From 2cb58a0b3c76dff9deac27851677e115a5b0f290 Mon Sep 17 00:00:00 2001 From: Tony Yu <49832190+ysntony@users.noreply.github.com> Date: Wed, 9 Sep 2026 22:20:47 +0800 Subject: [PATCH 1/3] docs: add Kimi tracking links to sponsor logo and Kimi sections (#3047) Point the Moonshot sponsor logo href at https://platform.kimi.ai?aff=ecc (image unchanged, link target only). Add a Get Kimi Code link (https://www.kimi.com/code?aff=ecc) to the Kimi Code CLI row of the install-target table. Link the API endpoint mention in the Self-host Kimi intro to the API platform link. --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 091836e33..73b4aa7f2 100644 --- a/README.md +++ b/README.md @@ -136,7 +136,7 @@ The native path installs ECC's skills, agents, commands, and plugin-managed hook CodeRabbit    Greptile    Atlas Cloud    - Moonshot AI - Kimi    + Moonshot AI - Kimi    Itô Markets

@@ -337,7 +337,7 @@ cd ECC | Qwen CLI | `./install.sh --profile minimal --target qwen` | See the [Qwen guide](docs/QWEN-GUIDE.md) | | Hermes | `./install.sh --profile minimal --target hermes` | See the [Hermes setup guide](docs/HERMES-SETUP.md) | | OpenClaw | `./install.sh --profile minimal --target openclaw` | Managed home-directory install | -| Kimi Code CLI | `./install.sh --profile minimal --target kimi` | Project-local `.kimi-code/` install | +| Kimi Code CLI | `./install.sh --profile minimal --target kimi` | Project-local `.kimi-code/` install · [Get Kimi Code](https://www.kimi.com/code?aff=ecc) | | CodeBuddy | `./install.sh --profile minimal --target codebuddy` | Project-local `.codebuddy/` install | | JoyCode | `./install.sh --profile minimal --target joycode` | Project-local `.joycode/` install | @@ -368,7 +368,7 @@ Run or self-host any open-source model behind that gateway using separate comput ### Self-host Kimi with ECC + Itô compute -The Kimi Code harness and the model-serving layer are separate. ECC configures the agent harness; you bring an API endpoint or self-host an open-weight Kimi model on your own GPU capacity. This adapter is verified against Kimi Code 0.31.x (`@moonshot-ai/kimi-code`): +The Kimi Code harness and the model-serving layer are separate. ECC configures the agent harness; you bring an API endpoint ([get a Kimi API key](https://platform.kimi.ai?aff=ecc)) or self-host an open-weight Kimi model on your own GPU capacity. This adapter is verified against Kimi Code 0.31.x (`@moonshot-ai/kimi-code`): From 549c14692ccf610f127a4b95eb6f496bb45ab6c9 Mon Sep 17 00:00:00 2001 From: Myles Agnew Date: Thu, 10 Sep 2026 03:56:47 +1000 Subject: [PATCH 2/3] fix(security): bump js-yaml 4.3.1 -> 4.3.2 (GHSA-2883-xcg3-v3hh) (#3032) js-yaml < 4.3.2 is affected by a high-severity uncontrolled-resource- consumption issue (CWE-400 / CWE-407, CVSS 7.5): maxTotalMergeKeys does not limit CPU use for empty merge sources, allowing a crafted YAML document with merge keys to cause a denial of service while parsing. js-yaml is a direct runtime dependency (it is also pinned via `overrides` and `resolutions`), so the bump is applied in all three package.json locations and both lockfiles are regenerated. 