A signature read that failed after one byte looked like a one-byte text
file and was skipped. The pipeline now runs under pipefail, so the file is
listed as unverified instead.
When cut, sort or uniq is missing, Step 7 says the tally is unavailable.
The count does not depend on them.
Step 1 skipped binaries while the role promised to verify the whole project,
so a credential in a spreadsheet, a PDF or an embedded database got a clean
PASS and never showed up in the report.
Step 7 now lists every file that doesn't read as text, plus any directory it
can't enter, and the pipeline stops on that list until a person confirms. On
this repo that's a few dozen files, all images and video, which is why they're
warnings and not failures. It doesn't try to extract or scan them: that needs
nested-archive recursion and size bounds, and I'd rather list a file than
half-scan it.
Detection is a first-byte signature check plus a whole-file NUL/control-byte
test, with file(1) only widening the list. If a detector fails, the file is
listed as unverified.
Filenames are untrusted, so Step 7 writes the paths to a manifest beside the
project directory, for a person to open, and keeps them out of its stdout
and its report section. Beside and not inside, so a re-run's text scans
can't read it back. The script prints the count itself as its last line. A
scan problem, a failed write, a walk that dies early or a run that never
reaches that line gives an unknown count, and the gate treats unknown as a
stop, not as zero.
Step 1 no longer skips *.min.js.
Tests in tests/skills/sanitizer-unreadable.test.js. Editing SKILL.md changes
the skill registry digest, so skill-triggers@1.json carries the new value.
Preserve the contributor audit and current skill-first guidance. Document all
68 shipped agents, namespace the added routes, and retain the evaluator
Prompt Defense Baseline without changing capabilities.
- Review a caller-supplied diff when given; otherwise collect committed
branch, staged, unstaged, and untracked Ruby changes. Plain `git diff`
missed staged-only and committed PR changes.
- Add update_all/delete_all/update_columns/insert_all/upsert_all on
user-reachable scopes to the HIGH tier, since they skip validations
and callbacks.
- Fix stale 67-agent catalog blocks in README.md and docs/ja-JP/README.md
and list ruby-reviewer there.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add a Ruby and Rails code reviewer agent covering Active Record query
safety, strong parameters, unsafe reflection and deserialization, XSS,
safe migrations, and RSpec/Minitest quality. It builds on the existing
rules/ruby/* and rails-patterns skill.
- Register it in .opencode/opencode.json with a matching prompt file
- Map ruby and rails to it in the orch-review workflow
- Bump the documented agent count from 68 to 69 across README, AGENTS.md,
plugin manifests, and translated docs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The pg_collation check referenced colllocale unconditionally. That column
only exists on PostgreSQL 17+; 15-16 call it colliculocale and <= 14 keep
the ICU locale in collcollate, so the query failed with "column does not
exist" on anything older than 17. Read the columns through to_jsonb(c),
which tolerates missing keys. Verified against postgres:14, :16 and :17 —
all return icu_provider = t, locale = bn-BD.
The reviewer's regex rule flagged `\w` unconditionally. In Python str
patterns `\w` does match Bengali letters, but not vowel signs or hasanta
(category M), so `re.findall(r'\w+', 'রহিম')` gives ['রহ', 'ম']. Say
that precisely, note where `\w` is ASCII-only (JavaScript, re.ASCII), and
point at [ঀ-] or \p{Bengali} instead.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
Resolve the 19 conflicts from 314 upstream commits (all language-selector
and catalog-count lines), then fix the review threads still open on #2655.
Merge resolution:
- Keep both new locales: every language selector now lists Українська and বাংলা,
including the selectors that previously carried only one of them.
- Resync catalog counts to 69 agents / 293 skills across README.md, AGENTS.md,
README.zh-CN.md, docs/zh-CN/*, docs/tr/AGENTS.md, and the plugin manifests.
Review fixes:
- install-components.json: drop the explicit skill:bengali-nlp -> framework-language
mapping so the selector resolves to the generated single-skill component.
Selecting it installed 70 skill paths plus core modules; it now installs
skills/bengali-nlp only. (Greptile P1)
- docs/bn/README.md: point the Stars/Forks/Contributors badges at affaan-m/ECC
instead of affaan-m/everything-claude-code, align the header with the other
translations, add the 2.2.1 release section, and update 67+/281+ to 69/293.
