fix: make the installer runtime pass strict supply-chain vetting (#2503)

* fix: make the installer runtime pass strict supply-chain vetting Remediate the four enterprise supply-chain vetting blockers from affaan-m/ECC#2502 so the installer runtime (package.json + manifests + scripts/lib/**) passes strict exact-pin evidence policy: 1. Remove the package.json `postinstall` lifecycle script (it only echoed a post-install banner) and move that banner to an explicit opt-in `npm run welcome` command. No install-time lifecycle script remains. 2. Exact-pin every dependency in package.json (dependencies + devDependencies) to the versions already resolved in package-lock.json; no ^/~ ranges. 3. Replace non-ASCII characters on the installer runtime script/config surface: em-dashes (U+2014) in scripts/lib/{path-safety,install-executor, install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in manifests/{install-components,install-modules}.json descriptions become ASCII, so strict-surface Unicode scanners are clean. 4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file already carries a complete hand-rolled validator enforcing the same schemas/install-state.schema.json (ecc.install.v1) constraints, so the installer closure is dependency-free (zero non-builtin bare requires). Refs affaan-m/ECC#2502 * fix: avoid unpinned welcome invocations Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: validate translated skill frontmatter Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: repair skill frontmatter YAML Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: add MIT license to core skill manifests; pin verification-loop tsc invocation * fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail) * chore(deps): sync lockfiles with exact-pinned package.json Regenerate package-lock.json and yarn.lock so the pinned dependency specs are reflected in both lockfiles. npm ci and Yarn's --immutable install now pass the sync check. The resolution tree is unchanged (231 yarn resolutions, byte-identical set; zero npm transitive drift); only the root descriptor strings move from ranges to the versions already resolved in the committed lockfiles. Addresses the Codex P1 on #2503. --------- Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>
2026-08-17 21:15:40 +02:00 · 2026-07-17 17:13:49 -04:00
parent 5da21c2b66
commit 754b8dd76c
42 changed files with 144 additions and 99 deletions
@@ -1,6 +1,6 @@
 ---
 name: django-verification
-description: Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR.
+description: "Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR."
 ---

 # Django 検証ループ
@@ -1,3 +1,10 @@
+---
+name: project-guidelines-example
+description: Project-specific skill template covering architecture, patterns, testing, and deployment guidance.
+metadata:
+  origin: ECC
+---
+
 # プロジェクトガイドラインスキル（例）

 これはプロジェクト固有のスキルの例です。自分のプロジェクトのテンプレートとして使用してください。
@@ -1,6 +1,7 @@
 ---
 name: returns-reverse-logistics
-description: 返品承認、受取・検品、処分決定、返金処理、不正検出、保証クレーム管理のための標準化された専門知識。15年以上の経験を持つ返品オペレーションマネージャーの知見に基づく。段階的フレームワーク、処分経済性、不正パターン認識、ベンダー回収プロセスを含む。製品返品、逆物流、返金決定、返品不正検出、保証クレームを扱う場合に使用。license: Apache-2.0
+description: 返品承認、受取・検品、処分決定、返金処理、不正検出、保証クレーム管理のための標準化された専門知識。15年以上の経験を持つ返品オペレーションマネージャーの知見に基づく。段階的フレームワーク、処分経済性、不正パターン認識、ベンダー回収プロセスを含む。製品返品、逆物流、返金決定、返品不正検出、保証クレームを扱う場合に使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,6 @@
 ---
 name: springboot-verification
-description: Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.
+description: "Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR."
 ---

 # Spring Boot 検証ループ
@@ -1,6 +1,6 @@
 ---
 name: swiftui-patterns
-description: @Observableを使用した状態管理、ビュー合成、ナビゲーション、パフォーマンス最適化、モダンなiOS/macOS UIのベストプラクティスを備えたSwiftUIアーキテクチャパターン。
+description: "@Observableを使用した状態管理、ビュー合成、ナビゲーション、パフォーマンス最適化、モダンなiOS/macOS UIのベストプラクティスを備えたSwiftUIアーキテクチャパターン。"
 ---

