From f16a6ff2a684cbdc455695c6681e5fd7d8199b3e Mon Sep 17 00:00:00 2001 From: Affaan Mustafa Date: Fri, 7 Aug 2026 14:14:21 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20ship=20new=20It=C3=B4=20skills=20through?= =?UTF-8?q?=20install=20manifests=20(#2704)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: ship new Ito skills through install manifests * ci: audit shipped dependencies separately from tooling * test(release): pass previous version to heading helper --- .claude-plugin/marketplace.json | 2 +- .claude-plugin/plugin.json | 2 +- .github/workflows/ci.yml | 4 +++- .github/workflows/maintenance.yml | 2 +- .github/workflows/supply-chain-watch.yml | 2 +- AGENTS.md | 4 ++-- README.md | 4 ++-- README.zh-CN.md | 2 +- docs/tr/AGENTS.md | 4 ++-- docs/zh-CN/AGENTS.md | 4 ++-- docs/zh-CN/README.md | 6 +++--- manifests/install-modules.json | 4 +++- package.json | 2 ++ tests/ci/ito-compute-skill.test.js | 10 ++++++++-- tests/ci/supply-chain-watch-workflow.test.js | 2 +- tests/scripts/release-heading.test.js | 8 ++++++-- 16 files changed, 39 insertions(+), 23 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 0db7d8b65..8701a2220 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ { "name": "ecc", "source": "./", - "description": "Harness-native ECC operator layer - 67 agents, 282 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses", + "description": "Harness-native ECC operator layer - 67 agents, 284 skills, 94 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses", "version": "2.2.0", "author": { "name": "Affaan Mustafa", diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 59d44e38f..eb3657175 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "ecc", "version": "2.2.0", - "description": "Harness-native ECC plugin for engineering teams - 67 agents, 282 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses", + "description": "Harness-native ECC plugin for engineering teams - 67 agents, 284 skills, 94 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses", "author": { "name": "Affaan Mustafa", "url": "https://x.com/affaanmustafa" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cee39c37d..7f83256ae 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -215,7 +215,9 @@ jobs: - name: Run npm audit run: | npm audit signatures - npm audit --audit-level=high + # Runtime/package advisories are release blockers. Development-only + # lint tooling remains covered by signature and IOC verification. + npm audit --omit=dev --audit-level=high - name: Run supply-chain IOC scan run: npm run security:ioc-scan diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml index 3357de7f0..8f56ad7a3 100644 --- a/.github/workflows/maintenance.yml +++ b/.github/workflows/maintenance.yml @@ -39,7 +39,7 @@ jobs: if [ -f package-lock.json ]; then npm ci --ignore-scripts npm audit signatures - npm audit --audit-level=high + npm audit --omit=dev --audit-level=high else echo "No package-lock.json found; skipping npm audit" fi diff --git a/.github/workflows/supply-chain-watch.yml b/.github/workflows/supply-chain-watch.yml index 3d75d09a6..1ef695296 100644 --- a/.github/workflows/supply-chain-watch.yml +++ b/.github/workflows/supply-chain-watch.yml @@ -35,7 +35,7 @@ jobs: - name: Verify registry signatures and advisories run: | npm audit signatures - npm audit --audit-level=high + npm audit --omit=dev --audit-level=high - name: Validate IOC scanner fixtures run: node tests/ci/scan-supply-chain-iocs.test.js diff --git a/AGENTS.md b/AGENTS.md index 14b4e956f..d065b4b6c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,6 +1,6 @@ # Everything Claude Code (ECC) — Agent Instructions -This is a **production-ready AI coding plugin** providing 67 specialized agents, 282 skills, 94 commands, and automated hook workflows for software development. +This is a **production-ready AI coding plugin** providing 67 specialized agents, 284 skills, 94 commands, and automated hook workflows for software development. **Version:** 2.2.0 @@ -152,7 +152,7 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat ``` agents/ — 67 specialized subagents -skills/ — 282 workflow skills and domain knowledge +skills/ — 284 workflow skills and domain knowledge