512 Commits

Include renames

Author	SHA1	Message	Date
Affaan MustafaandGitHub	56d9302f02	docs: map cross-harness control-plane roadmap (#2584) ... Map the ECC Ultra report into ten dependency-ordered execution lanes with explicit security, consent, schema, lifecycle, testing, and distribution gates.	2026-07-26 01:46:56 -07:00
Seekers2001andGitHub	ad8db87780	feat(skills): add contract-first collaboration workflow (#2567) ... Add a contract-first workflow for consumer/provider collaboration, including shared artifact authority, compatibility review, generated-type and runtime verification, and safe handling of contract-driven tooling.	2026-07-26 00:05:22 -07:00
Affaan MustafaandGitHub	33c7dbb7d6	feat(ito): expose guarded live node qualification ... Expose the canonical Itō CLI's pinned sixtytwo node-qualification path through ECC with double opt-in, explicit node/config gates, credential isolation, and no new MCP or execution authority. Validated across the full Linux, macOS, and Windows Node/package-manager matrix, hosted coverage, CodeQL, security, lint, and focused bridge tests.	2026-07-23 22:10:57 -07:00
Affaan MustafaandGitHub	bc774282e6	feat: connect ECC to canonical Ito compute CLI (#2558)	2026-07-23 19:28:55 -07:00
Affaan MustafaandGitHub	7b03a834b3	feat: add read-only Itō compute handoff (#2554) ... * feat: add read-only Itō compute handoff * fix(ito): keep handoff portable under CI * test(ito): run npm welcome through Windows shell	2026-07-23 14:35:57 -07:00
3 people	a3130f9ebf	feat(codex): add ECC navigation guide (#2525) ... * feat(codex): add ECC navigation guide * fix(codex): ship navigation guide references --------- Co-authored-by: Haley Chen <2022hachen@gmail.com>	2026-07-22 20:44:37 -04:00
Affaan MustafaandGitHub	96789caaf9	feat: add Itô compute sponsor routing and Phase 2 plan (#2546) ... * feat: add Ito compute sponsor routing * fix: harden Ito integration CI and framing	2026-07-22 03:07:45 -04:00
3 people	754b8dd76c	fix: make the installer runtime pass strict supply-chain vetting (#2503) ... * fix: make the installer runtime pass strict supply-chain vetting Remediate the four enterprise supply-chain vetting blockers from affaan-m/ECC#2502 so the installer runtime (package.json + manifests + scripts/lib/**) passes strict exact-pin evidence policy: 1. Remove the package.json `postinstall` lifecycle script (it only echoed a post-install banner) and move that banner to an explicit opt-in `npm run welcome` command. No install-time lifecycle script remains. 2. Exact-pin every dependency in package.json (dependencies + devDependencies) to the versions already resolved in package-lock.json; no ^/~ ranges. 3. Replace non-ASCII characters on the installer runtime script/config surface: em-dashes (U+2014) in scripts/lib/{path-safety,install-executor, install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in manifests/{install-components,install-modules}.json descriptions become ASCII, so strict-surface Unicode scanners are clean. 4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file already carries a complete hand-rolled validator enforcing the same schemas/install-state.schema.json (ecc.install.v1) constraints, so the installer closure is dependency-free (zero non-builtin bare requires). Refs affaan-m/ECC#2502 * fix: avoid unpinned welcome invocations Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: validate translated skill frontmatter Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: repair skill frontmatter YAML Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: add MIT license to core skill manifests; pin verification-loop tsc invocation * fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail) * chore(deps): sync lockfiles with exact-pinned package.json Regenerate package-lock.json and yarn.lock so the pinned dependency specs are reflected in both lockfiles. npm ci and Yarn's --immutable install now pass the sync check. The resolution tree is unchanged (231 yarn resolutions, byte-identical set; zero npm transitive drift); only the root descriptor strings move from ranges to the versions already resolved in the committed lockfiles. Addresses the Codex P1 on #2503. --------- Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>	2026-07-17 17:13:49 -04:00
5 people	40927950c4	fix: community-reported issues — pyproject URLs, dashboard Tkinter error, 1.x→2.0 migration guide, cyber-safeguards docs (#2481) ... * fix: repo URLs in pyproject, graceful dashboard tkinter error, 1.x->2.0 migration guide, cyber-safeguards troubleshooting Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: catch ImportError for broken tkinter installs and update About panel repo URL Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-07-09 03:53:51 -04:00
