WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-12 04:37:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/main'

Browse Source
This commit is contained in:
Vladyslav Tezyk
2026-08-12 09:03:00 +02:00
parent 638456c7ca 569b1d5b32
commit 75fb8a697d
818 changed files with 56046 additions and 6191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ATLAS-CLOUD-GUIDE.md
+2
View File
@@ -2,6 +2,8 @@
[Atlas Cloud](https://www.atlascloud.ai/?utm_source=github&utm_medium=link&utm_campaign=everything-claude-code) is a full-modal AI inference platform providing an OpenAI-compatible API for 59+ LLM models, image generation, and video generation.
> Run or self-host any open-source model instead of using a managed API. Itô is ECC's preferred compute sponsor: [open the Itô dashboard to sign in and rent or manage GPUs](https://compute.itomarkets.com). Any GPU provider works. That sponsorship link is passive: it does not invoke an RFQ, reserve capacity, provision compute, or configure serving. Separately, the opt-in `ecc ito find` bridge invokes the explicitly configured canonical Itô CLI and submits a live authenticated RFQ; it does not reserve capacity. Managed inference through Itô is not live yet.
## Configuration
Set the following environment variables to use Atlas Cloud as your LLM backend:
docs/CODEX-NAVIGATION-GUIDE.md
+167
View File
@@ -0,0 +1,167 @@
# Codex ECC Navigation Map
This guide helps Codex agents navigate ECC without scanning every surface from
scratch. Use it after the root `AGENTS.md` and `.codex/AGENTS.md` when planning
work, preparing a PR-quality diff, or handing context to a reviewer.
## Start Here
Read in this order:
1. `AGENTS.md` - universal project rules, agent routing, testing expectations,
and commit workflow.
2. `.codex/AGENTS.md` - Codex-specific setup, MCP, skill discovery, and
hook-parity limits.
3. `docs/COMMAND-AGENT-MAP.md` - command to agent and skill routing.
4. This guide - repo navigation, diff packet shape, and PR review lanes for
Codex sessions.
If those files disagree, prefer the more specific file for the current task:
Codex-specific behavior belongs in `.codex/AGENTS.md`; general contribution
policy belongs in `AGENTS.md` and `CONTRIBUTING.md`.
## Surface Map
| Surface | What It Owns | Codex Use |
|---------|---------------|-----------|
| `AGENTS.md` | Cross-harness operating rules | Read before any repo work |
| `.codex/AGENTS.md` | Codex-only guidance | Read after root instructions |
| `.codex/config.toml` | Codex sandbox, MCP, profiles, agent roles | Inspect when setup or MCP behavior matters |
| `.codex/agents/` | Codex multi-agent role layers | Use for explorer, reviewer, and docs researcher roles |
| `.agents/skills/` | Codex-facing skill copies | Use when Codex needs native skill loading |
| `skills/` | Canonical skill source | Update first for new workflow knowledge |
| `agents/` | Claude-style subagent prompts | Use as source material for review lanes and delegation intent |
| `commands/` | Legacy slash-command shims | Update only when command compatibility is needed |
| `docs/COMMAND-AGENT-MAP.md` | Command to agent and skill relationships | Check before renaming or adding workflow surfaces |
| `rules/` | Shared coding, security, and workflow rules | Read language or domain rules before implementation |
| `hooks/` | Claude Code hook workflows | Do not assume Codex hook parity |
| `scripts/` | Install, validation, sync, and CLI utilities | Follow existing Node script patterns |
| `manifests/` | Install component and module registration | Update when adding installable surfaces |
| `.github/PULL_REQUEST_TEMPLATE.md` | Required PR body checklist | Preserve sections when creating PRs |
## Task Routing
Use this quick routing before editing:
| Task | First Files | Likely Verification |
|------|-------------|---------------------|
| Add or update a skill | `skills/<name>/`, `.agents/skills/<name>/`, `manifests/`, `agent.yaml` | `node scripts/ci/validate-skills.js`, `node tests/ci/codex-skill-surface.test.js` |
| Add or update a command | `commands/`, `docs/COMMAND-AGENT-MAP.md`, `COMMANDS-QUICK-REF.md` | `node scripts/ci/validate-commands.js`, `npm run command-registry:check` |
| Add a Codex setup change | `.codex/`, `scripts/codex/`, `scripts/lib/install-targets/codex-home.js` | `node tests/scripts/codex-hooks.test.js`, `node tests/codex-config.test.js` |
| Add installable content | `manifests/`, `scripts/lib/install-*`, `package.json` | `node scripts/ci/validate-install-manifests.js`, targeted install tests |
| Add docs-only guidance | `docs/`, `README.md`, harness supplement files | Targeted docs test plus `markdownlint` if available |
| Review a PR | `commands/review-pr.md`, `agents/*reviewer.md`, `agents/pr-test-analyzer.md` | Diff review plus relevant tests |
Keep workflow contributions skills-first. Add or update `commands/` only for
legacy slash-entry compatibility or cross-harness parity.
## Codex Agent Roles
ECC ships project-local Codex role layers in `.codex/agents/`:
| Role | File | Use |
|------|------|-----|
| Explorer | `.codex/agents/explorer.toml` | Read-only evidence gathering before edits |
| Reviewer | `.codex/agents/reviewer.toml` | Correctness, security, and missing-test review |
| Docs researcher | `.codex/agents/docs-researcher.toml` | API, release-note, and docs claim verification |
Use roles for bounded sidecar work. Do the immediate blocking task locally, and
delegate independent evidence or review tasks when they can run in parallel.
## PR Diff Packet
Before `/pr`, prepare a local diff packet. This gives reviewers the context
that many PR tools otherwise have to reconstruct.
Run:
```bash
git fetch origin
git diff origin/main...HEAD --stat
git diff origin/main...HEAD --name-only
git log origin/main..HEAD --oneline --reverse
```
Then capture:
```markdown
## PR Diff Packet
### Intent
<One sentence describing the user-visible or maintainer-visible outcome.>
### Diff Map
- Added: <new files and why they exist>
- Modified: <existing files and why they changed>
- Unchanged but relevant: <surfaces checked and intentionally left alone>
### Risk and review lanes
- Behavior:
- Security:
- Tests:
- Docs:
- Release/install surface:
### Testing Done
- <commands run, or "Not run" with reason>
### Follow-ups
- <optional, only if not required for this PR>
```
Use `.github/PULL_REQUEST_TEMPLATE.md` as the final PR body structure. The diff
packet feeds that template; it does not replace it.
## PR Commands
| Need | Command Surface | Notes |
|------|-----------------|-------|
| Create a PR | `/pr` | Discovers PR template, analyzes commits and files, pushes, and creates a PR |
| Create a PR from PRP workflow | `/prp-pr` | Same core flow with PRP artifact references |
| Review a PR | `/review-pr` | Runs multi-perspective review lanes and aggregates findings |
| Review current changes before PR | `/code-review` | Use before committing when no GitHub PR exists yet |
Codex may not execute slash commands natively in every environment. When a
slash command is not available, read the command file and perform the same
steps manually.
## Review Lanes
For a PR-quality diff, check these lanes before asking for review:
| Lane | Evidence |
|------|----------|
| Scope | `git diff origin/main...HEAD --name-only` matches the stated intent |
| Tests | New behavior has a targeted test or a clear no-test rationale |
| Security | No secrets, unsafe external writes, broad permissions, or input trust gaps |
| Install surface | New skills, commands, agents, hooks, scripts, or files are registered where required |
| Cross-harness | Codex, OpenCode, Cursor, Claude Code, and docs surfaces are updated only when applicable |
| Docs | README and focused docs link to the new source of truth |
For code changes, invoke the relevant reviewer lane after implementation. For
docs-only changes, run the targeted docs test and review links for drift.
## Common Navigation Pitfalls
- Do not treat `commands/` as the canonical place for new workflow knowledge.
Prefer `skills/` first.
- Do not copy Claude hook claims into Codex docs. Codex enforcement is based on
instructions, sandbox settings, and optional MCP config.
- Do not update `.agents/skills/` without checking the canonical `skills/`
source and Codex `agents/openai.yaml` metadata expectations.
- Do not open broad PRs that mix unrelated skill, command, install, and release
changes unless the user explicitly wants a release bundle.
- Do not leave a Codex docs change discoverable only through README prose. Link
it from `.codex/AGENTS.md` when it affects Codex behavior.
## Fast Commands
Useful local checks:
```bash
node tests/docs/codex-navigation-map.test.js
node tests/ci/codex-skill-surface.test.js
npm run command-registry:check
npm run catalog:check
node tests/run-all.js
```
docs/COMMAND-AGENT-MAP.md
+14
View File
@@ -5,6 +5,7 @@ This document lists each slash command and the primary agent(s) or skills it inv
| Command | Primary agent(s) | Notes |
|---------|------------------|--------|
| `/plan` | planner | Implementation planning before code |
| `/plan-canvas` | — (skill: plan-canvas) | Browser review canvas for plan artifacts: annotate, chat, approve/request changes |
| `/tdd` | tdd-guide | Test-driven development |
| `/code-review` | code-reviewer | Quality and security review |
| `/build-fix` | build-error-resolver | Fix build/type errors |
@@ -46,6 +47,18 @@ This document lists each slash command and the primary agent(s) or skills it inv
| `/pm2` | — | PM2 service lifecycle |
| `/security-scan` | security-reviewer (skill) | AgentShield via security-scan skill |
## Non-Slash CLI Surfaces
| CLI surface | Primary skill/runtime | Notes |
|-------------|-----------------------|-------|
| `ecc memory init` | unified-memory / `scripts/memory.js` | Initialize project, team, or user Markdown vault scopes |
| `ecc memory save` | unified-memory / `scripts/memory.js` | Create unreviewed memory; body must come from stdin or a regular file |
| `ecc memory handoff` | unified-memory / `scripts/memory.js` | Create a targeted, cross-harness handoff |
| `ecc memory search` | unified-memory / `scripts/memory.js` | Bounded lexical search over selected vault scopes |
| `ecc memory read` | unified-memory / `scripts/memory.js` | Read one memory plus derived backlinks |
| `ecc memory doctor` | unified-memory / `scripts/memory.js` | Audit malformed files, duplicate IDs, broken links, and symlinks |
| `ecc-memory-mcp` | unified-memory / `scripts/memory-mcp.mjs` | Optional stdio MCP adapter; exposes save/search/read/doctor only |
## Direct-Use Agents
| Direct agent | Purpose | Scope | Notes |
@@ -59,6 +72,7 @@ This document lists each slash command and the primary agent(s) or skills it inv
- **eval-harness**: `/eval`
- **security-scan**: `/security-scan` (runs AgentShield)
- **strategic-compact**: suggested at compaction points (hooks)
- **unified-memory**: `ecc memory ...` and the opt-in `ecc-memory-mcp` server
## How to use this map
docs/COMMAND-REGISTRY.json
+25 -3
View File
@@ -1,6 +1,6 @@
{
"schemaVersion": 1,
"totalCommands": 92,
"totalCommands": 94,
"commands": [
{
"command": "aside",
@@ -617,6 +617,26 @@
],
"path": "commands/orch-refine-code.md"
},
{
"command": "orch-review",
"description": "Run the orch-review native Workflow over a diff (local changes or a GitHub PR) and report blocking vs advisory findings. Surface for the orch-review workflow.",
"type": "review",
"primaryAgents": [],
"allAgents": [],
"skills": [],
"path": "commands/orch-review.md"
},
{
"command": "plan-canvas",
"description": "Open a plan or HTML artifact in the browser Plan Canvas for annotate-and-approve review",
"type": "review",
"primaryAgents": [],
"allAgents": [],
"skills": [
"plan-canvas"
],
"path": "commands/plan-canvas.md"
},
{
"command": "plan-prd",
"description": "Generate a lean, problem-first PRD and hand off to /plan for implementation planning.",
@@ -636,7 +656,9 @@
"allAgents": [
"planner"
],
"skills": [],
"skills": [
"plan-canvas"
],
"path": "commands/plan.md"
},
{
@@ -1011,7 +1033,7 @@
"orchestration": 11,
"planning": 2,
"refactoring": 1,
"review": 13,
"review": 15,
"testing": 53
},
"topAgents": [
docs/ECC-2.0-GA-ROADMAP.md
+117
View File
@@ -17,6 +17,123 @@ The May 19 release/growth execution map lives at
It is the operator surface for the final ECC 2.0 repo identity, video suite,
partner/sponsor funnel, consulting/talk funnel, and social launch plan.
## 2026-07-26 Cross-Harness Control-Plane Delta
The next product layer is composition, not a second harness. ECC already has
session storage, worktree lifecycle helpers, merge-queue state, OTEL export,
skill-run records, learning hooks, and provenance checks. The missing work is
to expose those primitives through governed cross-harness contracts and make
promotion, merge, and policy decisions auditable.
The first cross-harness knowledge-transfer slice is tracked in
[PR #2581](https://github.com/affaan-m/ECC/pull/2581). It adds a file-first
memory vault for Codex, Claude Code, OpenCode, Cursor, and Hermes-style agents,
with Markdown as the portable source of truth and an optional MCP projection.
Every new memory remains unreviewed until a later, explicit promotion system is
implemented. [PR #2582](https://github.com/affaan-m/ECC/pull/2582) addresses
Claude's flat skill-discovery layout, and
[PR #2583](https://github.com/affaan-m/ECC/pull/2583) aligns Claude agent tool
frontmatter with the documented scalar format.
Existing implementation anchors:
- `ecc2/src/session/store.rs` persists sessions, tool logs, decisions, context
graph edges, queues, and conflict incidents.
- `ecc2/src/main.rs` already exposes session, worktree, merge-queue, daemon,
and OTEL-export commands.
- `scripts/lib/worktree-lifecycle/` and `scripts/worktree-lifecycle.js`
classify worktree state and produce conflict and cleanup plans.
- `scripts/lib/skill-evolution/` records skill runs, health, and provenance;
`skills/continuous-learning-v2/` and `skills/eval-harness/` provide the
learning and evaluation substrate.
- `skills/security-scan/`, `schemas/provenance.schema.json`, and
`docs/architecture/agentshield-enterprise-research-roadmap.md` provide the
current policy and supply-chain substrate.
The execution sequence is deliberately read-only first and promotion-gated:
1. **Distribution and knowledge-transfer correctness.** Land the memory,
Claude skill-layout, and Claude agent-frontmatter fixes with their complete
security and cross-platform matrices. Re-evaluate
[PR #2555](https://github.com/affaan-m/ECC/pull/2555),
[PR #2490](https://github.com/affaan-m/ECC/pull/2490), and
[PR #2578](https://github.com/affaan-m/ECC/pull/2578) after those bases are
stable.
2. **ECC2 MCP read plane.** Add an opt-in MCP server over existing ECC2
stores with bounded, redacted `list_sessions`, `get_diff`,
`worktree_status`, and `merge_queue` tools. This slice performs no task,
merge, approval, or filesystem mutation. Bind caller identity and a
canonical realpath workspace ID at server startup; expose only records owned
by that workspace/caller; deny undeclared read capabilities; and rate-limit
and audit every read without logging returned content. Version every tool's
request and response schema, validate both at the boundary, and return the
common `{success, data, error, pagination}` envelope. Bounded list and diff
responses include cursor, `has_more`, and `truncated` metadata. Bind every
cursor to an immutable session/worktree revision; reject stale cursors and
require pagination to restart when that revision is no longer available.
3. **ECC2 MCP mutation plane.** Add `create_task`, `merge_task`, and
`approve_tool` only after the read plane is stable. Require explicit
capability gates, immutable audit receipts, dry-run previews, and the
existing risk/profile policy at every mutation boundary. Caller identity,
workspace ownership, and per-tool authorization fail closed before inputs
reach the store or filesystem. Mutation tools use the same versioned,
boundary-validated request and response schemas and common envelope. Apply
per-caller and per-workspace rate limits before mutation processing and fail
closed when the limiter is unavailable. Persist the immutable receipt before
any side effect, or use an atomic transaction/outbox whose reconciliation
guarantees every successful mutation has a durable receipt.
4. **Worktree lifecycle contract.** Define and schema-validate
`ecc.worktree.yml`; specify `new`, `split`, `fork`, and `close` state
transitions; define bounded context seeding and lifecycle hooks without
copying secrets or raw harness transcripts.
5. **TCAS leases and merge serialization.** Derive touched paths from tool
activity and normalize each path against the canonical workspace. Persist
`{session, branch, touched_paths, heartbeat, owner, epoch}` leases with
transactional acquire/renew/release, unique overlap enforcement, and
compare-and-swap owner/epoch checks. Show overlap before blocking, then add
queue serialization, bounded lease expiry/recovery after heartbeat loss,
and human escalation records. Incomplete or uninstrumented touched-path
coverage blocks mutation unless the caller atomically acquires a
workspace-wide lease. Revalidate the final touched-path set and lease
ownership immediately before every mutation and merge.
6. **Consent-gated telemetry schema.** Standardize `ecc.*` span names and
bounded attributes, define `TRACEPARENT` propagation, and require explicit
consent, schema validation, and deterministic redaction before any sink.
Missing or invalid consent fails closed. Prompts, secrets, memory bodies,
raw diffs, and unbounded error text are forbidden by schema and regression
tests for both offline and future live output.
7. **Consent-gated OTLP exporter.** Add the opt-in live exporter only after
the telemetry schema and redaction suite are stable. Existing JSON export
remains the offline fallback, but it passes through the same consent,
validation, redaction, and bounded-output gate as the live sink.
8. **Skill-quality and promotion gates.** Stabilize invocation telemetry
before adding determinism and delta-value measures. Proposed skills live in
a candidate area and may reach canonical surfaces only through a recorded
eval result, human approval, append-only transition event, and reversible
promotion.
9. **AgentShield v2 enforcement.** Introduce a versioned allow/approve/block
policy contract enforced by ECC2, followed by signed provenance, registry
locks, and optional dual-engine scanning from
[issue #2415](https://github.com/affaan-m/ECC/issues/2415).
10. **Distribution interop.** Add provenance-preserving npx-skills and ClawHub
import/export only after the policy and promotion contracts plus
AgentShield's signed-provenance and registry-lock verification are stable.
Import and export deny by default when provenance or lock verification is
missing, invalid, or unavailable. Before any imported artifact reaches a
store or filesystem operation, validate its versioned schema, bounded size,
contained paths, and content policy, and reject malformed or untrusted
input with bounded errors. Training or inference automation remains deferred
until telemetry, evaluation, consent, and rollback gates are operational.
Each numbered item is a separate implementation lane. Do not combine the
read-only MCP plane with mutations, the telemetry schema with live export, or
candidate generation with promotion. Each lane requires unit and integration
tests plus end-to-end coverage for its critical operator flow to fail before
implementation begins. After implementation, those tests must pass with at
least 80% line and function coverage, adversarial boundary tests, a
migration/rollback note, and fresh Linux, macOS, and Windows evidence before
the next dependent lane begins.
## 2026-05-20 Delta
- The tracked platform audit is still green on May 20 with 0 open PRs,
docs/ECC-PRO-SECURITY-ROADMAP.md
+347
View File
@@ -0,0 +1,347 @@
# ECC Pro + AgentShield Security Roadmap
> Status: draft for review. Generated 2026-06-21 from a multi-agent survey + research pass
> (capability map of AgentShield and ECC Pro, triage of every open PR/issue on both repos,
> and web research on competitors, unbuilt ideas, and dev-tool demand). MRR-biased: every
> item is scored for how it converts the free funnel into paid ECC Pro / Enterprise.
## Why now
AgentShield (npm `ecc-agentshield`) is doing roughly **30K downloads/month with no decay**
(~7.2K/week, ~78K year-to-date) and **903 GitHub stars** — a large, growing top-of-funnel.
Today there is almost no bridge from that free funnel to paid ECC Pro, and the single most
ownable paid surface — the agent-proximity "airspace" moat — is fully computed but never
rendered. This roadmap is built to close both gaps: remove the trust blockers that suppress
conversion, make the moat visible, then productize the local CLI primitives into hosted,
recurring-revenue surfaces.
## Themes
### Trust & conversion gate (now)
AgentShield's ~30K/month free funnel only converts if the product is trustworthy and the upgrade path is visible. False positives that punish correct hardening, broken model IDs that hard-fail the LLM layer, Windows crashes, and security bugs in our own learning layer all erode trust before a user ever sees a Pro prompt. Fixing the FP cluster, shipping verified correctness/security fixes, and surfacing a Pro CTA at the point of value are the highest-leverage immediate moves.
### Make the moat visible & demo-able (now)
The agent-proximity 'airspace' metric is the single differentiated capability nothing else has, but it is math + JSON with zero UI rendering. Shipping the 3D observability dashboard (PR #2320) turns the strongest narrative asset into a demo that sells Team/Enterprise seats on sight.
### Productize local primitives into hosted Pro SaaS (next)
Every continuous/fleet capability — watch/drift, baseline gates, evidence-pack fleet operatorReadback, runtime NDJSON, org policy packs — already exists as local CLI building blocks. The fastest path to MRR is hosting these as authenticated multi-repo surfaces: continuous-scanning dashboard, inline PR review + autofix-PR, rule-pack loader + intel feed, compliance packs, and centrally-managed org policy.
### Close competitive gaps & expand reach (next/later)
Snyk Agent Scan, NVIDIA SkillSpector, and GoPlus AgentGuard validate the category and add runtime enforcement, LLM-judge semantic detection, and live MCP fetch that AgentShield lacks. LLM-judge Deep Scan, a free runtime guard with Pro telemetry, cross-machine A2A airspace, and a community MCP reputation registry neutralize those differentiators while keeping the free, zero-account, local-first posture as the moat. Harness-neutral expansion widens the whole funnel.
## Top 5 — do now
1. Merge PR #103 and ship the issue #100 follow-up to kill the false-positive cluster that punishes correct hardening (trust is the conversion gate)
2. Merge PR #2320 to render the 3D agent-airspace observability dashboard (the moat made visible and demo-able)
3. Add a Pro upgrade CTA to free CLI output + GitHub App PR comments to monetize the ~30K/month free download funnel, leading with the privacy + low-noise wedge
4. Merge the verified correctness/Windows batch (PR #2133 model-ID fix, #2307/#2063 Windows, #2273/#2246/#2312 docs, #2293 deps) and fix issue #2316 plan-orchestrate install detection
5. Harden continuous-learning storage: fix path traversal #2297 and registry-corruption race #2294 (security credibility for the brand Pro trades on)
## Roadmap at a glance
| Horizon | Item | Area | Effort | Impact |
| --- | --- | --- | --- | --- |
| now | Fix the false-positive cluster that punishes correct hardening | agentshield | S | high |
| now | Add autofix verification loop (re-scan + no-regression proof) | agentshield | M | medium |
| now | Render the 3D agent-airspace observability dashboard (the moat made visible) | ecc-pro | M | flagship |
| now | Add a Pro conversion CTA to free CLI output and GitHub App PR comments | both | S | high |
| now | Ship merge-ready correctness and Windows fixes that protect release velocity and core UX | ecc-core | S | medium |
| now | Harden continuous-learning storage (path traversal + registry race) | ecc-core | S | medium |
| next | Hosted continuous-scanning dashboard with fleet trend lines ('Sentry for agent security') | agentshield | L | flagship |
| next | Inline PR-comment review + autofix-PR via the ecc-tools GitHub App | agentshield | M | high |
| next | External rule-pack loader (--rule-pack) + curated commercial intel feed | agentshield | M | high |
| next | Pro Deep Scan: LLM-judge semantic detection + live MCP tool fetch + rug-pull pinning | agentshield | L | high |
| next | Compliance/evidence packs mapped to SOC2/PCI/ISO controls | agentshield | M | high |
| next | Centrally-managed org policy + RBAC distribution | agentshield | L | high |
| next | Harness-neutral expansion: Kimi, Codex alias, OpenClaude/Codex compat | ecc-core | L | medium |
| next | Batch-review and dedup the community skill/agent PR backlog | ecc-core | M | low |
| later | Free runtime guard hook with Pro centralized telemetry + trust registry | agentshield | XL | flagship |
| later | Cross-machine team airspace + A2A topology security in the control pane | ecc-pro | XL | high |
| later | Community MCP/skill reputation registry as growth flywheel + Pro risk-score API | agentshield | L | medium |
## NOW
### Fix the false-positive cluster that punishes correct hardening
- **Area:** agentshield | **Effort:** S | **Impact:** high
- **Linked:** PR #103, issue #102, issue #100
- **MRR angle:** FPs that penalize the scanner's own remediation destroy trust with security-conscious buyers and break the demo-and-CI value prop Pro is sold on. Trust is the conversion gate: a hardened config must score well or no one upgrades.
Merge PR #103 (treats --no-verify inside permissions.deny/ask as a prohibition, not a usage — fail-closed on invalid JSON, 6 tests, all review bots green) after confirming the Verify/test matrix passes locally. Then ship a follow-up PR for the two remaining FPs in issue #100: (1) --no-verify in string literals / help text flagged CRITICAL (needs executed-command vs literal context), and (2) the reversed-text rule at src/rules/agents.ts:1561 matching plain English 'backward/backwards' — re-scope it to require reverse-and-execute evidence so it stops noise-flooding ML/PyTorch agent repos (a high-value adopter segment).
### Add autofix verification loop (re-scan + no-regression proof)
- **Area:** agentshield | **Effort:** M | **Impact:** medium
- **Linked:** issue #102
- **MRR angle:** Verified, trustworthy autofix is the activation moment that makes the free CLI feel magical and seeds confidence in the paid managed-remediation workflow (autofix-as-PR in ECC Tools).
src/fixer/index.ts applies string transforms but never re-scans to prove the finding is gone and no new finding was introduced — and issue #102 proved a naive permission tighten can be re-flagged by the scanner. Close the loop: after applying --fix, re-run the scanner, diff the findings set, auto-revert if the score regresses, and emit a verified-fix attestation. OSS gets verify-after-fix locally; Pro gets autofix-as-PR via the ecc-tools GitHub App (open remediation PR, run verified re-scan in CI, attach before/after evidence pack, auto-merge on green).
### Render the 3D agent-airspace observability dashboard (the moat made visible)
- **Area:** ecc-pro | **Effort:** M | **Impact:** flagship
- **Linked:** PR #2320
- **MRR angle:** This is the single most ownable, demo-able paid-looking surface ECC has and nothing else offers it. 'Watch N agents crawl toward each other in code-space and one steer away' converts on the demo alone — it justifies a Team/Enterprise seat that competitors (CodeRabbit/Greptile) cannot match.
The agent-proximity math (noisy-OR collision risk, TCAS transmit/steer advisories, 3D space-filling embedding) is fully implemented in scripts/lib/agent-proximity/ and computed every tick, but the control-pane UI (ui.js) renders ZERO proximity output. Merge maintainer PR #2320 (self-contained, dependency-free 3D canvas viz + /api/proximity feed, XSS-safe textContent, +254/-0 with tests, MERGEABLE) to ship the renderer. This closes the biggest gap between the moat narrative and a shippable surface.
### Add a Pro conversion CTA to free CLI output and GitHub App PR comments
- **Area:** both | **Effort:** S | **Impact:** high
- **Linked:** PR #97
- **MRR angle:** Directly monetizes the ~30K downloads/month (78,108 YTD, ~7,228/week, no decay) free funnel. There is currently no surfaced upgrade path from the free scanner to ECC Pro — adding a contextual CTA at the point of value is the lowest-effort, highest-leverage conversion lever available.
Surface a Pro CTA where free users already feel value: a footer in terminal/JSON/markdown reports ('hosted fleet posture + continuous monitoring at ecc-tools Pro'), in the GitHub Action job summary, and in PR check-run comments. Lead with the privacy wedge ('scans never leave your machine' vs Snyk Agent Scan transmitting tool metadata to cloud) and the low-noise/runtimeConfidence accuracy story as the differentiators. Keep AgentShield free + zero-account as the moat against token-gated Snyk Agent Scan.
### Ship merge-ready correctness and Windows fixes that protect release velocity and core UX
- **Area:** ecc-core | **Effort:** S | **Impact:** medium
- **Linked:** PR #2133, PR #2307, PR #2063, PR #2273, PR #2246, PR #2312, PR #2293, issue #2316
- **MRR angle:** Broken model IDs hard-fail the multi-model LLM layer Pro features depend on; broken plan-orchestrate install detection and Windows crashes degrade the paid UX and erode trust before users ever reach the upgrade prompt.
Merge the clean, verified batch: PR #2133 (Claude provider model-ID + adaptive-thinking fix — replaces invalid IDs with claude-sonnet-4-6/haiku-4-5/opus-4-8, routes SYSTEM to top-level, omits temperature, adaptive thinking for Opus 4.7/4.8; previous default would 404/400 at the API), PR #2307 + #2063 (Windows test/UTF-8 fixes), PR #2273/#2246/#2312 (docs/workflow), PR #2293 (dependabot minor/patch). Schedule a fix for issue #2316 (plan-orchestrate still probes old paths after the ecc@ecc marketplace rename — broken install detection on a core workflow command).
### Harden continuous-learning storage (path traversal + registry race)
- **Area:** ecc-core | **Effort:** S | **Impact:** medium
- **Linked:** issue #2297, issue #2294, issue #2300, issue #2296
- **MRR angle:** ECC sells security tooling; a path-traversal or registry-corruption bug in our own learning layer is a credibility liability that undercuts the entire security brand the Pro tier trades on.
Fix two security-priority bugs in skills/continuous-learning-v2/scripts/instinct-cli.py as one hardening pass: issue #2297 (shutil.rmtree on PROJECTS_DIR/project_id with no path-containment check — arbitrary directory deletion risk) and issue #2294 (_write_registry writes projects.json without the advisory lock _update_registry uses — concurrent sessions can corrupt the registry). Pair with reliability issues #2300 (SIGALRM drops observations) and #2296 (signal-counter race) for observer integrity.
## NEXT
### Hosted continuous-scanning dashboard with fleet trend lines ('Sentry for agent security')
- **Area:** agentshield | **Effort:** L | **Impact:** flagship
- **MRR angle:** THE core ECC Tools Pro product and the clearest recurring-revenue moat: nobody unifies config-scan + runtime telemetry. Billed per seat/repo. Reuses operatorReadback/reviewItems as the API contract — lowest-effort-to-highest-leverage Pro upgrade because the data model already exists.
Productize the existing local primitives into a hosted, authenticated, multi-repo backend: ingest webhook/CI scan results, runtime.ndjson, and watch/drift events over time; persist baselines; chart score trend, drift history, blocked-command rate, injection-attempt rate, secret-exposure events, and cross-repo org rollup; fire Slack/email regression alerts. The continuous/fleet primitives (src/watch, src/baseline, src/evidence-pack fleet operatorReadback) exist only as local CLI today. Positions AgentShield as the unified config+runtime view that neither Snyk (scan-only) nor Sentry (no security semantics) offers.
### Inline PR-comment review + autofix-PR via the ecc-tools GitHub App
- **Area:** agentshield | **Effort:** M | **Impact:** high
- **Linked:** PR #2320
- **MRR angle:** Sticky inline PR comments + one-click fix PRs are now table stakes (Aikido, DryRun, Pixee) and are the GitHub-native paid surface that converts. The GitHub App already exists as the delivery vehicle; monetize PR-time review + autofix-PR as the paid tier.
Today the GitHub Action fails CI and emits SARIF (lands in the Security tab) but does not post sticky inline PR comments keyed to changed lines, and autofix is local-CLI only. Add per-line PR comments with one-click 'apply fix' that commits the existing remediation to the PR branch, plus auto-fix-PR generation. Differentiate from CodeRabbit/Greptile by bundling the agent-proximity / merge-conflict-prevention angle competitors lack.
### External rule-pack loader (--rule-pack) + curated commercial intel feed
- **Area:** agentshield | **Effort:** M | **Impact:** high
- **Linked:** issue #101
- **MRR angle:** Turns AgentShield into a platform: OSS gets the loader, Pro gets a signed, continuously-updated commercial rule-pack/threat-intel subscription. The ATR pack (464 rules, in production at Cisco AI Defense + Microsoft) brings credibility and reach; its corpus feeds the accuracy gate.
Build the loader requested in agentshield issue #101: a signed, versioned external rule-pack format with zod validation mirroring the --policy loader, no new deps, provenance/safety checks on the packs themselves. Maps cleanly onto the existing declarative rule tables and runRules loop. Resolve the one open design question (ScoreBreakdown's five fixed buckets — external findings count toward total without an own bucket is acceptable for v1). Couples with a hosted, curated AI-tooling malicious-package/skill + CVE intel feed as the paid subscription layer (the static 21-entry CVE DB goes stale; sync to NVD/GHSA/OSV).