4.3.2 is a non-breaking patch release; `npm audit --audit-level=high` and an immutable `yarn install` both pass afterward. Advisory: https://github.com/advisories/GHSA-2883-xcg3-v3hh Co-authored-by: Claude Opus 4.8 --- package-lock.json | 8 ++++---- package.json | 6 +++--- yarn.lock | 10 +++++----- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/package-lock.json b/package-lock.json index a692663fa..d5b64895a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "dependencies": { "@iarna/toml": "2.2.5", "ajv": "8.20.0", - "js-yaml": "4.3.1", + "js-yaml": "4.3.2", "sql.js": "1.14.2" }, "bin": { @@ -1493,9 +1493,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 70f136fc9..9cdc81dce 100644 --- a/package.json +++ b/package.json @@ -479,7 +479,7 @@ "dependencies": { "@iarna/toml": "2.2.5", "ajv": "8.20.0", - "js-yaml": "4.3.1", + "js-yaml": "4.3.2", "sql.js": "1.14.2" }, "pi": { @@ -509,13 +509,13 @@ "overrides": { "fast-uri": "3.1.7", "markdown-it": "14.3.0", - "js-yaml": "4.3.1", + "js-yaml": "4.3.2", "@humanfs/node": "0.16.8" }, "resolutions": { "fast-uri": "3.1.7", "markdown-it": "14.3.0", - "js-yaml": "4.3.1", + "js-yaml": "4.3.2", "@humanfs/node": "0.16.8" }, "packageManager": "yarn@4.9.2+sha512.1fc009bc09d13cfd0e19efa44cbfc2b9cf6ca61482725eb35bbc5e257e093ebf4130db6dfe15d604ff4b79efd8e1e8e99b25fa7d0a6197c9f9826358d4d65c3c" diff --git a/yarn.lock b/yarn.lock index 8867e1184..7b566ee07 100644 --- a/yarn.lock +++ b/yarn.lock @@ -606,7 +606,7 @@ __metadata: c8: "npm:11.0.0" eslint: "npm:10.9.1" globals: "npm:17.11.0" - js-yaml: "npm:4.3.1" + js-yaml: "npm:4.3.2" markdownlint-cli: "npm:0.49.1" sql.js: "npm:1.14.2" typescript: "npm:6.0.3" @@ -1082,14 +1082,14 @@ __metadata: languageName: node linkType: hard -"js-yaml@npm:4.3.1": - version: 4.3.1 - resolution: "js-yaml@npm:4.3.1" +"js-yaml@npm:4.3.2": + version: 4.3.2 + resolution: "js-yaml@npm:4.3.2" dependencies: argparse: "npm:^2.0.1" bin: js-yaml: bin/js-yaml.js - checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807 + checksum: 10c0/dedd34c2e8fef1d504687f1bc94ed0ee1311a1f78770fa2800352c6d59c635ccf555009d74e9afe529ae62199da2b1ccef30e53dc84dcd8d2d8187c22574bc97 languageName: node linkType: hard From cc91c24f9a35dc79811f2326b6cbf4a74739009a Mon Sep 17 00:00:00 2001 From: Wu Shuwen Date: Thu, 10 Sep 2026 03:00:49 +0800 Subject: [PATCH 3/3] fix(commands): distinguish prp-pr alias (#2907) --- commands/prp-pr.md | 2 +- docs/COMMAND-REGISTRY.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/commands/prp-pr.md b/commands/prp-pr.md index 9469cb884..2016ec90b 100644 --- a/commands/prp-pr.md +++ b/commands/prp-pr.md @@ -1,5 +1,5 @@ --- -description: "Create a GitHub PR from current branch with unpushed commits — discovers templates, analyzes changes, pushes" +description: "Alias of /pr for the PRP workflow series. Use when creating a pull request mid-PRP workflow; otherwise use /pr." argument-hint: "[base-branch] (default: main)" --- diff --git a/docs/COMMAND-REGISTRY.json b/docs/COMMAND-REGISTRY.json index 29b1cd647..4f7918cfc 100644 --- a/docs/COMMAND-REGISTRY.json +++ b/docs/COMMAND-REGISTRY.json @@ -741,7 +741,7 @@ }, { "command": "prp-pr", - "description": "Create a GitHub PR from current branch with unpushed commits — discovers templates, analyzes changes, pushes", + "description": "Alias of /pr for the PRP workflow series. Use when creating a pull request mid-PRP workflow; otherwise use /pr.", "type": "testing", "primaryAgents": [], "allAgents": [],