 # SwiftUI パターン
@@ -1,6 +1,7 @@
 ---
 name: token-budget-advisor
-description: 回答する前に、どれだけの回答深度を消費するかについてユーザーに情報に基づいた選択を提供する。ユーザーが回答の長さ、深さ、またはトークンバジェットを明示的に制御したい場合にこのスキルを使用する。トリガー条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"、またはユーザーが回答のサイズや深さの制御を明示的に求めるその他の明確なバリエーション。トリガーしない条件：ユーザーが現在のセッションでレベルを指定済み（そのレベルを維持）、リクエストが明らかに一言の回答、または「token」が認証/セッション/支払いトークンを指している。origin: community
+description: 回答する前に、どれだけの回答深度を消費するかについてユーザーに情報に基づいた選択を提供する。ユーザーが回答の長さ、深さ、またはトークンバジェットを明示的に制御したい場合にこのスキルを使用する。トリガー条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"、またはユーザーが回答のサイズや深さの制御を明示的に求めるその他の明確なバリエーション。トリガーしない条件：ユーザーが現在のセッションでレベルを指定済み（そのレベルを維持）、リクエストが明らかに一言の回答、または「token」が認証/セッション/支払いトークンを指している。
+origin: community
 ---

 # トークンバジェットアドバイザー（TBA）
@@ -1,3 +1,10 @@
+---
+name: verification-loop
+description: A comprehensive verification system for Claude Code sessions.
+metadata:
+  origin: ECC
+---
+
 # 検証ループスキル

 Claude Codeセッション向けの包括的な検証システム。
@@ -1,6 +1,6 @@
 ---
 name: laravel-verification
-description: Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.
+description: "Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness."
 origin: ECC
 ---

@@ -1,6 +1,7 @@
 ---
 name: blueprint
-description: 将单行目标转化为多会话、多代理工程项目的分步构建计划。每个步骤包含独立的上下文简介，以便新代理能直接执行。包括对抗性审查门、依赖图、并行步骤检测、反模式目录和计划突变协议。触发条件：当用户请求复杂多PR任务的计划、蓝图或路线图，或描述需要多个会话的工作时。不触发条件：任务可在单个PR或少于3个工具调用中完成，或用户说“直接执行”时。origin: community
+description: 将单行目标转化为多会话、多代理工程项目的分步构建计划。每个步骤包含独立的上下文简介，以便新代理能直接执行。包括对抗性审查门、依赖图、并行步骤检测、反模式目录和计划突变协议。触发条件：当用户请求复杂多PR任务的计划、蓝图或路线图，或描述需要多个会话的工作时。不触发条件：任务可在单个PR或少于3个工具调用中完成，或用户说“直接执行”时。
+origin: community
 ---

 # Blueprint — 施工计划生成器
@@ -1,3 +1,10 @@
+---
+name: browser-qa
+description: Automate visual testing and UI interaction verification using browser automation after deployment.
+metadata:
+  origin: ECC
+---
+
 # Browser QA — 自动化视觉测试与交互验证