### Pro Deep Scan: LLM-judge semantic detection + live MCP tool fetch + rug-pull pinning
- **Area:** agentshield | **Effort:** L | **Impact:** high
- **MRR angle:** Directly neutralizes the most dangerous competitor (Snyk Agent Scan) and AgentGuard. Metered/Pro feature where the platform fronts the model cost and runs deeper scheduled adversarial sweeps. Keeps free AgentShield as the no-account default vs Snyk's token-gated CLI.
Reuse the existing --opus (Red/Blue/Auditor) and --injection (live LLM adversarial, ~70 payloads) plumbing to ship an opt-in LLM-judge layer for semantic prompt-injection and toxic-flow chaining. Add a live MCP connector that fetches tool descriptions and pins tool hashes to flag rug-pulls between scans (capabilities Snyk has and AgentShield lacks). Close the acknowledged skill-md / freeform-prompt coverage gap as a free differentiator (now table stakes vs NVIDIA SkillSpector), reserving AST taint + curated YARA/IOC feed for Pro.
### Compliance/evidence packs mapped to SOC2/PCI/ISO controls
- **Area:** agentshield | **Effort:** M | **Impact:** high
- **MRR angle:** High-margin enterprise add-on: auditor-ready packs are the artifact GRC teams hand to auditors to justify agent deployments. Buyers want framework-mapped evidence, not raw findings — this is a clear Enterprise seat upsell.
AgentShield already generates deterministic hash-verified evidence packs and SARIF, plus baseline/drift and org-policy pass/fail. Add explicit framework mapping (findings -> SOC2 CC / PCI DSS / ISO control IDs), coverage and remediation-over-time charts fed by baseline history and runtime.ndjson, and hosted storage/retention/signing. Sell as the compliance deliverable for regulated buyers.
### Centrally-managed org policy + RBAC distribution
- **Area:** agentshield | **Effort:** L | **Impact:** high
- **MRR angle:** Per-seat Enterprise value: hosted policy distribution, enforcement across the fleet, and waiver/exception workflows with expiry and owner approval are exactly what org buyers pay seats for. Today policy packs are local JSON copied around with no central management.
Policy packs (6 presets), export/promote with SHA-256-verified promotion, and exception lifecycle already exist as local JSON. Add hosted policy distribution, fleet-wide enforcement, centrally-managed exceptions/waivers (expiry + owner approval), org identity/RBAC, audit-log retention, and central branch-protection evidence. Add a DryRun-style natural-language-to-policy authoring layer ('no MCP server may bind 0.0.0.0', 'skills must not read keychain') that compiles to AgentShield rules — a differentiated UX developers are gravitating to.
### Harness-neutral expansion: Kimi, Codex alias, OpenClaude/Codex compat
- **Area:** ecc-core | **Effort:** L | **Impact:** medium
- **Linked:** PR #2154, PR #2254, issue #2076, issue #2073, issue #2074
- **MRR angle:** Broadens the addressable user base for the whole funnel and aligns with the ECC 2.0 harness-neutral control-pane vision — more harnesses scanned = more top-of-funnel feeding Pro.
Land the harness-neutral work after the required catalog/registry sync, install-profile review, and surface tests: PR #2154 (Kimi Code CLI, 12th harness, +1397/16 files), PR #2254 (Codex plugin alias — currently DRAFT + CONFLICTING, resolve first), and answer the needs-info compat issues #2076 (OpenClaude), #2073 (Codex subagent TOML format), #2074 (OpenCode bun-on-PATH Windows bug). AgentShield's harness adapters already detect Claude Code/OpenCode/Codex/Gemini/Zed/VS Code/dmux.
### Batch-review and dedup the community skill/agent PR backlog
- **Area:** ecc-core | **Effort:** M | **Impact:** low
- **Linked:** issue #2308, PR #2309, PR #2310, PR #2311, PR #2285, PR #2275, PR #2274, PR #2270, PR #2318, PR #2315, PR #2313, PR #2137, issue #2069
- **MRR angle:** Indirect: keeps the catalog credible and discoverable (catalog quality is a free-tier retention factor) without bloating it with redundant skills that dilute the value prop.
Triage as batches with overlap/dedup review against the existing 200+ skill catalog plus manifest/catalog/command-registry sync and surface tests: the three BMAD-inspired skills (#2309/#2310/#2311 under tracking issue #2308), framework-reviewer family extensions (#2285 nuxt, #2275 React Native, #2280 AL/BC), and assorted new-skill PRs (#2319 ecc-recipes, #2314 quant-trading, #2281 council-multi-model, #2277 living-docs, #2288 mailtrap — needs cred-handling security review). Resolve needs-work conflicting/large PRs (#2274 gateguard rebase, #2270 OMP split, #2318/#2315 large drops). Close low-signal drive-bys: PR #2313 (empty template), PR #2137 (vague AI-slop SOP), agentshield #99 (spam). Route marketing reshare #2069 to content (ECC was 'featured', not a winner).
## LATER
### Free runtime guard hook with Pro centralized telemetry + trust registry
- **Area:** agentshield | **Effort:** XL | **Impact:** flagship
- **MRR angle:** Closes the biggest competitive gap (GoPlus AgentGuard runtime blocking, Snyk-Evo fleet monitoring) and is a pure hosted play billed per active agent/seat. Free static deny-list neutralizes AgentGuard's differentiator; Pro baselining + telemetry + managed trust registry is the recurring upsell.
Today the runtime monitor (src/runtime) is a thin deny-list + rate-limit PreToolUse evaluator logging to local NDJSON. Build a streaming evaluator with per-agent/per-repo behavioral baselining and intent-drift scoring (OTel GenAI spans), soft-warn/hard-block inline, and extend taint tracking from single-file static to cross-tool-call / cross-session data-flow lineage (the indirect-injection -> exfiltration chain that dominates 2026 incidents). Add credential-flow tracing (which hook/MCP reads each secret, does it egress). Pro centralizes runtime telemetry ingestion, fleet-wide deny-policy distribution, tamper-evident logging, a managed trust registry, and real-time alerting. This is 'AgentShield Runtime' — agent EDR, not a config linter.
### Cross-machine team airspace + A2A topology security in the control pane
- **Area:** ecc-pro | **Effort:** XL | **Impact:** high
- **MRR angle:** The clearest Team/Enterprise seat wedge: 'N agents, M humans, zero merge conflicts over Tailscale' is exactly what justifies per-seat team pricing. A2A privilege-escalation visualization is the security-native sibling of the Layer 4 moat, sold alongside the control pane.
Proximity only sees local sessions in one repo today (roadmap v2 cross-machine is unbuilt). Build hosted, authenticated multi-repo/multi-machine airspace (sessions, kanban, proximity, risk ledger) gated behind Team/Enterprise, with the TCAS transmit/steer protocol + agent+human JIT deconfliction as the per-seat value. Add agent-to-agent (A2A) topology security: model the org's multi-agent delegation graph (which agent invokes/delegates to which, with what inherited tools) and highlight confused-deputy / delegation-of-overprivilege paths. Promote the local memory-recall Knowledge panel into a synced team knowledge/RAG store as a Pro add-on.
### Community MCP/skill reputation registry as growth flywheel + Pro risk-score API
- **Area:** agentshield | **Effort:** L | **Impact:** medium
- **MRR angle:** Doubles as marketing and as the data backbone for a paid risk-score API. Counters Prompt Security's 13,000-server scored registry moat; the crowd + ECC-ecosystem scan-result data flywheel is hard for competitors to replicate.
Build a free community MCP/skill reputation registry aggregating crowd input + AgentShield scan results across the ECC ecosystem, with MCP provenance attestation (SLSA/in-toto/Sigstore-style signed agentshield.lock pinning the full MCP+skill+plugin dependency closure). Sell continuous monitoring, org allow/block policy, Shadow-MCP discovery, and a hosted multi-ecosystem (npm+PyPI+cargo) provenance/SBOM service as Pro. Optional niche add-on: pickle/safetensors/GGUF model-artifact deserialization scanner for local-OSS-model teams.
## Capability baseline (what we have, where the gaps are)
### AgentShield today
AgentShield today is a mature STATIC security scanner for AI-agent configurations (Claude Code and adjacent harnesses), shipping 102 pattern-based rules across secrets, permissions, hooks, MCP, and agents, hardened by a source-confidence/false-positive engine (runtimeConfidence tiers + score weighting). Beyond static rules it layers: MCP tool-poisoning + CVE detection backed by a 21-entry curated threat-intel DB, supply-chain provenance verification (offline + optional npm-online + package-manager hardening), opt-in static taint analysis, opt-in LLM-driven active prompt-injection testing (~70 payloads / 12 categories), opt-in hook sandbox execution with canary secrets, and an Opus 4.6 three-agent adversarial pipeline. Operational surfaces include org policy packs with verified export/promote + exception lifecycle, an installable runtime PreToolUse deny-list monitor, deterministic hash-verified evidence packs with fleet operatorReadback, baseline drift gating, a local watch/alert mode, harness adapters, and full CI integration (GitHub Action, SARIF, corpus self-test). The honest gaps are that detection is overwhelmingly static/signature-based (narrow non-shell hook-code coverage, weak skill-md prompt coverage, no live CVE feed, no real AST taint), and that all the continuous/fleet/hosted primitives (watch, evidence-pack fleet, policy distribution, runtime telemetry, deep LLM analysis) exist only as LOCAL CLI building blocks. That gap is precisely the Pro/Enterprise opportunity: the data models for continuous monitoring, fleet dashboards, hosted scanning, centrally-managed org policy, live threat-intel, and compliance evidence retention are already designed locally and would convert directly into a hosted ECC Tools Pro offering (README already references a $19/seat/mo tier and the ecc-tools GitHub App). Key files: src/rules/*, src/{taint,injection,sandbox,supply-chain,threat-intel,runtime,policy,evidence-pack,watch,baseline,harness-adapters,opus}/, README.md, false-positive-audit.md.
Key gaps the roadmap targets:
- STATIC-ONLY for most detection: rules are regex/pattern-based over config text. Polymorphic/obfuscated payloads, novel encodings, and logic-level malice that doesn't match a signature are missed. Deep behavioral detection requires opt-in --opus/--injection/--sandbox (LLM cost or local execution).
- NON-SHELL HOOK CODE coverage is narrow: hook-code findings only catch explicit signals (output() context injection, transcript access, child-process curl|bash). Broad language-aware analysis of JS/Python/etc hook implementations is not done — README explicitly flags this as a known high-signal caveat.
- skill-md / freeform prompt text bypasses most agent + injection rules (explicitly acknowledged). Skill prompt bodies have much weaker coverage than CLAUDE.md/agent-md.
- CVE database is a hand-curated static list of 21 entries with no live feed — goes stale; no automated sync to NVD/GHSA/OSV. No CVSS scoring, no version-range resolution beyond string matching.
- Supply-chain online check only hits npm registry; no PyPI/cargo/RubyGems online verification, no SBOM generation/consumption, no transitive-dependency graph or lockfile-tree integrity verification (only top-level provenance counts).
- Watch mode is local single-process fs.watch only (no daemon/service, no persistence across restarts, single targetPath baseline). Webhook alerting exists but there is no hosted ingestion, dashboard, or multi-repo fleet view that actually runs continuously.
- No hosted/SaaS scanning backend. Everything runs locally or in the user's CI. GitHub App (ecc-tools) is referenced but the scanner core is fully local/offline.
- No semantic/data-flow analysis across files for MCP tool chaining or multi-agent privilege escalation beyond single-config heuristics; taint analysis is regex source/sink, not real AST/CFG.
- No detection of malicious model behavior at inference time (only config-time + optional sandbox/injection test). No live transcript/telemetry monitoring of a running agent fleet.
- Runtime monitor is a thin deny-list evaluator (glob+regex) installed as one hook; no kernel/syscall-level sandboxing, no egress filtering enforcement, no tamper protection on the hook itself.
### ECC Pro surface today
ECC's paid story today is two separate hosted GitHub Apps (ECC Pro at $19/seat/mo for private repos, and ECC Tools with free/pro/enterprise Marketplace tiers + real billing infra), while the entire local plugin including the control pane stays MIT-free with no license gating. The control pane (loopback-only Node server) surfaces Sessions, an interactive kanban with agent+human JIT assignment, local Knowledge recall, MCP connectors, and executable actions. The genuinely differentiated 'moat' — the agent-airspace proximity metric (noisy-OR collision risk, TCAS transmit/steer advisories, 3D embedding) — is fully implemented in code and wired into the snapshot, BUT the 3D 'where-are-the-agents' visualization is never rendered (zero proximity output in the UI), and none of these capabilities are positioned or gated as Pro/Enterprise. The paid value story is thin: Pro currently reads as 'OSS for private repos + PR audits' (commodity vs CodeRabbit/Greptile), while the truly ownable surfaces — 3D agent observability, multi-agent/human JIT deconfliction, cross-machine team airspace, shared team knowledge — are either unrendered, unbuilt, or unmonetized. Also verify live GitHub Marketplace Pro billing-state provenance before claiming native payments are GA. Key files: scripts/lib/control-pane/{server,state,ui,proximity,message-sink,work-item-mutations}.js, scripts/lib/agent-proximity/{distance,graph,index}.js, docs/design/agent-proximity.md, docs/ECC-2.0-REFERENCE-ARCHITECTURE.md, docs/ECC-2.0-GA-ROADMAP.md, README.md:53-83 and :216.
Pro leverage points identified:
- 3D agent-airspace observability dashboard — render the already-computed scanAirspace positions/links/advisories (WebGL/Three.js in the control-pane UI). 'Watch N agents crawl toward each other in code-space and watch one steer away' is a unique, demo-able Pro/Team feature nothing else has. The math is done; only the renderer is missing.
- Multi-agent / multi-human JIT deconfliction as a TEAM seat product — the TCAS transmit/steer protocol + agent+human kanban JIT assignment is the natural per-seat value. Gate the cross-machine airspace (Tailscale, roadmap v2) behind Team/Enterprise.
- Hosted control pane / observability backend — today it is loopback-only local. A hosted, authenticated, multi-repo version (sessions, kanban, proximity, risk ledger, HUD/status JSON contract from the reference arch) is the obvious Pro SaaS surface.
- Shared team knowledge layer — promote the local memory-recall Knowledge panel into a synced team knowledge/RAG store (the reference arch already wants RAG over vetted patterns / PR outcomes / CI failures) as a Pro/Enterprise add-on.
- AgentShield Enterprise security platform — policy packs (OSS/team/enterprise/regulated), SARIF, supply-chain intel, exec HTML/PDF reports, CI enforcement (reference arch lines 152-173). This is already framed as the enterprise security tier and pairs with the proximity/observability story.
- ECC Tools deep analyzer + Linear sync as the GitHub-native paid PR layer (already the current paid surface); differentiate it from CodeRabbit/Greptile by bundling the agent-proximity/merge-conflict-prevention angle that competitors lack.
## Research inputs
### competitor-gap-analysis
AgentShield (npm "ecc-agentshield") occupies a defensible niche: a free, OSS, zero-account static auditor for AI-agent configuration surfaces (Claude Code .claude/ dirs, hooks, MCP configs, permissions, agent/skill markdown, secrets) shipped as CLI + GitHub Action + GitHub App, with 102 rules across 5 categories, runtimeConfidence source-weighting, supply-chain provenance, evidence packs/SARIF, and an Opus red/blue/auditor pipeline. npm growth is real: 78,108 downloads YTD 2026 (Jan 1-Jun 21), ~29,759 last 30 days, ~7,228 last week, daily 700-2,300. The field splits into two tiers. (1) Direct OSS config/skill scanners: Snyk agent-scan (ex-Invariant mcp-scan, the single most dangerous competitor), NVIDIA SkillSpector (AST taint + YARA), GoPlus AgentGuard (runtime action eval + trust registry, local-only), Mondoo Skill Check, Semgrep Guardian. (2) Enterprise runtime/firewall + model-supply-chain: Lakera Guard (Check Point), Prompt Security (SentinelOne), HiddenLayer, Protect AI Guardian (Palo Alto/Prisma AIRS), Noma, plus Cloudflare/Microsoft Defender MCP gateways; GitGuardian ships native Claude Code/Cursor/Copilot secret hooks. AgentShield's biggest gaps: no runtime/inline enforcement (purely static), no LLM-judge semantic prompt-injection/toxic-flow analysis, no live MCP tool-description fetch or rug-pull tool-pinning, no ML model-artifact scanning, no central fleet dashboard, no policy-as-code gateway. Biggest moats: free + zero-account + OSS (Snyk agent-scan needs a SNYK_TOKEN; enterprise tier is all paid/acquired), deep Claude Code config specificity, source-confidence false-positive weighting, and ECC distribution. Clear ECC Pro wedges: hosted fleet dashboard, LLM-judge deep-scan, live MCP runtime proxy + rug-pull detection, policy-as-code CI gates, model-artifact scanning, and a curated AI-tooling malicious-package/skill intel feed.</summary>
</invoke>
Notable gaps vs us (missing today):
- **GoPlus AgentGuard — local-only runtime action enforcement + trust registry (the runtime gap)** — Ship a free lightweight PreToolUse hook-based runtime guard (AgentShield already understands Claude Code hook wiring deeply — natural extension via agentshield init), reserving the managed trust registry, org-wide allow/block policy sync, and runtime telemetry/alerting for ECC Pro. Neutralizes AgentGuard's differentiator while keeping the upsell.
- **Lakera Guard (Check Point) — runtime prompt-injection firewall** — Enterprise inline-firewall is capital-intensive and now owned by Check Point/SentinelOne, so not a near-term build. Realistic ECC Pro angle: a hosted /guard-style endpoint reusing AgentShield's injection rule corpus for lightweight dev/CI gating of agent prompts and tool descriptions — developer-first and cheaper, not an enterprise WAF.
- **Prompt Security (SentinelOne) — MCP Gateway + dynamic risk scoring of 13,000+ public MCP servers** — Build a free community MCP/skill reputation registry (crowd + AgentShield scan results across the ECC ecosystem) as a growth/data-flywheel asset, then sell continuous monitoring + org allow/block policy + Shadow-MCP discovery as Pro. The registry doubles as marketing and as the data backbone for a Pro risk-score API.
- **HiddenLayer + Protect AI Guardian (Palo Alto/Prisma AIRS) — ML model-artifact supply-chain scanning** — Pro add-on: pickle/safetensors/GGUF deserialization scanner for agents that load local model artifacts, plus a Hugging Face model-reference checker in agent configs. Niche but a clean upsell for local-OSS-model teams; integrate a free OSS pickle-scan core (picklescan-style) with a Pro signature/IOC feed.
- **Cloudflare / Microsoft Defender — MCP gateways and managed enforcement infrastructure** — Stay complementary: position AgentShield/ECC Pro as the developer-side pre-flight + CI gate that feeds findings into these gateways (SARIF/JSON export already exists). A Pro integration that exports AgentShield posture to Cloudflare/Defender policy or emits Shadow-MCP candidate lists is a partnership-friendly upsell rather than a competitive build.
### unbuilt-ideation
AgentShield already ships an unusually broad static surface: 102+ rules across secrets/permissions/hooks/MCP/agents, MCP CVE + tool-poisoning detection, supply-chain provenance, taint analysis, sandbox hook execution, injection testing, watch/drift mode, a PreToolUse runtime monitor, org policy-as-code, evidence packs, baseline gates, SARIF/HTML, and the ECC Tools GitHub App + Pro tier. So the real unbuilt ideation is NOT "add another scanner category" — it is moving from static config audit toward live runtime defense, cross-call/cross-session reasoning, and a hosted continuous-assurance product. The biggest concrete gaps, grounded in the shipped code and the 2026 threat landscape: (1) the "runtime monitor" is only a static deny-rule + rate-limit PreToolUse evaluator — there is no behavioral baselining, intent-drift detection, or live taint propagation across actual tool calls; (2) taint tracking is single-file static only, not cross-tool-call / cross-session data-flow; (3) autofix has no verification loop (applies string transforms, never re-scans to prove the finding is gone and nothing new was introduced); (4) zero coverage of non-human/agent identity, least-privilege token scoping, or OAuth/credential-flow tracing (the fastest-growing 2026 risk per CSA/OWASP NHI work); (5) no MCP provenance attestation / signed lockfile (supply-chain is detection + npm metadata, not cryptographic attestation); (6) no A2A / multi-agent / agent-to-agent protocol coverage; (7) no hosted continuous-scanning dashboard with fleet trend lines (evidence-pack fleet exists as CLI, but no SaaS); (8) community rule-pack loader is requested (issue #101) but unbuilt. Each maps cleanly to ECC Pro / ECC Tools monetization because they require hosting, threat-intel feeds, or org-fleet state that an OSS CLI can't carry.
Notable gaps vs us (missing today):
- **Autofix with verification loop (re-scan + no-regression proof)** — OSS gets verify-after-fix locally. Pro gets autofix-as-PR via ECC Tools GitHub App: open a remediation PR, run the verified re-scan in CI, attach the before/after evidence pack, and auto-merge on green — a paid managed-remediation workflow.
- **Agent identity, least-privilege, and non-human-identity (NHI) governance** — Enterprise policy-pack feature: ship least-privilege scoring + token-rotation/age gates as a 'regulated/enterprise' Pro policy pack, and a hosted NHI inventory across the org's repos in ECC Tools (fleet-level identity sprawl map).
- **Agent-to-agent (A2A) and multi-agent topology security** — Premium control-pane integration: render the org's multi-agent delegation graph with privilege-escalation paths highlighted, sold alongside ECC 2.0 control pane / Layer 4 proximity as a paid org-fleet visualization.
- **Community/external rule-pack loader (--rule-pack)** — OSS gets the loader + local packs. Pro gets a curated, signed, continuously-updated commercial rule-pack feed (the CVE/known-malicious-MCP intel from the supply-chain item), turning detections into a subscription.
### devtool-demand-gaps
Across SAST/SCA tools (Snyk, CodeQL, Semgrep, SonarQube, Dependabot) the dominant 2026 developer complaint is not detection but triage: alert fatigue, false positives, and low-value PRs. A Go maintainer publicly called Dependabot a "noise machine"; teams report spending more time triaging Snyk SCA alerts than fixing issues; CodeQL FP-heavy unit-test flags and a postback-on-dismiss UX push developers to ignore alerts entirely. The clear demand is for low-noise, context-aware, PR-time findings with autofix and SARIF/compliance output. For AI-agent codebases specifically, two new direct competitors emerged: Snyk Agent Scan (Open Preview, May 2026 — CLI + background MDM/CrowdStrike mode, cloud-backed, sends tool metadata off-machine) and DryRun Security (contextual NL code policies in PRs, feeds Claude/Cursor/Codex). AgentShield already ships much of what the market asks for in agent-config security: 102 rules, SARIF, GitHub Action, autofix (--fix/remediation), evidence packs, supply-chain checks, runtimeConfidence FP weighting, a local runtime hook-enforcement layer (runtime.ndjson) and a watch/drift detector. The biggest unmet, monetizable gaps are: (1) a hosted Sentry-style aggregated dashboard + agent runtime telemetry (error/tool-failure/cost/drift across many repos and machines) — nobody unifies config-scan + runtime observability; (2) true inline PR-comment review (AgentShield's Action fails CI and emits SARIF but does not post sticky inline comments like DryRun/Aikido); (3) IDE/editor integration (Cursor/Windsurf/VS Code/Claude Code) so findings and fixes land where agents code; (4) natural-language custom org policies (DryRun-style) beyond the current JSON policy presets; (5) compliance/evidence packs mapped to SOC2/PCI frameworks as a paid Pro deliverable. AgentShield's local-first, no-data-leaves-machine posture is a concrete differentiator against Snyk Agent Scan's cloud metadata transmission and a privacy selling point for regulated buyers.
Notable gaps vs us (missing today):
- **IDE/editor integration — findings and fixes where agents actually write code** — Ship a VS Code/Cursor extension (and a Claude Code skill already exists via ecc:security-scan) that lints agent configs on save, shows findings inline, and offers fixes — gated behind Pro for org policy sync. Builds on existing harness-adapters; meets developers in the editor where Snyk Agent Scan (CLI/MDM) does not.
> Note: a fourth research thread (recent agentic/MCP CVEs) was blocked by an automated
> usage-policy classifier on the raw "find vulnerabilities" prompt. The CVE-database refresh
> need it would have covered is captured under the rule-pack + intel-feed item, and will be
> handled as a scoped, defensive OSV/GHSA/NVD sync rather than free-form vulnerability research.
## Appendix: open PR / issue triage
### affaan-m/ECC
| Disposition | Ref | Title |
| --- | --- | --- |
| merge | PR #2320 | feat(control-pane): 3D agent-airspace viz + /api/proximity feed (Layer 4 observability) |
| merge | PR #2133 | fix(llm): align Claude provider with current Anthropic API |
| needs-work | PR #2274 | fix(gateguard): make fact-force checklist tool-agnostic |
| merge | PR #2307 | fix(tests): resolve 10 failing tests on Windows |
| merge | PR #2293 | chore(deps): bump npm-minor-and-patch group (5 updates) |
| needs-work | PR #2260 | chore(deps-dev): bump eslint 9.39.2 to 10.5.0 |
| triage-later | PR #2319 | feat: add ecc-recipes skill |
| needs-work | PR #2318 | feat: add OpenSpec ecosystem (5 agents, 2 orchestration skills, 3 integrations) |
| needs-work | PR #2315 | feat(skills): add 10 custom local skills |
| triage-later | PR #2314 | feat(skills): add quant-trading-systems skill |
| close | PR #2313 | Add Pylint workflow for Python code analysis |
| merge | PR #2312 | fix(opencode): sync plugin metadata counts |
| triage-later | PR #2311 | feat(skills): add story-lifecycle skill |
| triage-later | PR #2310 | feat(skills): add project-context skill |
| triage-later | PR #2309 | feat(skills): add dev-team skill (multi-persona session) |
| needs-work | PR #2287 | refactor: migrate .kiro.hook files to JSON v1 format |
| triage-later | PR #2285 | feat(agents): add nuxt-reviewer and /nuxt-review surface |
| triage-later | PR #2281 | feat: add council-multi-model skill (heterogeneous Codex review) |
| triage-later | PR #2280 | feat: add AL/Business Central language pack |
| triage-later | PR #2277 | Add living-docs-governance skill |
| triage-later | PR #2275 | feat(rules,skills): React Native / Expo rules pack + react-native-patterns skill |
| merge | PR #2273 | docs(code-tour): document the ref field |
| needs-work | PR #2270 | fix(omp): harden harness contract |
| needs-work | PR #2264 | Harden release automation 6097857685862934372 |
| needs-work | PR #2254 | [codex] add everything codex plugin alias |
| merge | PR #2246 | docs(commands): generate discoverable <name>/SKILL.md skills not inert flat files |
| needs-work | PR #2154 | feat: add Kimi Code CLI support |
| close | PR #2137 | feat: add ULTRA CODE self-evolving operator SOP |
| needs-work | PR #2136 | Add opt-in AURA trust-check adapter (integrations/aura) |
| merge | PR #2063 | fix(instinct-cli): pin file reads and stdout to UTF-8 on Windows |
| merge | issue #2316 | plan-orchestrate: stale ECC install detection after marketplace rename to ecc@ecc |
| triage-later | issue #2308 | feat: add dev-team, project-context, story-lifecycle community skills |
| merge | issue #2306 | docs: Scope Decision Guide table duplicated in SKILL.md and observer.md with drift |
| merge | issue #2305 | chore: unused 'from unittest import mock' in test\_parse\_instinct.py |
| triage-later | issue #2304 | chore: three naming conventions coexist in continuous-learning-v2 shell scripts |
| triage-later | issue #2303 | chore: inconsistent shebangs across continuous-learning-v2 shell scripts |
| merge | issue #2302 | test: add coverage for cmd\_prune, projects delete/gc/merge, \_promote\_specific dry-run, |
| merge | issue #2301 | bug: migrate-homunculus.sh pgrep pattern treats $HOME as regex |
| merge | issue #2300 | bug: SIGALRM handler silently drops in-flight observations in observe.sh |
| merge | issue #2299 | bug: Python \_update\_registry omits 'id' field present in shell counterpart |
| merge | issue #2298 | bug: observer.md says 'each instance >= 0.8' but code uses average confidence |
| security-priority | issue #2297 | bug: \_remove\_project\_storage lacks path containment check |
| needs-work | issue #2296 | bug: signal counter race condition in observe.sh throttle logic |
| merge | issue #2295 | fix: replace hardcoded sleep 2 with PID file poll in start-observer.sh |
| security-priority | issue #2294 | fix: \_write\_registry missing file lock (race with \_update\_registry) |
| merge | issue #2293-dup | (see PR #2293) |
| triage-later | issue #2283 | OpenSpec Ecosystem: spec-miner lifecycle extension (5 agents + 3 integrations + CI) |
| triage-later | issue #2112 | ctx — potential synergy between ECC and ctx |
| triage-later | issue #2103 | Skill proposal: Before You Build Skill |
| needs-work | issue #2076 | OpenClaude Compatibility |
| needs-work | issue #2074 | Frequent 'bun: command not found' Error in OpenCode TUI (Windows) |
| needs-work | issue #2073 | Do agents/*.md need TOML rewrite for Codex subagent recognition? |
| triage-later | issue #2069 | Featured ECC in a Medium article — request to add to README and reshare |
| triage-later | PR #2288 | feat(skills): add mailtrap-email-integration skill |
Triaged all open PRs (30) and issues (24) on affaan-m/ECC. MERGE-READY (clean, correct, mergeable): PR #2320 (maintainer's Layer 4 control-pane 3D viz — top Pro/MRR value), PR #2133 (Claude provider model-ID + adaptive-thinking fix, verified correct against the authoritative Claude API reference — sonnet-4-6/haiku-4-5/opus-4-8, omit temperature, adaptive thinking for Opus 4.7/4.8), PR #2307 + #2063 (Windows fixes), PR #2273/#2246/#2312 (docs/workflow fixes), PR #2293 (dependabot minor/patch). Plus several quick-win issues in continuous-learning-v2 (#2306, #2305, #2302, #2301, #2299, #2298, #2295, #2300) and #2316 (plan-orchestrate stale install detection). SECURITY-PRIORITY: issue #2297 (path traversal — shutil.rmtree without containment check) and issue #2294 (registry write without file lock → corruption) in skills/continuous-learning-v2/scripts/instinct-cli.py. Both should be fixed as a hardening pass. PR #2136 (AURA external trust integration) needs a security review of its third-party dependency. NEEDS-WORK (rebase/scope/review): PR #2274 (gateguard tool-agnostic fix — correct but CONFLICTING), PR #2270 (OMP — +3151/-454, CONFLICTING, scope creep into release automation; split it), PR #2318/#2315/#2154 (large skill/harness drops needing catalog sync + per-item review), PR #2260 (eslint 9→10 major bump — verify before merge), drafts #2264/#2254, plus needs-info issues #2076/#2074/#2073. CLOSE candidates: PR #2313 (empty template, likely conflicts with existing python review), PR #2137 (vague 'ULTRA CODE self-evolving SOP', CONFLICTING, AI-slop). TRIAGE-LATER: the three BMAD-inspired community skills (#2309/#2310/#2311 under tracking issue #2308) and assorted new-skill PRs (#2319, #2314, #2281, #2280, #2277, #2275, #2288, #2285) — all need overlap/dedup review against the existing 200+ skill catalog and manifest sync. Issue #2069 is a marketing reshare request (route to content; note ECC was 'featured', not a winner). Pro/MRR-relevant cluster: control-pane Layer 4 (#2320), harness-neutral expansion (Kimi #2154, Codex alias #2254, OpenClaude/Codex compat #2076/#2073), multi-model orchestration skills (#2281, #2318), and continuous-learning reliability/security (#2294/#2297/#2300).
