* fix: disable Claude co-author attribution by default
* fix: harden default co-author opt-out and correct the docs
Follow-up on the co-author default in this PR.
- Remove the existsSync/writeFileSync race in the installer settings write
(CodeQL js/file-system-race, high). A single guarded read now covers the
fresh-install case, and unreadable or non-object settings are left untouched.
- Respect `attribution` as an explicit user choice. It supersedes
`includeCoAuthoredBy` in Claude Code 2.1.x, so a user who configured it would
otherwise have had a dead key written into their settings.
- Share one opt-out rule via scripts/lib/claude-commit-attribution.js instead of
duplicating it across the installer and plugin setup.
- Update the git-workflow rule and its nine mirrors and translations, which
still told users ECC does not ship this setting.
We keep writing the deprecated `includeCoAuthoredBy` key rather than
`attribution`: unknown keys fail Claude Code settings validation, so writing
`attribution` would break users on older versions.
Model-routing guidance across the rules, skills, and harness-steering docs
still recommends Sonnet 4.6 / Opus 4.5-4.6 by name. Readers on the current
generation have to map those onto Sonnet 5 / Opus 5 themselves, and the
recommendation reads as pinned to a superseded generation.
Renames the recommended models in guidance tables and updates two pinned
model IDs in code samples:
- rules/steering guidance: .cursor, .kiro, and the seven translated
performance.md copies (ja-JP, zh-CN, zh-TW, ko-KR, pt-BR, es, tr)
- skills/prompt-optimizer complexity-routing table (+ zh-CN copy)
- skills/cost-aware-llm-pipeline MODEL_SONNET constant (+ zh-CN, ja-JP)
- docs/examples project-guidelines template, which pinned the invalid ID
claude-sonnet-4-5-20250514 (+ zh-TW, ja-JP copies)
Deliberately left alone:
- The "Pricing Reference (2025-2026)" table in cost-aware-llm-pipeline.
Renaming those rows while keeping the existing per-token figures would
assert Claude 5 pricing this change has not verified.
- Executable model config (.opencode/opencode.json, agent.yaml). Those pins
change real agent behavior and belong in their own reviewed change.
- Historical and illustrative references: the-shortform-guide session
transcripts, the ECC-PRO roadmap log entry, gan-style-harness's
"Opus 4.5-class"/"Opus 4.6-class" capability tiers, and
strategic-compact's deliberately generic "400k Opus 4.x" example.
- docs/ATLAS-CLOUD-GUIDE.md, which lists a third-party provider's catalog.
Documentation wording only; no behavioral change.
Co-authored-by: Phumchai Tanonsi <274848436+phumchai1515-prog@users.noreply.github.com>
devin-ai-integration[bot]GitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>affaanDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>Affaan Mustafa
- suggest-compact hook now reads the latest usage record from the session
transcript and suggests /compact at a window-scaled token threshold
(160k/200k window, 250k/1M window; COMPACT_CONTEXT_THRESHOLD and
COMPACT_CONTEXT_INTERVAL overridable), re-firing per 60k-token growth
bucket; tool-call count stays as the secondary signal (#2155)
- Codex repo marketplace now points at ./plugins/ecc instead of ./ — Codex
never discovers plugins whose local marketplace source.path is the
marketplace root (verified on Codex CLI 0.137.0); plugins/ecc is a thin
folder referencing root skills/.mcp.json per maintainer direction on
#2097; docs flag plugin mode as experimental with the upstream blocker
openai/codex#26037 linked (#2128)
- README badges for installs/stars/forks now use shields endpoint badges
backed by api.ecc.tools (live install count 3,712 vs the stale static
150), which also eliminates shields' 'Unable to select next GitHub token
from pool' render in the stars badge
Closes#2155Closes#2128
Graduate 2.0.0-rc.1 to stable. Bump version across package, plugin,
marketplace, OpenCode, agent metadata, VERSION, and all localized docs.
Add 2.0.0 release notes + README sections (en/zh/pt-BR/tr), CHANGELOG
entry, and the ECC community Discord bot (dependency-free gateway client
+ guild command registrar). Update copilot-support and release-surface
tests for the sponsored-review migration and the 2.0.0 surface.
PR #2050 updated the root README.zh-CN.md install commands after the
everything-claude-code → ECC rename, but the same stale marketplace URL
remained in nine docs/<locale>/README.md copies. Align those quick-start
and self-hosted install blocks so /plugin install ecc@ecc resolves the
ecc marketplace instead of everything-claude-code.
Several published examples contained APIs that no longer exist, code that
does not run, or model versions that drifted from reality:
- agents/performance-optimizer.md used the web-vitals v3 API
(getCLS/getFID/getLCP/getFCP/getTTFB) and reported FID. web-vitals v4
renamed the imports to onCLS/onINP/onLCP/onFCP/onTTFB and FID was
replaced by INP (target < 200ms)
- rules/common/performance.md pinned stale model versions in the
model-selection guidance; refresh to the versions the repo itself uses
(agent.yaml pins claude-opus-4-6) and add the PowerShell variant for
MAX_THINKING_TOKENS next to the bash export
- skills/python-patterns/SKILL.md: both get_value examples referenced
default_value without declaring the parameter (NameError); add
default_value: Any = None to the EAFP and LBYL signatures
- skills/frontend-patterns/SKILL.md: the custom useQuery example rebuilt
refetch whenever callers passed inline fetchers/options, re-triggering
the effect after every state update (infinite fetch loop). Keep the
latest fetcher/options in refs so refetch stays referentially stable.
The PASS-labelled useMemo example mutated its input with in-place sort;
copy before sorting
- skills/coding-standards/SKILL.md repeated the same PASS-labelled
in-place-sort-in-useMemo example; same fix
- rules/typescript/security.md used a vendor-specific OPENAI_API_KEY in
generic guidance; switch to a neutral API_KEY
Every hand-maintained copy of the affected content is synced in the same
change: locale mirrors (ja-JP, ko-KR, pt-BR, tr, zh-CN, zh-TW - each only
where it carries the affected file) and the .agents/.kiro/.cursor harness
mirrors. Two structural divergences are left alone and noted here:
.kiro/steering/performance.md has no extended-thinking control list to
carry the PowerShell variant, and docs/zh-TW/rules/performance.md keeps an
older condensed thinking section without the budget-cap line.
rules/zh/performance.md is intentionally untouched - the rules/zh tree is
being retired in a separate change
Adds de-DE docs, installer wiring, and locale tests. Pre-validated on current main with install manifest checks, markdownlint, locale-install tests, and ECC 2.0 release-surface tests.
Adds docs/th/README.md with a concise onboarding-style Thai
translation mirroring the docs/vi-VN format. Updates the language
switchers in the English, Simplified Chinese, Traditional Chinese,
Japanese, Korean, Portuguese (BR), Russian, Turkish, Vietnamese,
and Simplified Chinese docs READMEs to link to the new Thai page.
The English README remains the canonical source of truth; the Thai
page links back to it for full content.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add compact prompt-defense baselines to active ECC prompt surfaces and copied CLAUDE examples. AgentShield prompt-defense findings are now zero; local tests passed 2366/2366.
- add a current Vietnamese onboarding README adapted from stale community PR #1322
- link Vietnamese from the existing localized README language selectors
- keep stale full translation content out of tree while preserving useful contributor work