4 people	a511395613	feat: Plan Canvas, a browser review canvas for plans (#2467) ... * feat: add Plan Canvas - browser annotate-and-approve review for plan artifacts - scripts/plan-canvas.js CLI (open/await/end/stop/server; bin ecc-plan-canvas) - loopback server + ECC-styled chrome + annotation SDK + zero-dep markdown renderer - Approve/Request-changes verdicts wired to the /plan confirmation gate - plan-canvas skill, /plan-canvas command, SessionStart hook surfacing open reviews - shared scripts/lib/loopback-guard.js extracted from control-pane (API re-exported) - 121 new tests incl. full-workflow E2E; registered in manifests, catalog, registry Inspired by lavish-axi (https://github.com/kunchenguid/lavish-axi) by @kunchenguid; original ECC-native implementation, not a port. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(plan-canvas): invoke via ecc-plan-canvas bin so the skill works from any project Skill/command referenced a cwd-relative `node scripts/plan-canvas.js`, unusable outside the ECC root. Switch to the ecc-plan-canvas bin (and $CLAUDE_PLUGIN_ROOT fallback) and align CLI next_step hints so an agent can run it as a skill in any repo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(plan-canvas): render Mermaid diagrams + ship Codex cross-harness surface - markdown renderer emits <pre class="mermaid"> for ```mermaid blocks (source entity-escaped so the browser decodes it for the renderer while blocking injection) - artifact template loads a pinned Mermaid build only when a diagram is present, themed to ECC dark, securityLevel strict, graceful offline fallback to source (ECC_PLAN_CANVAS_MERMAID_URL overrides for a local mirror) - skill teaches Mermaid-for-diagrams and states the CLI+JSON loop is harness-agnostic - add .agents/skills/plan-canvas (Codex) with agents/openai.yaml interface manifest - register in install-modules workflow-quality paths; docs updated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(plan-canvas): add demo screenshot Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): sync yarn.lock with new bin; add contributor checklist - yarn.lock records the ecc-plan-canvas bin so Yarn hardened-mode install no longer wants to modify the lockfile on public PRs - PR template + CONTRIBUTING gain a pre-push checklist covering the lockfile trap and the full skill/command/CLI registration surfaces Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Haley Chen <2022hachen@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 17:12:48 -04:00
9 people	2d40baacbd	fix: resolve open-issue cluster (#2295, #2298, #2303–#2306, #2340) + createdTime fallback bug (#2408) ... * fix: resolve issue cluster (#2295,#2298,#2303,#2304,#2305,#2306,#2340) + createdTime fallback bug - session-manager: fix createdTime birthtime||ctime fallback that never fired (a Date is always truthy); use birthtimeMs>0 check via resolveCreatedTime() - installer: rewrite source-relative rules/skills links for the injected ecc/ namespace so installed skills resolve correctly (#2340) - continuous-learning-v2: drop unused mock import (#2305); standardize bash shebangs (#2303); poll for PID file instead of fixed sleep (#2295); rename _ecc_* -> _clv2_* (#2304); align promotion confidence docs (#2298); de-brittle Scope Decision Guide cross-reference (#2306) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(observer): portable mktemp template on BSD/macOS (#2417); correct false attribution-disabled claim in git-workflow docs (#2426) (#2430) Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: remove duplicate resolveCreatedTime introduced by merge (no-redeclare) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: restore heading-based Scope Decision Guide ref (line numbers drift) + keep behavioral #2340 install test --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Affaan Mustafa <me@affaanmustafa.com>	2026-07-03 21:10:45 -07:00
JunandGitHub	52f7e82a61	docs(continuous-learning-v2): observer.md promotion uses avg confidence, not per-instance (#2411) ... SKILL.md and _promote_auto already use avg_conf >= 0.8; observer.md (EN + zh-CN) was missed and still says per-instance. Same drift as #2274. Refs #2298.	2026-07-03 20:37:03 -07:00