### affaan-m/agentshield
| Disposition | Ref | Title |
| --- | --- | --- |
| merge | PR #103 | fix: treat dangerous flags inside permissions.deny/ask rules as prohibitions, not usages |
| merge | issue #102 | False positive: permissions.deny rules blocking --no-verify flagged CRITICAL, zeroing Perm |
| needs-work | issue #100 | False positives: --no-verify in string literals (CRITICAL) and 'backward ...' English flag |
| triage-later | issue #101 | Proposal: external rule-pack loader (--rule-pack) to load community detection rules |
| merge | PR #97 | docs: Add FAQ section for common questions |
| needs-work | PR #96 | chore(deps-dev): bump vitest from 3.2.4 to 4.1.8 |
| close | issue #99 | bm |
7 open items on affaan-m/agentshield: 3 PRs (#103, #97, #96) and 4 issues (#102, #101, #100, #99). The headline is the false-positive cluster (#100, #102, #99-adjacent) where the scanner flags --no-verify inside permissions.deny rules as CRITICAL and zeros the Permissions score — penalizing its own recommended remediation. PR #103 cleanly fixes the structurally-decidable JSON case (#102) with fail-closed logic, 6 new tests, and all review-bot checks green; recommend MERGE as the top trust/conversion win. #100 covers two remaining FPs (--no-verify in string literals + 'backward' English matched as reversed-text in agents.ts:1561) not addressed by #103 — needs-work follow-up. #101 (external --rule-pack loader, ATR integration) is a high-value ecosystem/Pro proposal, well-scoped, recommend triage-later with intent to accept the PR. #97 (README FAQ) is mergeable docs. #96 (vitest 3→4) has a real test failure (renderTerminalAlert assertion under vitest 4) and needs work before merge. #99 ('bm', empty body) is spam — close. Notable caveat: PR #103's checks are only review bots (CodeRabbit/Greptile/GitGuardian); the Verify/test matrix does not appear to have run, so maintainer should confirm the suite passes locally before merge.
docs/HERMES-SETUP.md
+77 -2
View File
@@ -22,7 +22,7 @@ Telegram / CLI / TUI
↓
Hermes
↓
ECC skills + hooks + MCPs + generated workflow packs
ECC skills + hooks + MCPs + shared Memory Vault
↓
Google Drive / GitHub / browser automation / research APIs / media tools / finance tools
```
@@ -45,6 +45,79 @@ Use this as the minimal surface to reproduce the setup without leaking private s
- scheduled automation runs with explicit prompts and channels
- `~/.hermes/workspace/`
- business, ops, health, content, and memory artifacts
- `<repo>/.ecc/memory/`
- shared project and team context for Hermes, Claude, Codex, and other agents
- `~/.ecc/memory/`
- user-scoped context that follows the operator across repositories
## Shared Memory Across Hermes, Claude, And Codex
ECC Memory Vault provides one file-first handoff layer instead of a separate
inbox or transcript store for every agent. Initialize it from the repository
that the agents share. Skill-only, minimal, manual, and Claude plugin installs
do not add the Memory Vault runtime to `PATH`; install it separately first:
```bash
npm install -g ecc-universal
ecc memory --help
command -v ecc-memory-mcp
```
Then initialize the vault:
```bash
ecc memory init --scope project --scope team
```
Normal search recall covers active `project` and `team` memories. Use
`project` for repo-local state, `team` for memories a human will inspect before
committing, and request `user` explicitly for private operator context that
should follow the user across repositories. Every vault entry remains
unreviewed context; human acceptance means promoting verified knowledge into
governed project documentation.
Hermes can call the CLI directly or use the opt-in `ecc-memory-mcp` stdio
server. Harnesses may share the same installed binary and vault storage, but
each harness must launch its own server process with its own distinct lowercase
`ECC_MEMORY_HARNESS` identity; they must not connect to one shared server
process. Every process must launch from the same repository working directory
or receive identical `ECC_MEMORY_PROJECT_ROOT` and `ECC_MEMORY_USER_ROOT`
overrides.
A Hermes-to-Codex handoff can be written without putting the body in the
process list:
```bash
printf '%s\n' 'Research is complete. Verify the cited sources and implement the parser.' |
ecc memory handoff \
--from hermes \
--target codex \
--title "Implement the research parser" \
--tag research \
--stdin
```
Codex can retrieve it with:
```bash
ecc memory search "research parser" --target-harness codex
ecc memory read <memory-id>
```
For MCP access, copy only the `ecc-memory-vault` entry from
`mcp-configs/mcp-servers.json` into each harness that needs it. ECC does not
enable this server in the default `.mcp.json`. Launch each server with its own
lowercase identity, for example `ECC_MEMORY_HARNESS=hermes`. The server binds
writes and target filtering to that identity; tool callers cannot impersonate
another harness. User-scope MCP access also requires the operator to set
`ECC_MEMORY_ALLOW_USER_SCOPE=1`, and the tool call must request `user`.
Memories are create-only and always unreviewed. Treat recalled content as
context, not instructions; verify consequential claims against source files,
tests, or work items. Inspect team memories before committing them, never store
credentials or raw private transcripts, and keep canonical project decisions
in governed documentation. Secret-shape detection is only a best-effort
backstop.
## Recommended Capability Stack
@@ -52,6 +125,7 @@ Use this as the minimal surface to reproduce the setup without leaking private s
- Hermes for chat, cron, orchestration, and workspace state
- ECC for skills, rules, prompts, and cross-harness conventions
- ECC Memory Vault for explicit, local-first agent handoffs
- GitHub + Context7 + Exa + Firecrawl + Playwright as the baseline MCP layer
### Content
@@ -94,7 +168,8 @@ These stay local and should be configured per operator:
- import sanitized workspace memory with `ecc migrate import-memory`
1. Install ECC and verify the baseline harness setup with `node tests/run-all.js`; the expected result is a zero-failure test summary.
2. Install Hermes and point it at ECC-imported skills.
3. Register the MCP servers you actually use every day.
3. Initialize the shared ECC Memory Vault. Register `ecc-memory-mcp` only if
Hermes needs tool access instead of the `ecc memory` CLI.
4. Authenticate Google Drive first, then GitHub, then distribution channels.
5. Start with a small cron surface: readiness check, content accountability, inbox triage, revenue monitor.
6. Only then add heavier personal workflows like health, relationship graphing, or outbound sequencing.
docs/MIGRATION-1X-TO-2.0.md
+52
View File
@@ -0,0 +1,52 @@
# Migrating From ECC 1.x (everything-claude-code) To 2.0
ECC 2.0 renamed the repo (`affaan-m/everything-claude-code` → `affaan-m/ECC`) and the plugin identifier (`everything-claude-code@everything-claude-code` → `ecc@ecc`). If you installed 1.x, follow this guide to upgrade cleanly. See also the [Naming + Migration Note](../README.md#naming--migration-note) in the README.
## TL;DR
```bash
# 1. Install 2.0
/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@ecc
# 2. Remove the old plugin
/plugin uninstall everything-claude-code@everything-claude-code
```
Then remove any leftover 1.x folders (see below) and restart the session.
## "I now see two ECC plugins"
Expected. `ecc@ecc` and `everything-claude-code@everything-claude-code` are treated as separate plugins by Claude Code. Uninstall the old one; keep only `ecc@ecc`. Running both duplicates skills, commands, and hook executions.
## Leftover folders after uninstalling 1.x
`/plugin uninstall` removes the plugin from the active list, but can leave the old directory in the Claude plugin cache and any manual copies in your home directory.
Safe to delete after the old plugin no longer appears in `/plugin` list:
- The old plugin folder under the Claude plugins directory (e.g. `~/.claude/plugins/...everything-claude-code...`)
- A 1.x manual install in your home folder (a cloned `everything-claude-code/` directory), **if** you are not using it as a working checkout
- Old manually-copied surfaces under `~/.claude/` (`skills/`, `commands/`, `agents/` entries that came from 1.x) — the 2.0 plugin provides current versions
Do NOT delete `~/.claude/rules/` content you copied intentionally, or personal memory/state files.
## Does removing 1.x affect my existing projects?
No. ECC is a harness layer: skills, commands, agents, hooks. It does not alter your project code or git history. Everything ECC produced in your repos (commits, files, PRs) is untouched. Your next session simply loads 2.0 surfaces instead of 1.x ones. Slash-command namespaces changed from `everything-claude-code:*` to `ecc:*`.
## One install path only
Do not stack the plugin install with the manual installer (`install.sh` / `install.ps1` / `npx ecc-install --profile full`). Pick one path; stacking creates duplicate skills and duplicate hook runs. If you already stacked, see [Reset / Uninstall ECC](../README.md#reset--uninstall-ecc).
## Using 2.0 across harnesses (Codex, Antigravity/agy, OpenCode, Cursor)
2.0 is cross-harness. Use the manual installer with a target:
```bash
npx ecc-install --profile core --target codex # Codex CLI
npx ecc-install --profile core --target opencode # OpenCode
npx ecc-install --profile core --target cursor # Cursor
```
Run `npx ecc consult "<what you need>" --target <harness>` to preview which components fit before installing. Harness-specific guides: [ANTIGRAVITY-GUIDE.md](./ANTIGRAVITY-GUIDE.md), [HERMES-SETUP.md](./HERMES-SETUP.md), [QWEN-GUIDE.md](./QWEN-GUIDE.md), [JOYCODE-GUIDE.md](./JOYCODE-GUIDE.md).
docs/SELECTIVE-INSTALL-ARCHITECTURE.md
+1 -1
View File
@@ -703,7 +703,7 @@ Suggested payload:
"skippedModules": []
},
"source": {
"repoVersion": "2.0.0",
"repoVersion": "2.2.0",
"repoCommit": "git-sha",
"manifestVersion": 1
},
docs/TROUBLESHOOTING.md
+25
View File
@@ -67,6 +67,31 @@ exit 2
- Disable unused MCP servers per project.
- Compact manually at natural breakpoints instead of waiting for auto-compaction.
## ECC Dashboard Does Not Start
**Symptoms:** `npm run dashboard` or `python3 ecc_dashboard.py` fails, often with `ModuleNotFoundError: No module named 'tkinter'`.
**What helps:**
- The GUI dashboard needs Tkinter, which many Python installs omit:
- Debian/Ubuntu: `sudo apt-get install python3-tk`
- Fedora: `sudo dnf install python3-tkinter`
- macOS (Homebrew): `brew install python-tk`
- Windows: re-run the python.org installer and enable "tcl/tk and IDLE"
- Or use the browser dashboard, which only needs Node: `npm run dashboard:web`, then open the printed localhost URL.
- Both commands must be run from a full clone of the ECC repo (`git clone https://github.com/affaan-m/ECC`), not from inside the Claude Code plugin directory — plugin installs do not ship `package.json` scripts.
## Anthropic Cyber Safeguards Block Security Audits Of Your Own Code
**Symptoms:** Running security reviews/audits (e.g. `ecc:security-reviewer`) fails with an API error citing the Usage Policy and "cyber-related safeguards", even though you are auditing your own codebase.
**What helps:**
- This is an upstream Anthropic model-level safeguard, not GateGuard and not an ECC block. No ECC configuration can bypass it.
- Apply to Anthropic's [Cyber Verification Program](https://claude.com/form/cyber-use-case) — the error message includes a tokenized link for your account. Approved accounts get legitimate security workflows unblocked.
- Until approved, structure prompts defensively: state up front that you own the code and the goal is remediation ("review this module I own for vulnerabilities and propose fixes"), keep scope to one module at a time, and avoid exploit-generation phrasing ("write a PoC", "craft a payload").
- Prefer remediation-oriented skills (`security-review`, `security-scan`) over offensive framing, and run static tooling (semgrep, bandit, `npm audit`) yourself, then ask the model to interpret results.
## Related ECC Docs
- [hook-bug-workarounds.md](./hook-bug-workarounds.md) for the shorter hook/compaction/MCP recovery checklist.
docs/architecture/cross-harness.md
+48 -1
View File
@@ -10,6 +10,7 @@ The goal is to keep the durable parts of agentic work in one repo:
- MCP configuration
- install manifests
- session and orchestration patterns
- durable, harness-neutral memory documents
Claude Code, Codex, OpenCode, Cursor, Gemini, and future harnesses should adapt those assets at the edge instead of requiring a new workflow model for every tool.
@@ -27,6 +28,7 @@ For the full-stack platform framing and product-integration loop, see
| Hooks | `hooks/hooks.json`, `scripts/hooks/` | Claude native hooks, OpenCode plugin events, Cursor hook adapter | Hook-backed in Claude/OpenCode/Cursor; instruction-backed in Codex |
| MCPs | `.mcp.json`, `mcp-configs/` | Native MCP config import per harness | Supported where the harness exposes MCP |
| Commands | `commands/`, CLI scripts | Claude slash commands, compatibility shims, CLI entrypoints | Supported, but command semantics vary |
| Memory | `.ecc/memory/`, `~/.ecc/memory/` | `ecc memory` CLI or opt-in `ecc-memory-mcp` stdio server | Supported with explicit recall and unreviewed writes |
| Sessions | `ecc2/`, session adapters, orchestration scripts | TUI/daemon, tmux/worktree orchestration, harness-specific runners | Alpha |
## What Travels Unchanged
@@ -55,6 +57,50 @@ Each harness has different loading and enforcement behavior:
Adapters should stay thin. The shared behavior belongs in `skills/`, `rules/`, `hooks/`, `scripts/`, and `mcp-configs/`.
## Shared Memory Contract
ECC Memory Vault is the common knowledge-transfer surface for Claude, Codex,
Hermes, Cursor, OpenCode, and other agents. It stores portable
`ecc.memory.v1` Markdown documents in three scopes:
- project: `<repo>/.ecc/memory/project/`
- team: `<repo>/.ecc/memory/team/`
- user: `~/.ecc/memory/`
Every harness must use the same repository working directory or the same
`ECC_MEMORY_PROJECT_ROOT` and `ECC_MEMORY_USER_ROOT` overrides. The deterministic
`ecc memory` CLI is the baseline interface. Harnesses with MCP support may
instead launch `ecc-memory-mcp` and use `memory_save`, `memory_search`,
`memory_read`, and `memory_doctor`. Normal search recall is active-only across
`project` and `team`; a direct ID read can inspect a non-active entry, and
`user` must be requested explicitly. The CLI target flag is a caller-selected
routing filter, not an authorization boundary.
The MCP server is opt-in. Its reference entry lives in
`mcp-configs/mcp-servers.json`; it is intentionally absent from the default
`.mcp.json` so installations do not silently gain a writable context surface
or pay its tool-schema cost. Each MCP process requires a lowercase
`ECC_MEMORY_HARNESS`; this server-bound identity supplies the source harness
and target filter, so a tool caller cannot select another identity. User-scope
MCP access remains blocked unless the operator launches the process with
`ECC_MEMORY_ALLOW_USER_SCOPE=1`.
The trust boundary is consistent across every adapter:
- all first-release vault entries are create-only and always `unreviewed`;
- recalled memory is data, not executable instruction;
- known secret-shaped writes are rejected as a best-effort backstop, and
readers do not follow symlinks;
- project-scope writes stop if the vault's protective `.gitignore` is altered;
- human acceptance promotes knowledge into a governed repository artifact; it
never turns memory frontmatter into a self-asserted approval;
- active execution state remains in GitHub or Linear, not only in memory.
`skills/unified-memory/SKILL.md` owns this workflow. Codex and Cursor receive
behavior-identical packaging copies under `.agents/skills/` and
`.cursor/skills/`; Hermes can import the canonical skill. No harness owns a
separate authoritative memory store.
## Hermes Boundary
Hermes is not the public ECC runtime.
@@ -111,6 +157,7 @@ Supported today:
- Codex plugin metadata and MCP reference config
- OpenCode package/plugin surface
- Cursor-adapted rules, hooks, and skills
- file-first cross-harness memory through the CLI and opt-in MCP adapter
- `ecc2/` as an alpha Rust control plane
Still maturing:
@@ -119,7 +166,7 @@ Still maturing:
- automated skill sync into Hermes
- release packaging for `ecc2/`
- cross-harness session resume semantics
- deeper memory and operator planning layers
- optional semantic reranking and governed memory-promotion workflows
- the full platform loop where external products contribute skill packs,
gated APIs, evals, and case studies back into ECC
docs/architecture/evaluator-rag-prototype.md
+5 -4
View File
@@ -1,9 +1,10 @@
# Evaluator RAG Prototype
ECC 2.0 needs a self-improving harness loop that can learn from real work
without blindly mutating a user's Claude, Codex, OpenCode, dmux, Zed, or
terminal setup. This prototype defines the smallest read-only artifact set for
that loop.
ECC 2.0 needs an evidence-driven harness evaluation loop that can compare
operator-supplied candidates from real work without implying model learning or
blindly mutating a user's Claude, Codex, OpenCode, dmux, Zed, or terminal
setup. This prototype defines the smallest read-only artifact set for that
loop.
The fixture set lives in
[`examples/evaluator-rag-prototype/`](../../examples/evaluator-rag-prototype/).
docs/design/assets/plan-canvas-demo.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.1 MiB

docs/design/ecc-ito-compute-integration.md
+178
View File
@@ -0,0 +1,178 @@
# ECC × Itô Compute Integration
Status: **Implemented local CLI bridge; managed inference remains unavailable**
Owner: Affaan Mustafa
Updated: 2026-07-23
## Thesis
The distribution chain remains provider-neutral:
GPU compute (Itô or another selected provider)
-> any open-source model
-> model harness
-> ECC meta-harness
Itô is ECC's preferred compute sponsor, never an exclusive provider. Owned
hardware, existing clusters, and other providers remain valid.
## Implemented boundary
ECC delegates to the canonical Itô package in
`Ito-Markets/ito-cloud-runtime/cli/ito-compute-cli`. ECC does not maintain a
second API client or response schema.
The wrapper exposes only the canonical CLI's `login`, `logout`, `auth`, `find`, `status`, and `evals`
operations:
ecc ito login [--no-browser]
ecc ito logout
ecc ito auth
ecc ito find <all required RFQ constraints>
ecc ito status
ecc ito evals --cluster <id> --live-sixtytwo --nodes <list> --config-dir <dir>
The canonical MCP server exposes only `ito_auth`, `ito_find`, and `ito_status`.
ECC includes an opt-in configuration template pointing to the local built MCP
entry. It does not enable the server by default.
The former browser/manual-copy command is retired. `ecc ito login` delegates to
the canonical CLI's device authorization, which opens the Itô verification page
by default and persists a device token in macOS Keychain. `--no-browser`
suppresses that page handoff. ECC itself performs no browser automation and
stores no economic state. `ecc ito auth` is validation-only, never starts
device login, and rejects `--no-browser`.
## Local install
`ito-compute-cli` is unpublished. Install it from the canonical repository:
git clone https://github.com/Ito-Markets/ito-cloud-runtime.git
cd ito-cloud-runtime/cli/ito-compute-cli
npm ci
npm run check
Set `ECC_ITO_CLI_EXECUTABLE` to the explicit absolute built entry:
/absolute/path/to/ito-cloud-runtime/cli/ito-compute-cli/dist/bin/ito.js
ECC does not resolve the credential-bearing client through `PATH`; this avoids
forwarding authentication material to an unrelated executable with the same
name.
For MCP, configure `node` with:
/absolute/path/to/ito-cloud-runtime/cli/ito-compute-cli/dist/bin/ito-mcp.js
Device login forwards only required authorization settings, optional Itô
endpoint overrides, and the minimum process environment; it never inherits
`ITO_API_KEY`. The `auth`, `find`, and `status` commands forward `ITO_API_KEY`
directly when configured; `ITO_AUTH_MODE=legacy` is not required. Device tokens
use macOS Keychain by default. Explicit file fallback retains owner-only 0700
directory and 0600 token-file permissions. ECC does not inspect or log secrets.
## Authority and economics
- `login` starts canonical device authorization, with `--no-browser` available
when the operator does not want the CLI to open the verification page.
- `logout` revokes the current device credential and removes the local copy only
after confirmed remote revocation; a failed revocation keeps the local copy
for retry.
- `auth` validates existing credentials only.
- `find` reads live inventory and submits a live authenticated RFQ. An operator
or agent must gather every hard topology/economic constraint and obtain
explicit buyer authority before invoking it.
- `status` reads current RFQ and procurement status.
- `evals` requires both `ITO_ENABLE_SIXTYTWO_LIVE=1` and
`--live-sixtytwo`, then runs only the canonical CLI's pinned
`sixtytwo-cli==0.3.33` qualification adapter against an explicit node list
and existing absolute configuration directory. It receives no `ITO_API_KEY`
or unrelated cloud/model credentials and cannot rent, launch, recover,
repair, reset, purchase, or order resources.
- ECC returns the canonical process's stdout, stderr, and exit code unchanged.
- An inventory row or RFQ is not a capacity reservation.
- Only a non-null canonical firm quote is firm.
- After an ambiguous transport error, check `status` before repeating `find`.
- Global ECC dry-run does not create a local success result; the wrapper fails
closed without invoking the canonical CLI.
All durable RFQ, quote, procurement, and reservation state remains owned by the
Itô platform. ECC adds no shadow store.
## Unsupported in this slice
ECC exposes no quote lock, purchase, workload execution, or inference command.
Node qualification is live-only through the separately gated canonical
adapter; the ECC bridge does not expose its paper fixture mode.
Managed inference remains unavailable. ECC does not claim that Itô created a
model endpoint, deployed a workload, reserved capacity, or moved funds.
### Inference-serving contract
`skills/ito-inference` is the only canonical serving skill; `ito-serve` is
trigger language, not a second installed skill. The current ECC bridge has no
`serve` verb and rejects it before resolving or spawning the canonical client.
The canonical runtime documents `inference` only as an unsupported compatibility
probe, and MCP remains limited to auth, find, and status. Serving requests
therefore stop before login.
A future `serve` operation is not releasable until it verifies a completed
booking and fresh serving eligibility, accepts an immutable reviewed manifest,
requires a short-lived single-use confirmation bound to account, action,
manifest digest, and maximum cost, and atomically reserves a caller-provided
idempotency key. CLI arguments carry only an opaque non-authorizing confirmation
reference; bearer confirmation is resolved and consumed server-side.
Manifest handling must canonicalize the path, reject symlinks, open a regular
file without following links, validate ownership/permissions and bounded size,
and hash bytes from the opened descriptor. The digest must match the value bound
into confirmation before mutation, preventing path-swap and digest-mismatch
attacks. Authentication alone is never workload authority.
The same canonical client must expose structured, tenant-scoped status, logs,
metrics, cancel, and cleanup with bounded timeouts and revocation-aware errors.
After an ambiguous transport failure, callers reconcile by idempotency key
before retrying. ECC must never replace that control plane with root SSH, local
serving scripts, browser automation, or an unreviewed purchase endpoint.
## Skill and install shape
`skills/ito-compute/SKILL.md` is an opt-in workflow installed through:
- module: `ito-compute`
- component: `capability:ito-compute`
- profile: `full`
The skill documents the exact CLI and MCP names and the approval boundary. It
does not bundle the unpublished CLI.
## Publication blocker
The integration works from a local build. Distribution remains blocked until
`ito-compute-cli` has an approved package-publication policy and is published
or replaced by another verified distribution channel. ECC must not claim npm
availability before a registry read confirms it.
The ECC package version remains unchanged in this worktree. Its version bump,
release commit, and publication are intentionally deferred to the release owner
after review.
## Verification
The local contract suite proves:
- only the six supported operations spawn;
- RFQ arguments are forwarded without economic reinterpretation;
- only approved Itô runtime or isolated node-qualification variables cross the
process boundary;
- unsupported and dry-run paths fail before spawn;
- a missing or relative executable fails closed with local-install guidance;
- canonical output and exit status pass through unchanged;
- the skill, install manifests, npm surface, and opt-in MCP template stay
aligned.
No test in this integration invokes a live Itô API, submits an RFQ, opens a
browser, or contacts a GPU node.
docs/design/ecc-memory-vault.md
+222
View File
@@ -0,0 +1,222 @@
# ECC Memory Vault
## Capability
An operator can save, inspect, search, and hand off durable context through one
human-readable vault that Claude Code, Codex, Hermes, OpenCode, and other
harnesses can share. Project and team memories live under `.ecc/memory/`; user
memories live under `~/.ecc/memory/`. The same `ecc.memory.v1` documents are
available through the `ecc memory` CLI and an opt-in local stdio MCP server, so
knowledge transfer does not depend on email, one vendor's transcript format, or
one harness's hook support.
## Constraints
- Markdown files are the source of truth. SQLite context graphs, embeddings,
and hosted systems are indexes or adapters, never the only copy.
- A memory is context, not an instruction. Every first-release vault entry is
`trust: "unreviewed"` and cannot silently become rules, skills, or policy.
- Reviewed project standards still belong in the repository's canonical rules,
decision records, runbooks, or other governed documentation. The vault may
link to those artifacts; it does not replace them.
- The core is local-first, inspectable, and usable without a model, network,
database server, or embedding provider.
- Writes are create-only. The tool never overwrites an existing memory ID.
Supersession is represented by a new document with explicit links.
- Known credential shapes and private keys are rejected before a tool writes a
file. This scan is a best-effort backstop, not a complete secret classifier.
Memory readers do not follow symbolic links.
- Search is bounded lexical retrieval in the first release. Optional semantic
adapters may rerank results later without changing the document contract.
- Harness adapters stay thin. Shared behavior belongs in `scripts/`, `skills/`,
and the MCP server rather than separate Claude/Codex/Hermes stores.
- Procedural memory remains in rules and instincts, subject to their existing
promotion and validation gates.
### Threat boundary
The first-release runtime defends against hostile vault documents, stable
symlink/path escapes, accidental project-memory commits, cross-harness MCP
identity spoofing, known secret shapes, terminal control data, and bounded
resource exhaustion. Vault roots must remain writable only by the operator.
It is not a security boundary between concurrent processes running as the same
OS user: Node.js does not expose the directory-file-descriptor-relative
`openat2` guarantees needed to eliminate every parent-directory swap race.
Operators who need protection from a malicious local process must use separate
OS accounts, containers, or equivalent filesystem isolation.
## Implementation Contract
### Actors
- **Operator:** owns the vault, reviews files, commits team memories, and
decides when recalled context becomes governed project truth.
- **Harness agent:** writes unreviewed facts, notes, lessons, and handoffs; reads
active memories targeted to itself or all harnesses.
- **ECC CLI:** deterministic local create/read/search/doctor interface.
- **ECC Memory MCP:** stdio adapter exposing the same create/read/search/doctor
operations. It has no review or promotion tool.
- **ECC2 context graph:** optional projection populated from the Markdown
directory connector for richer relationship and session views.
### Surfaces
```text
<repo>/.ecc/memory/
├── project/
│ ├── contexts/
│ ├── decisions/
│ ├── facts/
│ ├── handoffs/
│ ├── lessons/
│ ├── notes/
│ ├── preferences/
│ └── runbooks/
└── team/
└── <same kind directories>
~/.ecc/memory/
└── <same kind directories>
```
The project scope is repo-local operator context and receives its own
fail-closed `.gitignore`: initialization and writes stop if the protection file
exists with unexpected content. The team scope is intended to be inspected by
a human before it is committed, but committed vault entries remain unreviewed
context. The user scope follows the operator across repos and is recalled only
when explicitly requested.
`ECC_MEMORY_PROJECT_ROOT` and `ECC_MEMORY_USER_ROOT` may override the two vault
locations explicitly.
### Document contract
Each memory is a Markdown file with strict JSON-valued YAML frontmatter:
```markdown
---
schema: "ecc.memory.v1"
id: "mem_20260726_01k123example"
title: "Authentication migration handoff"
kind: "handoff"
scope: "project"
trust: "unreviewed"
status: "active"
source_harness: "codex"
target_harnesses: ["claude"]
tags: ["auth", "migration"]
links: ["mem_20260725_01kolder"]
created_at: "2026-07-26T20:00:00.000Z"
updated_at: "2026-07-26T20:00:00.000Z"
---
The token rotation tests pass. The remaining task is ...
```
Required fields are schema, ID, title, kind, scope, trust, status, source
harness, targets, tags, links, and timestamps. IDs, kinds, tags, and harness
names use a bounded lowercase slug grammar. Bodies are bounded Markdown text.
Backlinks are derived from other documents' `links` fields.
### States and transitions
```text
tool save ──> active + unreviewed
│
├── human verifies evidence
│ └──> governed rule, decision record, runbook, or doc
│
└── new memory links with supersedes relation
└──> old item may be marked superseded manually
```
The initial runtime creates active, unreviewed memories only, and normal search
recall returns active entries only. A direct ID read may still retrieve a
non-active entry for inspection. Human review does not change a vault entry's
`trust` field; accepted knowledge is promoted into a governed repository
artifact. The runtime exposes no automated promotion transition. This is
intentional: a shell-capable agent cannot be treated as an independent human
approval boundary.
### Interfaces
CLI:
```text
ecc memory init [--scope project|team|user]
ecc memory save --title <text> [--body-file <path>|--stdin] [metadata flags]
ecc memory handoff --from <harness> --target <harness> --title <text> ...
ecc memory search <query> [--scope ...] [--target-harness ...] [--json]
ecc memory read <id> [--scope ...] [--json]
ecc memory doctor [--json]
```
MCP tools:
```text
memory_save
memory_search
memory_read
memory_doctor
```
The CLI searches active `project` and `team` memories by default. `user` recall
requires an explicit `--scope user`. Its `--target-harness` option is a
caller-selected routing filter, not an authorization boundary.
The MCP server requires a lowercase `ECC_MEMORY_HARNESS` identity at launch.
That server-side identity supplies `source_harness` for writes and constrains
search/read to memories targeted to that harness or `all`; clients cannot
override it in tool arguments. MCP access to `user` scope is disabled unless
the operator also sets `ECC_MEMORY_ALLOW_USER_SCOPE=1`, after which the client
must still request that scope explicitly. MCP writes always produce unreviewed
documents. Structured errors omit stack traces and secret values.
### Failure and recovery
- Invalid metadata, oversized input, duplicate IDs, suspected secrets, and path
escapes fail before writing.
- A malformed file is reported by `doctor` and excluded from search; it is
never deleted or rewritten automatically.
- Duplicate IDs and broken links are reported explicitly.
- Symlinks are skipped and reported.
- Missing vault directories are equivalent to an empty vault.
- A failed MCP request returns a bounded error and leaves existing files
unchanged.
### Observability
The first release reports operation results only. Write acknowledgements omit
the raw body and use a scope-relative vault path; only an explicit read returns
the full body. A later event-sourced ECC2 projection may record content hashes
and operation metadata, but it must not log raw memory bodies or credentials.
## Non-goals
- Building a vector database, hosted sync service, email transport, or new agent
framework.
- Importing raw Claude/Codex/Hermes transcripts automatically.
- Treating recalled memory as trusted system instructions.
- Auto-promoting memory into skills, rules, instincts, or policy.
- Replacing ECC2 sessions, the context graph, GitHub/Linear work items, or
governed project documentation.
- Solving cross-machine conflict-free replication in the first release.
## Open Questions
- Whether the team scope should gain a signed promotion manifest that points
to governed artifacts after the ECC2 append-only event substrate lands.
- Which semantic adapter should be the first optional reranker, and what offline
evaluation must beat lexical search before it becomes recommended.
- Whether SessionStart should inject links to governed project references or
keep all recall explicitly task-scoped. The first release keeps recall
explicit.
- How `.context/` worktree handoffs should materialize from vault handoffs once
the conductor fork lifecycle is stable.
## Handoff
The local file/CLI/MCP slice is implemented behind explicit CLI or MCP
activation and covered by core, schema, CLI, protocol, packaging, and
cross-harness tests. ECC2 graph sync, automatic session capture, semantic
adapters, governed-reference recall, and event-log promotion belong in
follow-up lanes after real-world retrieval evaluation.
docs/design/ecc-pro-fleet-dashboard.md
+327
View File
@@ -0,0 +1,327 @@
# ECC Pro: Hosted Multi-Repo Agent Security Posture Dashboard
> Status: draft design for review. Produced 2026-06-21 by an architecture agent grounded
> in the existing ecc-agentshield primitives. Proposes the hosted ECC Pro surface; does not
> implement it. Companion to docs/ECC-PRO-SECURITY-ROADMAP.md (the "next" flagship item).
## 1. Title, Thesis, and Wedge
ECC Pro is a hosted, authenticated, multi-repo "Sentry for agent security" surface built on top of the existing `ecc-agentshield` local CLI primitives. AgentShield already does ~30K npm downloads/month with near-zero monetization. The thesis: the continuous and fleet primitives that make a hosted product valuable already exist as local CLI building blocks (evidence packs with `bundleDigest` integrity, `operatorReadback`/`reviewItems` promotion routing, `fs.watch` drift detection, NDJSON runtime allow/block logging, baseline diffing, and policy promotion gates). The fastest path to MRR is not new science; it is hosting these primitives as authenticated multi-repo and multi-org surfaces and unifying config-scan posture with runtime telemetry over time.