 ## When to use
@@ -1,6 +1,7 @@
 ---
 name: carrier-relationship-management
-description: 用于管理承运商组合、协商运费、跟踪承运商绩效、分配货运以及维护战略承运商关系的编码专业知识。基于拥有15年以上经验的运输经理提供的信息。包括记分卡框架、RFP流程、市场情报和合规性审查。适用于管理承运商、协商费率、评估承运商绩效或制定货运策略时使用。license: Apache-2.0
+description: 用于管理承运商组合、协商运费、跟踪承运商绩效、分配货运以及维护战略承运商关系的编码专业知识。基于拥有15年以上经验的运输经理提供的信息。包括记分卡框架、RFP流程、市场情报和合规性审查。适用于管理承运商、协商费率、评估承运商绩效或制定货运策略时使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: customs-trade-compliance
-description: 海关文件、关税分类、关税优化、受限方筛查以及多司法管辖区法规合规的编码化专业知识。由拥有15年以上经验的贸易合规专家提供。包括HS分类逻辑、Incoterms应用、自贸协定利用以及罚款减免。适用于处理海关清关、关税分类、贸易合规、进出口文件或关税优化时使用。license: Apache-2.0
+description: 海关文件、关税分类、关税优化、受限方筛查以及多司法管辖区法规合规的编码化专业知识。由拥有15年以上经验的贸易合规专家提供。包括HS分类逻辑、Incoterms应用、自贸协定利用以及罚款减免。适用于处理海关清关、关税分类、贸易合规、进出口文件或关税优化时使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: energy-procurement
-description: 电力与燃气采购、电价优化、需量电费管理、可再生能源购电协议评估及多设施能源成本管理的编码化专业知识。基于能源采购经理在大型工商业用户中超过15年的经验。包括市场结构分析、对冲策略、负荷分析和可持续性报告框架。适用于采购能源、优化电价、管理需量电费、评估购电协议或制定能源策略时使用。license: Apache-2.0
+description: 电力与燃气采购、电价优化、需量电费管理、可再生能源购电协议评估及多设施能源成本管理的编码化专业知识。基于能源采购经理在大型工商业用户中超过15年的经验。包括市场结构分析、对冲策略、负荷分析和可持续性报告框架。适用于采购能源、优化电价、管理需量电费、评估购电协议或制定能源策略时使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: inventory-demand-planning
-description: 为多地点零售商提供需求预测、安全库存优化、补货规划及促销提升估算的编码化专业知识。基于拥有15年以上管理数百个SKU经验的需求规划师的专业知识。包括预测方法选择、ABC/XYZ分析、季节性过渡管理及供应商谈判框架。适用于预测需求、设定安全库存、规划补货、管理促销或优化库存水平时使用。license: Apache-2.0
+description: 为多地点零售商提供需求预测、安全库存优化、补货规划及促销提升估算的编码化专业知识。基于拥有15年以上管理数百个SKU经验的需求规划师的专业知识。包括预测方法选择、ABC/XYZ分析、季节性过渡管理及供应商谈判框架。适用于预测需求、设定安全库存、规划补货、管理促销或优化库存水平时使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,6 @@
 ---
 name: laravel-verification
-description: Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.
+description: "Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness."
 origin: ECC
 ---

@@ -1,6 +1,7 @@
 ---
 name: logistics-exception-management
-description: 针对货运异常、货物延误、损坏、丢失和承运商纠纷的编码化专业知识，由拥有15年以上运营经验的物流专业人士提供。包括升级协议、承运商特定行为、索赔程序和判断框架。在处理运输异常、货运索赔、交付问题或承运商纠纷时使用。license: Apache-2.0