- skills/bengali-nlp/SKILL.md: split the U+09F0-U+09FA row by character type;
reject empty search queries; replace the delimiter-only prompt boundary with
structured messages; require provider and locale checks before relying on the
bn-BD ICU collation; rewrite the isdigit() anti-pattern, which claimed the
method misses Bengali digits when it accepts them; add Best Practices and
Related Skills per the CONTRIBUTING template.
- agents/bengali-reviewer.md: HIGH findings now need a fix or a written waiver
with an owner and expiry, otherwise the verdict is BLOCK.
- tests/ci/bengali-language-surface.test.js: parse fences so an unclosed
```python block fails, track a missing interpreter as skipped rather than
passed, assert the single-skill install plan, and check every language
selector instead of only the root README.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
Adds a skill + matching delegated agent that draft Conventional
Commits-style messages by reading the repo's own git log norms
(prefix, scope, subject length) instead of assuming a fixed format.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The doc-updater description said it 'Runs /update-codemaps and /update-docs',
but its tools are Read, Write, Edit, Bash, Grep, Glob — no command-invoking
tool exists in this repo, and no agent is granted one. The agent body already
does the right thing (invokes generators directly); only the description was
wrong.
Agent descriptions drive selection, so a false capability claim can misroute
work to this agent on the assumption it can run slash commands.
docs/COMMAND-AGENT-MAP.md already records the true direction
(/update-codemaps -> doc-updater), so the description now matches: the agent
backs those commands rather than invoking them.
Applied to the canonical agent file and the two active .kiro mirrors that
carried the identical string.
Addresses CodeRabbit review findings on PR #2633: security-sensitive
diffs must stay BLOCKED until a human explicitly approves (no more
SHIP IT on flagged-but-unreviewed changes), and Step 2/3 now snapshot
the pre-change state and auto-restore it if the audit or test suite
fails, so a failed run never leaves the harness partially modified.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Add missing Español link to Bengali README language selectors
- Fix Unicode character table: correct vowel range to U+0985–U+0994,
consonant range to U+0995–U+09B0, include missing vowels ঌ ও ঔ
- Preserve ZWNJ/ZWJ in zero-width character stripping (important for
Bengali conjuncts) — only remove ZWSP, BOM, and formatting chars
- Replace locale.setlocale with PyICU-first sorting approach
- Fix JavaScript sort to not mutate original array
- Use re.fullmatch for digit validation instead of re.match
- Add input sanitization guidance for Bengali prompt engineering
- Add PostgreSQL ICU collation verification step
- Make review summary template dynamic, not hardcoded
- Remove Bash from bengali-reviewer tools list for security
- Make database encoding advice database-specific (utf8mb4 for MySQL)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add Bengali README translation (docs/bn/README.md) covering guides, quick start, components, agent table, FAQ, and token optimization
- Add bengali-nlp skill (skills/bengali-nlp/SKILL.md) for Bengali text processing: Unicode normalization, conjunct handling, tokenization, script detection, Banglish handling, and dataset preparation
- Add bengali-reviewer agent (agents/bengali-reviewer.md) for reviewing code that handles Bengali text: grapheme cluster safety, NFC normalization, encoding validation, and i18n best practices
- Update language selectors across all existing README translations to include বাংলা
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
agents/harness-optimizer.md told Claude to run /harness-audit as if it
were a skill under skills/, but /harness-audit is a command backed by
scripts/harness-audit.js, and subagents cannot invoke slash commands
during their own run. Rework the agent's workflow and output contract
to follow skills/eval-harness/SKILL.md's own methodology (EVAL
DEFINITION/EVAL REPORT, Grader Types, pass@k/pass^k) instead of an
ad-hoc scorecard, and restructure the body to match the agent template
in CONTRIBUTING.md (Your Role, Workflow steps, Output Format,
Examples).
- Add Prompt Defense Baseline to agent-evaluator (was the only agent missing it)
- Update AGENTS.md to document all 67 agents (36 were previously unlisted)
- Add routing guidance for 11 additional agents in orchestration section
- Count in header kept at 67 (matches actual agents/ folder count)
Audit findings (documented but not changed):
- 3 agents (doc-updater, opensource-forker, opensource-packager) use model:haiku
with Write/Edit tools; intentional for lightweight pipeline tasks
- 6 agents have non-standard color: field (loop-operator, harness-optimizer,
gan-*, performance-optimizer); may be harness-specific UI metadata
- 7 agents are <=60 lines; thin but sufficient for narrow scope
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Normalize scalar Claude agent tool metadata across validators, adapters, dashboards, and generated surfaces with regression coverage.