The wedge: Snyk and similar SCA tools are scan-only and have no concept of agent-runtime semantics (no PreToolUse deny decisions, no MCP/hook/agent injection model, no drift-over-time on agent config). Sentry has time-series and alerting but zero security semantics; it does not know what a hardcoded `sk-ant-` key, a `Bash(*)` allow rule, or an `autoApprove` MCP server is. CodeRabbit reviews PR diffs but is point-in-time and has no fleet posture rollup or runtime block-rate trend. ECC Pro is the only surface that charts `score` trend, `drift` history, `blocked-command` rate, and `injection-attempt` rate across a fleet of repos, anchored on a security-specific rule engine (102 rules across secrets/permissions/hooks/mcp/agents) that nobody else has. AgentShield was featured at the Cerebral Valley x Anthropic Claude Code Hackathon (Feb 2026); the hosted surface is the commercial extension of that featured tooling.
## 2. Scope: Free Local-First vs Pro Hosted
The free local-first scanner stays the moat. We never paywall the scanner itself; we monetize hosting, history, and multi-repo aggregation. Local-first capability is also what produces the redacted, integrity-checked artifacts the hosted product ingests, so a strong free tier directly grows the funnel.
Free, zero-account, local-only (unchanged, MIT):
- `agentshield scan` and all 102 rules, `--format terminal|json|markdown|html|sarif`.
- `--fix`, `agentshield init`, `--opus` deep analysis (user supplies their own `ANTHROPIC_API_KEY`).
- `--evidence-pack <dir>`, `evidence-pack verify|inspect|fleet` (local fleet routing stays free).
- `--baseline`, `--save-baseline`, `agentshield baseline write`, `--gate`.
- `agentshield runtime install|status|repair`, local `runtime.ndjson` logging.
- `agentshield policy init|export|promote`, all 6 policy packs (`oss`, `team`, `enterprise`, `regulated`, `high-risk-hooks-mcp`, `ci-enforcement`).
- Local `agentshield watch` (fs.watch drift, terminal/webhook alerts).
- GitHub Action `affaan-m/agentshield@v1` (CI scanning, SARIF upload, baseline gate).
- MiniClaw local server.
Pro, hosted, account-required (the recurring-revenue surface):
- Persisted history: every scan/baseline/drift/runtime event retained and charted over time (free CLI is point-in-time and stateless on the local box).
- Multi-repo and org rollup: cross-repo posture, fleet `operatorReadback` aggregation, org-level score trend.
- Authenticated ingestion endpoints for CI scan results, `runtime.ndjson` streaming, and watch/drift events.
- Hosted dashboard frontend (posture, drift timeline, blocked-command rate, injection-attempt rate, secret-exposure events).
- Hosted alerting and routing: turn `reviewItems` into assignable tickets, deliver to Slack/Linear/GitHub via the ecc-tools GitHub App.
- RBAC, audit log, retention/compliance, SSO (Enterprise).
- Hosted policy promotion gate: org-level promotion approval workflow on top of `policy promote` `reviewItems`.
The hard line: anything that runs against local files and produces a redacted artifact stays free. Anything that stores, aggregates, charts, or routes across repos/time/people is Pro. We never require an account to find a vulnerability; we require one to track a fleet of them over time.
## 3. Architecture
The hosted backend is a thin, stateless ingestion and query layer over the existing artifact shapes. The CLI/Action/App remain the producers; the backend never re-implements scanning. It receives already-redacted artifacts (the CLI redacts paths/usernames/emails/tokens by default in `createRedactor`/`buildReplacements`) and persists summaries plus time-series rollups.
Component diagram (ASCII):
```
PRODUCERS (free, local-first, already redacted)
+-----------------------+ +------------------------+ +-------------------------+
| GitHub Action | | agentshield watch | | runtime PreToolUse hook |
| (CI scan + evidence | | (fs.watch, diffBaseline,| | (evaluateToolCall -> |
| pack, SARIF, baseline)| | DriftResult, webhook) | | runtime.ndjson) |
+-----------+-----------+ +-----------+------------+ +-----------+-------------+
| | |
| POST evidence-pack | POST drift event | POST/stream ndjson batch
| summary + manifest digest | (DriftResult) | (RuntimeLogEntry[])
v v v
+-----------------------------------------------------------------------------------+
| INGESTION GATEWAY (stateless, authenticated) |
| - API token auth + org/repo identity resolution |
| - schema validation (Zod, reuse SecurityReport / DriftResult / RuntimeLogEntry) |
| - bundleDigest re-verification, idempotency on digest |
| - reject-if-not-redacted guard (manifest.redacted must be true for hosted) |
+-----------------------------------+-----------------------------------------------+
|
+--------------------+--------------------+
v v
+-----------------------------+ +-------------------------------+
| PRIMARY STORE (Postgres) | | TIME-SERIES ROLLUP STORE |
| org, repo, scan, baseline, | | score_trend, drift_history, |
| finding, runtime_event, | rollup job | blocked_cmd_rate, |
| drift_event, policy_eval, |------------->| injection_rate, secret_events |
| evidence_pack, review_item | | (Postgres time buckets or |
+--------------+--------------+ | ClickHouse for high-volume |
| | runtime ndjson) |
| +---------------+----------------+
| |
v v
+-----------------------------------------------------------------------------------+
| QUERY API (authenticated, RBAC-filtered, multi-tenant isolated by org_id) |
+-----------------------------------+-----------------------------------------------+
|
v
+-----------------------------+ +-------------------------------------------+
| DASHBOARD FRONTEND (Next.js) | | ROUTING/ALERTS (ecc-tools GitHub App, |
| posture, trends, drift, fleet| | Slack/Linear) from reviewItems + tickets |
+-----------------------------+ +-------------------------------------------+
```
Ingestion sources and their existing producers:
- CI scan results: GitHub Action already emits the full `SecurityReport` JSON, SARIF, and an evidence pack with `manifest.json` (`bundleDigest`, per-artifact `sha256`/`bytes`) plus `ci-context.json` (`EvidencePackGitHubContext`: `repository`, `sha`, `runId`, `workflow`, `ref`, `actor`). The Action gets a new optional input `ecc-pro-ingest-url` + token; on success it POSTs the inspected pack summary (`EvidencePackInspectionResult`) and the manifest digest.
- Runtime telemetry: the PreToolUse hook (`evaluateToolCall` -> `logEvalResult`) writes `RuntimeLogEntry` lines to `.agentshield/runtime.ndjson`. A small `agentshield runtime ship` command (Pro) tails and batch-POSTs new NDJSON lines.
- Watch/drift events: `startWatcher` already computes `DriftResult` and calls `dispatchAlert`. We add a `webhook` alert target that points at the hosted ingest endpoint; the existing `formatWebhookPayload` carries `newFindings`, `resolvedFindings`, `scoreDelta`, `isRegression`, `hasCritical`.
Storage choice: Postgres (Supabase) for the relational entities and most rollups; ClickHouse only if runtime NDJSON volume per org makes per-row retention in Postgres uneconomical (runtime events are append-only and high-cardinality, which is the ClickHouse sweet spot). Default MVP is Postgres-only.
## 4. API Contract
All endpoints are authenticated with an org-scoped API token (header `Authorization: Bearer eccp_...`). Request/response shapes reuse the real field names from the CLI so the producers do not need a translation layer. Ingestion is idempotent keyed on `bundleDigest` (scans) or `(repo_id, timestamp, tool, decision)` hash (runtime).
### 4.1 Ingest a scan / evidence pack summary
`POST /v1/ingest/scan`
The body is the existing `EvidencePackInspectionResult` plus the `ci-context` summary. The backend never asks for raw evidence; it consumes the already-computed inspection summary so it can re-derive the same rollups the local `evidence-pack inspect` produces.
Request:
```json
{
"repository": "acme/agent-platform",
"bundleDigest": "sha256:9f2c...e1",
"expectedBundleDigest": "sha256:9f2c...e1",
"generatedAt": "2026-06-21T17:42:00.000Z",
"redacted": true,
"report": {
"score": { "grade": "C", "numericScore": 66 },
"findings": { "total": 29, "critical": 1, "high": 7, "medium": 8, "low": 10, "info": 3 },
"runtimeConfidence": { "active-runtime": 11, "template-example": 14, "project-local-optional": 4 }
},
"policy": { "status": "failed", "policyPack": "enterprise", "violations": 3 },
"baseline": { "status": "regressed", "newFindings": 4, "resolvedFindings": 1, "scoreDelta": -8 },
"supplyChain": { "totalPackages": 22, "riskyPackages": 2, "criticalCount": 0, "highCount": 1 },
"ciContext": {
"provider": "github-actions",
"repository": "acme/agent-platform",
"workflow": "security.yml",
"runId": "1182334455",
"sha": "4c1d9ab"
},
"remediation": { "totalFindings": 29, "autoFixable": 2, "manualReview": 7 }
}
```
Response:
```json
{
"ok": true,
"scanId": "scan_01J...",
"repoId": "repo_01H...",
"ingestedAt": "2026-06-21T17:42:03.114Z",
"deduped": false,
"rollupsUpdated": ["score_trend", "drift_history", "secret_exposure_events"]
}
```
Server-side guards: reject with `422` if `redacted !== true` (hosted tenants must never store unredacted bundles), and reject with `409 deduped` echo if `bundleDigest` already ingested for that repo. If `expectedBundleDigest` is present and differs from `bundleDigest`, mark `integrity: "mismatch"` on the stored scan.
### 4.2 Ingest runtime telemetry batch
`POST /v1/ingest/runtime`
Body is an array of the existing `RuntimeLogEntry` shape from `src/runtime/types.ts`.
Request:
```json
{
"repository": "acme/agent-platform",
"sessionId": "sess_4f8a",
"entries": [
{ "timestamp": "2026-06-21T17:50:01.002Z", "tool": "Bash", "decision": "block", "reason": "Input matches denied pattern \"rm -rf\"", "durationMs": 2 },
{ "timestamp": "2026-06-21T17:50:02.114Z", "tool": "Read", "decision": "allow", "durationMs": 1 }
]
}
```
Response:
```json
{ "ok": true, "accepted": 2, "blocked": 1, "allowed": 1, "rollupsUpdated": ["blocked_command_rate"] }
```
Note: `RuntimeLogEntry` already carries no raw input payload (only `tool`, `decision`, `reason`, `durationMs`), so runtime ingestion is safe-by-construction. We keep it that way; the hosted API must not add a raw-input field.
### 4.3 Ingest a drift event
`POST /v1/ingest/drift`
Body is the existing `DriftResult` from `src/watch/types.ts` (already what `formatWebhookPayload` emits).
Request:
```json
{
"repository": "acme/agent-platform",
"timestamp": "2026-06-21T18:01:10.000Z",
"newFindings": [ { "id": "secrets-hardcoded-anthropic", "severity": "critical", "category": "secrets", "title": "Hardcoded Anthropic API key", "file": "<target-path>/CLAUDE.md" } ],
"resolvedFindings": [],
"scoreDelta": -25,
"previousScore": 66,
"currentScore": 41,
"isRegression": true,
"hasCritical": true
}
```
Response:
```json
{ "ok": true, "driftEventId": "drift_01J...", "alertRouted": true }
```
### 4.4 Query: org fleet rollup
`GET /v1/org/{orgId}/fleet`
Response reuses the `EvidencePackFleetInspectionResult` `operatorReadback` shape so the dashboard and the existing `evidence-pack fleet` consumers share one contract:
```json
{
"ok": false,
"requiresAttention": true,
"summary": { "totalPacks": 12, "verifiedPacks": 11, "invalidPacks": 1, "critical": 2, "high": 9, "policyFailures": 3, "baselineRegressions": 2, "riskyPackages": 5 },
"operatorReadback": {
"status": "blocked",
"ready": false,
"requiresApproval": true,
"digest": "sha256:aa17...",
"reviewItemCount": 5,
"blockingItemCount": 2,
"ownerCount": 3,
"owners": ["acme/agent-platform security owner"],
"routesRequiringApproval": ["policy-review", "security-blocker"],
"approvalIds": ["agsr_2b1c8f0d9e7a4c11"],
"nextAction": "Route review items to listed owners and attach approval before promotion."
}
}
```
### 4.5 Query: per-repo posture and trend
`GET /v1/repo/{repoId}/posture?from=...&to=...&bucket=day`
Returns `score_trend`, latest `EvidencePackInspectionResult`, latest `DriftResult`, and runtime rollups for the window.
### 4.6 Query: review items (routing)
`GET /v1/repo/{repoId}/review-items`
Returns the existing `EvidencePackFleetReviewItem[]` (route, severity, priority, `approvalId`, `owner`, `evidencePaths`, `beforeState`, `afterState`, `reversibleAction`, `actions`, `recommendation`, and the Linear-friendly `ticket.externalId`). These map one-to-one to assignable hosted tickets; no new schema needed.
## 5. Data Model
Persisted relational entities (Postgres). All carry `org_id` for tenant isolation; all timestamps are ISO-8601 UTC.
- `org`: `id`, `name`, `github_org_login`, `plan` (`team` | `enterprise`), `created_at`, `sso_enabled`.
- `repo`: `id`, `org_id`, `full_name` (e.g. `acme/agent-platform`), `github_repo_id` (from `EvidencePackGitHubContext.repositoryId`), `default_provider` (`github-actions` | `local`), `created_at`.
- `scan`: `id`, `repo_id`, `bundle_digest` (unique per repo, idempotency key), `generated_at`, `redacted`, `grade`, `numeric_score`, `score_breakdown` (jsonb: secrets/permissions/hooks/mcp/agents), `total_findings`, `critical/high/medium/low/info`, `provider`, `ci_sha`, `ci_run_id`, `ci_workflow`, `integrity` (`ok` | `mismatch`).
- `finding`: `id`, `scan_id`, `finding_key` (the `Finding.id`, e.g. `mcp-risky-filesystem`), `severity`, `category` (`FindingCategory`), `title`, `file` (already redacted to `<target-path>` form), `runtime_confidence` (`RuntimeConfidence`), `fingerprint` (reuse `fingerprintFinding` so the same finding across scans collapses to one timeline). Never store `evidence` raw for hosted; store only the redacted `file` and `title`.
- `baseline`: `id`, `repo_id`, `baseline_timestamp`, `numeric_score`, `finding_count`, `source_scan_id`. Mirrors `SerializedBaseline` (`version`, `timestamp`, `score`, `findings` with `fingerprint`).
- `baseline_comparison`: `id`, `repo_id`, `scan_id`, `is_regression`, `new_findings_count`, `resolved_findings_count`, `unchanged_count`, `score_delta`, `new_critical_count`, `new_high_count` (the `BaselineComparison` shape).
- `runtime_event`: `id`, `repo_id`, `session_id`, `timestamp`, `tool`, `decision` (`allow` | `block`), `reason`, `duration_ms` (the `RuntimeLogEntry` shape; high-volume, candidate for ClickHouse).
- `drift_event`: `id`, `repo_id`, `timestamp`, `score_delta`, `previous_score`, `current_score`, `is_regression`, `has_critical`, `new_findings` (jsonb summary), `resolved_findings` (jsonb summary) (the `DriftResult` shape).
- `policy_eval`: `id`, `scan_id`, `policy_name`, `policy_pack` (`PolicyPack`), `passed`, `violation_count`, `score`, `min_score`, `exception_summary` (jsonb: `total`/`active`/`expiringSoon`/`expired` from `PolicyExceptionSummary`). Mirrors `PolicyEvaluation`.
- `evidence_pack`: `id`, `scan_id`, `bundle_digest`, `expected_bundle_digest`, `artifact_count`, `verified_artifact_count`, `redacted`, `generated_at`. Mirrors `EvidencePackInspectionResult`.
- `review_item`: `id`, `repo_id`, `approval_id` (the `agsr_...` id), `route` (`EvidencePackFleetRoute`), `severity`, `priority`, `owner`, `recommendation`, `ticket_external_id`, `status` (`open` | `approved` | `dismissed`), `assignee`. Mirrors `EvidencePackFleetReviewItem`.
Time-series rollups to chart (materialized from the entities above, bucketed by hour/day/week):
- `score_trend`: per repo and org-aggregate `numeric_score` and `grade` over time (from `scan.numeric_score`). The headline chart.
- `drift_history`: count and severity of `drift_event` regressions over time, with `score_delta` band. Answers "is this repo's agent posture decaying?".
- `blocked_command_rate`: `runtime_event` where `decision = block` over total, per tool, over time. The "Sentry-style" live signal nobody else has.
- `injection_attempt_rate`: count of blocked runtime events whose `reason` matches injection deny patterns, plus scan findings with `category = injection`, over time.
- `secret_exposure_events`: timeline of `finding` rows with `category = secrets` and `severity = critical` (e.g. `secrets-hardcoded-*`), de-duplicated by `fingerprint`, so a recurring committed key shows as one persistent event until resolved.
- `cross_repo_org_rollup`: org-level fold of `score_trend`, open `review_item` count by `route`, `policyFailures`, and `baselineRegressions` (the `EvidencePackFleetSummary` fields), feeding the `operatorReadback.status` badge at org scope.
## 6. Auth Model
Identity and tenancy:
- Org is the top-level tenant, anchored to a GitHub org login (the ecc-tools GitHub App install scope is the natural onboarding boundary). `repo` rows are children of exactly one `org`; `github_repo_id` from `EvidencePackGitHubContext.repositoryId` is the stable external key.
- Multi-tenant isolation: every row carries `org_id`. On Supabase Postgres, enforce Row Level Security so every query is filtered by the caller's `org_id`; the query API never accepts a client-supplied `org_id` that is not in the caller's token claims. No cross-org joins exist in any query path.
API tokens:
- Org-scoped ingestion tokens (`eccp_...`) are minted per org and optionally per repo. Tokens are hashed at rest (store only a SHA-256 of the token, never the token), shown once on creation. CI uses a repo-scoped token in GitHub Actions secrets; runtime/watch shippers use the same.
- Tokens have a `scope` (`ingest:scan`, `ingest:runtime`, `ingest:drift`, `read`) so a CI token cannot read the dashboard API and a read token cannot write.
RBAC tiers (per org):
- `owner`: billing, SSO config, token management, member management, policy promotion approval.
- `admin`: token management, review-item assignment, alert routing config.
- `member`: view all posture, assign review items to self, comment.
- `viewer`: read-only posture and trends (auditor / buyer-review persona).
Prohibited handling (hard requirements, enforced server-side):
- Never store raw secrets. The CLI already redacts paths, usernames, emails, and token-shaped strings by default via `createRedactor`/`buildReplacements` (covers `sk-`, `gh*_`, `github_pat_`, `glpat-`, `npm_`, `AKIA`, JWT `eyJ...`, Slack tokens, emails, etc.). The ingestion gateway must reject any scan payload where `manifest.redacted` / `redacted` is not `true`. Preserve redaction end-to-end; the hosted store only ever holds the `<redacted-token>` / `<target-path>` / `<home>` / `<user>` forms.
- `runtime_event` ingestion accepts only the `RuntimeLogEntry` fields (`tool`, `decision`, `reason`, `durationMs`); it must not accept raw tool `input`. The local `ToolCall.input` stays local.
- Remediation plans and baselines already omit raw evidence and before/after token-shaped strings; preserve that omission in the hosted projection. Findings stored hosted carry redacted `file` + `title` + `fingerprint` only, never raw `evidence`.
- Audit log: every token mint/revoke, review-item state change, and policy promotion approval is appended to an immutable per-org audit trail (defense-in-depth, least-privilege, secure-by-default).
## 7. MVP vs v2 vs v3 (Build Order)
MVP (smallest shippable Pro v1) -- "history + multi-repo posture for CI scans":
1. Org/repo model, GitHub App (ecc-tools) install -> org/repo provisioning, org-scoped ingest tokens with RLS isolation.
2. `POST /v1/ingest/scan` consuming `EvidencePackInspectionResult` + `ci-context`; persist `scan`, `finding`, `evidence_pack`, `policy_eval`, `baseline_comparison`; idempotent on `bundleDigest`; reject-if-not-redacted guard.
3. GitHub Action gets `ecc-pro-ingest-url` + token inputs; on scan it POSTs the inspected summary.
4. Dashboard v1: `score_trend` chart, per-repo finding table (severity + `runtimeConfidence` filter), org fleet table reusing `operatorReadback.status`.
5. Stripe billing, Team plan ($19/seat/mo per the existing ecc-tools Pro listing), per-org token quota.
This is shippable because it only stitches existing artifacts to storage + a chart. No new scanning logic.
v2 -- "runtime telemetry + drift over time + routing":
6. `POST /v1/ingest/runtime` + `agentshield runtime ship` shipper; `runtime_event` store; `blocked_command_rate` and `injection_attempt_rate` charts.
7. `POST /v1/ingest/drift` + `watch` webhook target -> hosted; `drift_history` chart; `secret_exposure_events` timeline.
8. `review_item` ingestion + assignable tickets, alert routing to Slack/Linear/GitHub via ecc-tools App, reusing `approvalId` and `ticket.externalId` for dedupe.
v3 -- "Enterprise governance":
9. Hosted policy promotion gate: org approval workflow on top of `policy promote` `reviewItems`; required approvals before `operatorReadback.ready`.
10. SSO/SAML, custom retention, audit-log export, per-org data residency; ClickHouse migration for runtime events if volume warrants.
## 8. Pricing and Packaging Hooks
- Team ($19/seat/mo, matches the current ecc-tools Pro listing): per-seat billing; included repo cap (e.g. 25 repos); 90-day history retention; scan + drift ingestion; Slack/GitHub routing; standard RBAC (owner/admin/member/viewer).
- Enterprise (per-repo or platform-fee, sales-assisted): metered by `repo` count rather than seats because security platform value scales with fleet size, not headcount; unlimited seats; SSO/SAML; unlimited retention + audit-log export; hosted policy promotion approval gate; `regulated`/`enterprise` policy packs with required-approval enforcement; data residency.
Gating levers (what flips Team -> Enterprise): runtime telemetry retention window, number of repos under management, SSO requirement, policy-promotion approval workflow, audit-log export, and `routesRequiringApproval` enforcement (Enterprise can require that `operatorReadback.requiresApproval` blocks promotion; Team only surfaces it). Per-seat captures small teams; per-repo captures the platform-team buyer whose value is fleet breadth.
## 9. Risks and Open Questions
Risks:
- Cannibalization: a too-generous hosted free tier could erode the local moat, or a too-aggressive paywall could stall the 30K/mo funnel. Mitigation: never paywall detection; only paywall persistence/aggregation/routing.
- Redaction trust boundary: the hosted product's entire safety story depends on the CLI redactor being complete. A new token format the regex set misses would be ingested unredacted. Mitigation: reject-if-not-redacted is necessary but not sufficient; add a server-side secondary redaction pass over inbound `title`/`file`/`reason` strings as defense-in-depth, and keep `buildReplacements` patterns under test.
- Runtime volume economics: `runtime.ndjson` can be high-cardinality per active agent; Postgres retention could get expensive. Mitigation: pre-aggregate to `blocked_command_rate` rollups on ingest and retain raw `runtime_event` only for the plan's window (ClickHouse for Enterprise).
- Idempotency edge: `bundleDigest` excludes `manifest.json` and `README.md` (`BUNDLE_DIGEST_EXCLUDED_FILES`), so two scans with identical findings but different `generatedAt` produce the same digest. That is correct for dedupe but means we must key the time-series on `generatedAt`/`ci_run_id`, not on digest alone.
Open questions:
- Should drift/runtime ingestion from purely local `watch`/runtime (no CI, `provider: "local"`) be allowed for Pro, given there is no GitHub-verifiable repo identity? Proposal: allow it but tag `provider: local` and require a repo-scoped token bound at mint time to a `full_name`.
- Do we attribute runtime events to a GitHub identity (`ci-context.actor`) for per-developer block-rate, or keep them repo-anonymous for privacy? Leaning repo-anonymous by default with opt-in actor attribution.
- Is org identity strictly GitHub-org-bound, or do we need a GitHub-independent org for GitLab/local-only users in v2? MVP is GitHub-org-bound via the ecc-tools App.
- For the `injection_attempt_rate` chart, do we trust runtime `reason` string matching, or do we need a structured `matchedRule` field shipped from `EvalResult` (which has `matchedRule`) instead of only `RuntimeLogEntry` (which drops it)? Proposal: extend the runtime shipper to include `matchedRule` so injection attribution is structured, not string-parsed.
Relevant grounding files (all absolute):
- `agentshield/src/evidence-pack/index.ts` (`EvidencePackInspectionResult`, `EvidencePackFleetOperatorReadback`, `EvidencePackFleetReviewItem`, `bundleDigest`, `BUNDLE_DIGEST_EXCLUDED_FILES`, `createRedactor`, `buildReplacements`)
- `agentshield/src/runtime/types.ts` (`RuntimeLogEntry`, `EvalResult`, `RuntimePolicy`) and `agentshield/src/runtime/evaluator.ts` (`evaluateToolCall`, `logEvalResult`)
- `agentshield/src/watch/types.ts` (`DriftResult`, `WatchConfig`) and `agentshield/src/watch/index.ts` (`formatWebhookPayload`, `dispatchAlert`)
- `agentshield/src/baseline/types.ts` (`SerializedBaseline`, `SerializedFinding`, `BaselineComparison`) and `agentshield/src/baseline/index.ts` (`fingerprintFinding`)
- `agentshield/src/policy/types.ts` (`PolicyEvaluation`, `PolicyPack`, `PolicyExceptionSummary`)
- `agentshield/src/types.ts` (`Finding`, `RuntimeConfidence`, `FindingCategory`, `SecurityReport`, `SecurityScore`)
- `agentshield/README.md` (GitHub Action inputs/outputs, ecc-tools GitHub App, `ecc-agentshield` npm, ECC Tools Pro $19/seat/mo)
docs/design/plan-canvas.md
+120
View File
@@ -0,0 +1,120 @@
# Plan Canvas — interactive plan review in the browser
Status: implemented (`feat/plan-canvas`)
Inspired by: [lavish-axi](https://github.com/kunchenguid/lavish-axi) by @kunchenguid, the
idea of a local, annotate-and-chat review loop over agent-generated artifacts. Plan Canvas is
an original, ECC-native implementation of that idea, not a port.
![Plan Canvas reviewing a plan on the left while the agent works in the terminal on the right](assets/plan-canvas-demo.png)
## Problem
`/plan` ends with a hard gate: the agent writes `.claude/plans/{name}.plan.md` and WAITS for
the user to confirm. Today that review happens as a wall of markdown in the terminal, and the
feedback loop is "retype what you want changed in chat." The community has asked for the same
loop lavish-axi popularized: see the plan rendered properly, point at the part you mean, and
talk to the agent from the page.
## What it is
A loopback-only web editor for plan artifacts (and any local HTML artifact):
- The agent runs `node scripts/plan-canvas.js open <artifact>` after writing a plan.
- The artifact opens in the browser inside ECC-styled chrome (same design tokens as
`scripts/dashboard-web.js`): dark-first, `--accent #6885e8`, accent→pink brand gradient,
light theme toggle.
- The human reviews visually, clicks elements or selects text to attach numbered annotations,
and chats with the agent from a side rail.
- Plan-specific verdict actions — **Approve plan** / **Request changes** — map directly onto
`/plan`'s CONFIRM gate, so approval can happen from the canvas instead of the terminal.
- The agent blocks on `node scripts/plan-canvas.js await <artifact>` (long poll). Feedback
arrives as JSON on stdout: chat messages, annotations with CSS-selector + text-range
anchors, verdicts, or session-end.
- The agent replies with `await --reply "..."`, which appears in the canvas chat; edits to the
artifact file live-reload the page.
## How it fits ECC
| Piece | Location | Follows |
|---|---|---|
| CLI entry | `scripts/plan-canvas.js` (+ npm bin `ecc-plan-canvas`) | `scripts/control-pane.js` |
| Server | `scripts/lib/plan-canvas/server.js` | control-pane loopback server, host-header + Origin allowlist (DNS-rebinding guard) |
| Editor chrome | `scripts/lib/plan-canvas/ui.js` | `scripts/lib/control-pane/ui.js`, tokens from `scripts/dashboard-web.js` |
| Markdown plan renderer | `scripts/lib/plan-canvas/markdown.js` | zero new deps; renders the `commands/plan.md` artifact schema (tables, tasks, code fences, Mermaid blocks) |
| Mermaid diagrams | `scripts/lib/plan-canvas/ui.js` | ` ```mermaid ` blocks render in the browser, themed to ECC; pinned CDN with offline fallback (`ECC_PLAN_CANVAS_MERMAID_URL` for a local mirror) |
| Session state | `scripts/lib/plan-canvas/sessions.js` | file-path-keyed sessions, state under `~/.claude/plan-canvas/` (`ECC_PLAN_CANVAS_STATE_DIR` override) |
| Skill | `skills/plan-canvas/SKILL.md` | skills-first surface; teaches the open → await → reply loop; defers visual guidance to `frontend-design-direction`, `artifact-design`, `dataviz` |
| Command shim | `commands/plan-canvas.md` | legacy parity surface, points at the skill |
| `/plan` pointer | `commands/plan.md` | after writing the artifact, offer canvas review |
| Hook (optional) | `scripts/hooks/plan-canvas-sessions.js`, `SessionStart` | surfaces open canvas sessions so a fresh session can resume a review |
| Tests | `tests/lib/plan-canvas/*`, `tests/integration/plan-canvas-e2e.test.js` | node:test-style plain assert, run by `tests/run-all.js` |
Registration: `package.json` (`bin`, `files[]`), `manifests/install-components.json`
(+ `install-modules.json` workflow-quality paths), `agent.yaml` skills list, catalog +
command-registry regeneration.
## Cross-harness / model compatibility
The feature is model- and harness-agnostic by construction: the CLI emits plain JSON and the
skill teaches a shell-plus-stdout loop, so any capable agent drives it identically — the same
"just a CLI" thesis lavish-axi uses. There is no Claude-only dependency in the core loop; the
`SessionStart` hook is an additive Claude Code convenience (other harnesses see open sessions
from a bare `ecc-plan-canvas` invocation).
Surfaces mirror how peer workflow-quality skills ship across ECC's harnesses:
- `skills/plan-canvas/` — canonical (Claude Code and the installer's per-target adapters).
- `.agents/skills/plan-canvas/` (+ `agents/openai.yaml` interface manifest) — Codex, alongside
`tdd-workflow`, `e2e-testing`, `verification-loop`.
- `agent.yaml` skills list — the Codex gitagent manifest.
- The CLI resolves from any project via the `ecc-plan-canvas` bin (global/plugin install) or
`$CLAUDE_PLUGIN_ROOT/scripts/plan-canvas.js`, never a cwd-relative path.
Cursor's checked-in subset is content/marketing skills only, so — matching peers — plan-canvas
is not added there; the installer still places it for Cursor from the canonical `skills/`.
## Protocol
Sessions are keyed by canonical artifact path (`sha256(realpath)[:12]`). The CLI talks to a
detached server (`server.json` in the state dir records pid/port/version; idle self-shutdown
after 30 min, `ECC_PLAN_CANVAS_IDLE_MS`). Feedback is deliver-and-drain: queued items are
handed to exactly one `await` call and persisted to disk until then, so nothing is lost if
the poll is interrupted.
- `GET /health` — `{ok, app: "ecc-plan-canvas", version}` (CLI/server version handshake)
- `GET /` — session list (ECC chrome)
- `POST /api/sessions` `{file, reopen?}` — open/resume; `409 user-ended` unless `reopen`
- `GET /canvas/<key>` — editor chrome; `GET /artifact/<key>/` — rendered artifact
(markdown → ECC plan template, HTML passthrough) with the annotation SDK injected;
sibling assets confined to the artifact directory
- `POST /api/session/<key>/feedback` `{items[], endSession?}` — browser queues
chat / annotation / verdict items
- `GET /api/await?file=<path>[&timeoutMs=n]` — agent long-poll (whitespace heartbeat);
returns `{status: feedback|ended|waiting|missing, items[], sessionEnded?, endedBy?}`
- `POST /api/session/<key>/reply` `{text}` — agent message → canvas chat
- `POST /api/session/<key>/end` (user) / `POST /api/end` `{file}` (agent) — ender recorded;
user ends are sticky: plain `open` refuses to reopen without `--reopen`
- `GET /events/<key>` — SSE to the browser: `chat-sync`, `presence`
(waiting/listening/working), `reload` (artifact file changed), `ended`
## Deliberate differences from lavish-axi
- Plan-first: renders `.plan.md` / `.md` natively (including Mermaid); lavish is HTML-only.
- Verdict actions wired to ECC's plan-confirmation workflow.
- ECC design tokens and chrome; JSON (not TOON) agent output.