Nidelson GimenezandGitHub	8c3a3040ae	fix(skills): document plugin vs manual hook setup for strategic-compact (#2420) ... The Hook Setup section told all users to wire `node ~/.claude/scripts/hooks/suggest-compact.js` into settings.json. That path only exists on manual `./install.sh` installs; for plugin installs the hook is already registered by the plugin's hooks/hooks.json (id `pre:edit-write:suggest-compact`, standard/strict profiles), so the snippet fails silently and would double-register the hook. - Add a plugin-install note (mirrors continuous-learning-v2 wording) and scope the snippet to manual installs — applied to the canonical skill, the .kiro mirror, and ja-JP/zh-CN/zh-TW/ko-KR translations - ko-KR: also replace the settings.json snippet that used `${CLAUDE_PLUGIN_ROOT}`, which does not resolve in user settings.json	2026-07-03 20:36:59 -07:00
28winz-botandGitHub	fb37c23c84	fix(golang-patterns): replace removed govet check-shadowing with enable: [shadow] (#2423) ... golangci-lint deprecated the govet `check-shadowing` setting in v1.57.0 and later removed it; a config using it now errors. The current v1-format way to enable the shadow analyzer is `govet.enable: [shadow]`. Applies to the source skill and the ja-JP, zh-CN, zh-TW, ko-KR, tr translated copies. Refs: https://golangci-lint.run/docs/product/migration-guide/	2026-07-03 20:36:50 -07:00
28winz-botandGitHub	ee2663d5b2	fix(clickhouse-io): use official @clickhouse/client instead of unmaintained clickhouse package (#2422) ... * fix(clickhouse-io): use official @clickhouse/client instead of unmaintained clickhouse package The example imported the third-party `clickhouse` (TimonKK) package and used its API (new ClickHouse, .query().toPromise(), .insert().stream()). Migrate to the official @clickhouse/client: createClient() and structured clickhouse.insert({ table, values, format }). The structured values array also removes the previous SQL string-interpolation anti-pattern. Applies to the source skill and the ja-JP, zh-CN, zh-TW, ko-KR translated copies (translated code comments preserved). Refs: https://clickhouse.com/docs/integrations/javascript * fix(clickhouse-io): migrate remaining insert calls to @clickhouse/client Address review feedback: the earlier commit missed two spots that still used the legacy clickhouse API. - CDC example: clickhouse.insert('market_updates', [...]) -> clickhouse.insert({ table, values, format: 'JSONEachRow' }) - Single-row insertTrade: map the row to the column shape (same as the bulk path) instead of passing the raw trade object. Applies to the source skill and the ja-JP, zh-CN, zh-TW, ko-KR copies.	2026-07-03 20:36:46 -07:00
+2838 people	7a46a7b8fc	docs: MRR-biased ECC Pro + AgentShield security roadmap (#2321) ... * docs: add MRR-biased ECC Pro + AgentShield security roadmap Output of a multi-agent survey + research pass: capability map of AgentShield and ECC Pro, triage of every open PR/issue on both repos, and web research on competitors, unbuilt ideas, and dev-tool demand. 17 items across 4 themes (now/next/later) scored for free-to-paid conversion, each linked to the real PRs/issues that implement it. Includes the reusable workflow script that generated it. Headline: ecc-agentshield is ~30K downloads/month with near-zero monetization bridge, and the agent-proximity moat is computed but never rendered. Roadmap removes trust blockers (FP cluster), makes the moat visible (PR #2320), then productizes local CLI primitives into hosted Pro surfaces. * docs(design): add hosted Pro fleet dashboard design (Sentry for agent security) Implementation-ready architecture for the flagship 'next' roadmap item: a hosted, multi-repo agent-security posture dashboard built on the existing ecc-agentshield primitives (evidence-pack bundleDigest + operatorReadback, watch/drift DriftResult, runtime NDJSON, baseline diff, policy promotion). Covers free-vs-Pro scope, ingestion/query API grounded in real field names, data model + time-series rollups, auth/RBAC + redaction guarantees, MVP build order, and pricing hooks. Companion to ECC-PRO-SECURITY-ROADMAP.md. * feat(control-pane): serve 3D agent-airspace viz + /api/proximity feed (#2320) Adds the Layer 4 observability view to the control pane: a self-contained, dependency-free 3D point-cloud of the agent airspace (positions from the proximity embedding, sized by working set, colored by collision risk, links for converging pairs) plus an XSS-safe advisory panel that polls every 5s. - proximity-viz.js: renderProximityVizHtml() (canvas projection, no external JS) - server.js: GET /proximity (page) + GET /api/proximity (snapshot.proximity feed) - test: asserts both routes serve and the feed carries positions/links/advisories * fix(clv2): escape $HOME before pgrep -f in migrate-homunculus.sh (#2339) * fix(clv2): escape $HOME before pgrep -f in migrate-homunculus.sh pgrep -f treats its argument as an extended regular expression, but the running-observer guard interpolated $HOME unescaped. Paths containing regex metacharacters (e.g. /home/user.name, /home/c++dev, /home/user (work)) made the match over-broad or invalid, causing either a false negative (live observer missed, migration proceeds and risks registry corruption) or a false positive (migration blocked unnecessarily). Escape the ERE metacharacters in $HOME via sed before building the pattern so the home prefix is matched literally while the trailing .