2026-07-26 03:20:15 -07:00
Affaan MustafaGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat(agents): add spec-miner agent for brownfield spec extraction
Mines behavioral specs (Requirements + Invariants) from existing codebases
without OpenSpec. Fully self-bootstrapping with sample-and-expand token
strategy. Produces flat, delta-ready spec.md files with machine-parseable
metadata (id, entities, enforced, depends_on, triggers).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* docs: bump agent catalog count from 64 to 65 for spec-miner
All documentation and plugin manifests now reflect the new agent total.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: add spec-miner to routing table and clarify id field requirement
- Add spec-miner to AGENTS.md agent table and orchestration hints
- Fix id field in output template: was marked [optional] but Rule #7
requires it when enforced is known
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: update catalog skills count from 261 to 262 across all docs
The upstream added a 262nd skill but documentation references across 7 files
still reported 261. The CI validate step (scripts/ci/catalog.js --text) caught
the mismatch — this only runs on PRs, not on direct pushes to main.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: replace emoji characters with text equivalents in spec-miner agent
The unicode safety check (check-unicode-safety.js) blocks emoji characters.
Replace ❌ with FAIL: per the project's targeted replacement convention.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: add Write tool to spec-miner agent tools list
The agent generates spec output files at openspec/specs/<capability>/spec.md
and requires the Write tool to create them.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: address review bot comments - tool guardrails and metadata schema consistency
- Add Tool guardrails section: scoping Write to openspec/specs/ path, Bash to read-only
- Fix deferred/uncertainty comments to follow key: value schema (deferred: file list, uncertainty: reason)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: strengthen Prompt Defense Baseline for repository content and Bash boundaries
Add two defense points: treat all repo content as untrusted prompt-injection
vector, and explicitly reject Bash commands that mutate, exfiltrate, or write
outside the allowed openspec/specs/ path.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: strip explanatory prose from id metadata comment to preserve key:value format
The id comments included explanatory text after the value, which would be
stored verbatim in copied specs and break stable delta matching. The
explanation is already covered by Format Rule #7.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: restore README.md to upstream baseline with only catalog count changes
The README was corrupted during cherry-pick conflict resolution — an older fork
version was introduced, changing release notes links, badge URLs, sponsor
sections, and other content. Restore to upstream/main (5b173d2) and re-apply
only the agent count (64→65) using catalog.js --write.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix: restore all catalog files to upstream baseline, keep only intentional changes
The cherry-pick during rebase introduced a stale fork version of multiple files
via git checkout --theirs conflict resolution. Restore from upstream/main and
re-apply only:
- Agent counts: 64→65 (all 7 catalog-tracked files)
- Skills counts: 261→262 (where needed)
- AGENTS.md: spec-miner routing table + orchestration hint (our additions)
This reverts unintended regressions:
- Version downgrades (2.0.0 → 2.0.0-rc.1) in marketplace.json, plugin.json,
AGENTS.md, docs/zh-CN/AGENTS.md, docs/zh-CN/README.md
- Badge URL changes (api.ecc.tools dynamic → hardcoded) in Chinese READMEs
- Deleted v2.0.0 stable release sections in Chinese READMEs
- Wrong release notes path (2.0.0-rc.1 → 2.0.0) in README.md
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: lege962 <1515808962@qq.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Git commands (log, diff, show) can execute arbitrary code via:
- core.pager set in repo-local .git/config
- diff.external pointing to an attacker-controlled binary
- filter drivers in .gitattributes
Mitigation: require --no-pager flag, recommend -c core.pager=cat
to disable pager-driven execution. Moved git commands from the
unqualified allowlist to a hardened allowlist with explicit flags.
- Replace httpx.Retry references with correct httpx API usage across all files
(httpx has no built-in Retry class; use HTTPTransport/Limits instead)
- Fix _check_summary to check first 100 words (not 100 characters)
- Fix template to only show → improvement arrow for non-5 scores
- Clarify hook documentation: hook echoes reminder, does not run evaluator
- Add return type annotation to main()
- Make required parameter keyword-only in _read_file_or_text
- evaluate.py: add CRITICAL ISSUES (axes ≤ 2) section, VERDICT line
- agent-evaluator.md: match format_report output exactly (title, evidence markers, bar graphs)
- templates/evaluation-report.md: match evaluate.py output format
- All now produce identical AGENT SELF-EVALUATION REPORT structure
Single authoritative format: evaluate.py's format_report() output.