+description: 针对货运异常、货物延误、损坏、丢失和承运商纠纷的编码化专业知识，由拥有15年以上运营经验的物流专业人士提供。包括升级协议、承运商特定行为、索赔程序和判断框架。在处理运输异常、货运索赔、交付问题或承运商纠纷时使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: production-scheduling
-description: 为离散和批量制造中的生产调度、作业排序、产线平衡、换模优化和瓶颈解决提供编码化专业知识。基于拥有15年以上经验的生产调度师的知识。包括约束理论/鼓-缓冲-绳、快速换模、设备综合效率分析、中断响应框架以及企业资源计划/制造执行系统交互模式。适用于调度生产、解决瓶颈、优化换模、应对中断或平衡制造产线时。license: Apache-2.0
+description: 为离散和批量制造中的生产调度、作业排序、产线平衡、换模优化和瓶颈解决提供编码化专业知识。基于拥有15年以上经验的生产调度师的知识。包括约束理论/鼓-缓冲-绳、快速换模、设备综合效率分析、中断响应框架以及企业资源计划/制造执行系统交互模式。适用于调度生产、解决瓶颈、优化换模、应对中断或平衡制造产线时。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: quality-nonconformance
-description: 为受监管制造业中的质量控制、不合格调查、根本原因分析、纠正措施和供应商质量管理提供编码化专业知识。基于在FDA、IATF 16949和AS9100环境中拥有15年以上经验的质量工程师的见解。包括不合格报告生命周期管理、纠正与预防措施系统、统计过程控制解释和审核方法。适用于调查不合格、进行根本原因分析、管理纠正与预防措施、解释统计过程控制数据或处理供应商质量问题。license: Apache-2.0
+description: 为受监管制造业中的质量控制、不合格调查、根本原因分析、纠正措施和供应商质量管理提供编码化专业知识。基于在FDA、IATF 16949和AS9100环境中拥有15年以上经验的质量工程师的见解。包括不合格报告生命周期管理、纠正与预防措施系统、统计过程控制解释和审核方法。适用于调查不合格、进行根本原因分析、管理纠正与预防措施、解释统计过程控制数据或处理供应商质量问题。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: returns-reverse-logistics
-description: 用于退货授权、接收与检验、处置决策、退款处理、欺诈检测以及保修索赔管理的标准化专业知识。基于拥有15年以上经验的退货运营经理的见解。包括分级框架、处置经济学、欺诈模式识别和供应商回收流程。适用于处理产品退货、逆向物流、退款决策、退货欺诈检测或保修索赔时使用。license: Apache-2.0
+description: 用于退货授权、接收与检验、处置决策、退款处理、欺诈检测以及保修索赔管理的标准化专业知识。基于拥有15年以上经验的退货运营经理的见解。包括分级框架、处置经济学、欺诈模式识别和供应商回收流程。适用于处理产品退货、逆向物流、退款决策、退货欺诈检测或保修索赔时使用。
+license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
 origin: ECC
@@ -1,6 +1,7 @@
 ---
 name: token-budget-advisor
-description: 在回答前，为用户提供关于消耗多少响应深度的知情选择。当用户明确希望控制响应长度、深度或令牌预算时使用此技能。触发条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"，或用户明确要求控制答案大小或深度的清晰变体。不触发条件：用户已在当前会话中指定了级别（保持该级别），请求明显是单字答案，或"token"指代认证/会话/支付令牌而非响应大小。origin: community
+description: 在回答前，为用户提供关于消耗多少响应深度的知情选择。当用户明确希望控制响应长度、深度或令牌预算时使用此技能。触发条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"，或用户明确要求控制答案大小或深度的清晰变体。不触发条件：用户已在当前会话中指定了级别（保持该级别），请求明显是单字答案，或"token"指代认证/会话/支付令牌而非响应大小。
+origin: community
 ---

