Carry forward PR #3055 at 92f53c4c onto ef648e01, preserving contributor attribution and current main. Focused maintainer fixes reuse shared input ceilings, preserve late root context through outer bootstrap, bound frontmatter before immutable parsing, and assert real oversized input in the limits workflow.
Carry forward PR #3115ef475c79 and 780dfb78 onto current main. Preserve the newer hook-consent transforms during install and repair. Main already includes the source import fix from #3167.
* chore: retire the Everything Claude Code name, ECC only
Replace the expanded product name and the everything-claude-code slug
with ECC across READMEs, translated docs, harness folders, skills,
commands, scripts and examples. Repo URLs now point at affaan-m/ECC.
Rename repo-internal artifacts to ecc forms (ecc-conventions skill,
ecc-guardrails, ecc-research-playbook, ecc-team-config, ecc-instincts
with ecc-* ids) and update .claude/ecc-tools.json.
Legacy install ids, plugin dirs, package names and MCP prefixes stay
where existing installs resolve against them. The codex global-state
check and harness-audit repo detection accept the new name first and
the legacy one as a fallback. The Discord bot prefers ~/GitHub/ECC and
falls back to the nested legacy checkout path.
Refresh the skill-triggers registryDigest for the changed skill text.
* fix(ecc-tools): drop managed paths to the removed Claude repo skill
.claude/skills/<repo-skill>/SKILL.md was deleted in #2770 but stayed listed in
ecc-tools.json and the team config. Remove those entries and point the Claude
Code adapter at the existing .agents/skills/ecc-conventions/SKILL.md.
Preserve the Bengali and MyBatis catalog additions, keep Laravel storage examples disk-consistent, isolate ECC 2 test configuration with private permissions, and verify every command-referenced runtime script is published.
`package.json` `files[]` enumerates each top-level `scripts/*.js` by hand, and
`scripts/github-coordination.js` was never added. npm therefore drops it from
the tarball while `scripts/lib/` still ships wholesale, so only the CLI entry
disappears.
All seven `/epic-*` commands ship in `commands/` and each instructs the agent
to run:
node scripts/github-coordination.js <command> <issue> --repo <owner/repo>
so anyone who installs from npm -- including the documented
`npm i -g ecc-universal` path -- gets seven commands that cannot run:
Error: Cannot find module '.../ecc-universal/scripts/github-coordination.js'
It works from a git clone, which is what masked it locally.
Add the missing `files[]` entry, the matching publish-surface allowlist entry in
`tests/scripts/npm-publish-surface.test.js` (CONTRIBUTING asks for both), and a
guard test that fails when any published command invokes a `scripts/*.js` that
the publish surface does not cover. The guard reproduces this exact bug: with
`package.json` reverted it fails naming only `github-coordination.js`.
Refs #3270
Preserve the original contributor histories and apply the exact independently reviewed repair.
Source-Parent: aa0ea42882
Review-Manifest-SHA256: 3d35033783c03f7660b6795e20c1de588fc1cd48850b208e36add955e2446ad7
Keep the original wrapper assertions while supervising owned child groups through pipe closure, reporting failed capability probes, and preserving aggregate counts.
Reviewed-Base: 807f07a687
Source-Manifest-SHA256: 75176a5cfe5345cc93c20fb748ba5a1f159fdeb171b12ae7a8619979fa55edd9
Final-Source-SHA256: 691cb15f7356845a2cc4f84277ff5fd24cd6210ec9995ffefea0ab19509ba076
Preserve current SerpApi terms and release history while moving inactive Mike sponsorship into past sections across affected pages. Add focused document contract coverage.
Source-PR: #3061
Source-Head: 7c1df74a60
Integration-Base: d3b8a3e908
Reviewed-Manifest: bc736b95c8dfd668a89fe256b61c7bd5cc3cb357e30858e93f99260324e26639
Preserve contributor history and current-main behavior while resolving the exact reviewed follow-up.
Source-PR: https://github.com/affaan-m/ECC/pull/3241
Source-Parent: 83f19dee14
Review-Manifest-SHA256: 638af3690929ac4e39066387a87236ddd1ba00e07874b3c2b5b23aa0b22bfbba
Preserve the contributor pin and current main. Keep both default connector declarations at the exact official 1.10.1 release and retain user-managed configuration behavior.
Source-PR: https://github.com/affaan-m/ECC/pull/3233
Source-Head: 62bf2b2910
Integration-Main: d3b8a3e908
Preserve the contributor security repair and current main. Apply the artifact sandbox to SVG document responses and report unavailable symlink checks separately from passing assertions.
Source-PR: https://github.com/affaan-m/ECC/pull/3241
Source-Head: d237e1972f
Integration-Main: d3b8a3e908
* fix(install): make install.sh robust to sh/dash invocation
Two related portability fixes so `sh install.sh` behaves correctly
even though the script is written for bash:
- The cygpath detection used the bash-only `&>/dev/null` redirection.
dash misparses `&>`, so `command -v cygpath &>/dev/null` always took
the true branch and tried to run the nonexistent `cygpath` binary,
failing with "cygpath: not found". Switched to the POSIX-portable
`>/dev/null 2>&1` form.
- Some dash builds don't support `set -o pipefail`, so `sh install.sh`
can fail immediately at that line before even reaching the cygpath
check (or the `[[ ... ]]` symlink-resolution logic further down).
Added a guard that re-execs the script under bash when the current
shell lacks bash capabilities, so the rest of the bash-only syntax
always runs under a real bash regardless of the invoking shell. The
guard probes for the `[[` compound command directly (via
`eval '[[ 1 == 1 ]]'`) rather than trusting the $BASH_VERSION
environment variable, since that variable could be inherited or
spoofed under a non-bash shell and cause the guard to be skipped.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019XBaBRjaZgwhrZtYoqcQfp
* test(install): cover the sh install.sh re-exec path
Greptile flagged that the bash re-exec guard added in install.sh has
no automated coverage, since the existing test helper only invoked
the wrapper via `bash`. Adds two regression tests:
- "delegates to the Node installer when invoked via a POSIX sh
wrapper" — runs the script via `sh` and asserts the args/cwd still
reach the Node installer correctly.
- "re-execs into bash under sh even when BASH_VERSION is spoofed in
the environment" — exercises the eval '[[ 1 == 1 ]]' capability
probe directly, guarding against a regression back to trusting the
(spoofable) $BASH_VERSION variable.
CodeRabbit then pointed out that the second test used generic `sh`,
which could trivially pass without exercising the re-exec branch at
all if `sh` ever resolves to bash on some system. Added a
findPosixOnlyShell() helper that prefers `dash` (falling back to
checking `sh`, and skipping with an explicit message if neither
genuinely lacks bash's `[[`), so the test reliably exercises the
branch it claims to cover instead of passing vacuously.
CodeRabbit then flagged that the skip path itself was miscounted as
a pass (the callback returned normally, so `test()` reported success
and `passed` was incremented even though nothing executed). Moved
the findPosixOnlyShell() check outside the test() registration, so
the test is only registered — and only counted — when a genuinely
POSIX-only shell is actually available; otherwise it's excluded from
both the passed and failed counts with an explicit skip line.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019XBaBRjaZgwhrZtYoqcQfp
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
haelyra