- Mermaid renders themed to ECC, but without lavish's pan/zoom or node-id capture —
whole-element annotation covers pointing at a diagram or node.
- No export/share hosting, no layout-audit gate, no bundled playbooks — ECC's existing
design skills (`frontend-design-direction`, `artifact-design`, `dataviz`) cover authoring.
## Security posture
Loopback bind only by default; Host and Origin allowlist checks on every request (same
approach as control-pane); artifact served only from registered session paths with
sibling-asset access confined to the artifact directory; state dir is user-local. The server
never executes artifact content — it only serves it to the browser.
The one optional outbound request is the pinned Mermaid library, fetched by the browser only
for artifacts that contain a diagram; it renders with `securityLevel: 'strict'`, degrades to
showing diagram source if unavailable, and can be repointed at a local mirror via
`ECC_PLAN_CANVAS_MERMAID_URL`. The server itself still makes no network calls.
docs/es/README.md
+6 -9
View File
@@ -757,16 +757,13 @@ cp -r rules/golang ~/.claude/rules/ecc/
cp -r rules/php ~/.claude/rules/ecc/
cp -r rules/arkts ~/.claude/rules/ecc/
# Copiar skills primero (superficie principal de flujo de trabajo)
# Recomendado (nuevos usuarios): solo skills generales/básicas
mkdir -p ~/.claude/skills/ecc
cp -r .agents/skills/* ~/.claude/skills/ecc/
cp -r skills/search-first ~/.claude/skills/ecc/
# Instalar skills con el instalador consciente de migraciones.
# Conserva skills del usuario, informa conflictos y evita sobrescribirlos.
node scripts/install-apply.js --target claude --modules workflow-quality
# Opcional: añadir skills específicas de framework solo cuando las necesites
# for s in django-patterns django-tdd laravel-patterns springboot-patterns quarkus-patterns; do
# cp -r skills/$s ~/.claude/skills/ecc/
# done
# Opcional: instalar skills concretas solo cuando las necesites.
node scripts/install-apply.js --target claude --skills search-first
# node scripts/install-apply.js --target claude --skills django-patterns,django-tdd
# Opcional: mantener compatibilidad con entradas slash durante la migración
mkdir -p ~/.claude/commands
docs/es/rules/common/git-workflow.md
+1 -1
View File
@@ -9,7 +9,7 @@
Tipos: feat, fix, refactor, docs, test, chore, perf, ci
Nota: Atribución deshabilitada globalmente mediante ~/.claude/settings.json.
Nota: Las instalaciones gestionadas por ECC configuran `"includeCoAuthoredBy": false` en `~/.claude/settings.json`, por lo que los commits no incluyen `Co-Authored-By` de forma predeterminada. Para conservar la atribución de Claude, configure `"includeCoAuthoredBy": true` o `attribution`; ECC nunca sobrescribe una elección explícita.
## Flujo de Trabajo de Pull Request
docs/es/rules/common/performance.md
+2 -2
View File
@@ -7,12 +7,12 @@
- Programación en pareja y generación de código
- Agentes workers en sistemas multi-agente
**Sonnet 4.6** (Mejor modelo para codificación):
**Sonnet 5** (Mejor modelo para codificación):
- Trabajo de desarrollo principal
- Orquestación de flujos de trabajo multi-agente
- Tareas de codificación complejas
**Opus 4.5** (Razonamiento más profundo):
**Opus 5** (Razonamiento más profundo):
- Decisiones arquitectónicas complejas
- Requisitos de razonamiento máximo
- Tareas de investigación y análisis
docs/es/skills/quarkus-verification/SKILL.md
+1 -1
View File
@@ -179,7 +179,7 @@ mvn quarkus:list-extensions
### OWASP ZAP (Pruebas de Seguridad de API)
```bash
docker run -t owasp/zap2docker-stable zap-api-scan.py \
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
-t http://localhost:8080/q/openapi \
-f openapi
```
docs/examples/project-guidelines-template.md
+1 -1
View File
@@ -161,7 +161,7 @@ async def analyze_with_claude(content: str) -> AnalysisResult:
client = Anthropic()
response = client.messages.create(
model="claude-sonnet-4-5-20250514",
model="claude-sonnet-5",
max_tokens=1024,
messages=[{"role": "user", "content": content}],
tools=[{
docs/ja-JP/commands/auto-update.md
+1 -1
View File
@@ -11,7 +11,7 @@ ECCをアップストリームリポジトリから更新し、元のインス
```bash
# 何も変更せずに更新をプレビュー
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot({probe:p.join('scripts','auto-update.js')})}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/auto-update.js" --dry-run
# 現在のプロジェクトのCursor管理ファイルのみ更新
docs/ja-JP/commands/instinct-status.md
+1 -1
View File
@@ -18,7 +18,7 @@ command: true
残っているときに発生するパスの分岐を回避します (#2037)。
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
python3 "$ECC_ROOT/skills/continuous-learning-v2/scripts/instinct-cli.py" status
```
docs/ja-JP/commands/skill-health.md
+3 -3
View File
@@ -13,21 +13,21 @@ command: true
ダッシュボードモードでスキルヘルスCLIを実行:
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/skills-health.js" --dashboard
```
特定のパネルのみ:
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/skills-health.js" --dashboard --panel failures
```
機械読み取り可能な出力:
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/skills-health.js" --dashboard --json
```
docs/ja-JP/rules/common/git-workflow.md
+1 -1
View File
@@ -10,7 +10,7 @@
タイプ: feat, fix, refactor, docs, test, chore, perf, ci
注記: Attribution は ~/.claude/settings.json でグローバルに無効化されています。
注記: ECC が管理するインストールは `~/.claude/settings.json` に `"includeCoAuthoredBy": false` を設定するため、コミットには既定で `Co-Authored-By` が付きません。Claude の属性を残す場合は `"includeCoAuthoredBy": true` または `attribution` を設定してください。ECC は明示的な設定を上書きしません。
## Pull Request ワークフロー
docs/ja-JP/rules/common/performance.md
+2 -2
View File
@@ -7,12 +7,12 @@
- ペアプログラミングとコード生成
- マルチ agent システムのワーカー agent
**Sonnet 4.6**（最高のコーディングモデル）:
**Sonnet 5**（最高のコーディングモデル）:
- メイン開発作業
- マルチ agent ワークフローのオーケストレーション
- 複雑なコーディングタスク
**Opus 4.6**（最も深い推論）:
**Opus 5**（最も深い推論）:
- 複雑なアーキテクチャの意思決定
- 最大限の推論要件
- 調査と分析タスク
docs/ja-JP/skills/clickhouse-io/SKILL.md
+46 -41
View File
@@ -151,39 +151,43 @@ ORDER BY market_id, date;
### 一括挿入（推奨）
```typescript
import { ClickHouse } from 'clickhouse'
import { createClient } from '@clickhouse/client'
const clickhouse = new ClickHouse({
url: process.env.CLICKHOUSE_URL,
port: 8123,
basicAuth: {
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
}
const clickhouse = createClient({
url: process.env.CLICKHOUSE_URL ?? 'http://localhost:8123',
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
})
// PASS: バッチ挿入（効率的）
async function bulkInsertTrades(trades: Trade[]) {
const values = trades.map(trade => `(
'${trade.id}',
'${trade.market_id}',
'${trade.user_id}',
${trade.amount},
'${trade.timestamp.toISOString()}'
)`).join(',')
await clickhouse.query(`
INSERT INTO trades (id, market_id, user_id, amount, timestamp)
VALUES ${values}
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: trades.map(trade => ({
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
})),
format: 'JSONEachRow'
})
}
// FAIL: 個別挿入（低速）
async function insertTrade(trade: Trade) {
// ループ内でこれをしないでください！
await clickhouse.query(`
INSERT INTO trades VALUES ('${trade.id}', ...)
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: [{
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
}],
format: 'JSONEachRow'
})
}
```
@@ -191,17 +195,14 @@ async function insertTrade(trade: Trade) {
```typescript
// 継続的なデータ取り込み用
import { createWriteStream } from 'fs'
import { pipeline } from 'stream/promises'
import { Readable } from 'node:stream'
async function streamInserts() {
const stream = clickhouse.insert('trades').stream()
for await (const batch of dataSource) {
stream.write(batch)
}
await stream.end()
async function streamInserts(dataSource: AsyncIterable<Record<string, unknown>>) {
await clickhouse.insert({
table: 'trades',
values: Readable.from(dataSource, { objectMode: true }),
format: 'JSONEachRow'
})
}
```
@@ -386,14 +387,18 @@ pgClient.query('LISTEN market_updates')
pgClient.on('notification', async (msg) => {
const update = JSON.parse(msg.payload)
await clickhouse.insert('market_updates', [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
])
await clickhouse.insert({
table: 'market_updates',
values: [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
],
format: 'JSONEachRow'
})
})
```
docs/ja-JP/skills/configure-ecc/SKILL.md
+139 -267
View File
@@ -1,313 +1,185 @@
---
name: configure-ecc
description: Everything Claude Code のインタラクティブなインストーラー — スキルとルールの選択とインストールをユーザーレベルまたはプロジェクトレベルのディレクトリへガイドし、パスを検証し、必要に応じてインストールされたファイルを最適化します。
description: Claude Code、Codex、Kimi 内で ECC のインストール、更新、再設定を案内し、各ハーネスが実際に備えるプラグイン、スコープ、フック機能を守ります。
metadata:
origin: ECC
---
# Configure Everything Claude Code (ECC)
# Everything Claude Code の設定
Everything Claude Code プロジェクトのインタラクティブなステップバイステップのインストールウィザードです。`AskUserQuestion` を使用してスキルとルールの選択的インストールをユーザーにガイドし、正確性を検証し、最適化を提供します。
現在のハーネス内で対話式ウィザードを実行します。最初にインベントリを調べ、対応する選択肢だけを
収集し、プレビュー後に 1 回だけ確認し、非対話で適用・検証します。ウェルカム表示は成功後だけです。
ECC を一時ディレクトリへ clone したり、プラグインを手作業でコピーしたりしないでください。
## 起動タイミング
ユーザー自身が操作するターミナルの正規エントリは `ecc setup` と `npx ecc-universal setup` です。
ハーネス内では、代わりに以下の明示的な非対話コマンドを使います。
- ユーザーが "configure ecc"、"install ecc"、"setup everything claude code" などと言った場合
- ユーザーがこのプロジェクトからスキルまたはルールを選択的にインストールしたい場合
- ユーザーが既存の ECC インストールを検証または修正したい場合
- ユーザーがインストールされたスキルまたはルールをプロジェクト用に最適化したい場合
## 現在のハーネスで分岐
## 前提条件
- Claude Code では、以下の完全なスコープ/フックウィザードを使います。
- Codex では Codex ネイティブのプラグインライフサイクルを使います。Claude のスコープを提示したり、
Claude の ECC フック 4 段階を Codex に対応付けたりしません。
- Kimi ではプロジェクトサーフェスを `./.kimi-code` に導入します。Kimi は ECC の Claude ライフサイクル
フックプロファイルに対応しません。
- ハーネスを特定できない場合は、検出根拠を示し、変更コマンドの前に対象を質問します。
このスキルは起動前に Claude Code からアクセス可能である必要があります。ブートストラップには2つの方法があります：
1. **プラグイン経由**: `/plugin install ecc@ecc` — プラグインがこのスキルを自動的にロードします
2. **手動**: このスキルのみを `~/.claude/skills/configure-ecc/SKILL.md` にコピーし、"configure ecc" と言って起動します
このスキルは導入後の再設定経路です。プロバイダー組み込みの初回導入 UI を横取り、または代替できません。
---
## Claude Code: 完全な対話式ウィザード
## ステップ 0: ECC リポジトリのクローン
### 1. 変更せずにインベントリを確認
インストールの前に、最新の ECC ソースを `/tmp` にクローンします：
両方のコマンドを実行し、ECC の導入スコープ、有効状態、marketplace ソースを要約します。
```bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code
claude plugin list --json
claude plugin marketplace list --json
```
以降のすべてのコピー操作のソースとして `ECC_ROOT=/tmp/everything-claude-code` を設定します。
`ecc@ecc` が 1 つのみ既存する場合は再設定として扱います。Claude が所有する
"Open home page" コントロールをインストールの根拠にしません。setup が複数の ECC スコープ、
旧式/手動導入、不正な設定、marketplace 衝突を報告したら停止し、返された復旧方法を示します。
削除対象を推測しません。
クローンが失敗した場合（ネットワークの問題など）、`AskUserQuestion` を使用してユーザーに既存の ECC クローンへのローカルパスを提供するよう依頼します。
### 2. 2 つの選択だけを収集
---
スコープについて 1 回だけ質問し、必ず 1 つの値を選びます。
## ステップ 1: インストールレベルの選択
- `user | project | local`
- `user` はこのユーザーの全プロジェクトで使えます。
- `project` はリポジトリ設定で共有されます。
- `local` は現在のプロジェクトのみに非公開です。
`AskUserQuestion` を使用してユーザーにインストール先を尋ねます：
選択済みまたはインストール中の表示は、実際に選んだ 1 スコープだけにします。唯一の既存スコープと異なる
値を選んだら、スコープ移行であると説明し、以下のコマンドに `--move-scope` を含めます。
```
Question: "ECC コンポーネントをどこにインストールしますか？"
Options:
- "User-level (~/.claude/)" — "すべての Claude Code プロジェクトに適用されます"
- "Project-level (.claude/)" — "現在のプロジェクトのみに適用されます"
- "Both" — "共通/共有アイテムはユーザーレベル、プロジェクト固有アイテムはプロジェクトレベル"
```
フックモードについて 1 回だけ質問し、必ず 1 つの値を選びます。
選択を `INSTALL_LEVEL` として保存します。ターゲットディレクトリを設定します：
- User-level: `TARGET=~/.claude`
- Project-level: `TARGET=.claude`（現在のプロジェクトルートからの相対パス）
- Both: `TARGET_USER=~/.claude`、`TARGET_PROJECT=.claude`
- `off | minimal | standard | strict`
- `off` はスキルとコマンドを残し、ECC フック自動化を無効にします。
- `minimal` は最軽量のライフサイクルと安全自動化のみを有効にします。
- `standard` は品質と安全のバランスを取ります。
- `strict` は最も強いチェックとリマインダーを有効にします。
ターゲットディレクトリが存在しない場合は作成します：
```bash
mkdir -p $TARGET/skills $TARGET/rules
```
フック設定は個人の Claude プラグイン設定であり、導入スコープには追従しません。
---
### 3. プレビューし、1 回だけ確認
## ステップ 2: スキルの選択とインストール
### 2a: スキルカテゴリの選択
31個のスキルが4つのカテゴリに分類されています。`multiSelect: true` で `AskUserQuestion` を使用します：
```
Question: "どのスキルカテゴリをインストールしますか？"
Options:
- "Framework & Language" — "Django, Spring Boot, Go, Python, Java, Frontend, Backend パターン"
- "Database" — "PostgreSQL, ClickHouse, JPA/Hibernate パターン"
- "Workflow & Quality" — "TDD, 検証, 学習, セキュリティレビュー, コンパクション"
- "All skills" — "利用可能なすべてのスキルをインストール"
```
### 2b: 個別スキルの確認
選択された各カテゴリについて、以下の完全なスキルリストを表示し、ユーザーに確認または特定のものの選択解除を依頼します。リストが4項目を超える場合、リストをテキストとして表示し、`AskUserQuestion` で「リストされたすべてをインストール」オプションと、ユーザーが特定の名前を貼り付けるための「その他」オプションを使用します。
**カテゴリ: Framework & Language（20スキル）**
| スキル | 説明 |
|-------|-------------|
| `backend-patterns` | バックエンドアーキテクチャ、API設計、Node.js/Express/Next.js のサーバーサイドベストプラクティス |
| `coding-standards` | TypeScript、JavaScript、React、Node.js の汎用コーディング標準 |
| `django-patterns` | Django アーキテクチャ、DRF による REST API、ORM、キャッシング、シグナル、ミドルウェア |
| `django-security` | Django セキュリティ: 認証、CSRF、SQL インジェクション、XSS 防止 |
| `django-tdd` | pytest-django、factory_boy、モック、カバレッジによる Django テスト |
| `django-verification` | Django 検証ループ: マイグレーション、リンティング、テスト、セキュリティスキャン |
| `frontend-patterns` | React、Next.js、状態管理、パフォーマンス、UI パターン |
| `golang-patterns` | 慣用的な Go パターン、堅牢な Go アプリケーションのための規約 |
| `golang-testing` | Go テスト: テーブル駆動テスト、サブテスト、ベンチマーク、ファジング |
| `java-coding-standards` | Spring Boot 用 Java コーディング標準: 命名、不変性、Optional、ストリーム |
| `python-patterns` | Pythonic なイディオム、PEP 8、型ヒント、ベストプラクティス |
| `python-testing` | pytest、TDD、フィクスチャ、モック、パラメータ化による Python テスト |
| `quarkus-patterns` | Quarkus アーキテクチャ、Camel メッセージング、CDI サービス、Panache データアクセス |
| `quarkus-security` | Quarkus セキュリティ: JWT/OIDC、RBAC、入力バリデーション、シークレット管理 |
| `quarkus-tdd` | JUnit 5、Mockito、REST Assured、Camel テストによる Quarkus TDD |
| `quarkus-verification` | Quarkus 検証: ビルド、静的解析、テスト、ネイティブコンパイル |
| `springboot-patterns` | Spring Boot アーキテクチャ、REST API、レイヤードサービス、キャッシング、非同期 |
| `springboot-security` | Spring Security: 認証/認可、検証、CSRF、シークレット、レート制限 |
| `springboot-tdd` | JUnit 5、Mockito、MockMvc、Testcontainers による Spring Boot TDD |
| `springboot-verification` | Spring Boot 検証: ビルド、静的解析、テスト、セキュリティスキャン |
**カテゴリ: Database（3スキル）**
| スキル | 説明 |
|-------|-------------|
| `clickhouse-io` | ClickHouse パターン、クエリ最適化、分析、データエンジニアリング |
| `jpa-patterns` | JPA/Hibernate エンティティ設計、リレーションシップ、クエリ最適化、トランザクション |
| `postgres-patterns` | PostgreSQL クエリ最適化、スキーマ設計、インデックス作成、セキュリティ |
**カテゴリ: Workflow & Quality（8スキル）**
| スキル | 説明 |
|-------|-------------|
| `continuous-learning` | セッションから再利用可能なパターンを学習済みスキルとして自動抽出 |
| `continuous-learning-v2` | 信頼度スコアリングを持つ本能ベースの学習、スキル/コマンド/エージェントに進化 |
| `eval-harness` | 評価駆動開発（EDD）のための正式な評価フレームワーク |
| `iterative-retrieval` | サブエージェントコンテキスト問題のための段階的コンテキスト改善 |
| `security-review` | セキュリティチェックリスト: 認証、入力、シークレット、API、決済機能 |
| `strategic-compact` | 論理的な間隔で手動コンテキスト圧縮を提案 |
| `tdd-workflow` | 80%以上のカバレッジで TDD を強制: ユニット、統合、E2E |
| `verification-loop` | 検証と品質ループのパターン |
**スタンドアロン**
| スキル | 説明 |
|-------|-------------|
| `docs/examples/project-guidelines-template.md` | プロジェクト固有のスキルを作成するためのテンプレート |
### 2c: インストールの実行
選択された各スキルについて、正しいソースルートからスキルディレクトリ全体をコピーします：
プラグイン内蔵 setup スクリプトを優先します。2 つの選択値を代入し、スコープ移行の場合だけ
`--move-scope` を含めます。
```bash
# コアスキルは .agents/skills/ 配下にあります
cp -R "$ECC_ROOT/.agents/skills/<skill-name>" "$TARGET/skills/"
# ニッチスキルは skills/ 配下にあります
cp -R "$ECC_ROOT/skills/<skill-name>" "$TARGET/skills/"
node "$CLAUDE_PLUGIN_ROOT/scripts/setup.js" --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --dry-run --json
```
glob で取得したソースディレクトリを処理するときは、trailing slash 付きのソースをそのまま `cp` に渡さないでください。宛先名にディレクトリ名を明示します：
`$CLAUDE_PLUGIN_ROOT` がない場合は公開 npm パッケージを使います。
```bash
cp -R "${src%/}" "$TARGET/skills/$(basename "${src%/}")"
npx --yes --package ecc-universal ecc setup --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --dry-run --json
```
注: `continuous-learning` と `continuous-learning-v2` には追加ファイル（config.json、フック、スクリプト）があります — SKILL.md だけでなく、ディレクトリ全体がコピーされることを確認してください。
確認サマリーは 1 回だけ表示します。予定アクション、1 スコープ、1 フックモード、marketplace アクション、
および移行元から移行先を含め、yes/no を 1 回だけ質問します。ハーネスの Shell は通常非 TTY のため、
そこで bare な対話式 `ecc setup` を実行しません。
---
### 4. 明示した選択を適用
## ステップ 3: ルールの選択とインストール
`multiSelect: true` で `AskUserQuestion` を使用します：
```
Question: "どのルールセットをインストールしますか？"
Options:
- "Common rules (Recommended)" — "言語に依存しない原則: コーディングスタイル、git ワークフロー、テスト、セキュリティなど（8ファイル）"
- "TypeScript/JavaScript" — "TS/JS パターン、フック、Playwright によるテスト（5ファイル）"
- "Python" — "Python パターン、pytest、black/ruff フォーマット（5ファイル）"
- "Go" — "Go パターン、テーブル駆動テスト、gofmt/staticcheck（5ファイル）"
```
インストールを実行：
```bash
# 共通ルール
cp -r $ECC_ROOT/rules/common $TARGET/rules/common
# 言語固有のルール（言語別ディレクトリを保持）
cp -r $ECC_ROOT/rules/typescript $TARGET/rules/typescript # 選択された場合
cp -r $ECC_ROOT/rules/python $TARGET/rules/python # 選択された場合
cp -r $ECC_ROOT/rules/golang $TARGET/rules/golang # 選択された場合
```
**重要**: ユーザーが言語固有のルールを選択したが、共通ルールを選択しなかった場合、警告します：
> "言語固有のルールは共通ルールを拡張します。共通ルールなしでインストールすると、不完全なカバレッジになる可能性があります。共通ルールもインストールしますか？"
---
## ステップ 4: インストール後の検証
インストール後、以下の自動チェックを実行します：
### 4a: ファイルの存在確認
インストールされたすべてのファイルをリストし、ターゲットロケーションに存在することを確認します：
```bash
ls -la $TARGET/skills/
ls -la $TARGET/rules/
```
### 4b: パス参照のチェック
インストールされたすべての `.md` ファイルでパス参照をスキャンします：
```bash
grep -rn "~/.claude/" $TARGET/skills/ $TARGET/rules/
grep -rn "../common/" $TARGET/rules/
grep -rn "skills/" $TARGET/skills/
```
**プロジェクトレベルのインストールの場合**、`~/.claude/` パスへの参照をフラグします：
- スキルが `~/.claude/settings.json` を参照している場合 — これは通常問題ありません（設定は常にユーザーレベルです）
- スキルが `~/.claude/skills/` または `~/.claude/rules/` を参照している場合 — プロジェクトレベルのみにインストールされている場合、これは壊れている可能性があります
- スキルが別のスキルを名前で参照している場合 — 参照されているスキルもインストールされているか確認します
### 4c: スキル間の相互参照のチェック
一部のスキルは他のスキルを参照します。これらの依存関係を検証します：
- `django-tdd` は `django-patterns` を参照する可能性があります
- `springboot-tdd` は `springboot-patterns` を参照する可能性があります
- `continuous-learning-v2` は `~/.claude/homunculus/` ディレクトリを参照します
- `python-testing` は `python-patterns` を参照する可能性があります
- `golang-testing` は `golang-patterns` を参照する可能性があります
- 言語固有のルールは `common/` の対応物を参照します
### 4d: 問題の報告
見つかった各問題について、報告します：
1. **ファイル**: 問題のある参照を含むファイル
2. **行**: 行番号
3. **問題**: 何が間違っているか（例: "~/.claude/skills/python-patterns を参照していますが、python-patterns がインストールされていません"）
4. **推奨される修正**: 何をすべきか（例: "python-patterns スキルをインストール" または "パスを .claude/skills/ に更新"）
---
## ステップ 5: インストールされたファイルの最適化（オプション）
`AskUserQuestion` を使用します：
```
Question: "インストールされたファイルをプロジェクト用に最適化しますか？"
Options:
- "Optimize skills" — "無関係なセクションを削除、パスを調整、技術スタックに合わせて調整"
- "Optimize rules" — "カバレッジ目標を調整、プロジェクト固有のパターンを追加、ツール設定をカスタマイズ"
- "Optimize both" — "インストールされたすべてのファイルの完全な最適化"
- "Skip" — "すべてをそのまま維持"
```
### スキルを最適化する場合：
1. インストールされた各 SKILL.md を読み取ります
2. ユーザーにプロジェクトの技術スタックを尋ねます（まだ不明な場合）
3. 各スキルについて、無関係なセクションの削除を提案します
4. インストール先（ソースリポジトリではなく）で SKILL.md ファイルをその場で編集します
5. ステップ4で見つかったパスの問題を修正します
### ルールを最適化する場合：
1. インストールされた各ルール .md ファイルを読み取ります
2. ユーザーに設定について尋ねます：
- テストカバレッジ目標（デフォルト80%）
- 優先フォーマットツール
- Git ワークフロー規約
- セキュリティ要件
3. インストール先でルールファイルをその場で編集します
**重要**: インストール先（`$TARGET/`）のファイルのみを変更し、ソース ECC リポジトリ（`$ECC_ROOT/`）のファイルは決して変更しないでください。
---
## ステップ 6: インストールサマリー
`/tmp` からクローンされたリポジトリをクリーンアップします：
確認後、同じ経路を `--dry-run` なしで再実行します。全選択を明示し、JSON で成功を判定します。
```bash
rm -rf /tmp/everything-claude-code
node "$CLAUDE_PLUGIN_ROOT/scripts/setup.js" --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --yes --json
```
次にサマリーレポートを出力します：
フォールバック:
```
## ECC インストール完了
### インストール先
- レベル: [user-level / project-level / both]
- パス: [ターゲットパス]
### インストールされたスキル（[数]）
- skill-1, skill-2, skill-3, ...
### インストールされたルール（[数]）
- common（8ファイル）
- typescript（5ファイル）
- ...
### 検証結果
- [数]個の問題が見つかり、[数]個が修正されました
- [残っている問題をリスト]
### 適用された最適化
- [加えられた変更をリスト、または "なし"]
```bash
npx --yes --package ecc-universal ecc setup --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --yes --json
```
---
### 5. 検証後にウェルカムを表示
## トラブルシューティング
終了コードが 0 であり、setup 結果の `scope` と `hooks` が選択値と一致することを必須とします。
その後、独立して実行します。
### "スキルが Claude Code に認識されません"
- スキルディレクトリに `SKILL.md` ファイルが含まれていることを確認します（単なる緩い .md ファイルではありません）
- ユーザーレベルの場合: `~/.claude/skills/<skill-name>/SKILL.md` が存在するか確認します
- プロジェクトレベルの場合: `.claude/skills/<skill-name>/SKILL.md` が存在するか確認します
```bash
claude plugin list --json
```
### "ルールが機能しません"
- ルールはフラットファイルで、サブディレクトリにはありません: `$TARGET/rules/coding-style.md`（正しい） vs `$TARGET/rules/common/coding-style.md`（フラットインストールでは不正）
- ルールをインストール後、Claude Code を再起動します
選択スコープに有効な `ecc@ecc` が正確に 1 件ある場合のみ続行します。`$CLAUDE_PLUGIN_ROOT` があるときは、
成功した setup の `action`（`installed`、`updated`、`migrated`、`resumed`、
`already-migrated`）を内蔵レンダラーへ渡します。
### "プロジェクトレベルのインストール後のパス参照エラー"
- 一部のスキルは `~/.claude/` パスを前提としています。ステップ4の検証を実行してこれらを見つけて修正します。
- `continuous-learning-v2` の場合、`~/.claude/homunculus/` ディレクトリは常にユーザーレベルです — これは想定されており、エラーではありません。
呼び出し前に、プロバイダーが報告したバージョンが
`scripts/lib/terminal-welcome.js` の `ECC_VERSION_PATTERN` に一致することを
確認します。予期しない値は shell に補間せず拒否してください。
```bash
node -e 'const { renderTerminalWelcome } = require(process.env.CLAUDE_PLUGIN_ROOT + "/scripts/lib/terminal-welcome"); process.stdout.write(renderTerminalWelcome({ action: process.argv[1], version: process.argv[2], color: process.stdout.isTTY }));' "<action>" "<installed-version>"
```
ウェルカムは 1 回だけ表示します。失敗、dry-run、キャンセル、スコープ/フック不一致、検証不能の場合は
表示せず、エラーと復旧手順を報告します。検証後は `/reload-plugins` または Claude Code の再起動を案内します。
## Codex: ネイティブプラグインライフサイクル
`codex plugin marketplace list --json` と `codex plugin list --available --json` で確認します。
Codex ネイティブのプラグインコマンドには Claude 式 `user | project | local` 選択はありません。
Claude のスコープ/フック 4 段階は質問しません。Codex ネイティブプラグインはプロバイダー固有フックに対応しますが、
Codex はその明示的な信頼を求めます。Codex にその信頼判断を表示させ、Claude の 4 プロファイルが Codex に対応すると表現しません。
ECC marketplace がない場合は追加し、既存ならスナップショットを更新します。
```bash
codex plugin marketplace add affaan-m/ECC
codex plugin marketplace upgrade ecc --json
```
1 回だけ確認し、インストールまたは導入済みキャッシュの再現可能な更新を行い、検証します。
```bash
codex plugin add ecc@ecc --json
codex plugin list --json
```
JSON が ECC を導入済みと報告し、`installedPath` を提供した場合のみ続行し、検証済みバンドルからウェルカムを表示します。
`installedPath` は Codex JSON が返した絶対パスそのものだけを使い、制御文字を
拒否します。バージョンは `ECC_VERSION_PATTERN` で検証します。`node` を次の
argument array で直接呼び出してください。これは shell コマンドではなく、ツール API 呼び出しです。
```text
["<installedPath>/scripts/welcome.js", "--action", "configured", "--version", "<installed-version>"]
```
現在のハーネスが実行ファイルと argument array を分けて渡せない場合は、ウェルカム表示を
スキップします。Codex JSON の値から shell コマンドを組み立ててはいけません。
Claude の `off | minimal | standard | strict` が Codex に適用されたとは表現しません。
## Kimi: プロジェクトサーフェス
確認前に機能サマリーを示します。導入先は `./.kimi-code`、ECC ライフサイクルフックは
`hooks=unsupported` です。Claude のスコープ/フックモードを質問しません。まずプレビューします。
```bash
npx --yes --package ecc-universal ecc install --profile core --target kimi --dry-run
```
このプロジェクト導入先について 1 回だけ確認し、`--dry-run` を除いた同一コマンドを適用します。
検証コマンド:
```bash
npx --yes --package ecc-universal ecc doctor --target kimi
```
doctor が成功し、導入された指示とスキルが `./.kimi-code` 内に留まることを確認した後だけ実行します。
```bash
npx --yes --package ecc-universal ecc welcome --action configured
```
Kimi が ECC ライフサイクルフックを導入または設定したとは表現しません。
docs/ja-JP/skills/cost-aware-llm-pipeline/SKILL.md
+1 -1
View File
@@ -22,7 +22,7 @@ origin: ECC
シンプルなタスクには自動的に安価なモデルを選択し、複雑なタスクのために高価なモデルを予約します。
```python
MODEL_SONNET = "claude-sonnet-4-6"
MODEL_SONNET = "claude-sonnet-5"
MODEL_HAIKU = "claude-haiku-4-5-20251001"
_SONNET_TEXT_THRESHOLD = 10_000 # 文字数
docs/ja-JP/skills/django-verification/SKILL.md
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: django-verification
description: Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR.
description: "Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR."
