run test:ci runs the registry freshness check, the eval and the routing tests (CC-2063).
  • Auto-routing: the what-next menu after a skill run has a per-session cooldown: at most one menu every 10 minutes (CCC_ROUTE_NEXT_COOLDOWN_MIN, 0 offers after every run). A skill run inside the cooldown is dropped, not saved for later, and a run that ends on its own question does not start the cooldown (CC-2062).
  • Codex: docs/reference/dual-host-hooks.md documents the hook contract shared by Claude Code and Codex (command form, plugin root, events, output fields, host detection, menus) and the one-time /hooks trust step Codex users need before hooks fire; linked from the README and the Codex adapter README. commander/tests/dual-host-hooks.test.js checks that both hosts register the routing hook on UserPromptSubmit and Stop, that the mirrored hook files are byte-identical and that host detection holds (CC-2064).
  • Broadcast: /ccc-broadcast can send every signal to one ops channel (opsChannel). Incidents stay immediate, lib/broadcast-route.js adds dedup keys and message-id receipts, and the router refuses credential fields (CC-1598).
  • Specialists: a read-only specialist resolver maps a name to its canonical agent or persona profile with provenance. It is off unless CCC_SPECIALIST_RESOLVER=1 (CC-1998).
  • Docs: docs/reports/2026-10-25-ccc-best-practice-audit.md is a cited best-practice audit of the CCC-HQ findings (FLT-187).

Fixed

  • Command names: the suggest-ticker nudge and the BIBLE workflow table no longer name nonexistent commands (/ccc-debug, /ccc-verify, /ccc-spike*). A test fails when hook text names a missing command (CC-296).
  • MCP pins: bundled MCP server versions are pinned (CC-2106).

Also in this release (not yet in CHANGELOG.md; flagged by the release review, docs fix to follow)

  • Voice injector: now opt-in with CCC_VOICE=1 (CC-2112).
  • Status line and session end: the "Powered by" partner lines are removed (CC-2111).
  • Lanes: the status line and doctor accept lane aliases and CCC_CONFIG_DIR (CC-2115).
  • Wording: the SessionStart nudge says "Commander Method" instead of "Fable Method" (CC-2117).

Release gate: independent Fable review of 3d1f1a6 returned VERDICT: PASS (session c668cb87-fd64-4722-83d1-4f57a9a1f9c7).

Assets 2
Loading