ROOT CAUSE: hooks load plugin-hook-bootstrap.js via
`node -e "...; process.argv.splice(1,0,s); require(s)"`. On Node 21+,
require.main is `undefined` under --eval, so the `if (require.main === module)`
guard was false and main() never ran — every plugin hook silently no-op'd
(e.g. the MCP-health PreToolUse hook stopped blocking). CI (Node 18/20) hid
this; it only surfaces on Node 21+. Fix: also run main() when require.main is
undefined (the eval-bootstrap case), while staying dormant on real imports.
Also clears pre-existing main debt the full local suite enforces:
- catalog:sync — README/docs agent+skill counts drifted after recent merges
- tests/ci/supply-chain-watch-workflow: update checkout SHA to the merged v6.0.3 (#2183)
- markdownlint + check-unicode-safety --write across docs/skills
Suite: 2683/2683 green under Node v25; lint + unicode clean.
Co-authored-by: ECC Test <ecc@example.test>
Several published examples contained APIs that no longer exist, code that
does not run, or model versions that drifted from reality:
- agents/performance-optimizer.md used the web-vitals v3 API
(getCLS/getFID/getLCP/getFCP/getTTFB) and reported FID. web-vitals v4
renamed the imports to onCLS/onINP/onLCP/onFCP/onTTFB and FID was
replaced by INP (target < 200ms)
- rules/common/performance.md pinned stale model versions in the
model-selection guidance; refresh to the versions the repo itself uses
(agent.yaml pins claude-opus-4-6) and add the PowerShell variant for
MAX_THINKING_TOKENS next to the bash export
- skills/python-patterns/SKILL.md: both get_value examples referenced
default_value without declaring the parameter (NameError); add
default_value: Any = None to the EAFP and LBYL signatures
- skills/frontend-patterns/SKILL.md: the custom useQuery example rebuilt
refetch whenever callers passed inline fetchers/options, re-triggering
the effect after every state update (infinite fetch loop). Keep the
latest fetcher/options in refs so refetch stays referentially stable.
The PASS-labelled useMemo example mutated its input with in-place sort;
copy before sorting
- skills/coding-standards/SKILL.md repeated the same PASS-labelled
in-place-sort-in-useMemo example; same fix
- rules/typescript/security.md used a vendor-specific OPENAI_API_KEY in
generic guidance; switch to a neutral API_KEY
Every hand-maintained copy of the affected content is synced in the same
change: locale mirrors (ja-JP, ko-KR, pt-BR, tr, zh-CN, zh-TW - each only
where it carries the affected file) and the .agents/.kiro/.cursor harness
mirrors. Two structural divergences are left alone and noted here:
.kiro/steering/performance.md has no extended-thinking control list to
carry the PowerShell variant, and docs/zh-TW/rules/performance.md keeps an
older condensed thinking section without the budget-cap line.
rules/zh/performance.md is intentionally untouched - the rules/zh tree is
being retired in a separate change
* feat(rules): add rules/react/ track
Five rule files mirroring per-language convention (coding-style,
hooks, patterns, security, testing). Each has `paths:` glob
frontmatter for auto-activation when editing matching files.
- coding-style.md: file extensions, naming, JSX, RSC boundary
- hooks.md: React hooks (NOT Claude Code hooks) — rules-of-hooks,
dep arrays, cleanup, memoization, React 19 additions
- patterns.md: container/presentational split, state location
decision tree, Suspense + error boundaries, forms, data fetching
- security.md: dangerouslySetInnerHTML, unsafe URL schemes,
server-action validation, env-var leaks, CSP
- testing.md: RTL queries, userEvent, async, MSW, axe, anti-patterns
Each file extends typescript/* and common/* rules.
* feat(skills): add react-patterns, react-testing, react-performance
Three new skills under skills/ following the SKILL.md convention.
- react-patterns: React 18/19 idioms — hooks discipline, state
location decision tree, server/client component boundary,
Suspense + error boundaries, form actions (React 19), data
fetching matrix, composition recipes, accessibility-first.
- react-testing: React Testing Library + Vitest/Jest, query
priority order, userEvent, MSW network mocking, axe a11y
assertions, RTL vs Playwright CT boundary, TDD workflow.
- react-performance: 70-rule performance ruleset adapted from
Vercel Labs react-best-practices (MIT) across 8 priority
categories — waterfalls, bundle size, server-side, client
fetch, re-render, rendering, JS micro, advanced patterns.