---
# Django 検証ループ
docs/ja-JP/skills/gan-style-harness/SKILL.md
+13 -13
View File
@@ -37,7 +37,7 @@ This is the same dynamic as GANs (Generative Adversarial Networks): the Generato
```
┌─────────────┐
│ PLANNER │
│ (Opus 4.6) │
│ (Sonnet) │
└──────┬──────┘
│ Product Spec
│ (features, sprints, design direction)
@@ -49,14 +49,14 @@ This is the same dynamic as GANs (Generative Adversarial Networks): the Generato
│ │
│ ┌──────────┐ │
│ │GENERATOR │--build-->│──┐
│ │(Opus 4.6)│ │ │
│ │ (Sonnet) │ │ │
│ └────▲─────┘ │ │
│ │ │ │ live app
│ feedback │ │
│ │ │ │
│ ┌────┴─────┐ │ │
│ │EVALUATOR │<-test----│──┘
│ │(Opus 4.6)│ │
│ │ (Sonnet) │ │
│ │+Playwright│ │
│ └──────────┘ │
│ │
@@ -76,7 +76,7 @@ This is the same dynamic as GANs (Generative Adversarial Networks): the Generato
- Is deliberately **ambitious** — conservative planning leads to underwhelming results
- Produces evaluation criteria that the Evaluator will use later
**Model:** Opus 4.6 (needs deep reasoning for spec expansion)
**Model:** Sonnet by default; raise via `GAN_PLANNER_MODEL=opus` for deeper spec expansion
### 2. Generator Agent
@@ -89,7 +89,7 @@ This is the same dynamic as GANs (Generative Adversarial Networks): the Generato
- Manages git for version control between iterations
- Reads Evaluator feedback and incorporates it in next iteration
**Model:** Opus 4.6 (needs strong coding capability)
**Model:** Sonnet by default; raise via `GAN_GENERATOR_MODEL=opus` for maximum coding capability
### 3. Evaluator Agent
@@ -106,7 +106,7 @@ This is the same dynamic as GANs (Generative Adversarial Networks): the Generato
- Returns structured feedback with scores and specific issues
- Is engineered to be **ruthlessly strict** — never praises mediocre work
**Model:** Opus 4.6 (needs strong judgment + tool use)
**Model:** Sonnet by default; raise via `GAN_EVALUATOR_MODEL=opus` for stronger judgment + tool use
## Evaluation Criteria
@@ -178,16 +178,16 @@ GAN_EVAL_CRITERIA="functionality,performance,security" \
```bash
# Step 1: Plan
claude -p --model opus "You are a Product Planner. Read PLANNER_PROMPT.md. Expand this brief into a full product spec: 'Build a Kanban board app'. Write spec to spec.md"
claude -p --model sonnet "You are a Product Planner. Read PLANNER_PROMPT.md. Expand this brief into a full product spec: 'Build a Kanban board app'. Write spec to spec.md"
# Step 2: Generate (iteration 1)
claude -p --model opus "You are a Generator. Read spec.md. Implement Sprint 1. Start the dev server on port 3000."
claude -p --model sonnet "You are a Generator. Read spec.md. Implement Sprint 1. Start the dev server on port 3000."
# Step 3: Evaluate (iteration 1)
claude -p --model opus --allowedTools "Read,Bash,mcp__playwright__*" "You are an Evaluator. Read EVALUATOR_PROMPT.md. Test the live app at http://localhost:3000. Score against the rubric. Write feedback to feedback-001.md"
claude -p --model sonnet --allowedTools "Read,Bash,mcp__playwright__*" "You are an Evaluator. Read EVALUATOR_PROMPT.md. Test the live app at http://localhost:3000. Score against the rubric. Write feedback to feedback-001.md"
# Step 4: Generate (iteration 2 — reads feedback)
claude -p --model opus "You are a Generator. Read spec.md and feedback-001.md. Address all issues. Improve the scores."
claude -p --model sonnet "You are a Generator. Read spec.md and feedback-001.md. Address all issues. Improve the scores."
# Repeat steps 3-4 until pass threshold met
```
@@ -224,9 +224,9 @@ The harness should simplify as models improve. Following Anthropic's evolution:
|----------|---------|-------------|
| `GAN_MAX_ITERATIONS` | `15` | Maximum generator-evaluator cycles |
| `GAN_PASS_THRESHOLD` | `7.0` | Weighted score to pass (1-10) |
| `GAN_PLANNER_MODEL` | `opus` | Model for planning agent |
| `GAN_GENERATOR_MODEL` | `opus` | Model for generator agent |
| `GAN_EVALUATOR_MODEL` | `opus` | Model for evaluator agent |
| `GAN_PLANNER_MODEL` | `sonnet` | Model for planning agent |
| `GAN_GENERATOR_MODEL` | `sonnet` | Model for generator agent |
| `GAN_EVALUATOR_MODEL` | `sonnet` | Model for evaluator agent |
| `GAN_EVAL_CRITERIA` | `design,originality,craft,functionality` | Comma-separated criteria |
| `GAN_DEV_SERVER_PORT` | `3000` | Port for the live app |
| `GAN_DEV_SERVER_CMD` | `npm run dev` | Command to start dev server |
docs/ja-JP/skills/gateguard/SKILL.md
+2 -2
View File
@@ -52,7 +52,7 @@ MultiEdit is handled identically — each file in the batch is gated individuall
```
Before editing {file_path}, present these facts:
1. List ALL files that import/require this file (use Grep)
1. List ALL files that import/require this file (search the tree — Glob/Grep, or find/grep via Bash)
2. List the public functions/classes affected by this change
3. If this file reads/writes data files, show field names, structure,
and date format (use redacted or synthetic values, not raw production data)
@@ -65,7 +65,7 @@ Before editing {file_path}, present these facts:
Before creating {file_path}, present these facts:
1. Name the file(s) and line(s) that will call this new file
2. Confirm no existing file serves the same purpose (use Glob)
2. Confirm no existing file serves the same purpose (search the tree — Glob/Grep, or find/grep via Bash)
3. If this file reads/writes data files, show field names, structure,
and date format (use redacted or synthetic values, not raw production data)
4. Quote the user's current instruction verbatim
docs/ja-JP/skills/golang-patterns/SKILL.md
+2 -1
View File
@@ -615,7 +615,8 @@ linters-settings:
errcheck:
check-type-assertions: true
govet:
check-shadowing: true
enable:
- shadow
issues:
exclude-use-default: false
docs/ja-JP/skills/project-guidelines-example/SKILL.md
+8 -1
View File
@@ -1,3 +1,10 @@
---
name: project-guidelines-example
description: Project-specific skill template covering architecture, patterns, testing, and deployment guidance.
metadata:
origin: ECC
---
# プロジェクトガイドラインスキル（例）
これはプロジェクト固有のスキルの例です。自分のプロジェクトのテンプレートとして使用してください。
@@ -159,7 +166,7 @@ async def analyze_with_claude(content: str) -> AnalysisResult:
client = Anthropic()
response = client.messages.create(
model="claude-sonnet-4-5-20250514",
model="claude-sonnet-5",
max_tokens=1024,
messages=[{"role": "user", "content": content}],
tools=[{
docs/ja-JP/skills/quarkus-verification/SKILL.md
+6 -5
View File
@@ -186,7 +186,7 @@ mvn quarkus:list-extensions
### OWASP ZAP (API Security Testing)
```bash
docker run -t owasp/zap2docker-stable zap-api-scan.py \
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
-t http://localhost:8080/q/openapi \
-f openapi
```
@@ -436,16 +436,16 @@ jobs:
verify:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v7
- name: Set up JDK 21
uses: actions/setup-java@v3
uses: actions/setup-java@v5
with:
java-version: '21'
distribution: 'temurin'
- name: Cache Maven packages
uses: actions/cache@v3
uses: actions/cache@v6
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -460,8 +460,9 @@ jobs:
run: mvn org.owasp:dependency-check-maven:check
- name: Upload Coverage
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@v7
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: target/site/jacoco/jacoco.xml
```
docs/ja-JP/skills/returns-reverse-logistics/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: returns-reverse-logistics
description: 返品承認、受取・検品、処分決定、返金処理、不正検出、保証クレーム管理のための標準化された専門知識。15年以上の経験を持つ返品オペレーションマネージャーの知見に基づく。段階的フレームワーク、処分経済性、不正パターン認識、ベンダー回収プロセスを含む。製品返品、逆物流、返金決定、返品不正検出、保証クレームを扱う場合に使用。license: Apache-2.0
description: 返品承認、受取・検品、処分決定、返金処理、不正検出、保証クレーム管理のための標準化された専門知識。15年以上の経験を持つ返品オペレーションマネージャーの知見に基づく。段階的フレームワーク、処分経済性、不正パターン認識、ベンダー回収プロセスを含む。製品返品、逆物流、返金決定、返品不正検出、保証クレームを扱う場合に使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/ja-JP/skills/springboot-verification/SKILL.md
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: springboot-verification
description: Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.
description: "Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR."
---
# Spring Boot 検証ループ
docs/ja-JP/skills/strategic-compact/SKILL.md
+3 -1
View File
@@ -29,7 +29,9 @@ description: 任意の自動コンパクションではなく、タスクフェ
## フック設定
`~/.claude/settings.json`に追加：
**プラグインとしてインストール済みの場合**：設定は不要です。プラグインの `hooks/hooks.json` が既に `suggest-compact.js` を登録しています（フック ID `pre:edit-write:suggest-compact`、`standard` と `strict` フックプロファイルで有効）。下のブロックを `~/.claude/settings.json` にコピーしないでください — プラグインインストールでは `~/.claude/scripts/` は存在せず、プラグインフックを重複させると二重実行になります。
**手動インストール**（`./install.sh`）の場合、`~/.claude/settings.json` に追加：
```json
{
docs/ja-JP/skills/swiftui-patterns/SKILL.md
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: swiftui-patterns
description: @Observableを使用した状態管理、ビュー合成、ナビゲーション、パフォーマンス最適化、モダンなiOS/macOS UIのベストプラクティスを備えたSwiftUIアーキテクチャパターン。
description: "@Observableを使用した状態管理、ビュー合成、ナビゲーション、パフォーマンス最適化、モダンなiOS/macOS UIのベストプラクティスを備えたSwiftUIアーキテクチャパターン。"
---
# SwiftUI パターン
docs/ja-JP/skills/token-budget-advisor/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: token-budget-advisor
description: 回答する前に、どれだけの回答深度を消費するかについてユーザーに情報に基づいた選択を提供する。ユーザーが回答の長さ、深さ、またはトークンバジェットを明示的に制御したい場合にこのスキルを使用する。トリガー条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"、またはユーザーが回答のサイズや深さの制御を明示的に求めるその他の明確なバリエーション。トリガーしない条件：ユーザーが現在のセッションでレベルを指定済み（そのレベルを維持）、リクエストが明らかに一言の回答、または「token」が認証/セッション/支払いトークンを指している。origin: community
description: 回答する前に、どれだけの回答深度を消費するかについてユーザーに情報に基づいた選択を提供する。ユーザーが回答の長さ、深さ、またはトークンバジェットを明示的に制御したい場合にこのスキルを使用する。トリガー条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"、またはユーザーが回答のサイズや深さの制御を明示的に求めるその他の明確なバリエーション。トリガーしない条件：ユーザーが現在のセッションでレベルを指定済み（そのレベルを維持）、リクエストが明らかに一言の回答、または「token」が認証/セッション/支払いトークンを指している。
origin: community
---
# トークンバジェットアドバイザー（TBA）
docs/ja-JP/skills/verification-loop/SKILL.md
+7
View File
@@ -1,3 +1,10 @@
---
name: verification-loop
description: A comprehensive verification system for Claude Code sessions.
metadata:
origin: ECC
---
# 検証ループスキル
Claude Codeセッション向けの包括的な検証システム。
docs/ko-KR/rules/git-workflow.md
+1 -1
View File
@@ -9,7 +9,7 @@
타입: feat, fix, refactor, docs, test, chore, perf, ci
참고: 어트리뷰션 비활성화 여부는 각자의 `~/.claude/settings.json` 로컬 설정에 따라 달라질 수 있습니다.
참고: ECC가 관리하는 설치는 `~/.claude/settings.json`에 `"includeCoAuthoredBy": false`를 설정하므로 커밋에 기본적으로 `Co-Authored-By`가 붙지 않습니다. Claude 표기를 유지하려면 `"includeCoAuthoredBy": true`를 설정하거나 `attribution`을 구성하세요. ECC는 명시적인 선택을 덮어쓰지 않습니다.
## Pull Request 워크플로우
docs/ko-KR/rules/performance.md
+2 -2
View File
@@ -7,12 +7,12 @@
- 페어 프로그래밍과 코드 생성
- 멀티 에이전트 시스템의 워커 에이전트
**Sonnet 4.6** (최고의 코딩 모델):
**Sonnet 5** (최고의 코딩 모델):
- 주요 개발 작업
- 멀티 에이전트 워크플로우 오케스트레이션
- 복잡한 코딩 작업
**Opus 4.6** (가장 깊은 추론):
**Opus 5** (가장 깊은 추론):
- 복잡한 아키텍처 의사결정
- 최대 추론 요구사항
- 리서치 및 분석 작업
docs/ko-KR/skills/clickhouse-io/SKILL.md
+46 -38
View File
@@ -161,36 +161,43 @@ ORDER BY market_id, date;
### 배치 삽입 (권장)
```typescript
import { ClickHouse } from 'clickhouse'
import { createClient } from '@clickhouse/client'
const clickhouse = new ClickHouse({
url: process.env.CLICKHOUSE_URL,
port: 8123,
basicAuth: {
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
}
const clickhouse = createClient({
url: process.env.CLICKHOUSE_URL ?? 'http://localhost:8123',
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
})
// PASS: 배치 삽입 (효율적)
async function bulkInsertTrades(trades: Trade[]) {
const rows = trades.map(trade => ({
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
}))
await clickhouse.insert('trades', rows)
await clickhouse.insert({
table: 'trades',
values: trades.map(trade => ({
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
})),
format: 'JSONEachRow'
})
}
// FAIL: 개별 삽입 (느림)
async function insertTrade(trade: Trade) {
// 루프 안에서 이렇게 하지 마세요!
await clickhouse.query(`
INSERT INTO trades VALUES ('${trade.id}', ...)
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: [{
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
}],
format: 'JSONEachRow'
})
}
```
@@ -198,17 +205,14 @@ async function insertTrade(trade: Trade) {
```typescript
// 연속적인 데이터 수집용
import { createWriteStream } from 'fs'
import { pipeline } from 'stream/promises'
import { Readable } from 'node:stream'
async function streamInserts() {
const stream = clickhouse.insert('trades').stream()
for await (const batch of dataSource) {
stream.write(batch)
}
await stream.end()
async function streamInserts(dataSource: AsyncIterable<Record<string, unknown>>) {
await clickhouse.insert({
table: 'trades',
values: Readable.from(dataSource, { objectMode: true }),
format: 'JSONEachRow'
})
}
```
@@ -404,14 +408,18 @@ pgClient.query('LISTEN market_updates')
pgClient.on('notification', async (msg) => {
const update = JSON.parse(msg.payload)
await clickhouse.insert('market_updates', [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
])
await clickhouse.insert({
table: 'market_updates',
values: [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
],
format: 'JSONEachRow'
})
})
```
docs/ko-KR/skills/golang-patterns/SKILL.md
+2 -1
View File
@@ -617,7 +617,8 @@ linters-settings:
errcheck:
check-type-assertions: true
govet:
check-shadowing: true
enable:
- shadow
issues:
exclude-use-default: false
docs/ko-KR/skills/strategic-compact/SKILL.md
+9 -9
View File
@@ -38,21 +38,21 @@ origin: ECC
## Hook 설정
`~/.claude/settings.json`에 추가합니다:
**플러그인으로 설치한 경우**: 별도 설정이 필요 없습니다. 플러그인의 `hooks/hooks.json`이 이미 `suggest-compact.js`를 등록합니다(훅 ID `pre:edit-write:suggest-compact`, `standard` 및 `strict` 훅 프로파일에서 활성). 아래 블록을 `~/.claude/settings.json`에 복사하지 마세요 — 플러그인 설치에는 `~/.claude/scripts/`가 존재하지 않으며, 플러그인 훅을 중복하면 이중 실행이 발생합니다(`${CLAUDE_PLUGIN_ROOT}`는 사용자 `settings.json`에서 해석되지 않습니다).
**수동 설치**(`./install.sh`)인 경우 `~/.claude/settings.json`에 추가합니다:
```json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Edit|Write",
"hooks": [
{
"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/run-with-flags.js\" \"pre:edit-write:suggest-compact\" \"scripts/hooks/suggest-compact.js\" \"standard,strict\""
}
],
"description": "Suggest manual compaction at logical intervals"
"matcher": "Edit",
"hooks": [{ "type": "command", "command": "node ~/.claude/scripts/hooks/suggest-compact.js" }]
},
{
"matcher": "Write",
"hooks": [{ "type": "command", "command": "node ~/.claude/scripts/hooks/suggest-compact.js" }]
}
]
}
docs/pt-BR/README.md
+5 -1
View File
@@ -79,7 +79,11 @@ Este repositório contém apenas o código. Os guias explicam tudo.
## O Que Há de Novo
### v2.0.0 — O Sistema Operacional do Harness de Agentes (Jun 2026)
### v2.2.0 — Instalação Guiada para Múltiplos Harnesses (Ago 2026)
Adiciona uma instalação revisável para Claude Code, Codex e Kimi Code, com uma entrada de comando npm sincronizada.
### v2.1.0 — O Sistema Operacional do Harness de Agentes (Jun 2026)
Graduação estável da linha 2.0: 261 skills, substrato de control-pane, inventário MCP, serviço de ciclo de vida de worktrees e a comunidade no [Discord](https://discord.gg/36yGMHGFbR).
docs/pt-BR/rules/git-workflow.md
+1 -1
View File
@@ -9,7 +9,7 @@
Tipos: feat, fix, refactor, docs, test, chore, perf, ci
Nota: Atribuição desabilitada globalmente via ~/.claude/settings.json.
Nota: As instalações gerenciadas pelo ECC definem `"includeCoAuthoredBy": false` em `~/.claude/settings.json`, portanto os commits não incluem `Co-Authored-By` por padrão. Para manter a atribuição do Claude, defina `"includeCoAuthoredBy": true` ou configure `attribution`; o ECC nunca sobrescreve uma escolha explícita.
## Fluxo de Trabalho de Pull Request
docs/pt-BR/rules/performance.md
+2 -2
View File
@@ -7,12 +7,12 @@
- Programação em par e geração de código
- Agentes worker em sistemas multi-agente
**Sonnet 4.6** (Melhor modelo para codificação):
**Sonnet 5** (Melhor modelo para codificação):
- Trabalho principal de desenvolvimento
- Orquestrando fluxos de trabalho multi-agente
- Tarefas de codificação complexas
**Opus 4.6** (Raciocínio mais profundo):
**Opus 5** (Raciocínio mais profundo):
- Decisões arquiteturais complexas
- Requisitos máximos de raciocínio
- Pesquisa e análise
docs/releases/2.1.0/assets/ecc-plan-canvas-demo.gif
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 698 KiB

docs/releases/2.1.0/assets/ecc-plan-canvas-demo.mp4
BIN
View File
Binary file not shown.
docs/releases/2.1.0/assets/ecc-plan-canvas-demo.webm
BIN
View File
Binary file not shown.
docs/releases/2.1.0/plan-canvas-demo.plan.md
+77
View File
@@ -0,0 +1,77 @@
# ECC: The Agent Harness Operating System
> Plan artifact · generated by `/ecc:plan` · review in Plan Canvas, then approve to begin
## What ECC installs into your agent
Your agent can already write code. ECC gives it an engineering system: it plans
before it builds, verifies with tests, reviews its own work from a fresh context,
and turns repeated wins into reusable skills.
```mermaid
flowchart LR
P[Plan] --> T[Test first] --> I[Implement] --> R[Review] --> V[Verify]
V --> M[Remember] --> S[Improve skills] -.-> P
style P fill:#6885e8,color:#fff
style V fill:#6885e8,color:#fff
```
## How the pieces fit
| Concept | What it does | Context behavior |
|---|---|---|
| Skills | Reusable workflows: TDD, security review, deep research | Loaded when the task needs them |
| Agents | Scoped workers with their own context and tool permissions | Isolate planning, implementation, review |
| Rules | Durable project or language standards | Always loaded, so install selectively |
| Hooks | Scripts triggered by harness events | Run outside the model context |
| Instincts | Patterns learned from real sessions | Recalled when relevant |
```mermaid
flowchart TB
subgraph Harness["Any harness: Claude Code · Codex · Kimi · Cursor · OpenCode"]
A[Your agent]
end
subgraph ECC["ECC"]
SK[279 skills] --- AG[67 agents]
RU[Rules] --- HO[Hooks]
ME[Memory + instincts] --- AS[AgentShield]
end
A --> SK
A --> AG
```
## The review gate you are using right now
`/plan` ends with a hard confirmation gate. Plan Canvas moves that gate from a
wall of terminal markdown to this page. Point at the part you mean, annotate
it, and approve from here.
```mermaid
sequenceDiagram
participant U as You (browser)
participant C as Plan Canvas
participant A as Agent (terminal)
A->>C: open plan-canvas-demo.plan.md
U->>C: annotate "Split phase 2"
C->>A: feedback JSON
A->>C: revised plan (live-reload)
U->>C: Approve plan
C->>A: verdict: approve
A->>A: begin implementation
```
## Rollout tasks
- [x] Plan Canvas: annotate, chat, approve from the browser
- [x] Kimi Code install target with Moonshot AI
- [x] Verified self-host path on Itô GPUs
- [ ] Ship ECC 2.1 release + announcement
- [x] Demo video (you are watching it)
## Risks
| Risk | Mitigation |
|---|---|
| Plans reviewed as walls of text get skimmed | Canvas renders diagrams + anchored annotations |
| Same context writes and reviews code | Fresh-context reviewer agents |
| Harness config trusted by default | AgentShield scans the harness itself |
docs/releases/2.1.0/release-notes.md
+68
View File
@@ -0,0 +1,68 @@
# ECC 2.1.0: Plan Canvas, Kimi Harness, and Self-Hosted Compute
ECC 2.1 turns plan review into a visual loop and opens the harness to self-hosted models. Plan Canvas lets you review agent plans in the browser. Point at the part you mean instead of retyping it in chat. A new Kimi Code install target and a verified Itô GPU path make ECC + open-source models a first-class setup, backed by our public sponsors: Moonshot AI (Kimi), Itô, and Atlas Cloud.
## Plan Canvas: review plans by pointing, not retyping
![Plan Canvas demo: reviewing an ECC plan, attaching an annotation, chatting with the agent, and approving the plan](assets/ecc-plan-canvas-demo.gif)
[Download the MP4 demo](assets/ecc-plan-canvas-demo.mp4)
`/plan` ends with a confirm gate, and until now that review was a wall of markdown in the terminal. Now the agent opens the plan in a loopback-only browser canvas:
- Click elements or select text to attach numbered annotations
- Chat with the agent from a side rail while it works in the terminal
- **Approve plan** / **Request changes** buttons map directly onto `/plan`'s CONFIRM gate
- Mermaid diagrams, tables, and task lists render natively; file edits live-reload the page
- Model- and harness-agnostic: a plain CLI + JSON protocol (`ecc-plan-canvas`), no Claude-only dependency
## Kimi harness: Moonshot AI partnership
ECC now installs directly into [Kimi Code](https://moonshotai.github.io/kimi-cli/) (`--target kimi`). Kimi Code discovers the installed `.kimi/AGENTS.md` instructions and `.kimi/skills/` workflows natively:
```bash
bash ./install.sh --target kimi --profile minimal
npx ecc doctor --target kimi
kimi
```
## Self-host on Itô GPUs
Run ECC against any self-hosted open-source model. If you need GPU capacity, [Itô](https://compute.itomarkets.com) is ECC's preferred compute sponsor. The integration shipped guarded end to end:
- `ecc ito find`: opt-in bridge to the canonical Itô CLI that submits a live, authenticated RFQ (it does not reserve capacity)
- Guarded live node qualification and read-only compute handoff
- Credential-bearing CLI shims are rejected outright
The sponsorship link itself is passive: it does not invoke an RFQ, reserve capacity, provision compute, or configure serving. Managed inference through Itô is not live yet. Any GPU provider works, and ECC stays provider-agnostic.
## Partners
[Moonshot AI (Kimi)](https://www.moonshot.ai), [Itô](https://compute.itomarkets.com), and [Atlas Cloud](https://www.atlascloud.ai) are now public sponsors of ECC. The README documents a recommended self-host path: Itô for GPU capacity, a Kimi checkpoint served behind a compatible endpoint, then Kimi Code + ECC on top. Each choice remains separate and swappable.
## Also in 2.1
- **Hermes and OpenClaw install targets**: two more harnesses join Claude Code, Codex, OpenCode, Cursor, Gemini, Zed, Copilot, and Kimi
- **Codex ECC navigation guide**: find the right skill/command surface from inside Codex
- **GateGuard path exemptions** (`GATEGUARD_EXEMPT_GLOBS`) and configurable instinct injection (count + confidence threshold)
- **PostToolUse hooks consolidated** into sync/async dispatchers, with fewer processes per tool call
- **Supply-chain hardening**: the installer runtime passes strict vetting, and the pre-commit secret scan now catches Anthropic API keys (`sk-ant-...`)
- A long tail of community fixes across OpenCode, Windows, bun lockfiles, the dashboard, and project detection
The catalog now stands at **67 agents, 281 skills, and 94 command shims** (2.0.0 shipped 64/261/84), plus hooks, rules, memory, continuous learning, and AgentShield.
## Install or upgrade
```text
/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@ecc
```
Existing installs: `/plugin update ecc`
## Community
Join the ECC community for release announcements, questions, and Show and Tell:
<https://discord.gg/36yGMHGFbR>
Full changelog: <https://github.com/affaan-m/ECC/compare/v2.0.0...v2.1.0>
docs/testing/ecc-ito-real-cli-bridge.tdd.md
+80
View File
@@ -0,0 +1,80 @@
# ECC × Itô Real CLI Bridge — TDD Evidence
Date: 2026-08-05
Source plan: requirements were derived from the approved implementation
handoff. No external plan file was executed.
## User journeys
1. As an ECC operator, I can explicitly invoke streaming device `login`, then
use validation-only `auth`, `find`, and `status`, or revoke the device with
`logout`, without a duplicate client.
2. As a security reviewer, I can prove unsupported operations, missing local
installs, and ECC dry-run requests fail before any child process or network
operation.
3. As an agent-harness user, I can install one truthful skill that names only
the real CLI commands and MCP tools.
## RED evidence
Before production changes:
```text
node tests/scripts/ito-cli-bridge.test.js
Passed: 13
Failed: 8
node tests/ci/ito-compute-skill.test.js
Passed: 2
Failed: 3
```
The failures captured the old combined auth/login surface, legacy-mode API-key
gate, buffered login output, and stale help, skill, MCP, and integration wording.
## GREEN evidence
```text
node tests/scripts/ito-cli-bridge.test.js
Passed: 21
Failed: 0
node tests/ci/ito-compute-skill.test.js
Passed: 5
Failed: 0
node scripts/ci/validate-skills.js
Validated 281 skill directories
```
`node tests/scripts/ito-compute-sponsor.test.js` reached 11 passes and 2 failures;
both failures are setup failures because the current worktree lacks `ajv`.
`node scripts/ci/validate-install-manifests.js` is blocked by the same missing
module. No dependency installation was performed.
## Test specification
| Guarantee | Test | Type | Result |
|---|---|---|---|
| `login`, `logout`, `auth`, `find`, and `status` forward only their reviewed surfaces | `tests/scripts/ito-cli-bridge.test.js` | end-to-end process contract | PASS |
| Login output streams before completion and its exit status propagates | `tests/scripts/ito-cli-bridge.test.js` | async process contract | PASS |
| `auth --no-browser` fails before spawn | `tests/scripts/ito-cli-bridge.test.js` | negative process contract | PASS |
| Full RFQ arguments cross unchanged | `tests/scripts/ito-cli-bridge.test.js` | integration | PASS |
| Login scrubs the API key; auth/find/status forward it directly; evals stays isolated | `tests/scripts/ito-cli-bridge.test.js` | security integration | PASS |
| Unsupported and dry-run operations fail before spawn | `tests/scripts/ito-cli-bridge.test.js` | negative end-to-end | PASS |
| Missing/relative executables fail with exact local guidance | `tests/scripts/ito-cli-bridge.test.js` | negative end-to-end | PASS |
| Child output and exit code are preserved | `tests/scripts/ito-cli-bridge.test.js` | end-to-end process contract | PASS |
| Skill, package, manifests, and MCP template agree | `tests/ci/ito-compute-skill.test.js` | repository contract | PASS |
## Known gaps
- No live Itô API, RFQ, browser, GPU node, or paid operation was invoked.
- No live GPU qualification was performed.
- The CLI remains locally built and unpublished.
## Merge evidence
No TDD checkpoint commits were created because the implementation handoff
explicitly prohibited commits. The working-tree diff and this report preserve
the RED/GREEN evidence instead.
docs/tr/AGENTS.md
+5 -5
View File
@@ -1,8 +1,8 @@
# Everything Claude Code (ECC) — Agent Talimatları
Bu, yazılım geliştirme için 28 özel agent, 116 skill, 59 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
Bu, yazılım geliştirme için 68 özel agent, 287 skill, 94 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**.
**Sürüm:** 2.0.0
**Sürüm:** 2.2.0
## Temel İlkeler
@@ -141,9 +141,9 @@ Başarısızlık sorunlarını giderin: test izolasyonunu kontrol edin → mockl
## Proje Yapısı
```
agents/ — 28 özel subagent
skills/ — 115 iş akışı skillleri ve alan bilgisi
commands/ — 59 slash command
agents/ — 68 özel subagent
skills/ — 287 iş akışı skillleri ve alan bilgisi
commands/ — 94 slash command
hooks/ — Tetikleyici tabanlı otomasyonlar
rules/ — Her zaman uyulması gereken kurallar (ortak + dile özel)
scripts/ — Platformlar arası Node.js yardımcı programları
docs/tr/README.md
+5 -1
View File
@@ -79,7 +79,11 @@ Bu repository yalnızca ham kodu içerir. Rehberler her şeyi açıklıyor.
## Yenilikler
### v2.0.0 — Ajan Harness İşletim Sistemi (Haz 2026)
### v2.2.0 — Rehberli Çoklu Harness Kurulumu (Ağu 2026)
Claude Code, Codex ve Kimi Code için incelenebilir çoklu harness kurulumu ve eşitlenmiş npm komut girişi eklendi.
### v2.1.0 — Ajan Harness İşletim Sistemi (Haz 2026)
2.0 hattının kararlı sürümü: 261 skill, control-pane altyapısı, MCP envanteri, worktree yaşam döngüsü servisi ve [Discord topluluğu](https://discord.gg/36yGMHGFbR).
docs/tr/commands/instinct-status.md
+1 -1
View File
@@ -18,7 +18,7 @@ Bu, `CLAUDE_PLUGIN_ROOT` ayarlanmamışken eski bir
yol sapmasını önler (#2037).
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
python3 "$ECC_ROOT/skills/continuous-learning-v2/scripts/instinct-cli.py" status
```
docs/tr/commands/sessions.md
+8 -8
View File
@@ -29,8 +29,8 @@ Bir swarm için operatör-yüzey context'e ihtiyacınız olduğunda `/sessions i
**Script:**
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const path = require('path');
const result = sm.getAllSessions({ limit: 20 });
@@ -70,8 +70,8 @@ Session içeriğini yükle ve göster (ID veya alias ile).
**Script:**
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const id = process.argv[1];
// Önce alias olarak çözümlemeyi dene
@@ -143,8 +143,8 @@ Session için akılda kalıcı bir alias oluştur.
**Script:**
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const sessionId = process.argv[1];
const aliasName = process.argv[2];
@@ -183,7 +183,7 @@ Mevcut bir alias'ı sil.
**Script:**
```bash
node -e "
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const aliasName = process.argv[1];
if (!aliasName) {
@@ -222,7 +222,7 @@ Tüm session aliaslarını göster.
**Script:**
```bash
node -e "
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const aliases = aa.listAliases();
console.log('Session Aliases (' + aliases.length + '):');
docs/tr/rules/common/git-workflow.md
+1 -1
View File
@@ -9,7 +9,7 @@
Types: feat, fix, refactor, docs, test, chore, perf, ci
Not: Attribution ~/.claude/settings.json aracılığıyla global olarak devre dışı bırakıldı.
Not: ECC tarafından yönetilen kurulumlar `~/.claude/settings.json` içinde `"includeCoAuthoredBy": false` ayarlar, bu nedenle commitler varsayılan olarak `Co-Authored-By` içermez. Claude atfını korumak için `"includeCoAuthoredBy": true` veya `attribution` ayarlayın; ECC açık bir tercihin üzerine asla yazmaz.