 # Token预算顾问（TBA）
@@ -1,3 +1,10 @@
+---
+name: project-guidelines-example
+description: Project-specific skill template covering architecture, patterns, testing, and deployment guidance.
+metadata:
+  origin: ECC
+---
+
 # 專案指南技能（範例）

 這是專案特定技能的範例。使用此作為你自己專案的範本。
@@ -1,3 +1,10 @@
+---
+name: verification-loop
+description: A comprehensive verification system for Claude Code sessions.
+metadata:
+  origin: ECC
+---
+
 # 驗證循環技能

 Claude Code 工作階段的完整驗證系統。
@@ -189,7 +189,7 @@
    {
      "id": "capability:prediction-markets",
      "family": "capability",
-      "description": "Public, non-advisory prediction-market and Itô basket research workflows with gated Itô API access.",
+      "description": "Public, non-advisory prediction-market and Ito basket research workflows with gated Ito API access.",
      "modules": [
        "prediction-market-skills"
      ]
@@ -541,7 +541,7 @@
    {
      "id": "prediction-market-skills",
      "kind": "skills",
-      "description": "Public, non-advisory prediction-market and Itô basket research workflows with gated Itô API access.",
+      "description": "Public, non-advisory prediction-market and Ito basket research workflows with gated Ito API access.",
      "paths": [
        "skills/ito-basket-compare",
        "skills/ito-data-atlas-agent",
@@ -7,27 +7,27 @@
    "": {
      "name": "ecc-universal",
      "version": "2.0.0",
-      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
-        "@iarna/toml": "^2.2.5",
-        "ajv": "^8.20.0",
-        "sql.js": "^1.14.1"
+        "@iarna/toml": "2.2.5",
+        "ajv": "8.20.0",
+        "sql.js": "1.14.1"
      },
      "bin": {
        "ecc": "scripts/ecc.js",
        "ecc-control-pane": "scripts/control-pane.js",
-        "ecc-install": "scripts/install-apply.js"
+        "ecc-install": "scripts/install-apply.js",
+        "ecc-plan-canvas": "scripts/plan-canvas.js"
      },
      "devDependencies": {
-        "@eslint/js": "^9.39.2",
-        "@opencode-ai/plugin": "^1.16.2",
+        "@eslint/js": "9.39.2",
+        "@opencode-ai/plugin": "1.17.3",
        "@types/node": "25.9.2",
-        "c8": "^11.0.0",
-        "eslint": "^10.6.0",
-        "globals": "^17.4.0",
-        "markdownlint-cli": "^0.48.0",
-        "typescript": "^6.0.3"
+        "c8": "11.0.0",
+        "eslint": "10.6.0",
+        "globals": "17.4.0",
+        "markdownlint-cli": "0.48.0",
+        "typescript": "6.0.3"
      },
      "engines": {
        "node": ">=18"
@@ -410,7 +410,7 @@
    "ecc-plan-canvas": "scripts/plan-canvas.js"
  },
  "scripts": {
-    "postinstall": "echo '\\n  ecc-universal installed!\\n  Run: npx ecc typescript\\n  Compat: npx ecc-install typescript\\n  Docs: https://github.com/affaan-m/ECC\\n'",
+    "welcome": "echo '\\n  ecc-universal installed!\\n  Run: ecc typescript\\n  Compat: ecc-install typescript\\n  Docs: https://github.com/affaan-m/ECC\\n'",
    "catalog:check": "node scripts/ci/catalog.js --text",
    "catalog:sync": "node scripts/ci/catalog.js --write --text",
    "command-registry:generate": "node scripts/ci/generate-command-registry.js",
@@ -441,19 +441,19 @@
    "dashboard:web": "node scripts/dashboard-web.js"
  },
  "dependencies": {
-    "@iarna/toml": "^2.2.5",
-    "ajv": "^8.20.0",
-    "sql.js": "^1.14.1"
+    "@iarna/toml": "2.2.5",
+    "ajv": "8.20.0",
+    "sql.js": "1.14.1"
  },
  "devDependencies": {
-    "@eslint/js": "^9.39.2",
-    "@opencode-ai/plugin": "^1.16.2",
+    "@eslint/js": "9.39.2",
+    "@opencode-ai/plugin": "1.17.3",
    "@types/node": "25.9.2",
-    "c8": "^11.0.0",
-    "eslint": "^10.6.0",
-    "globals": "^17.4.0",
-    "markdownlint-cli": "^0.48.0",
-    "typescript": "^6.0.3"
+    "c8": "11.0.0",
+    "eslint": "10.6.0",
+    "globals": "17.4.0",
+    "markdownlint-cli": "0.48.0",
+    "typescript": "6.0.3"
  },
  "engines": {
    "node": ">=18"
@@ -695,8 +695,8 @@ function dedupeCopyFileOperations(operations) {
  // actually determines the installed content. Recording the shadowed earlier
  // writes in install-state makes `doctor` report perpetual drift and drives
  // `repair` to clobber the override with the generic source (issue #2414).
-  // Keep only the last `copy-file` per destination — matching the sequential
-  // apply order in applyInstallPlan — and leave every other operation kind
+  // Keep only the last `copy-file` per destination - matching the sequential
+  // apply order in applyInstallPlan - and leave every other operation kind
  // (e.g. accumulating `merge-json` writes into a shared config) untouched and
  // in order.
  const lastCopyIndexByDestination = new Map();
@@ -1,17 +1,11 @@
 const fs = require('fs');
 const path = require('path');

-let Ajv = null;
-try {
-  // Prefer schema-backed validation when dependencies are installed.
-  // The fallback validator below keeps source checkouts usable in bare environments.
-  const ajvModule = require('ajv');
-  Ajv = ajvModule.default || ajvModule;
-} catch (_error) {
-  Ajv = null;
-}
-
-const SCHEMA_PATH = path.join(__dirname, '..', '..', 'schemas', 'install-state.schema.json');
+// Dependency-free, self-contained validation. The installer closure must not
+// require any non-builtin package (enterprise supply-chain vetting: the vetted
+// bytes must be the installed bytes). install-state is validated by the
+// hand-rolled validator below, which enforces the same constraints as
+// schemas/install-state.schema.json (ecc.install.v1).

 let cachedValidator = null;