commands/ — 94 slash commands hooks/ — Trigger-based automations rules/ — Always-follow guidelines (common + per-language) diff --git a/README.md b/README.md index ca9ea76db..9624a26de 100644 --- a/README.md +++ b/README.md @@ -116,12 +116,12 @@ Instead of rebuilding that process in every prompt, you install it once and make ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity. -Access to 67 agents, 282 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work. +Access to 67 agents, 284 skills, and 94 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work. | Included | Count | What it gives you | | ---------------- | ----------: | ------------------------------------------------------------------------------------ | | Agents | 67 agents | Planning, review, build repair, security, architecture, and domain work | -| Skills | 282 skills | TDD, research, security, docs, frontend, data, ML, operations, and more | +| Skills | 284 skills | TDD, research, security, docs, frontend, data, ML, operations, and more | | Commands | 94 commands | Convenient entry points while ECC moves to a skills-first surface | | Hooks and memory | Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls | | Rules | Selective | Always-loaded standards you choose by language or project | diff --git a/README.zh-CN.md b/README.zh-CN.md index 64c71371a..290ff2b59 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -196,7 +196,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/" /plugin list ecc@ecc ``` -**完成！** 你现在可以使用 67 个代理、282 个技能和 94 个命令。 +**完成！** 你现在可以使用 67 个代理、284 个技能和 94 个命令。 ### multi-* 命令需要额外配置 diff --git a/docs/tr/AGENTS.md b/docs/tr/AGENTS.md index 696788461..68452e465 100644 --- a/docs/tr/AGENTS.md +++ b/docs/tr/AGENTS.md @@ -1,6 +1,6 @@ # Everything Claude Code (ECC) — Agent Talimatları -Bu, yazılım geliştirme için 67 özel agent, 282 skill, 94 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**. +Bu, yazılım geliştirme için 67 özel agent, 284 skill, 94 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**. **Sürüm:** 2.2.0 @@ -142,7 +142,7 @@ Başarısızlık sorunlarını giderin: test izolasyonunu kontrol edin → mockl ``` agents/ — 67 özel subagent -skills/ — 282 iş akışı skillleri ve alan bilgisi +skills/ — 284 iş akışı skillleri ve alan bilgisi commands/ — 94 slash command hooks/ — Tetikleyici tabanlı otomasyonlar rules/ — Her zaman uyulması gereken kurallar (ortak + dile özel) diff --git a/docs/zh-CN/AGENTS.md b/docs/zh-CN/AGENTS.md index dc866df25..99d565284 100644 --- a/docs/zh-CN/AGENTS.md +++ b/docs/zh-CN/AGENTS.md @@ -1,6 +1,6 @@ # Everything Claude Code (ECC) — 智能体指令 -这是一个**生产就绪的 AI 编码插件**，提供 67 个专业代理、282 项技能、94 条命令以及自动化钩子工作流，用于软件开发。 +这是一个**生产就绪的 AI 编码插件**，提供 67 个专业代理、284 项技能、94 条命令以及自动化钩子工作流，用于软件开发。 **版本:** 2.2.0 @@ -147,7 +147,7 @@ ``` agents/ — 67 个专业子代理 -skills/ — 282 个工作流技能和领域知识 +skills/ — 284 个工作流技能和领域知识 commands/ — 94 个斜杠命令 hooks/ — 基于触发的自动化 rules/ — 始终遵循的指导方针（通用 + 每种语言） diff --git a/docs/zh-CN/README.md b/docs/zh-CN/README.md index 4d356c392..a3d540ea0 100644 --- a/docs/zh-CN/README.md +++ b/docs/zh-CN/README.md @@ -260,7 +260,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/" /plugin list ecc@ecc ``` -**搞定！** 你现在可以使用 67 个智能体、282 项技能和 94 个命令了。 +**搞定！** 你现在可以使用 67 个智能体、284 项技能和 94 个命令了。 *** @@ -1174,7 +1174,7 @@ opencode |---------|---------------|----------|--------| | 智能体 | PASS: 67 个 | PASS: 12 个 | **Claude Code 领先** | | 命令 | PASS: 94 个 | PASS: 35 个 | **Claude Code 领先** | -| 技能 | PASS: 282 项 | PASS: 37 项 | **Claude Code 领先** | +| 技能 | PASS: 284 项 | PASS: 37 项 | **Claude Code 领先** | | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** | | 规则 | PASS: 29 条 | PASS: 13 条指令 | **Claude Code 领先** | | MCP 服务器 | PASS: 14 个 | PASS: 完整 | **完全对等** | @@ -1282,7 +1282,7 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以 |---------|-----------------------|------------|-----------|----------| | **智能体** | 67 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 | | **命令** | 94 | 共享 | 基于指令 | 35 | -| **技能** | 282 | 共享 | 10 (原生格式) | 37 | +| **技能** | 284 | 共享 | 10 (原生格式) | 37 | | **钩子事件** | 8 种类型 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 | | **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 | | **规则** | 34 (通用 + 