## Pull Request İş Akışı
docs/tr/rules/common/performance.md
+2 -2
View File
@@ -7,12 +7,12 @@
- Pair programming ve kod üretimi
- Multi-agent sistemlerinde worker agent'lar
**Sonnet 4.6** (En iyi kodlama modeli):
**Sonnet 5** (En iyi kodlama modeli):
- Ana geliştirme çalışması
- Multi-agent iş akışlarını orkestrasyon
- Karmaşık kodlama görevleri
**Opus 4.6** (En derin akıl yürütme):
**Opus 5** (En derin akıl yürütme):
- Karmaşık mimari kararlar
- Maksimum akıl yürütme gereksinimleri
- Araştırma ve analiz görevleri
docs/tr/skills/golang-patterns/SKILL.md
+2 -1
View File
@@ -616,7 +616,8 @@ linters-settings:
errcheck:
check-type-assertions: true
govet:
check-shadowing: true
enable:
- shadow
issues:
exclude-use-default: false
docs/tr/skills/laravel-verification/SKILL.md
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: laravel-verification
description: Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.
description: "Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness."
origin: ECC
---
docs/tr/skills/quarkus-verification/SKILL.md
+6 -5
View File
@@ -186,7 +186,7 @@ mvn quarkus:list-extensions
### OWASP ZAP (API Güvenlik Testi)
```bash
docker run -t owasp/zap2docker-stable zap-api-scan.py \
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
-t http://localhost:8080/q/openapi \
-f openapi
```
@@ -436,16 +436,16 @@ jobs:
verify:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v7
- name: Set up JDK 21
uses: actions/setup-java@v3
uses: actions/setup-java@v5
with:
java-version: '21'
distribution: 'temurin'
- name: Cache Maven packages
uses: actions/cache@v3
uses: actions/cache@v6
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -460,8 +460,9 @@ jobs:
run: mvn org.owasp:dependency-check-maven:check
- name: Upload Coverage
uses: codecov/codecov-action@v3
uses: codecov/codecov-action@v7
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: target/site/jacoco/jacoco.xml
```
docs/zh-CN/AGENTS.md
+5 -5
View File
@@ -1,8 +1,8 @@
# Everything Claude Code (ECC) — 智能体指令
这是一个**生产就绪的 AI 编码插件**，提供 67 个专业代理、271 项技能、92 条命令以及自动化钩子工作流，用于软件开发。
这是一个**生产就绪的 AI 编码插件**，提供 68 个专业代理、287 项技能、94 条命令以及自动化钩子工作流，用于软件开发。
**版本:** 2.0.0
**版本:** 2.2.0
## 核心原则
@@ -146,9 +146,9 @@
## 项目结构
```
agents/ — 67 个专业子代理
skills/ — 271 个工作流技能和领域知识
commands/ — 92 个斜杠命令
agents/ — 68 个专业子代理
skills/ — 287 个工作流技能和领域知识
commands/ — 94 个斜杠命令
hooks/ — 基于触发的自动化
rules/ — 始终遵循的指导方针（通用 + 每种语言）
scripts/ — 跨平台 Node.js 实用工具
docs/zh-CN/README.md
+44 -12
View File
@@ -81,7 +81,11 @@
## 最新动态
### v2.0.0 — 智能体 Harness 操作系统（2026年6月）
### v2.2.0 — 引导式多 Harness 安装（2026年8月）
新增可审查的 Claude Code、Codex 与 Kimi Code 多 Harness 安装流程，并提供同步的 npm 命令入口。
### v2.1.0 — 智能体 Harness 操作系统（2026年6月）
2.0 主线稳定版：261 个技能、control-pane 基底（会话适配器 + MCP 清单）、worktree 生命周期服务，以及 [ECC Discord 社区](https://discord.gg/36yGMHGFbR)。
@@ -163,6 +167,34 @@
***
## 统一记忆库
`ecc memory` 使用可检查的 `ecc.memory.v1` Markdown 文档，在 Claude、
Codex、Hermes 等 harness 之间传递上下文。常规搜索只召回 `project` 和
`team` 范围内状态为 active 的条目，按 ID 直接读取仍可用于检查非 active
条目；`user` 范围必须显式请求。首个版本中的所有记忆都保持 unreviewed，
接受后的知识应进入受治理的项目文档，
而不是修改记忆的信任字段。召回内容始终是不可信数据，不能作为指令执行。
可选的 `ecc-memory-mcp` 服务必须由操作者设置小写
`ECC_MEMORY_HARNESS` 身份；工具调用方不能覆盖该身份。只有操作者另外设置
`ECC_MEMORY_ALLOW_USER_SCOPE=1` 后，MCP 调用才能显式请求 `user` 范围。
该服务默认不会启用。
仅安装 skill、最小配置、手动复制或 Claude 插件不会把记忆库运行时加入
`PATH`。请先单独安装 ECC npm 运行时：
```bash
npm install -g ecc-universal
ecc memory --help
command -v ecc-memory-mcp
```
如需启用 MCP，请从 `mcp-configs/mcp-servers.json` 复制
`ecc-memory-vault` 配置到对应 harness，并为每个 harness 分别启动一个服务
进程，例如 `ECC_MEMORY_HARNESS=codex ecc-memory-mcp`。不同 harness 可以共享
同一个二进制文件和记忆库目录，但不能共用同一个服务进程。
## 快速开始
在 2 分钟内启动并运行：
@@ -228,7 +260,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
/plugin list ecc@ecc
```
**搞定！** 你现在可以使用 67 个智能体、271 项技能和 92 个命令了。
**搞定！** 你现在可以使用 68 个智能体、287 项技能和 94 个命令了。
***
@@ -1140,9 +1172,9 @@ opencode
| 功能特性 | Claude Code | OpenCode | 状态 |
|---------|---------------|----------|--------|
| 智能体 | PASS: 67 个 | PASS: 12 个 | **Claude Code 领先** |
| 命令 | PASS: 92 个 | PASS: 35 个 | **Claude Code 领先** |
| 技能 | PASS: 271 项 | PASS: 37 项 | **Claude Code 领先** |
| 智能体 | PASS: 68 个 | PASS: 12 个 | **Claude Code 领先** |
| 命令 | PASS: 94 个 | PASS: 35 个 | **Claude Code 领先** |
| 技能 | PASS: 287 项 | PASS: 37 项 | **Claude Code 领先** |
| 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** |
| 规则 | PASS: 29 条 | PASS: 13 条指令 | **Claude Code 领先** |
| MCP 服务器 | PASS: 14 个 | PASS: 完整 | **完全对等** |
@@ -1248,11 +1280,11 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
| 功能特性 | Claude Code | Cursor IDE | Codex CLI | OpenCode |
|---------|-----------------------|------------|-----------|----------|
| **智能体** | 67 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
| **命令** | 92 | 共享 | 基于指令 | 35 |
| **技能** | 271 | 共享 | 10 (原生格式) | 37 |
| **钩子事件** | 8 种类型 | 15 种类型 | 暂无 | 11 种类型 |
| **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | N/A | 插件钩子 |
| **智能体** | 68 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
| **命令** | 94 | 共享 | 基于指令 | 35 |
| **技能** | 287 | 共享 | 10 (原生格式) | 37 |
| **钩子事件** | 8 种类型 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 |
| **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 |
| **规则** | 34 (通用 + 语言) | 34 (YAML 前页) | 基于指令 | 13 条指令 |
| **自定义工具** | 通过钩子 | 通过钩子 | N/A | 6 个原生工具 |
| **MCP 服务器** | 14 | 共享 (mcp.json) | 4 (基于命令) | 完整 |
@@ -1260,14 +1292,14 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
| **上下文文件** | CLAUDE.md + AGENTS.md | AGENTS.md | AGENTS.md | AGENTS.md |
| **秘密检测** | 基于钩子 | beforeSubmitPrompt 钩子 | 基于沙箱 | 基于钩子 |
| **自动格式化** | PostToolUse 钩子 | afterFileEdit 钩子 | N/A | file.edited 钩子 |
| **版本** | 插件 | 插件 | 参考配置 | 2.0.0 |
| **版本** | 插件 | 插件 | 参考配置 | 2.2.0 |
**关键架构决策：**
* **AGENTS.md** 在根目录是通用的跨工具文件（所有 4 个工具都能读取）
* **DRY 适配器模式** 让 Cursor 可以重用 Claude Code 的钩子脚本而无需重复
* **技能格式**（带有 YAML 前言的 SKILL.md）在 Claude Code、Codex 和 OpenCode 中都能工作
* Codex 缺少钩子功能，通过 `AGENTS.md`、可选的 `model_instructions_file` 覆盖以及沙箱权限来弥补
* Codex 通过原生 `SessionStart` 引导钩子初始化 ECC；其余行为由 `AGENTS.md`、可选的 `model_instructions_file` 覆盖以及沙箱权限提供
***
docs/zh-CN/commands/auto-update.md
+1 -1
View File
@@ -11,7 +11,7 @@ disable-model-invocation: true
```bash
# Preview the update without mutating anything
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot({probe:p.join('scripts','auto-update.js')})}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/auto-update.js" --dry-run
# Update only Cursor-managed files in the current project
docs/zh-CN/commands/instinct-status.md
+1 -1
View File
@@ -16,7 +16,7 @@ command: true
`~/.claude/skills/continuous-learning-v2/` 目录仍然存在时发生的路径分歧 (#2037)。
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
python3 "$ECC_ROOT/skills/continuous-learning-v2/scripts/instinct-cli.py" status
```
docs/zh-CN/commands/sessions.md
+10 -10
View File
@@ -30,8 +30,8 @@ description: 管理Claude Code会话历史、别名和会话元数据。
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const path = require('path');
const result = sm.getAllSessions({ limit: 20 });
@@ -72,8 +72,8 @@ for (const s of result.sessions) {
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const id = process.argv[1];
// First try to resolve as alias
@@ -146,8 +146,8 @@ if (session.metadata.worktree) {
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const sessionId = process.argv[1];
const aliasName = process.argv[2];
@@ -187,7 +187,7 @@ if (result.success) {
```bash
node -e "
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const aliasName = process.argv[1];
if (!aliasName) {
@@ -217,8 +217,8 @@ if (result.success) {
```bash
node -e "
const sm = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-manager');
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const sm = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-manager');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const id = process.argv[1];
const resolved = aa.resolveAlias(id);
@@ -268,7 +268,7 @@ if (aliases.length > 0) {
```bash
node -e "
const aa = require((()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q)))return c}}catch(x){}return d})()+'/scripts/lib/session-aliases');
const aa = require((function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})()+'/scripts/lib/session-aliases');
const aliases = aa.listAliases();
console.log('Session Aliases (' + aliases.length + '):');
docs/zh-CN/commands/skill-health.md
+3 -3
View File
@@ -13,21 +13,21 @@ command: true
在仪表盘模式下运行技能健康 CLI：
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(!f.existsSync(p.join(d,q))){try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q))){d=c;break}}}catch(x){}}console.log(d)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/skills-health.js" --dashboard
```
仅针对特定面板：
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(!f.existsSync(p.join(d,q))){try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q))){d=c;break}}}catch(x){}}console.log(d)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/skills-health.js" --dashboard --panel failures
```
获取机器可读输出：
```bash
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(!f.existsSync(p.join(d,q))){try{var b=p.join(d,'plugins','cache','everything-claude-code');for(var o of f.readdirSync(b))for(var v of f.readdirSync(p.join(b,o))){var c=p.join(b,o,v);if(f.existsSync(p.join(c,q))){d=c;break}}}catch(x){}}console.log(d)")}"
ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(function(){var p=require('path'),f=require('fs'),o=require('os');var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var d=p.join(o.homedir(),'.claude');function L(x){try{return require(p.join(x,'scripts','lib','resolve-ecc-root')).resolveEccRoot()}catch(_){return null}}var r=L(d);if(r)return r;var s=['ecc','ecc@ecc','marketplaces/ecc','everything-claude-code','everything-claude-code@everything-claude-code','marketplaces/everything-claude-code'];for(var i=0;i<s.length;i++){r=L(p.join(d,'plugins',s[i]));if(r)return r}try{var g=['ecc','everything-claude-code'];for(var j=0;j<g.length;j++){var c=p.join(d,'plugins','cache',g[j]);var O=f.readdirSync(c);for(var k=0;k<O.length;k++){var q=p.join(c,O[k]);var V=f.readdirSync(q);for(var m=0;m<V.length;m++){r=L(p.join(q,V[m]));if(r)return r}}}}catch(_){}return d})();console.log(r)")}"
node "$ECC_ROOT/scripts/skills-health.js" --dashboard --json
```
docs/zh-CN/rules/common/git-workflow.md
+1 -1
View File
@@ -10,7 +10,7 @@
类型：feat, fix, refactor, docs, test, chore, perf, ci
注意：通过 ~/.claude/settings.json 全局禁用了归因。
注意：ECC 管理的安装会在 `~/.claude/settings.json` 中设置 `"includeCoAuthoredBy": false`，因此提交默认不带 `Co-Authored-By`。若要保留 Claude 的归因，请设置 `"includeCoAuthoredBy": true` 或配置 `attribution`；ECC 不会覆盖用户的显式选择。
## 拉取请求工作流程
docs/zh-CN/rules/common/performance.md
+2 -2
View File
@@ -8,13 +8,13 @@
* 结对编程和代码生成
* 多智能体系统中的工作智能体
**Sonnet 4.6** (最佳编码模型):
**Sonnet 5** (最佳编码模型):
* 主要的开发工作
* 编排多智能体工作流
* 复杂的编码任务
**Opus 4.6** (最深的推理能力):
**Opus 5** (最深的推理能力):
* 复杂的架构决策
* 最高级别的推理需求
docs/zh-CN/skills/blueprint/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: blueprint
description: 将单行目标转化为多会话、多代理工程项目的分步构建计划。每个步骤包含独立的上下文简介，以便新代理能直接执行。包括对抗性审查门、依赖图、并行步骤检测、反模式目录和计划突变协议。触发条件：当用户请求复杂多PR任务的计划、蓝图或路线图，或描述需要多个会话的工作时。不触发条件：任务可在单个PR或少于3个工具调用中完成，或用户说“直接执行”时。origin: community
description: 将单行目标转化为多会话、多代理工程项目的分步构建计划。每个步骤包含独立的上下文简介，以便新代理能直接执行。包括对抗性审查门、依赖图、并行步骤检测、反模式目录和计划突变协议。触发条件：当用户请求复杂多PR任务的计划、蓝图或路线图，或描述需要多个会话的工作时。不触发条件：任务可在单个PR或少于3个工具调用中完成，或用户说“直接执行”时。
origin: community
---
# Blueprint — 施工计划生成器
docs/zh-CN/skills/browser-qa/SKILL.md
+7
View File
@@ -1,3 +1,10 @@
---
name: browser-qa
description: Automate visual testing and UI interaction verification using browser automation after deployment.
metadata:
origin: ECC
---
# Browser QA — 自动化视觉测试与交互验证
## When to use
docs/zh-CN/skills/carrier-relationship-management/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: carrier-relationship-management
description: 用于管理承运商组合、协商运费、跟踪承运商绩效、分配货运以及维护战略承运商关系的编码专业知识。基于拥有15年以上经验的运输经理提供的信息。包括记分卡框架、RFP流程、市场情报和合规性审查。适用于管理承运商、协商费率、评估承运商绩效或制定货运策略时使用。license: Apache-2.0
description: 用于管理承运商组合、协商运费、跟踪承运商绩效、分配货运以及维护战略承运商关系的编码专业知识。基于拥有15年以上经验的运输经理提供的信息。包括记分卡框架、RFP流程、市场情报和合规性审查。适用于管理承运商、协商费率、评估承运商绩效或制定货运策略时使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/clickhouse-io/SKILL.md
+46 -41
View File
@@ -162,39 +162,43 @@ ORDER BY market_id, date;
### 批量插入 (推荐)
```typescript
import { ClickHouse } from 'clickhouse'
import { createClient } from '@clickhouse/client'
const clickhouse = new ClickHouse({
url: process.env.CLICKHOUSE_URL,
port: 8123,
basicAuth: {
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
}
const clickhouse = createClient({
url: process.env.CLICKHOUSE_URL ?? 'http://localhost:8123',
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
})
// PASS: Batch insert (efficient)
async function bulkInsertTrades(trades: Trade[]) {
const values = trades.map(trade => `(
'${trade.id}',
'${trade.market_id}',
'${trade.user_id}',
${trade.amount},
'${trade.timestamp.toISOString()}'
)`).join(',')
await clickhouse.query(`
INSERT INTO trades (id, market_id, user_id, amount, timestamp)
VALUES ${values}
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: trades.map(trade => ({
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
})),
format: 'JSONEachRow'
})
}
// FAIL: Individual inserts (slow)
async function insertTrade(trade: Trade) {
// Don't do this in a loop!
await clickhouse.query(`
INSERT INTO trades VALUES ('${trade.id}', ...)
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: [{
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
}],
format: 'JSONEachRow'
})
}
```
@@ -202,17 +206,14 @@ async function insertTrade(trade: Trade) {
```typescript
// For continuous data ingestion
import { createWriteStream } from 'fs'
import { pipeline } from 'stream/promises'
import { Readable } from 'node:stream'
async function streamInserts() {
const stream = clickhouse.insert('trades').stream()
for await (const batch of dataSource) {
stream.write(batch)
}
await stream.end()
async function streamInserts(dataSource: AsyncIterable<Record<string, unknown>>) {
await clickhouse.insert({
table: 'trades',
values: Readable.from(dataSource, { objectMode: true }),
format: 'JSONEachRow'
})
}
```
@@ -397,14 +398,18 @@ pgClient.query('LISTEN market_updates')
pgClient.on('notification', async (msg) => {
const update = JSON.parse(msg.payload)
await clickhouse.insert('market_updates', [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
])
await clickhouse.insert({
table: 'market_updates',
values: [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
],
format: 'JSONEachRow'
})
})
```
docs/zh-CN/skills/configure-ecc/SKILL.md
+114 -333
View File
@@ -1,400 +1,181 @@
---
name: configure-ecc
description: Everything Claude Code 的交互式安装程序 — 引导用户选择并安装技能和规则到用户级或项目级目录，验证路径，并可选择优化已安装文件。
origin: ECC
description: 在 Claude Code、Codex 或 Kimi 内引导 ECC 安装、更新或重新配置，同时严格遵守各家工具真实的插件、范围和 Hook 能力。
metadata:
origin: ECC
---
# 配置 Everything Claude Code (ECC)
# 配置 Everything Claude Code
一个交互式、分步安装向导，用于 Everything Claude Code 项目。使用 `AskUserQuestion` 引导用户选择性安装技能和规则，然后验证正确性并提供优化。
在当前工具内运行对话式向导：先检查，只收集受支持的选项，预览，只确认
一次，以非交互方式执行，验证，最后才显示欢迎信息。不要把 ECC 克隆到
临时目录，也不要手动复制插件组件。
## 何时激活
在用户自己操作的终端中，规范入口是 `ecc setup` 和 `npx ecc-universal setup`。
在工具内请改用下方参数完整的非交互命令。
* 用户说 "configure ecc"、"install ecc"、"setup everything claude code" 或类似表述
* 用户想要从此项目中选择性安装技能或规则
* 用户想要验证或修复现有的 ECC 安装
* 用户想要为其项目优化已安装的技能或规则
## 按当前工具分流
## 先决条件
- Claude Code：使用下面完整的范围与 Hook 向导。
- Codex：使用 Codex 原生插件生命周期；不要提供 Claude 范围，也不要映射
Claude 的四种 ECC Hook 配置。
- Kimi：把项目表面安装到 `./.kimi-code`；Kimi 不支持 ECC 的 Claude 生命周期
Hook 配置。
- 无法确定工具时，先说明检测依据，再询问要配置哪一个，不要直接修改。
此技能必须在激活前对 Claude Code 可访问。有两种引导方式：
此技能是安装后的重新配置路径，无法拦截或取代提供商内置的首次安装界面。
1. **通过插件**: `/plugin install ecc@ecc` — 插件会自动加载此技能
2. **手动**: 仅将此技能复制到 `~/.claude/skills/configure-ecc/SKILL.md`，然后通过说 "configure ecc" 激活
## Claude Code：运行完整对话式向导
***
### 1. 只读检查
## 步骤 0：克隆 ECC 仓库
在任何安装之前，将最新的 ECC 源代码克隆到 `/tmp`：
运行以下两条命令，总结 ECC 的安装范围、启用状态和 marketplace 来源：
```bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code
claude plugin list --json
claude plugin marketplace list --json
```
将 `ECC_ROOT=/tmp/everything-claude-code` 设置为所有后续复制操作的源。
只有一个现有 `ecc@ecc` 时，将本次视为重新配置。不要把 Claude 提供商所有的
“Open home page”控件当作安装证据。若 setup 报告多个 ECC 范围、旧版或手动
安装、配置损坏或 marketplace 冲突，请停止并原样报告恢复建议，不要猜测要删除哪个。
如果克隆失败（网络问题等），使用 `AskUserQuestion` 要求用户提供现有 ECC 克隆的本地路径。
### 2. 只收集两个选择
***
只询问一次安装范围，并要求且仅要求一个值：
## 步骤 1：选择安装级别
- `user | project | local`
- `user` 对当前用户全局可用。
- `project` 通过仓库设置共享。
- `local` 仅当前项目私有。
使用 `AskUserQuestion` 询问用户安装位置：
界面中只能把选中的一个范围显示为已选或正在安装。如果用户从唯一现有范围
切换到另一范围，说明这是范围迁移，并在下方命令中加入 `--move-scope`。
```
问题："ECC组件应安装在哪里？"
选项：
- "用户级别 (~/.claude/)" — "适用于您所有的Claude Code项目"
- "项目级别 (.claude/)" — "仅适用于当前项目"
- "两者" — "通用/共享项在用户级别，项目特定项在项目级别"
```
只询问一次 Hook 模式，并要求且仅要求一个值：
将选择存储为 `INSTALL_LEVEL`。设置目标目录：
- `off | minimal | standard | strict`
- `off` 保留技能和命令，但关闭 ECC Hook 自动化。
- `minimal` 只启用最轻量的生命周期和安全自动化。
- `standard` 平衡质量和安全自动化。
- `strict` 启用最严格的检查和提醒。
* 用户级别：`TARGET=~/.claude`
* 项目级别：`TARGET=.claude`（相对于当前项目根目录）
* 两者：`TARGET_USER=~/.claude`，`TARGET_PROJECT=.claude`
Hook 偏好是个人 Claude 插件配置，不会跟随所选安装范围。
如果目标目录不存在，则创建它们：
### 3. 预览并只确认一次
优先使用插件自带的 setup 脚本。替换两个已选值，只在范围迁移时加入
`--move-scope`：
```bash
mkdir -p $TARGET/skills $TARGET/rules
node "$CLAUDE_PLUGIN_ROOT/scripts/setup.js" --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --dry-run --json
```
***
## 步骤 2：选择并安装技能
### 2a: 选择范围（核心 vs 细分领域）
默认为 **核心（推荐给新用户）** — 对于研究优先的工作流，复制 `.agents/skills/*` 加上 `skills/search-first/`。此捆绑包涵盖工程、评估、验证、安全、战略压缩、前端设计以及 Anthropic 跨职能技能（文章写作、内容引擎、市场研究、前端幻灯片）。
使用 `AskUserQuestion`（单选）：
```
问题："只安装核心技能，还是包含小众/框架包？"
选项：
- "仅核心（推荐）" — "tdd, e2e, evals, verification, research-first, security, frontend patterns, compacting, cross-functional Anthropic skills"
- "核心 + 精选小众" — "在核心基础上添加框架/领域特定技能"
- "仅小众" — "跳过核心，安装特定框架/领域技能"
默认：仅核心
```
如果用户选择细分领域或核心 + 细分领域，则继续下面的类别选择，并且仅包含他们选择的那些细分领域技能。
### 2b: 选择技能类别
下方有7个可选的类别组。后续的详细确认列表涵盖了8个类别中的45项技能，外加1个独立模板。使用 `AskUserQuestion` 与 `multiSelect: true`：
```
问题：“您希望安装哪些技能类别？”
选项：
- “框架与语言” — “Django, Laravel, Spring Boot, Go, Python, Java, 前端, 后端模式”
- “数据库” — “PostgreSQL, ClickHouse, JPA/Hibernate 模式”
- “工作流与质量” — “TDD, 验证, 学习, 安全审查, 压缩”
- “研究与 API” — “深度研究, Exa 搜索, Claude API 模式”
- “社交与内容分发” — “X/Twitter API, 内容引擎并行交叉发布”
- “媒体生成” — “fal.ai 图像/视频/音频与 VideoDB 并行”
- “编排” — “dmux 多智能体工作流”
- “所有技能” — “安装所有可用技能”
```
### 2c: 确认个人技能
对于每个选定的类别，打印下面的完整技能列表，并要求用户确认或取消选择特定的技能。如果列表超过 4 项，将列表打印为文本，并使用 `AskUserQuestion`，提供一个 "安装所有列出项" 的选项，以及一个 "其他" 选项供用户粘贴特定名称。
**类别：框架与语言（21项技能）**
| 技能 | 描述 |
|-------|-------------|
| `backend-patterns` | Node.js/Express/Next.js 的后端架构、API 设计、服务器端最佳实践 |
| `coding-standards` | TypeScript、JavaScript、React、Node.js 的通用编码标准 |
| `django-patterns` | Django 架构、使用 DRF 的 REST API、ORM、缓存、信号、中间件 |
| `django-security` | Django 安全性：认证、CSRF、SQL 注入、XSS 防护 |
| `django-tdd` | 使用 pytest-django、factory\_boy、模拟、覆盖率进行 Django 测试 |
| `django-verification` | Django 验证循环：迁移、代码检查、测试、安全扫描 |
| `laravel-patterns` | Laravel 架构模式：路由、控制器、Eloquent、队列、缓存 |
| `laravel-security` | Laravel 安全性：认证、策略、CSRF、批量赋值、速率限制 |
| `laravel-tdd` | 使用 PHPUnit 和 Pest、工厂、假对象、覆盖率进行 Laravel 测试 |
| `laravel-verification` | Laravel 验证：代码检查、静态分析、测试、安全扫描 |
| `frontend-patterns` | React、Next.js、状态管理、性能、UI 模式 |
| `frontend-slides` | 零依赖的 HTML 演示文稿、样式预览以及 PPTX 到网页的转换 |
| `golang-patterns` | 地道的 Go 模式、构建稳健 Go 应用程序的约定 |
| `golang-testing` | Go 测试：表驱动测试、子测试、基准测试、模糊测试 |
| `java-coding-standards` | Spring Boot 的 Java 编码标准：命名、不可变性、Optional、流 |
| `python-patterns` | Pythonic 惯用法、PEP 8、类型提示、最佳实践 |
| `python-testing` | 使用 pytest、TDD、夹具、模拟、参数化进行 Python 测试 |
| `quarkus-patterns` | Quarkus 架构、使用 Camel 的事件驱动模式、Panache 数据访问、CDI 服务 |
| `quarkus-security` | Quarkus 安全：JWT/OIDC 认证、RBAC、Bean 验证、CORS、密钥管理 |
| `quarkus-tdd` | 使用 JUnit 5、Mockito、REST Assured、Camel 测试进行 Quarkus TDD |
| `quarkus-verification` | Quarkus 验证：构建、静态分析、测试、安全扫描、原生编译 |
| `springboot-patterns` | Spring Boot 架构、REST API、分层服务、缓存、异步处理 |
| `springboot-security` | Spring Security：认证/授权、验证、CSRF、密钥、速率限制 |
| `springboot-tdd` | 使用 JUnit 5、Mockito、MockMvc、Testcontainers 进行 Spring Boot TDD |
| `springboot-verification` | Spring Boot 验证：构建、静态分析、测试、安全扫描 |
**类别：数据库（3 项技能）**
| 技能 | 描述 |
|-------|-------------|
| `clickhouse-io` | ClickHouse 模式、查询优化、分析、数据工程 |
| `jpa-patterns` | JPA/Hibernate 实体设计、关系、查询优化、事务 |
| `postgres-patterns` | PostgreSQL 查询优化、模式设计、索引、安全 |
**类别：工作流与质量（8 项技能）**
| 技能 | 描述 |
|-------|-------------|
| `continuous-learning` | 从会话中自动提取可重用模式作为习得技能 |
| `continuous-learning-v2` | 基于本能的学习，带有置信度评分，演变为技能/命令/代理 |
| `eval-harness` | 用于评估驱动开发 (EDD) 的正式评估框架 |
| `iterative-retrieval` | 用于子代理上下文问题的渐进式上下文优化 |
| `security-review` | 安全检查清单：身份验证、输入、密钥、API、支付功能 |
| `strategic-compact` | 在逻辑间隔处建议手动上下文压缩 |
| `tdd-workflow` | 强制要求 TDD，覆盖率 80% 以上：单元测试、集成测试、端到端测试 |
| `verification-loop` | 验证和质量循环模式 |
**类别：业务与内容（5 项技能）**
| 技能 | 描述 |
|-------|-------------|
| `article-writing` | 使用笔记、示例或源文档，以指定的口吻进行长篇写作 |
| `content-engine` | 多平台社交内容、脚本和内容再利用工作流 |
| `market-research` | 带有来源标注的市场、竞争对手、基金和技术研究 |
| `investor-materials` | 宣传文稿、一页简介、投资者备忘录和财务模型 |
| `investor-outreach` | 个性化的投资者冷邮件、熟人介绍和后续跟进 |
**类别：研究与API（2项技能）**
| 技能 | 描述 |
|-------|-------------|
| `deep-research` | 使用 firecrawl 和 exa MCP 进行多源深度研究，并生成带引用的报告 |
| `exa-search` | 通过 Exa MCP 进行网络、代码、公司和人员的神经搜索 |
`claude-api` 是 Anthropic 官方技能；需要时请从 [`anthropics/skills`](https://github.com/anthropics/skills) 安装官方版本，而不是通过 ECC 重复打包。
**类别：社交与内容分发（2项技能）**
| 技能 | 描述 |
|-------|-------------|
| `x-api` | X/Twitter API 集成，用于发帖、线程、搜索和分析 |
| `crosspost` | 多平台内容分发，并进行平台原生适配 |
**类别：媒体生成（2项技能）**
| 技能 | 描述 |
|-------|-------------|
| `fal-ai-media` | 通过 fal.ai MCP 进行统一的AI媒体生成（图像、视频、音频） |
| `video-editing` | AI辅助视频编辑，用于剪辑、结构化和增强实拍素材 |
**类别：编排（1项技能）**
| 技能 | 描述 |
|-------|-------------|
| `dmux-workflows` | 使用 dmux 进行多智能体编排，实现并行智能体会话 |
**独立技能**
| 技能 | 描述 |
|-------|-------------|
| `docs/examples/project-guidelines-template.md` | 用于创建项目特定技能的模板 |
### 2d: 执行安装
对于每个选定的技能，请从正确的源目录复制整个技能目录：
如果 `$CLAUDE_PLUGIN_ROOT` 不可用，使用已发布的 npm 包：
```bash
# 核心技能位于 .agents/skills/
cp -R "$ECC_ROOT/.agents/skills/<skill-name>" "$TARGET/skills/"
# 细分技能位于 skills/
cp -R "$ECC_ROOT/skills/<skill-name>" "$TARGET/skills/"
npx --yes --package ecc-universal ecc setup --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --dry-run --json
```
遍历 glob 得到的源目录时，不要把带 trailing slash 的源路径直接传给 `cp`。显式使用目录名作为目标名：
只显示一次确认摘要，内容包含计划操作、唯一范围、唯一 Hook 模式、marketplace 操作和
任何从来源到目标的迁移。只问一个是/否问题。不要通过工具的 Shell 调用不带参数的
交互式 `ecc setup`，因为该 Shell 通常不是 TTY。
### 4. 应用明确选择
确认后，使用同一路径但去掉 `--dry-run`。保留每个明确选择，并请求 JSON：
```bash
cp -R "${src%/}" "$TARGET/skills/$(basename "${src%/}")"
node "$CLAUDE_PLUGIN_ROOT/scripts/setup.js" --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --yes --json
```
注意：`continuous-learning` 和 `continuous-learning-v2` 有额外的文件（config.json、钩子、脚本）——确保复制整个目录，而不仅仅是 SKILL.md。
***
## 步骤 3：选择并安装规则
使用 `AskUserQuestion` 和 `multiSelect: true`：
```
问题："您希望安装哪些规则集？"
选项：
- "通用规则（推荐）" — "语言无关原则：编码风格、Git工作流、测试、安全等（8个文件）"
- "TypeScript/JavaScript" — "TS/JS模式、钩子、Playwright测试（5个文件）"
- "Python" — "Python模式、pytest、black/ruff格式化（5个文件）"
- "Go" — "Go模式、表驱动测试、gofmt/staticcheck（5个文件）"
```
执行安装：
备用命令：
```bash
# Common rules
cp -r $ECC_ROOT/rules/common $TARGET/rules/common
# Language-specific rules (preserve per-language directories)
cp -r $ECC_ROOT/rules/typescript $TARGET/rules/typescript # if selected
cp -r $ECC_ROOT/rules/python $TARGET/rules/python # if selected
cp -r $ECC_ROOT/rules/golang $TARGET/rules/golang # if selected
npx --yes --package ecc-universal ecc setup --mode claude-plugin \
--scope <scope> --hooks <hooks> [--move-scope] --yes --json
```
**重要**：如果用户选择了任何特定语言的规则但**没有**选择通用规则，警告他们：
### 5. 先验证，再显示欢迎信息
> "特定语言规则扩展了通用规则。不安装通用规则可能导致覆盖不完整。是否也安装通用规则？"
***
## 步骤 4：安装后验证
安装后，执行这些自动化检查：
### 4a：验证文件存在
列出所有已安装的文件并确认它们存在于目标位置：
必须得到零退出状态，且 setup 结果中的 `scope` 和 `hooks` 必须等于所选值。然后独立运行：
```bash
ls -la $TARGET/skills/
ls -la $TARGET/rules/
claude plugin list --json
```
### 4b：检查路径引用
只有在所选范围中恰好存在一个已启用的 `ecc@ecc` 条目时才继续。如果
`$CLAUDE_PLUGIN_ROOT` 可用，把成功 setup 的 `action`（`installed`、`updated`、
`migrated`、`resumed` 或 `already-migrated`）传给内置渲染器：
扫描所有已安装的 `.md` 文件中的路径引用：
调用前必须确认提供方报告的版本匹配 `scripts/lib/terminal-welcome.js` 中的
`ECC_VERSION_PATTERN`。异常版本文本应被拒绝，不得插入 shell 命令。
```bash
grep -rn "~/.claude/" $TARGET/skills/ $TARGET/rules/
grep -rn "../common/" $TARGET/rules/
grep -rn "skills/" $TARGET/skills/
node -e 'const { renderTerminalWelcome } = require(process.env.CLAUDE_PLUGIN_ROOT + "/scripts/lib/terminal-welcome"); process.stdout.write(renderTerminalWelcome({ action: process.argv[1], version: process.argv[2], color: process.stdout.isTTY }));' "<action>" "<installed-version>"
```
**对于项目级别安装**，标记任何对 `~/.claude/` 路径的引用：
欢迎信息只渲染一次。失败、预览、取消、范围或 Hook 不匹配、无法验证时都不显示；
改为报告错误和恢复方法。验证完成后，提醒用户运行 `/reload-plugins` 或重启 Claude Code。
* 如果技能引用 `~/.claude/settings.json` — 这通常没问题（设置始终是用户级别的）
* 如果技能引用 `~/.claude/skills/` 或 `~/.claude/rules/` — 如果仅安装在项目级别，这可能损坏
* 如果技能通过名称引用另一项技能 — 检查被引用的技能是否也已安装
## Codex：使用原生插件生命周期
### 4c：检查技能间的交叉引用
使用 `codex plugin marketplace list --json` 和 `codex plugin list --available --json` 检查。
Codex 的原生插件命令没有 Claude 式 `user | project | local` 选择器。不要询问 Claude 范围或
Hook 四档模式。Codex 原生插件支持提供商专用 Hook，但 Codex 会要求用户明确信任。让 Codex
显示该信任决定；不要声称 Claude 的四种配置可以映射到 Codex。
有些技能会引用其他技能。验证这些依赖关系：
* `django-tdd` 可能会引用 `django-patterns`
* `laravel-tdd` 可能会引用 `laravel-patterns`
* `quarkus-tdd` 可能会引用 `quarkus-patterns`
* `springboot-tdd` 可能会引用 `springboot-patterns`
* `continuous-learning-v2` 引用 `~/.claude/homunculus/` 目录
* `python-testing` 可能会引用 `python-patterns`
* `golang-testing` 可能会引用 `golang-patterns`
* `crosspost` 引用 `content-engine` 和 `x-api`
* `deep-research` 引用 `exa-search`（补充的 MCP 工具）
* `fal-ai-media` 引用 `videodb`（补充的媒体技能）
* `x-api` 引用 `content-engine` 和 `crosspost`
* 特定语言的规则引用 `common/` 的对应内容
### 4d：报告问题
对于发现的每个问题，报告：
1. **文件**：包含问题引用的文件
2. **行号**：行号
3. **问题**：哪里出错了（例如，"引用了 ~/.claude/skills/python-patterns 但 python-patterns 未安装"）
4. **建议的修复**：该怎么做（例如，"安装 python-patterns 技能" 或 "将路径更新为 .claude/skills/"）
***
## 步骤 5：优化已安装文件（可选）
使用 `AskUserQuestion`：
```
问题："您想要优化项目中的已安装文件吗？"
选项：
- "优化技能" — "移除无关部分，调整路径，适配您的技术栈"
- "优化规则" — "调整覆盖目标，添加项目特定模式，自定义工具配置"
- "两者都优化" — "对所有已安装文件进行全面优化"
- "跳过" — "保持原样不变"
```
### 如果优化技能：
1. 读取每个已安装的 SKILL.md
2. 询问用户其项目的技术栈是什么（如果尚不清楚）
3. 对于每项技能，建议删除无关部分
4. 在安装目标处就地编辑 SKILL.md 文件（**不是**源仓库）
5. 修复在步骤 4 中发现的任何路径问题
### 如果优化规则：
1. 读取每个已安装的规则 .md 文件
2. 询问用户的偏好：
* 测试覆盖率目标（默认 80%）
* 首选的格式化工具
* Git 工作流约定
* 安全要求
3. 在安装目标处就地编辑规则文件
**关键**：只修改安装目标（`$TARGET/`）中的文件，**绝不**修改源 ECC 仓库（`$ECC_ROOT/`）中的文件。
***
## 步骤 6：安装摘要
从 `/tmp` 清理克隆的仓库：
如果缺少 ECC marketplace，请添加；否则刷新快照：
```bash
rm -rf /tmp/everything-claude-code
codex plugin marketplace add affaan-m/ECC
codex plugin marketplace upgrade ecc --json
```
然后打印摘要报告：
只确认一次，然后安装或幂等刷新已安装缓存，并验证：
```
## ECC 安装完成
### 安装目标
- 级别：[用户级别 / 项目级别 / 两者]
- 路径：[目标路径]
### 已安装技能 ([数量])
- 技能-1, 技能-2, 技能-3, ...