@@ -36,13 +30,6 @@ function getValidator() {
    return cachedValidator;
  }

-  if (Ajv) {
-    const schema = readJson(SCHEMA_PATH, 'install-state schema');
-    const ajv = new Ajv({ allErrors: true });
-    cachedValidator = ajv.compile(schema);
-    return cachedValidator;
-  }
-
  cachedValidator = createFallbackValidator();
  return cachedValidator;
 }
@@ -159,8 +159,8 @@ function rewriteRelativeLinks(content, options) {
        }
        // If the recomputed link points to the same place as the original
        // (e.g. an intra-namespace `./sibling.md` whose endpoints both shift by
-        // the same prefix), keep the original text verbatim — including any
-        // leading `./` — so the rewrite stays a strict no-op where it must.
+        // the same prefix), keep the original text verbatim - including any
+        // leading `./` - so the rewrite stays a strict no-op where it must.
        if (posix.normalize(rewritten) === posix.normalize(pathPart)) {
          return match;
        }
@@ -10,7 +10,7 @@ const path = require('path');
 * (a cloned/forked repo can ship a crafted `.cursor/ecc-install-state.json`).
 * `repair`/`uninstall`/`auto-update` replay recorded operations, so every
 * write/delete destination MUST be confined to the adapter-derived trusted
- * root — never trusted from the state file itself (GHSA-hfpv-w6mp-5g95).
+ * root - never trusted from the state file itself (GHSA-hfpv-w6mp-5g95).
 */

 function safeRealpath(target) {
@@ -1,6 +1,7 @@
 ---
 name: agent-eval
 description: Head-to-head comparison of coding agents (Claude Code, Aider, Codex, etc.) on custom tasks with pass rate, cost, time, and consistency metrics
+license: MIT
 metadata:
  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
@@ -6,6 +6,7 @@ description: >-
  visual craft, offer packaging, evidence, enterprise-readiness, thought
  leadership, pricing, client's strategic tension) with explicit 1–5 rubrics
  and a tension-plot. Precedes competitive-report-structure.
+license: MIT
 ---

 # Benchmark Methodology
@@ -1,6 +1,7 @@
 ---
 name: benchmark-optimization-loop
 description: Use when the user asks to make something faster, try many variants, run recursive optimization, benchmark latency/throughput/cost, or choose the best implementation by repeated measured tests.
+license: MIT
 metadata:
  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
@@ -1,6 +1,7 @@
 ---
 name: benchmark
 description: Use this skill to measure performance baselines, detect regressions before/after PRs, and compare stack alternatives.
+license: MIT
 metadata:
  origin: ECC
 ---
@@ -1,6 +1,7 @@
 ---
 name: data-throughput-accelerator
 description: Use when large data ingestion, backfill, export, ETL, warehouse loading, manifest catch-up, or table synchronization needs to become much faster while preserving data correctness.
+license: MIT
 metadata:
  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
@@ -1,6 +1,7 @@
 ---
 name: latency-critical-systems
 description: Use for latency-sensitive systems such as realtime dashboards, market data, streaming agents, execution gateways, queues, caches, or HFT-like infrastructure where freshness and p95 latency matter.
+license: MIT
 metadata:
  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
@@ -1,6 +1,6 @@
 ---
 name: loop-design-check
-description: Design a goal-oriented agent loop, and review it for the ways loops go wrong — spinning and burning tokens, Goodhart-gaming the verifier, or running a wrong answer to completion. Two actions: (1) WRITE a loop — gate whether to build it, define a machine-decidable goal, pick the loop type, pick a skeleton; (2) REVIEW a loop — run it past five failure modes plus decidability, boundaries, fallback, judge independence, and keep-judgment-with-the-human red lines. Use when designing an autonomous agent loop, or when you already have one and worry it will spin, cheat, or run a wrong answer to the end. Complements the mechanism-layer loop skills (autonomous-loops, continuous-agent-loop) by covering the judgment layer they don't. 中文触发：写 loop、设计 loop、做一个 loop、检查 loop 对不对、loop 体检、loop 会不会跑飞、可判定目标、五个崩法、plan build judge。English triggers: design an agent loop, write a loop, check a loop, loop review, prevent a runaway loop, goal-oriented loop, decidable goal, plan/build/judge.
+description: "Design a goal-oriented agent loop, and review it for the ways loops go wrong — spinning and burning tokens, Goodhart-gaming the verifier, or running a wrong answer to completion. Two actions: (1) WRITE a loop — gate whether to build it, define a machine-decidable goal, pick the loop type, pick a skeleton; (2) REVIEW a loop — run it past five failure modes plus decidability, boundaries, fallback, judge independence, and keep-judgment-with-the-human red lines. Use when designing an autonomous agent loop, or when you already have one and worry it will spin, cheat, or run a wrong answer to the end. Complements the mechanism-layer loop skills (autonomous-loops, continuous-agent-loop) by covering the judgment layer they don't. 中文触发：写 loop、设计 loop、做一个 loop、检查 loop 对不对、loop 体检、loop 会不会跑飞、可判定目标、五个崩法、plan build judge。English triggers: design an agent loop, write a loop, check a loop, loop review, prevent a runaway loop, goal-oriented loop, decidable goal, plan/build/judge."
 metadata:
  origin: ECC
 ---
@@ -1,6 +1,7 @@
 ---
 name: mle-workflow
 description: Production machine-learning engineering workflow for data contracts, reproducible training, model evaluation, deployment, monitoring, and rollback. Use when building, reviewing, or hardening ML systems beyond one-off notebooks.
+license: MIT
 metadata:
  origin: ECC
 ---
@@ -1,6 +1,7 @@
 ---
 name: parallel-execution-optimizer
 description: Use when the user wants a task done much faster through parallel work, concurrent agents, batched tool calls, isolated worktrees, or many independent verification lanes without losing correctness.
+license: MIT
 metadata:
  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
@@ -1,6 +1,7 @@
 ---
 name: recursive-decision-ledger
 description: Use when the user asks for repeated rollouts, marked decision processes, high-dimensional search, stochastic optimization, local-optima exploration, ensemble comparison, or recursive reasoning with a visible evidence trail.
+license: MIT
 metadata:
  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
@@ -1,6 +1,7 @@
 ---
 name: verification-loop
 description: "A comprehensive verification system for Claude Code sessions."
+license: MIT
 metadata:
  origin: ECC
 ---
@@ -31,8 +32,9 @@ If build fails, STOP and fix before continuing.