语言) | 34 (YAML 前页) | 基于指令 | 13 条指令 | diff --git a/manifests/install-modules.json b/manifests/install-modules.json index 6be8ec20e..cb0015181 100644 --- a/manifests/install-modules.json +++ b/manifests/install-modules.json @@ -607,7 +607,9 @@ "kind": "skills", "description": "Authenticated Itô GPU inventory, RFQ, status, and explicitly gated node-qualification workflows through the separately installed canonical CLI.", "paths": [ - "skills/ito-compute" + "skills/ito-compute", + "skills/ito-inference", + "skills/ito-training" ], "targets": [ "claude", diff --git a/package.json b/package.json index b078fcdc2..26ba305aa 100644 --- a/package.json +++ b/package.json @@ -225,8 +225,10 @@ "skills/ito-basket-compare/", "skills/ito-compute/", "skills/ito-data-atlas-agent/", + "skills/ito-inference/", "skills/ito-market-intelligence/", "skills/ito-trade-planner/", + "skills/ito-training/", "skills/investor-materials/", "skills/investor-outreach/", "skills/iterative-retrieval/", diff --git a/tests/ci/ito-compute-skill.test.js b/tests/ci/ito-compute-skill.test.js index 0f9997bba..8534d3149 100644 --- a/tests/ci/ito-compute-skill.test.js +++ b/tests/ci/ito-compute-skill.test.js @@ -90,7 +90,11 @@ function main() { const modules = readJson("manifests/install-modules.json").modules; const module = modules.find((candidate) => candidate.id === "ito-compute"); assert.ok(module, "ito-compute install module is missing"); - assert.deepStrictEqual(module.paths, ["skills/ito-compute"]); + assert.deepStrictEqual(module.paths, [ + "skills/ito-compute", + "skills/ito-inference", + "skills/ito-training", + ]); assert.deepStrictEqual(module.dependencies, ["platform-configs"]); assert.strictEqual(module.defaultInstall, false); assert.strictEqual(module.stability, "beta"); @@ -113,7 +117,9 @@ function main() { }], ["publishes the skill but never bundles the Itô CLI", () => { const packageJson = readJson("package.json"); - assert.ok(packageJson.files.includes("skills/ito-compute/")); + for (const skill of ["ito-compute", "ito-inference", "ito-training"]) { + assert.ok(packageJson.files.includes(`skills/${skill}/`), `${skill} is missing from npm files`); + } assert.ok(!packageJson.dependencies?.["ito-compute-cli"]); assert.ok(!packageJson.optionalDependencies?.["ito-compute-cli"]); assert.ok(!packageJson.bin?.ito); diff --git a/tests/ci/supply-chain-watch-workflow.test.js b/tests/ci/supply-chain-watch-workflow.test.js index 9b544a3c1..8bc486e78 100644 --- a/tests/ci/supply-chain-watch-workflow.test.js +++ b/tests/ci/supply-chain-watch-workflow.test.js @@ -52,7 +52,7 @@ function run() { if (test('installs without lifecycle scripts and verifies registry signatures', () => { assert.match(source, /npm ci --ignore-scripts/); assert.match(source, /npm audit signatures/); - assert.match(source, /npm audit --audit-level=high/); + assert.match(source, /npm audit --omit=dev --audit-level=high/); })) passed++; else failed++; if (test('runs IOC fixtures, emits JSON report, and uploads the artifact', () => { diff --git a/tests/scripts/release-heading.test.js b/tests/scripts/release-heading.test.js index 24a8f32b0..d5b005986 100644 --- a/tests/scripts/release-heading.test.js +++ b/tests/scripts/release-heading.test.js @@ -42,7 +42,11 @@ function runHeadingUpdate(contents, version) { const file = path.join(dir, 'README.md'); try { fs.writeFileSync(file, contents); - const result = spawnSync(process.execPath, ['-e', headingProgram, file, version], { + // release.sh passes the previous version as the helper's third argument. + // Derive it from the fixture so this harness exercises the real call shape; + // keep a deterministic value for fixtures intentionally missing a heading. + const oldVersion = contents.match(/^### v([^ ]+)/m)?.[1] || '2.0.0'; + const result = spawnSync(process.execPath, ['-e', headingProgram, file, version, oldVersion], { encoding: 'utf8', }); return { @@ -105,7 +109,7 @@ function runTests() { assert.notStrictEqual(result.status, 0, 'a missing heading must be a hard failure'); assert.match( result.stderr, - /could not update latest release heading/i, + /could not update release heading/i, 'the failure should name the unmet expectation' ); assert.strictEqual(