### 已安装规则 ([数量])
- 通用规则 (8 个文件)
- TypeScript 规则 (5 个文件)
- ...
### 验证结果
- 发现 [数量] 个问题，已修复 [数量] 个
- [列出任何剩余问题]
### 已应用的优化
- [列出所做的更改，或 "无"]
```bash
codex plugin add ecc@ecc --json
codex plugin list --json
```
***
只有 JSON 报告 ECC 已安装并提供 `installedPath` 时才继续，然后渲染已验证组合包的欢迎信息：
## 故障排除
`installedPath` 只能使用 Codex JSON 返回的原始绝对路径，并拒绝控制字符。版本必须通过
`ECC_VERSION_PATTERN` 验证。请使用下面的 argument array 直接调用 `node`；这是工具 API
调用，不是 shell 命令：
### "Claude Code 未获取技能"
```text
["<installedPath>/scripts/welcome.js", "--action", "configured", "--version", "<installed-version>"]
```
* 验证技能目录包含一个 `SKILL.md` 文件（不仅仅是松散的 .md 文件）
* 对于用户级别：检查 `~/.claude/skills/<skill-name>/SKILL.md` 是否存在
* 对于项目级别：检查 `.claude/skills/<skill-name>/SKILL.md` 是否存在
如果当前工具无法把可执行文件与 argument array 分开传递，请跳过欢迎信息。不得使用 Codex
JSON 中的值构造 shell 命令。
### "规则不工作"
绝不要声称 Claude 的 `off | minimal | standard | strict` 配置已应用到 Codex。
* 规则是平面文件，不在子目录中：`$TARGET/rules/coding-style.md`（正确）对比 `$TARGET/rules/common/coding-style.md`（对于平面安装不正确）
* 安装规则后重启 Claude Code
## Kimi：安装项目表面
### "项目级别安装后出现路径引用错误"
确认前说明能力摘要：目标为 `./.kimi-code`；ECC 生命周期 Hook 为 `hooks=unsupported`。
不要询问 Claude 范围或 Hook 模式。先预览：
* 有些技能假设 `~/.claude/` 路径。运行步骤 4 验证来查找并修复这些问题。
* 对于 `continuous-learning-v2`，`~/.claude/homunculus/` 目录始终是用户级别的 — 这是预期的，不是错误。
```bash
npx --yes --package ecc-universal ecc install --profile core --target kimi --dry-run
```
只针对该项目目标确认一次，然后执行去掉 `--dry-run` 的同一命令。使用以下命令验证：
```bash
npx --yes --package ecc-universal ecc doctor --target kimi
```
只有 doctor 成功，且已安装的指令和技能仍位于 `./.kimi-code` 内时才运行：
```bash
npx --yes --package ecc-universal ecc welcome --action configured
```
不要声称 Kimi 已安装或配置 ECC 生命周期 Hook。
docs/zh-CN/skills/continuous-learning-v2/agents/observer.md
+1 -1
View File
@@ -164,7 +164,7 @@ Validate and sanitize all user input before processing.
当一个本能满足以下条件时，应从项目作用域提升到全局：
1. **相同模式**（通过 id 或类似触发器）存在于 **2 个以上不同的项目**中
2. 每个实例的置信度 **>= 0.8**
2. 各实例的平均置信度 **>= 0.8**
3. 其领域属于全局友好列表（安全、通用最佳实践、工作流）
提升操作由 `instinct-cli.py promote` 命令或 `/evolve` 分析处理。
docs/zh-CN/skills/cost-aware-llm-pipeline/SKILL.md
+1 -1
View File
@@ -22,7 +22,7 @@ origin: ECC
自动为简单任务选择更便宜的模型，为复杂任务保留昂贵的模型。
```python
MODEL_SONNET = "claude-sonnet-4-6"
MODEL_SONNET = "claude-sonnet-5"
MODEL_HAIKU = "claude-haiku-4-5-20251001"
_SONNET_TEXT_THRESHOLD = 10_000 # chars
docs/zh-CN/skills/customs-trade-compliance/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: customs-trade-compliance
description: 海关文件、关税分类、关税优化、受限方筛查以及多司法管辖区法规合规的编码化专业知识。由拥有15年以上经验的贸易合规专家提供。包括HS分类逻辑、Incoterms应用、自贸协定利用以及罚款减免。适用于处理海关清关、关税分类、贸易合规、进出口文件或关税优化时使用。license: Apache-2.0
description: 海关文件、关税分类、关税优化、受限方筛查以及多司法管辖区法规合规的编码化专业知识。由拥有15年以上经验的贸易合规专家提供。包括HS分类逻辑、Incoterms应用、自贸协定利用以及罚款减免。适用于处理海关清关、关税分类、贸易合规、进出口文件或关税优化时使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/energy-procurement/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: energy-procurement
description: 电力与燃气采购、电价优化、需量电费管理、可再生能源购电协议评估及多设施能源成本管理的编码化专业知识。基于能源采购经理在大型工商业用户中超过15年的经验。包括市场结构分析、对冲策略、负荷分析和可持续性报告框架。适用于采购能源、优化电价、管理需量电费、评估购电协议或制定能源策略时使用。license: Apache-2.0
description: 电力与燃气采购、电价优化、需量电费管理、可再生能源购电协议评估及多设施能源成本管理的编码化专业知识。基于能源采购经理在大型工商业用户中超过15年的经验。包括市场结构分析、对冲策略、负荷分析和可持续性报告框架。适用于采购能源、优化电价、管理需量电费、评估购电协议或制定能源策略时使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/gan-style-harness/SKILL.md
+13 -13
View File
@@ -37,7 +37,7 @@ tools: Read, Write, Edit, Bash, Grep, Glob, Task
```
┌─────────────┐
│ 规划器 │
│ (Opus 4.6) │
│ (Sonnet) │
└──────┬──────┘
│ 产品规格
│ (功能、冲刺、设计方向)
@@ -49,14 +49,14 @@ tools: Read, Write, Edit, Bash, Grep, Glob, Task
│ │
│ ┌──────────┐ │
│ │ 生成器 │--构建-->│──┐
│ │(Opus 4.6)│ │ │
│ │ (Sonnet) │ │ │
│ └────▲─────┘ │ │
│ │ │ │ 实时应用
│ 反馈 │ │
│ │ │ │
│ ┌────┴─────┐ │ │
│ │ 评估器 │<-测试---│──┘
│ │(Opus 4.6)│ │
│ │ (Sonnet) │ │
│ │+Playwright│ │
│ └──────────┘ │
│ │
@@ -77,7 +77,7 @@ tools: Read, Write, Edit, Bash, Grep, Glob, Task
* 故意**雄心勃勃**——保守规划会导致结果平庸
* 生成评估器后续使用的评估标准
**模型：** Opus 4.6（需要深度推理进行规格扩展）
**模型：** 默认 Sonnet；可通过 `GAN_PLANNER_MODEL=opus` 提升以获得更深入的规格扩展
### 2. 生成器智能体
@@ -91,7 +91,7 @@ tools: Read, Write, Edit, Bash, Grep, Glob, Task
* 管理 git 进行迭代间的版本控制
* 读取评估器反馈并在下一轮迭代中采纳
**模型：** Opus 4.6（需要强大的编码能力）
**模型：** 默认 Sonnet；可通过 `GAN_GENERATOR_MODEL=opus` 提升以获得最强编码能力
### 3. 评估器智能体
@@ -109,7 +109,7 @@ tools: Read, Write, Edit, Bash, Grep, Glob, Task
* 返回结构化反馈，包含分数和具体问题
* 设计为**极度严格**——从不赞美平庸的工作
**模型：** Opus 4.6（需要强大的判断力 + 工具使用能力）
**模型：** 默认 Sonnet；可通过 `GAN_EVALUATOR_MODEL=opus` 提升以获得更强的判断力 + 工具使用能力
## 评估标准
@@ -181,16 +181,16 @@ GAN_EVAL_CRITERIA="functionality,performance,security" \
```bash
# Step 1: Plan
claude -p --model opus "You are a Product Planner. Read PLANNER_PROMPT.md. Expand this brief into a full product spec: 'Build a Kanban board app'. Write spec to spec.md"
claude -p --model sonnet "You are a Product Planner. Read PLANNER_PROMPT.md. Expand this brief into a full product spec: 'Build a Kanban board app'. Write spec to spec.md"
# Step 2: Generate (iteration 1)
claude -p --model opus "You are a Generator. Read spec.md. Implement Sprint 1. Start the dev server on port 3000."
claude -p --model sonnet "You are a Generator. Read spec.md. Implement Sprint 1. Start the dev server on port 3000."
# Step 3: Evaluate (iteration 1)
claude -p --model opus --allowedTools "Read,Bash,mcp__playwright__*" "You are an Evaluator. Read EVALUATOR_PROMPT.md. Test the live app at http://localhost:3000. Score against the rubric. Write feedback to feedback-001.md"
claude -p --model sonnet --allowedTools "Read,Bash,mcp__playwright__*" "You are an Evaluator. Read EVALUATOR_PROMPT.md. Test the live app at http://localhost:3000. Score against the rubric. Write feedback to feedback-001.md"
# Step 4: Generate (iteration 2 — reads feedback)
claude -p --model opus "You are a Generator. Read spec.md and feedback-001.md. Address all issues. Improve the scores."
claude -p --model sonnet "You are a Generator. Read spec.md and feedback-001.md. Address all issues. Improve the scores."
# Repeat steps 3-4 until pass threshold met
```
@@ -230,9 +230,9 @@ claude -p --model opus "You are a Generator. Read spec.md and feedback-001.md. A
|----------|---------|-------------|
| `GAN_MAX_ITERATIONS` | `15` | 最大生成器-评估器循环次数 |
| `GAN_PASS_THRESHOLD` | `7.0` | 通过所需的加权分数（1-10） |
| `GAN_PLANNER_MODEL` | `opus` | 规划智能体的模型 |
| `GAN_GENERATOR_MODEL` | `opus` | 生成器智能体的模型 |
| `GAN_EVALUATOR_MODEL` | `opus` | 评估器智能体的模型 |
| `GAN_PLANNER_MODEL` | `sonnet` | 规划智能体的模型 |
| `GAN_GENERATOR_MODEL` | `sonnet` | 生成器智能体的模型 |
| `GAN_EVALUATOR_MODEL` | `sonnet` | 评估器智能体的模型 |
| `GAN_EVAL_CRITERIA` | `design,originality,craft,functionality` | 逗号分隔的标准 |
| `GAN_DEV_SERVER_PORT` | `3000` | 实时应用的端口 |
| `GAN_DEV_SERVER_CMD` | `npm run dev` | 启动开发服务器的命令 |
docs/zh-CN/skills/gateguard/SKILL.md
+2 -2
View File
@@ -52,7 +52,7 @@ LLM 的自我评估不起作用。问"你是否违反了任何策略？"答案
```
在编辑 {file_path} 之前，请先呈现以下事实：
1. 列出所有导入/引用此文件的文件（使用 Grep）
1. 列出所有导入/引用此文件的文件（在代码树中搜索——Glob/Grep，或通过 Bash 用 find/grep）
2. 列出受此更改影响的公共函数/类
3. 如果此文件读取/写入数据文件，请显示字段名称、结构以及日期格式（使用脱敏或合成值，而非原始生产数据）
4. 逐字引用用户当前的指令
@@ -64,7 +64,7 @@ LLM 的自我评估不起作用。问"你是否违反了任何策略？"答案
在创建 {file_path} 之前，请先说明以下事实：
1. 命名将调用此新文件的文件及行号
2. 确认没有现有文件具有相同功能（使用 Glob）
2. 确认没有现有文件具有相同功能（在代码树中搜索——Glob/Grep，或通过 Bash 用 find/grep）
3. 如果此文件读取/写入数据文件，请展示字段名称、结构及日期格式（使用脱敏或合成值，而非原始生产数据）
4. 逐字引用用户当前的指令
```
docs/zh-CN/skills/golang-patterns/SKILL.md
+2 -1
View File
@@ -616,7 +616,8 @@ linters-settings:
errcheck:
check-type-assertions: true
govet:
check-shadowing: true
enable:
- shadow
issues:
exclude-use-default: false
docs/zh-CN/skills/inventory-demand-planning/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: inventory-demand-planning
description: 为多地点零售商提供需求预测、安全库存优化、补货规划及促销提升估算的编码化专业知识。基于拥有15年以上管理数百个SKU经验的需求规划师的专业知识。包括预测方法选择、ABC/XYZ分析、季节性过渡管理及供应商谈判框架。适用于预测需求、设定安全库存、规划补货、管理促销或优化库存水平时使用。license: Apache-2.0
description: 为多地点零售商提供需求预测、安全库存优化、补货规划及促销提升估算的编码化专业知识。基于拥有15年以上管理数百个SKU经验的需求规划师的专业知识。包括预测方法选择、ABC/XYZ分析、季节性过渡管理及供应商谈判框架。适用于预测需求、设定安全库存、规划补货、管理促销或优化库存水平时使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/laravel-verification/SKILL.md
+1 -1
View File
@@ -1,6 +1,6 @@
---
name: laravel-verification
description: Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.
description: "Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness."
origin: ECC
---
docs/zh-CN/skills/logistics-exception-management/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: logistics-exception-management
description: 针对货运异常、货物延误、损坏、丢失和承运商纠纷的编码化专业知识，由拥有15年以上运营经验的物流专业人士提供。包括升级协议、承运商特定行为、索赔程序和判断框架。在处理运输异常、货运索赔、交付问题或承运商纠纷时使用。license: Apache-2.0
description: 针对货运异常、货物延误、损坏、丢失和承运商纠纷的编码化专业知识，由拥有15年以上运营经验的物流专业人士提供。包括升级协议、承运商特定行为、索赔程序和判断框架。在处理运输异常、货运索赔、交付问题或承运商纠纷时使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/production-scheduling/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: production-scheduling
description: 为离散和批量制造中的生产调度、作业排序、产线平衡、换模优化和瓶颈解决提供编码化专业知识。基于拥有15年以上经验的生产调度师的知识。包括约束理论/鼓-缓冲-绳、快速换模、设备综合效率分析、中断响应框架以及企业资源计划/制造执行系统交互模式。适用于调度生产、解决瓶颈、优化换模、应对中断或平衡制造产线时。license: Apache-2.0
description: 为离散和批量制造中的生产调度、作业排序、产线平衡、换模优化和瓶颈解决提供编码化专业知识。基于拥有15年以上经验的生产调度师的知识。包括约束理论/鼓-缓冲-绳、快速换模、设备综合效率分析、中断响应框架以及企业资源计划/制造执行系统交互模式。适用于调度生产、解决瓶颈、优化换模、应对中断或平衡制造产线时。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/prompt-optimizer/SKILL.md
+6 -6
View File
@@ -158,10 +158,10 @@ Research → Plan → Implement (TDD) → Review → Verify → Commit
| 范围 | 推荐模型 | 理由 |
|-------|------------------|-----------|
| 微小-低 | Sonnet 4.6 | 快速、成本效益高，适合简单任务 |
| 中 | Sonnet 4.6 | 标准工作的最佳编码模型 |
| 高 | Sonnet 4.6 (主) + Opus 4.6 (规划) | Opus 用于架构，Sonnet 用于实现 |
| 史诗级 | Opus 4.6 (蓝图) + Sonnet 4.6 (执行) | 深度推理用于多会话规划 |
| 微小-低 | Sonnet 5 | 快速、成本效益高，适合简单任务 |
| 中 | Sonnet 5 | 标准工作的最佳编码模型 |
| 高 | Sonnet 5 (主) + Opus 5 (规划) | Opus 用于架构，Sonnet 用于实现 |
| 史诗级 | Opus 5 (蓝图) + Sonnet 5 (执行) | 深度推理用于多会话规划 |
**多提示拆分**（针对高/史诗级范围）：
@@ -197,7 +197,7 @@ Research → Plan → Implement (TDD) → Review → Verify → Commit
| 命令 | /plan | 编码前规划架构 |
| 技能 | tdd-workflow | TDD 方法指导 |
| 代理 | code-reviewer | 实施后审查 |
| 模型 | Sonnet 4.6 | 针对此范围的推荐模型 |
| 模型 | Sonnet 5 | 针对此范围的推荐模型 |
### 第 3 部分：优化提示 —— 完整版本
@@ -363,7 +363,7 @@ Research → Plan → Implement (TDD) → Review → Verify → Commit
阶段之间使用 /save-session。使用 /resume-session 继续。
在依赖关系允许时，使用 git worktrees 进行并行服务提取。
推荐：使用 Opus 4.6 进行蓝图规划，使用 Sonnet 4.6 执行各阶段。
推荐：使用 Opus 5 进行蓝图规划，使用 Sonnet 5 执行各阶段。
```
***
docs/zh-CN/skills/quality-nonconformance/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: quality-nonconformance
description: 为受监管制造业中的质量控制、不合格调查、根本原因分析、纠正措施和供应商质量管理提供编码化专业知识。基于在FDA、IATF 16949和AS9100环境中拥有15年以上经验的质量工程师的见解。包括不合格报告生命周期管理、纠正与预防措施系统、统计过程控制解释和审核方法。适用于调查不合格、进行根本原因分析、管理纠正与预防措施、解释统计过程控制数据或处理供应商质量问题。license: Apache-2.0
description: 为受监管制造业中的质量控制、不合格调查、根本原因分析、纠正措施和供应商质量管理提供编码化专业知识。基于在FDA、IATF 16949和AS9100环境中拥有15年以上经验的质量工程师的见解。包括不合格报告生命周期管理、纠正与预防措施系统、统计过程控制解释和审核方法。适用于调查不合格、进行根本原因分析、管理纠正与预防措施、解释统计过程控制数据或处理供应商质量问题。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/returns-reverse-logistics/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: returns-reverse-logistics
description: 用于退货授权、接收与检验、处置决策、退款处理、欺诈检测以及保修索赔管理的标准化专业知识。基于拥有15年以上经验的退货运营经理的见解。包括分级框架、处置经济学、欺诈模式识别和供应商回收流程。适用于处理产品退货、逆向物流、退款决策、退货欺诈检测或保修索赔时使用。license: Apache-2.0
description: 用于退货授权、接收与检验、处置决策、退款处理、欺诈检测以及保修索赔管理的标准化专业知识。基于拥有15年以上经验的退货运营经理的见解。包括分级框架、处置经济学、欺诈模式识别和供应商回收流程。适用于处理产品退货、逆向物流、退款决策、退货欺诈检测或保修索赔时使用。
license: Apache-2.0
version: 1.0.0
homepage: https://github.com/affaan-m/everything-claude-code
origin: ECC
docs/zh-CN/skills/strategic-compact/SKILL.md
+3 -1
View File
@@ -40,7 +40,9 @@ origin: ECC
## 钩子设置
添加到你的 `~/.claude/settings.json`：
**作为插件安装？** 无需任何设置。插件的 `hooks/hooks.json` 已经注册了 `suggest-compact.js`（钩子 ID `pre:edit-write:suggest-compact`，在 `standard` 和 `strict` 钩子配置档中生效）。不要把下面的代码块复制到 `~/.claude/settings.json` — 插件安装中不存在 `~/.claude/scripts/`，并且重复注册插件钩子会导致双重执行。
**如果是手动安装**（`./install.sh`），添加到你的 `~/.claude/settings.json`：
```json
{
docs/zh-CN/skills/token-budget-advisor/SKILL.md
+2 -1
View File
@@ -1,6 +1,7 @@
---
name: token-budget-advisor
description: 在回答前，为用户提供关于消耗多少响应深度的知情选择。当用户明确希望控制响应长度、深度或令牌预算时使用此技能。触发条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"，或用户明确要求控制答案大小或深度的清晰变体。不触发条件：用户已在当前会话中指定了级别（保持该级别），请求明显是单字答案，或"token"指代认证/会话/支付令牌而非响应大小。origin: community
description: 在回答前，为用户提供关于消耗多少响应深度的知情选择。当用户明确希望控制响应长度、深度或令牌预算时使用此技能。触发条件："token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas"，或用户明确要求控制答案大小或深度的清晰变体。不触发条件：用户已在当前会话中指定了级别（保持该级别），请求明显是单字答案，或"token"指代认证/会话/支付令牌而非响应大小。
origin: community
---
# Token预算顾问（TBA）
docs/zh-TW/rules/git-workflow.md
+1 -1
View File
@@ -10,7 +10,7 @@
類型：feat、fix、refactor、docs、test、chore、perf、ci
注意：歸屬透過 ~/.claude/settings.json 全域停用。
注意：ECC 管理的安裝會在 `~/.claude/settings.json` 中設定 `"includeCoAuthoredBy": false`，因此提交預設不會附帶 `Co-Authored-By`。若要保留 Claude 的歸屬，請設定 `"includeCoAuthoredBy": true` 或設定 `attribution`；ECC 不會覆寫使用者的明確選擇。
## Pull Request 工作流程
docs/zh-TW/rules/performance.md
+2 -2
View File
@@ -7,12 +7,12 @@
- 配對程式設計和程式碼產生
- 多 agent 系統中的 worker agents
**Sonnet 4.6**（最佳程式碼模型）：
**Sonnet 5**（最佳程式碼模型）：
- 主要開發工作
- 協調多 agent 工作流程
- 複雜程式碼任務
**Opus 4.6**（最深度推理）：
**Opus 5**（最深度推理）：
- 複雜架構決策
- 最大推理需求
- 研究和分析任務
docs/zh-TW/skills/clickhouse-io/SKILL.md
+46 -41
View File
@@ -151,39 +151,43 @@ ORDER BY market_id, date;
### 批量插入（推薦）
```typescript
import { ClickHouse } from 'clickhouse'
import { createClient } from '@clickhouse/client'
const clickhouse = new ClickHouse({
url: process.env.CLICKHOUSE_URL,
port: 8123,
basicAuth: {
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
}
const clickhouse = createClient({
url: process.env.CLICKHOUSE_URL ?? 'http://localhost:8123',
username: process.env.CLICKHOUSE_USER,
password: process.env.CLICKHOUSE_PASSWORD
})
// PASS: 批量插入（高效）
async function bulkInsertTrades(trades: Trade[]) {
const values = trades.map(trade => `(
'${trade.id}',
'${trade.market_id}',
'${trade.user_id}',
${trade.amount},
'${trade.timestamp.toISOString()}'
)`).join(',')
await clickhouse.query(`
INSERT INTO trades (id, market_id, user_id, amount, timestamp)
VALUES ${values}
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: trades.map(trade => ({
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
})),
format: 'JSONEachRow'
})
}
// FAIL: 個別插入（慢）
async function insertTrade(trade: Trade) {
// 不要在迴圈中這樣做！
await clickhouse.query(`
INSERT INTO trades VALUES ('${trade.id}', ...)
`).toPromise()
await clickhouse.insert({
table: 'trades',
values: [{
id: trade.id,
market_id: trade.market_id,
user_id: trade.user_id,
amount: trade.amount,
timestamp: trade.timestamp.toISOString()
}],
format: 'JSONEachRow'
})
}
```
@@ -191,17 +195,14 @@ async function insertTrade(trade: Trade) {
```typescript
// 用於持續資料攝取
import { createWriteStream } from 'fs'
import { pipeline } from 'stream/promises'
import { Readable } from 'node:stream'
async function streamInserts() {
const stream = clickhouse.insert('trades').stream()
for await (const batch of dataSource) {
stream.write(batch)
}
await stream.end()
async function streamInserts(dataSource: AsyncIterable<Record<string, unknown>>) {
await clickhouse.insert({
table: 'trades',
values: Readable.from(dataSource, { objectMode: true }),
format: 'JSONEachRow'
})
}
```
@@ -386,14 +387,18 @@ pgClient.query('LISTEN market_updates')
pgClient.on('notification', async (msg) => {
const update = JSON.parse(msg.payload)
await clickhouse.insert('market_updates', [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
])
await clickhouse.insert({
table: 'market_updates',
values: [
{
market_id: update.id,
event_type: update.operation, // INSERT, UPDATE, DELETE
timestamp: new Date(),
data: JSON.stringify(update.new_data)
}
],
format: 'JSONEachRow'
})
})
```
docs/zh-TW/skills/golang-patterns/SKILL.md
+2 -1
View File
@@ -615,7 +615,8 @@ linters-settings:
errcheck:
check-type-assertions: true
govet:
check-shadowing: true
enable:
- shadow
issues:
exclude-use-default: false
docs/zh-TW/skills/project-guidelines-example/SKILL.md
+8 -1
View File
@@ -1,3 +1,10 @@
---
name: project-guidelines-example
description: Project-specific skill template covering architecture, patterns, testing, and deployment guidance.
metadata:
origin: ECC
---
# 專案指南技能（範例）
這是專案特定技能的範例。使用此作為你自己專案的範本。
@@ -159,7 +166,7 @@ async def analyze_with_claude(content: str) -> AnalysisResult:
client = Anthropic()
response = client.messages.create(
model="claude-sonnet-4-5-20250514",
model="claude-sonnet-5",
max_tokens=1024,
messages=[{"role": "user", "content": content}],
tools=[{
docs/zh-TW/skills/strategic-compact/SKILL.md
+3 -1
View File
@@ -29,7 +29,9 @@ description: Suggests manual context compaction at logical intervals to preserve
## Hook 設定
新增到你的 `~/.claude/settings.json`：
**以外掛安裝？** 無需任何設定。外掛的 `hooks/hooks.json` 已經註冊了 `suggest-compact.js`（Hook ID `pre:edit-write:suggest-compact`，在 `standard` 與 `strict` hook 設定檔中生效）。請勿將下方區塊複製到 `~/.claude/settings.json` — 外掛安裝中不存在 `~/.claude/scripts/`，且重複註冊外掛 hook 會導致重複執行。
**如果是手動安裝**（`./install.sh`），新增到你的 `~/.claude/settings.json`：
```json
{

Some files were not shown because too many files have changed in this diff Show More