Resolve six conflicts:
- hooks/hooks.metadata.json: keep this branch's gateguard description and
fingerprint, add upstream's hookify-runtime entries.
- package.json: keep both gateguard-report.js and github-coordination.js.
- scripts/hooks/gateguard-fact-force.js, tests/hooks/gateguard-fact-force.test.js,
skills/gateguard/SKILL.md: upstream added a simpler session denial cap; this
branch already has the fuller one (cap threaded through
markCheckedAndCountDenial, malformed-value warning, miss and target notes),
so keep it. Upstream's taskset and su wrapper handling, fail-closed
recursion limit and soft-hyphen sanitising merged cleanly and their tests pass.
- manifests/context-packs/skill-triggers@1.json: take upstream's file and
recompute registryDigest for the merged registry.
Follow up PR #3187 at 38b8c07f while preserving the original contribution history and all current-main helper bodies. Remove both CI safety-suite exclusions, clean stale imports and the warning glyph, retain shipped test/coverage entrypoints, and keep unknown test totals honest. The tree matches the fully tested 6246-pass/325-file tree; disposable Claude/OpenCode lifecycle passes.
Carry forward PR #3049 at 65e6e5ee and repair its missing npm lockfile update. Preserve the exact canonical Yarn lock and confirm the actual OpenCode build/runtime workflow with clean npm installation. Existing audit findings are unchanged from the assigned base.
Three review findings, all verified before fixing.
1. Publish surface (blocking). package.json `files` lists
scripts/gemini-adapt-agents.js but not this script, so the npm tarball
omitted it and ecc-universal users hit MODULE_NOT_FOUND. Added to `files`
and to the allowlist in tests/scripts/npm-publish-surface.test.js, which now
passes 2/2.
2. CRLF agents were silently skipped. The frontmatter regex matched LF only, so
a Windows-saved agent was reported as 'already compatible' while still
carrying tools: Read, Bash and color: teal -- a success message with no
adaptation. Normalize to LF, adapt, then restore the original ending style.
Reproduced before and after: the same CRLF fixture went from 'Updated 0' with
Read/teal intact to 'Updated 1' with read_file/cyan and CRLF preserved.
3. Unknown flags were discarded. Because the script rewrites files in place,
`--dry-run` rewrote every installed agent and exited 0. parseArgs now throws
on any unrecognized option before a directory is selected.
Tests: 12/12 (added CRLF preservation and no-mutation-on-unknown-flag),
gemini-adapt-agents 4/4 unaffected, npm-publish-surface 2/2. Re-run against all
68 canonical definitions: 68 updated, second run 0 updated, no Claude-shaped
frontmatter remaining, no spurious CRLF introduced.
Note: findings 2 and 3 apply equally to scripts/gemini-adapt-agents.js, which
has the same LF-only regex and the same flag filter. Left unchanged here to keep
this PR scoped to the Qwen adapter; worth a follow-up.
Add Arabic (ar) localization guide and glossary, register the locale:ar component and docs-ar module across install manifests, and wire test coverage.
Contributed-by: @taljeri (taljeri)
Signed-off-by: taljeri <318237806+taljeri@users.noreply.github.com>
Brings in the three commits main gained since the branch's merge base: the 2.2.3
release, retiring the Everything Claude Code name for ECC, and the ja-JP sponsor
update. 227 files arrive from main; two conflicted.
CHANGELOG.md: the branch had added an Unreleased section and main a released
2.2.3 section, both at the top. Both are kept verbatim with Unreleased above
2.2.3, since none of the branch's entries shipped in that release.
manifests/context-packs/skill-triggers@1.json: both sides had recomputed
registryDigest from the same earlier value to different results, and neither is
the digest of the merged tree. It is recomputed with loadContextRegistry over the
merged tree and only that field changes; triggers and triggersDigest are
untouched on both sides. validate-context-profiles passes.
All twelve CI validators pass. The full suite reports 44 failures in seven files;
43 of them fail by name and count identically on an unmodified upstream/main, and
the remaining one, plugin-hook-bootstrap, fails only inside run-all and passes in
isolation on both trees. The merge introduces no failing test that main does not
already have.
Keep both the new Polski locale and Bengali in every language switcher,
locale list and alias map; cross-link docs/pl and docs/bn. Resync catalog
counts (69 agents, 294 skills) and the skill-trigger registry digest.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
`package.json` `files[]` enumerates each top-level `scripts/*.js` by hand, and
`scripts/github-coordination.js` was never added. npm therefore drops it from
the tarball while `scripts/lib/` still ships wholesale, so only the CLI entry
disappears.
All seven `/epic-*` commands ship in `commands/` and each instructs the agent
to run:
node scripts/github-coordination.js <command> <issue> --repo <owner/repo>
so anyone who installs from npm -- including the documented
`npm i -g ecc-universal` path -- gets seven commands that cannot run:
Error: Cannot find module '.../ecc-universal/scripts/github-coordination.js'
It works from a git clone, which is what masked it locally.
Add the missing `files[]` entry, the matching publish-surface allowlist entry in
`tests/scripts/npm-publish-surface.test.js` (CONTRIBUTING asks for both), and a
guard test that fails when any published command invokes a `scripts/*.js` that
the publish surface does not cover. The guard reproduces this exact bug: with
`package.json` reverted it fails naming only `github-coordination.js`.
Refs #3270