*observer-loop\.sh regex is preserved. Portable across BSD and GNU sed. Fixes #2301 * test(clv2): add regression test for migrate-homunculus.sh $HOME escaping Guards the #2301 fix: extracts the script's sed escaping command and asserts the resulting pgrep -f pattern matches the literal home path while no longer over-matching a regex-expanded decoy (HOME=/home/user.name must not match /home/userXname). Also pins that the guard uses escaped_home rather than $HOME directly. Follows the existing clv2 shell-test convention in tests/hooks/observe-entrypoint-allowlist.test.js. Refs #2301 * test(clv2): skip migrate-homunculus escaping test on Windows The test relies on POSIX bash/sed/grep -E semantics, which differ on the Windows CI runners. Guard with the same process.platform === 'win32' early exit used by tests/hooks/observe-subdirectory-detection.test.js so the bash-dependent assertions only run on POSIX platforms. Refs #2301 * fix(clv2): harden registry writes and project deletion (#2294, #2297) (#2323) Two security-priority fixes in continuous-learning-v2/scripts/instinct-cli.py: - #2294: _write_registry wrote projects.json without the advisory lock that _update_registry holds, so concurrent 'projects delete/gc/merge' could race an observe-time update and corrupt the registry. Extract the lock into a shared _registry_lock() context manager and use it in both writers. - #2297: _remove_project_storage called shutil.rmtree on PROJECTS_DIR/project_id with no containment check. Add defense-in-depth: resolve the path and refuse to delete anything that is not strictly inside PROJECTS_DIR (or is the root itself), so a relaxed validator or future caller can never cause an arbitrary-directory delete. Adds 5 pytest regression tests (atomic write under lock, contained delete, missing-dir no-op, traversal refused, root refused). Node integration suite (tests/scripts/instinct-cli-projects.test.js) green 9/9. * feat(workflows): add orch-review native Workflow pilot (#2363) * feat(workflows): add orch-review native Workflow pilot Port orch-pipeline Phase 5 (Review) to a native Claude Code Workflow script. The gated outer loop stays in the main conversation; this script owns only the autonomous review+verify segment between the two human gates: 1. Review — reviewers fan out in parallel: ecc:code-reviewer always, ecc:<language>-reviewer when args.language maps, ecc:security-reviewer when the orch-pipeline security trigger matches the diff/paths. 2. Dedup — merge findings across dimensions keyed on the normalized evidence snippet, since independent reviewers flag the same line. 3. Verify — each unique CRITICAL/HIGH finding goes to an independent adversarial verifier; MEDIUM/LOW pass through as advisory. The Review->Verify barrier is deliberate: deduping before verification stops the verifier running N times on the same bug (local testing: 11 raw findings collapsed to 4 unique, ~halving verifier cost). Existing ECC reviewer subagents are reused via agentType; reviewer output is validated by JSON schema. args is accepted as an object or a JSON-encoded string. - workflows/orch-review.workflow.js — the workflow script - workflows/README.md — invocation contract, returns shape, follow-ups CI lint is scoped to scripts/ and tests/, so the script (validated with node --check) and the README (passes markdownlint) are untouched. * fix(workflows): fail closed on invalid args and lost review dimensions Addresses the two safety findings from the PR bot review: 1. Lost review dimension (Greptile P1 / CodeRabbit Major): a reviewer agent that returns null or rejects was silently dropped by filter(Boolean), so an unreviewed security dimension could still return APPROVE. Each dimension's outcome is now captured; failures land in failedDimensions and force CHANGES_REQUESTED (incomplete). 