Includes Lighthouse / Web Vitals mapping and attribution to
upstream.
Cross-links between the three skills and out to frontend-patterns,
accessibility, e2e-testing, tdd-workflow.
* feat(agents): add react-reviewer and react-build-resolver
Two new agents covering React-specific code review and build error
resolution, plus matching .kiro/ mirrors and a routing pointer
edit on typescript-reviewer.
- react-reviewer: slim React-only lanes (hooks rules,
dangerouslySetInnerHTML, unsafe URL schemes, key prop, state
mutation, derived-state-in-effect, server/client component
boundary, accessibility, render performance, Server Action
validation, env-var leaks). Explicitly delegates generic
TypeScript/async/Node concerns to typescript-reviewer. Both
agents should be invoked together on .tsx/.jsx PRs.
- react-build-resolver: React build/bundler/runtime hydration
failures across Vite, webpack, Next.js, CRA, Parcel, esbuild,
Bun, Rsbuild. Handles JSX/TSX compile errors, tsconfig fixes,
Next.js App Router server/client boundary errors, hydration
mismatches, duplicated React copies, Tailwind/PostCSS pipeline.
- .kiro/agents/react-reviewer.json + react-build-resolver.json:
Kiro IDE format mirrors following the per-language precedent.
- typescript-reviewer: routing pointer added to its MEDIUM React
block — defers to /react-review for React-specific concerns
while keeping its block as fallback for repos that only invoke
typescript-reviewer.
All agents carry the standard Prompt Defense Baseline stanza.
* feat(commands): add /react-review /react-build /react-test
Three new slash commands invoking the React agents.
- /react-review: invokes react-reviewer. Documents the routing
rule with typescript-reviewer — both should run together on
TSX/JSX PRs. Lists CRITICAL/HIGH/MEDIUM rule categories and
the automated checks (eslint with react-hooks + jsx-a11y,
tsc --noEmit, npm audit).
- /react-build: invokes react-build-resolver. Documents bundler
detection, common failure patterns, fix strategy, and stop
conditions.
- /react-test: enforces TDD with React Testing Library + Vitest
or Jest, behavior-focused queries, userEvent + MSW patterns,
axe accessibility assertions, coverage targets.
Each command file has the required description: frontmatter and
follows the per-language command convention (cpp-test, go-test,
kotlin-test, etc.).
* chore: wire react track into manifests and stack mappings
- agent.yaml: add react-patterns, react-performance, react-testing
to the skills array; add react-build, react-review, react-test to
the commands array (alphabetically inserted to satisfy the
ci/agent-yaml-surface sync test).
- config/project-stack-mappings.json: extend the `react` stack
entry — add "react" to rules array (was ["common","typescript",
"web"]); add react-patterns, react-performance, react-testing,
accessibility to the skills array.
- docs/COMMAND-REGISTRY.json: bump totalCommands 75 -> 78; add
three new entries (react-build, react-review, react-test) with
primaryAgents / allAgents / skills wiring. react-review's
allAgents includes typescript-reviewer to reflect the dual-agent
routing convention.
- CLAUDE.md: add Skills-table row mapping *.tsx / *.jsx /
components/** to react-patterns + react-testing skills and
the /react-review, /react-build, /react-test commands.
* chore(catalog): sync counts to 62 agents / 78 commands / 235 skills
Auto-generated via `node scripts/ci/catalog.js --write --text`
after the react track additions:
- 2 new agents: react-reviewer, react-build-resolver (60 -> 62)
- 3 new commands: react-build, react-review, react-test (75 -> 78)
- 3 new skills: react-patterns, react-performance, react-testing
(232 -> 235)
Files updated by the catalog sync:
- .claude-plugin/plugin.json description string
- .claude-plugin/marketplace.json plugin description
- README.md quick-start summary, project tree, feature parity tables
- README.zh-CN.md quick-start summary
- AGENTS.md project structure summary
- docs/zh-CN/README.md parity table
- docs/zh-CN/AGENTS.md project structure summary
All counts now match the filesystem catalog (verified by
ci/catalog.test.js).