 ### Phase 2: Type Check
 ```bash
+set -o pipefail
 # TypeScript projects
-npx tsc --noEmit 2>&1 | head -30
+npx --no-install tsc --noEmit 2>&1 | head -30

 # Python projects
 pyright . 2>&1 | head -30
@@ -59,7 +59,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@eslint/js@npm:^9.39.2":
+"@eslint/js@npm:9.39.2":
  version: 9.39.2
  resolution: "@eslint/js@npm:9.39.2"
  checksum: 10c0/00f51c52b04ac79faebfaa65a9652b2093b9c924e945479f1f3945473f78aee83cbc76c8d70bbffbf06f7024626575b16d97b66eab16182e1d0d39daff2f26f5
@@ -114,7 +114,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@iarna/toml@npm:^2.2.5":
+"@iarna/toml@npm:2.2.5":
  version: 2.2.5
  resolution: "@iarna/toml@npm:2.2.5"
  checksum: 10c0/d095381ad4554aca233b7cf5a91f243ef619e5e15efd3157bc640feac320545450d14b394aebbf6f02a2047437ced778ae598d5879a995441ab7b6c0b2c2f201
@@ -203,7 +203,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@opencode-ai/plugin@npm:^1.16.2":
+"@opencode-ai/plugin@npm:1.17.3":
  version: 1.17.3
  resolution: "@opencode-ai/plugin@npm:1.17.3"
  dependencies:
@@ -333,6 +333,18 @@ __metadata:
  languageName: node
  linkType: hard

+"ajv@npm:8.20.0":
+  version: 8.20.0
+  resolution: "ajv@npm:8.20.0"
+  dependencies:
+    fast-deep-equal: "npm:^3.1.3"
+    fast-uri: "npm:^3.0.1"
+    json-schema-traverse: "npm:^1.0.0"
+    require-from-string: "npm:^2.0.2"
+  checksum: 10c0/5df9a1c8f83863cde1bd3a9ddb426f599718f88e3dc9153616c79fb28e0be455335830d7f21d745576519f057b371352daa31047b6a33d7036fe08777d60cf2a
+  languageName: node
+  linkType: hard
+
 "ajv@npm:^6.14.0":
  version: 6.14.0
  resolution: "ajv@npm:6.14.0"
@@ -345,18 +357,6 @@ __metadata:
  languageName: node
  linkType: hard

-"ajv@npm:^8.20.0":
-  version: 8.20.0
-  resolution: "ajv@npm:8.20.0"
-  dependencies:
-    fast-deep-equal: "npm:^3.1.3"
-    fast-uri: "npm:^3.0.1"
-    json-schema-traverse: "npm:^1.0.0"
-    require-from-string: "npm:^2.0.2"
-  checksum: 10c0/5df9a1c8f83863cde1bd3a9ddb426f599718f88e3dc9153616c79fb28e0be455335830d7f21d745576519f057b371352daa31047b6a33d7036fe08777d60cf2a
-  languageName: node
-  linkType: hard
-
 "ansi-regex@npm:^5.0.1":
  version: 5.0.1
  resolution: "ansi-regex@npm:5.0.1"
@@ -403,7 +403,7 @@ __metadata:
  languageName: node
  linkType: hard

-"c8@npm:^11.0.0":
+"c8@npm:11.0.0":
  version: 11.0.0
  resolution: "c8@npm:11.0.0"
  dependencies:
@@ -578,17 +578,17 @@ __metadata:
  version: 0.0.0-use.local
  resolution: "ecc-universal@workspace:."
  dependencies:
-    "@eslint/js": "npm:^9.39.2"
-    "@iarna/toml": "npm:^2.2.5"
-    "@opencode-ai/plugin": "npm:^1.16.2"
+    "@eslint/js": "npm:9.39.2"
+    "@iarna/toml": "npm:2.2.5"
+    "@opencode-ai/plugin": "npm:1.17.3"
    "@types/node": "npm:25.9.2"
-    ajv: "npm:^8.20.0"
-    c8: "npm:^11.0.0"
-    eslint: "npm:^10.6.0"
-    globals: "npm:^17.4.0"
-    markdownlint-cli: "npm:^0.48.0"
-    sql.js: "npm:^1.14.1"
-    typescript: "npm:^6.0.3"
+    ajv: "npm:8.20.0"
+    c8: "npm:11.0.0"
+    eslint: "npm:10.6.0"
+    globals: "npm:17.4.0"
+    markdownlint-cli: "npm:0.48.0"
+    sql.js: "npm:1.14.1"
+    typescript: "npm:6.0.3"
  bin:
    ecc: scripts/ecc.js
    ecc-control-pane: scripts/control-pane.js
@@ -676,7 +676,7 @@ __metadata:
  languageName: node
  linkType: hard

-"eslint@npm:^10.6.0":
+"eslint@npm:10.6.0":
  version: 10.6.0
  resolution: "eslint@npm:10.6.0"
  dependencies:
@@ -907,7 +907,7 @@ __metadata:
  languageName: node
  linkType: hard

-"globals@npm:^17.4.0":
+"globals@npm:17.4.0":
  version: 17.4.0
  resolution: "globals@npm:17.4.0"
  checksum: 10c0/2be9e8c2b9035836f13d420b22f0247a328db82967d3bebfc01126d888ed609305f06c05895914e969653af5c6ba35fd7a0920f3e6c869afa60666c810630feb
@@ -1206,7 +1206,7 @@ __metadata:
  languageName: node
  linkType: hard

-"markdownlint-cli@npm:^0.48.0":
+"markdownlint-cli@npm:0.48.0":
  version: 0.48.0
  resolution: "markdownlint-cli@npm:0.48.0"
  dependencies:
@@ -1876,7 +1876,7 @@ __metadata:
  languageName: node
  linkType: hard

-"sql.js@npm:^1.14.1":
+"sql.js@npm:1.14.1":
  version: 1.14.1
  resolution: "sql.js@npm:1.14.1"
  checksum: 10c0/3491b7642b8b6d89926e4cf1807c01697df7e3f7283b94aaebc026e6c38aaf9496065e9daf25de3109e51df835150d4f795f5249f22a1d3e6a3bb1f2e32c0710
@@ -1998,7 +1998,7 @@ __metadata:
  languageName: node
  linkType: hard

-"typescript@npm:^6.0.3":
+"typescript@npm:6.0.3":
  version: 6.0.3
  resolution: "typescript@npm:6.0.3"
  bin:
@@ -2008,7 +2008,7 @@ __metadata:
  languageName: node
  linkType: hard

-"typescript@patch:typescript@npm%3A^6.0.3#optional!builtin<compat/typescript>":
+"typescript@patch:typescript@npm%3A6.0.3#optional!builtin<compat/typescript>":
  version: 6.0.3
  resolution: "typescript@patch:typescript@npm%3A6.0.3#optional!builtin<compat/typescript>::version=6.0.3&hash=5786d5"
  bin: