v6.1.1

Release 6.1.1 — 2026-10-23

Summary

ycc 6.1.1 is a toolchain security patch. Repository CI and mise now pin the Node.js October 2026 security releases (22.23.4 and 24.22.1), and the dev dependency tree pins markdown-it to 14.3.3. Plugin behavior is unchanged.

Added

None this release.

Changed

be9d76d docs(internal): record the v6.1.0 post-release OMP install smoke (YAN-1560) (#458)

Removed

None this release.

Fixed

a7934e6 fix(security): pin Node.js October 2026 releases and markdown-it 14.3.3 (#459)

Packages

Package	Runtime	Status	Mechanism	Listed	Version or target	Notes
@yandy-r/ycc-opencode	opencode	included	npm	no	6.1.1	experimental; opt-in; not yet published; Experimental and opt-in in v6; the @yandy-r npm scope is already owned. The V2 setup hook registers components and delivers instructions through the context hook; install.sh file copy stays the primary opencode path.
ycc	claude	included	native	yes	6.1.1	Shipping entry; stays visible in every catalog throughout the v6 flip. status-bar@ycc-mods is versioned independently and stays outside this manifest.
ycc	codex	included	native	yes	6.1.1	Listed in the ycc Codex catalog (.agents/plugins/marketplace.json) with a local source at ./.codex-plugin/ycc; installs together with ycc-mcp. Replaces the legacy local-ycc-plugins catalog.
ycc	cursor	included	native	yes	6.1.1	Ships through the GitHub marketplace; no cursor.com submission before post-6.0.
ycc	omp	included	native	yes	6.1.1	Generated OMP package under packages/omp/ycc (omp >=18.12.2) with .omp-plugin and .claude-plugin manifests and package.json, rewritten ${CLAUDE_PLUGIN_ROOT}, /ycc: and _shared references, agents translated to @ROLE models, and one commands/.md entrypoint per public skill (/ycc:). Listed in the root .omp-plugin/marketplace.json (YAN-1180). install.sh --target omp exports it to a local marketplace (--mode local) or registers the repository catalog (--mode repo) and installs it through omp plugin (user or project scope).
ycc-agents	claude	deferred	native	no	target v7.0.0	Deferred to v7.0.0 as a breaking change with qualified ycc-agents: references; the v6 namespace spike rejects a shared manifest name. Hidden prep: claude_agents_split.py builds and validates the split on demand (claude-native check); test-claude-agents-split.sh is the opt-in live dispatch proof.
ycc-all	claude	included	native	yes	6.1.1	Meta plugin that installs ycc, ycc-mcp, and ycc-hooks through Claude plugin dependencies.
ycc-all	omp	excluded	native	no	target v6.1.0	Excluded: the OMP marketplace does not read plugin dependencies, so ycc-all (on Claude the union of ycc, ycc-mcp, and ycc-hooks) is omitted from the OMP catalog; install ycc and ycc-mcp separately; herdr reporting comes from herdr integration install omp.
ycc-hooks	claude	included	native	yes	6.1.1	Native plugin hooks/hooks.json needs Claude Code 2.1.300 or later; older clients keep installer-managed hooks. After enabling ycc-hooks@ycc, install.sh migrate --target claude --apply prunes the installer hooks.
ycc-hooks	codex	excluded	native	no	target v6.0.0	Excluded: NO-GO until verified under YAN-1149 (YAN-1149 gate). Hooks stay out of the Codex bundle.
ycc-hooks	cursor	included	native	yes	6.1.1	sessionStart only; WorktreeCreate stays on install.sh.
ycc-hooks	omp	excluded	native	no	target v6.1.0	Excluded: herdr ships its own OMP integration (herdr integration install omp), which reports the session and agent state; a ycc reporter is ignored by herdr (non-herdr source) or corrupts herdr's ordering (herdr:omp). WorktreeCreate has no OMP event. ycc ships no OMP hooks (YAN-1174); its only OMP extension is the agent scope guard inside the ycc package (YAN-1250).
ycc-mcp	claude	included	native	yes	6.1.1	Native MCP-only plugin.
ycc-mcp	codex	included	native	yes	6.1.1	Native MCP-only plugin; carries the MCP servers the Codex ycc plugin used to ship. Listed together with ycc.
ycc-mcp	cursor	included	native	yes	6.1.1	Native MCP-only plugin.
ycc-mcp	omp	included	native	yes	6.1.1	Generated OMP package under packages/omp/ycc-mcp (omp >=18.12.2) with .omp-plugin and .claude-plugin manifests, package.json, and a root .mcp.json byte-identical to mcp-configs/mcp.json (secret-literal audited; ${VAR} env placeholders stay unexpanded until omp starts a server). Servers load as ycc-mcp:. Listed in the root .omp-plugin/marketplace.json (YAN-1180). install.sh --target omp installs it next to ycc through omp plugin (user or project scope); a running session picks it up after /reload-plugins or a restart.
ycc-rules	cursor	included	native	yes	6.1.1	Cursor-only rules package. No Claude ycc-rules: Claude rules stay on install.sh (see installer-fallback claude).
ycc-rules	omp	included	native	yes	6.1.1	Generated package under packages/omp/ycc-rules (omp >=18.12.2): 31 flat rules named ycc--, paths→globs, description kept, alwaysApply only when true. Language rules are rulebook entries read via rule://; 5 description-less ycc--trigger TTSR rules (glob-gated edit/write, interruptMode never) attach them once per session and once per subagent that edits a matching file. Listed in the root .omp-plugin/marketplace.json (YAN-1180).

File-copy packages (the installer fallback) have no native manifest and are not versioned here.

Validation

• ./scripts/sync.sh — OK
• ./scripts/validate.sh — OK
• python3 -m json.tool .claude-plugin/marketplace.json — OK
• python3 -m json.tool ycc/.claude-plugin/plugin.json — OK

Upgrade Notes

No action required. Installed plugins do not embed Node.js, and this patch does not change skills, agents, or commands.

Repository checkouts and CI pick up Node.js 22.23.4 for the validate and live OMP workflows, and Node.js 24.22.1 for mise and the release workflow. The dev lockfiles pin markdown-it to 14.3.3. Node.js 20 and other end-of-life lines are outside the October 2026 fixes; use 22.x or 24.x.

Publishing the v6.1.1 tag is what ships the experimental, opt-in @yandy-r/ycc-opencode package. The install.sh file copy remains the primary opencode path.

Commit Log

a7934e6 fix(security): pin Node.js October 2026 releases and markdown-it 14.3.3 (#459)
be9d76d docs(internal): record the v6.1.0 post-release OMP install smoke (YAN-1560) (#458)

---

Previous release: v6.1.0