* feat(kiro): add react agent markdown companions to JSON entries
* feat(kiro): add react skills into manifests
* fix(ci): sync catalog counts, registry, and package files for react track
- .claude-plugin/{plugin,marketplace}.json: bump description counts to 62/235/78
- docs/COMMAND-REGISTRY.json: regenerate to include quality-gate and react commands
- package.json: add skills/react-{patterns,performance,testing}/ to files allowlist so npm-publish-surface aligns with install-modules manifest
* fix(react): address PR #2024 review feedback
Critical:
- Remove undefined/.claude/session-aliases.json containing __proto__ prototype-pollution
fixture committed by accident in a7333c14
High:
- agents/react-build-resolver.md: replace brittle `test -o $(grep -l ...)` and
`test -a -n $(grep ...)` detection with explicit `{ ... || grep -q ...; }` so
bundler detection no longer breaks when grep returns empty
- agents/react-build-resolver.md: drop hardcoded `npm i react@^19 react-dom@^19`
remediation; replace with version-agnostic pair-upgrade note that honors the
project's installed major (17/18/19) — surgical fix principle
- commands/react-review.md: guard `tsc --noEmit -p tsconfig.json` with
`[ -f tsconfig.json ] &&` so the review skips cleanly on JS-only projects
Medium:
- rules/react/security.md: correct the React-18-blocks-javascript-URL claim
(React only warns in dev; production navigation is not blocked)
- rules/react/security.md: correct CRA env-var exposure row (CRA exposes
REACT_APP_*, NODE_ENV, PUBLIC_URL — not 'all' variables)
- skills/react-testing/SKILL.md: instantiate QueryClient once outside the
wrapper closure so React Query cache survives re-renders (flaky-test fix)
- skills/react-testing/SKILL.md: restore console.error spy with mockRestore()
in a try/finally so the mock does not leak across tests
- commands/react-test.md: switch outer example-session fence to 4 backticks
so the inner ```tsx/```bash blocks don't prematurely terminate it
* fix(kiro): mirror react-build-resolver react 19 conditional remediation
Discussion r3272907106 flagged the kiro json variant still carrying the hardcoded
'npm i react@^19 react-dom@^19' line that the .md companion already dropped.
Replace with the same conditional, version-agnostic guidance so both variants
stay in sync.
* fix(react): bump react-build example session fence to 4 backticks
Discussion r3272907144 flagged the same nested-fence issue in
commands/react-build.md that we fixed earlier in commands/react-test.md.
The outer triple-backtick text block was being prematurely terminated by
the inner bash/tsx fences inside the Example Session.
* fix(react): bump react-review example usage fence to 4 backticks
Discussion r3272907201 flagged the same nested-fence issue in
commands/react-review.md. The outer triple-backtick text block was
being prematurely terminated by the inner tsx/ts fences inside the
Example Usage transcript.
* fix(docs): clarify commands row as legacy shims in feature parity table
Discussion r3272912003: README comparison table said 'PASS: 78 commands'
while the install-section and quick-start prose use 'legacy command shims'.
Aligned the comparison-table cell to 'PASS: 78 commands (legacy shims)' so
the count word survives the catalog-validator regex while making the legacy
nature explicit.
Widened the catalog comparison-table commands regex to tolerate an optional
parenthetical after the count word, so both the existing 'X commands' and
the new 'X commands (legacy shims)' phrasings validate without breaking
older READMEs/translations.
* Update rules/react/security.md
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* fix(react): guard tsc in react-build-resolver diagnostic commands
Discussion r3288910205: the agent prompt instructed an unconditional
'tsc --noEmit -p tsconfig.json', which adds noise (or hard-fails) on
JavaScript-only projects with no tsconfig.json or no installed TypeScript.
Replaced with 'test -f tsconfig.json && npx --yes tsc --noEmit -p tsconfig.json'
in both variants:
- agents/react-build-resolver.md
- .kiro/agents/react-build-resolver.json (prompt string mirrored)
Mirrors the same guard already applied to commands/react-review.md in de135f61.
* fix(react): pin tsc resolution to local install in build resolver
Discussion r3289054157: previous fix used 'npx --yes tsc' which auto-installs
the latest TypeScript from npm when none is local, producing version drift
and non-reproducible typecheck results across machines.
Switched to 'npx --no-install tsc' in both variants so the diagnostic uses
only the project's pinned TypeScript and fails fast if it isn't installed:
- agents/react-build-resolver.md
- .kiro/agents/react-build-resolver.json (prompt string mirrored)
* feat(counts): resolve counts for agents, skills...
* fix(ci): regen command registry for golang-testing entry
Removes stale kotlin-patterns entry to satisfy command-registry:check.
* fix: keep local Claude settings out of React track PR
---------
Co-authored-by: AlexisLeDain <a.ledain@docoon.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Affaan Mustafa <affaan@dcube.ai>
haelyra