2. Invalid args (CodeRabbit Major): an empty diff returned APPROVE and bad JSON / non-array changedFiles threw inconsistently. Input is now validated up front and rejected with a clear error — the gate fails closed instead of approving an unreviewed payload. Docs (header contract + README) updated for the new return fields (incomplete, failedDimensions, stats.failed). Remaining bot nits (evidence minLength, verify-label collision, verified->confirmed rename, contract drift) deferred as follow-ups. * fix(workflows): address remaining orch-review review nits Follow-up to the bot review (deferred items from the safety pass): - evidence: require minLength 1 in the schema, and fall back to a title+line dedup key when evidence is empty, so empty-evidence findings in one file no longer collapse onto a single key and drop (CodeRabbit). - verify label: include a slice of the normalized evidence so two CRITICAL/HIGH findings from the same file get distinct labels and do not alias under resumability (Greptile). - stats.verified -> stats.confirmed to match the "confirmed" wording used in the log and avoid ambiguity vs the refuted count (Greptile); header contract and README updated to match. Verified by running the workflow on a synthetic vulnerable diff: dedup 12 raw -> 5 unique, stats.confirmed populated, fail-closed fields (incomplete/failedDimensions) intact. * fix(workflows): harden verify stage and diff-only verification Addresses the second-round bot review: - Verify stage now has the same failure guard as the review stage: a rejected verifier no longer nulls out its slot (which crashed the later filter). A null return is treated as unconfirmed; a rejection keeps the finding as blocking (fail closed) so an unverifiable CRITICAL is never silently demoted to advisory (CodeRabbit @221). - verifyPrompt now instructs the skeptic to judge solely from the provided diff text and not to refute merely because the referenced file is absent from the working tree (the diff may be an unapplied PR). Fixes the false-refute seen when testing on a synthetic diff. CodeRabbit @81 (evidence minLength) was already addressed in the prior commit; this is a stale re-post on the unresolved thread. * fix(workflows): keep unverifiable blockers blocking; stop leaking error text Second-round bot review (CodeRabbit): - @218 Treat a null/failed verifier as `unverified`, not refuted. A terminal verifier failure or skip no longer demotes a CRITICAL/HIGH to advisory; it stays in `blocking` tagged "could not be verified" (fail closed). Only a genuine isReal=false verdict is refuted. Adds stats.unverified. - @189 Do not return raw subagent error text. Review/verify failures now log the raw message for operators and return only a bounded label (failedDimensions[].error = "review agent failed"). Stale re-posts this round (@81 evidence minLength, @224 verify guard) were already fixed in prior commits. * docs(workflows): enumerate bounded failedDimensions.error labels CodeRabbit (trivial): the public contract implied callers get human-readable error text, but the implementation returns only bounded labels. Enumerate them in the README returns block. * Update yarn.lock (#2342) * Add memxus configuration to mcp-servers.json (#2355) * Add memxus configuration to mcp-servers.json Added configuration for Memxus service with API key placeholder and description. * Revise description in mcp-servers.json Updated the description to include a note about reviewing stored memories to prevent prompt-injection. * Update description in mcp-servers.json Update description in mcp-servers.json * Fix for docs: Scope Decision Guide table duplicated in SKILL.md and observer.md with minor drift (#2366) #2306 Co-authored-by: angadsingh7666 <angdsingh7666@gmail.com> * fix(llm): align Claude provider with current Anthropic API (#2133) Replace invalid default model IDs (e.g. claude-sonnet-4-7) with current claude-sonnet-4-6, claude-opus-4-8, and claude-haiku-4-5. Route system messages to the API system field, enable ephemeral prompt caching, omit temperature for Opus 4.7/4.8, and surface cache usage metrics. Update the CLI model picker to match. Co-authored-by: Vladimir Đuranović <vlada@MacBook-Pro.local> Co-authored-by: Cursor <cursoragent@cursor.com> * fix(release): derive approval gate paths from version (#2383) Co-authored-by: jan <jan@w-saxs001.local> * fix(release): derive video suite paths from version (#2384) Co-authored-by: jan <jan@w-saxs001.local> * ci: isolate OMP workflow verification (#2382) Co-authored-by: jan <jan@w-saxs001.local> * fix(tests): resolve 10 failing tests on Windows (#2307) - resolve-formatter: stop findProjectRoot walk before os.homedir() to avoid mistaking global dotfiles (e.g. ~/.prettierrc) for a project root - instinct-cli-projects: detect python3/python binary at runtime; skip gracefully when Python 3 is unavailable instead of crashing with null status - command-registry: regenerate COMMAND-REGISTRY.json (was stale) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(hooks): quote args when probing Windows .cmd MCP servers via shell (#2343) On Windows, when a bare-name MCP server command (e.g. codesys-mcp-sp21-plus) falls back to the .cmd candidate, the probe sets shell:true to work around Node 18.20+ CVE-2024-27980. However, passing an args array alongside shell:true causes Node to concatenate the tokens without quoting (DEP0190), so an arg containing a space (e.g. --codesys-path "C:\Program Files\...") is re-split by cmd.exe at every space boundary. The child process receives a truncated path, fails to launch, and the probe declares the server unavailable, falsely blocking every MCP tool call to that server. Fix: add a quoteWin() helper that double-quotes any token containing whitespace or cmd metacharacters. In the useShell branch, build a single properly-quoted command line string and pass it as the sole argument to spawn() with no separate args array. The else branch (shell:false, all non-.cmd commands) is unchanged. Regression test added: on Windows, creates a .cmd shim that echoes its first positional argument to stderr, probes it with a space-containing path arg, and asserts the probe succeeds and the arg was not split at the space boundary. Co-authored-by: Karstein Phobic Nyvold Kvistad <karstein.kvistad@maritimerobotics.com> * fix(hooks): guard doc-file-warning stdin listeners behind require.main (#2358) * fix(hooks): guard doc-file-warning stdin listeners behind require.main doc-file-warning.js registered process.stdin data/end listeners at module scope while also exporting run(). run-with-flags.js require()s any hook that exports run() for its in-process fast path, so importing this hook attached stray stdin listeners to the dispatcher process, corrupting the PreToolUse stdout JSON contract. This is the exact failure run-with-flags' own SAFETY comment warns about, and 24 sibling hooks already guard against it. - Move the stdin entrypoint into main() and gate it behind require.main === module - pre-write-doc-warn.js now calls main() explicitly instead of relying on the import side effect - Add regression tests: require() attaches no stdin listeners, run()/main() stay exported, and the pre-write-doc-warn shim still warns * docs(hooks): add JSDoc for doc-file-warning main() entrypoint Satisfies the docstring-coverage pre-merge check; documents the stdin entrypoint and why it must not run on require(). * fix(windows): prefer PowerShell over bash to prevent zombie process accumulation (#2346) * fix(windows): prefer PowerShell over bash to prevent zombie process accumulation On Windows, ECC hook scripts were spawning bash.exe (MSYS2/Git Bash) on every tool use via findShellBinary(). These processes were not reaped by Windows, causing 40+ zombie bash.exe/conhost.exe processes per session with noticeable system lag. Changes to scripts/hooks/plugin-hook-bootstrap.js: - Add isPowerShellBin(bin) helper: basename-based detection so full paths like C:\Windows\...\powershell.exe are handled correctly - findShellBinary(): check BASH env var first (preserves escape hatch), then on win32 probe pwsh.exe -> powershell.exe -> bash.exe -> bash; use correct probe args per shell type; cache result in _cachedShell - findBashBinary(): separate cached bash-only finder used by spawnShell .sh fallback; skips PowerShell binaries even if BASH points to one - spawnShell(): use isPowerShellBin() to select -NoProfile -NonInteractive -File args for PowerShell; .sh scripts fall back to findBashBinary() with a skip-warning if no bash found on Windows observe-runner.js is intentionally unchanged: it always invokes observe.sh which is bash-only; routing it through PowerShell would silently break it. The observe.sh -> observe.js migration is tracked separately. Fixes #2345 * fix(windows): address CodeRabbit and Greptile review comments - Add timeout: 30000 to all spawnSync probe calls in findShellBinary and findBashBinary to prevent hangs on broken/stalled shell candidates - Add -ExecutionPolicy Bypass to PowerShell -File invocation to fix execution on machines with the default Restricted policy (Win10/11) - Add PowerShell availability skip guard to PS selection test (mirrors existing bash skip guard) - Fix no-bash test to keep PowerShell on PATH so the .sh fallback branch is actually exercised rather than hitting shell-unavailable early exit * test: add timeout to spawnSync probes in Windows test skip guards --------- Co-authored-by: Christopher J Diamond <diamondcj@leidos.com> * feat(session): LLM-powered session summary via claude -p (#2388) Replace mechanical text extraction in session-end.js and pre-compact.js with LLM-generated summaries using `claude -p`. Summaries now capture design decisions, resolved bugs, changed files, and carry-over context rather than just truncated user message snippets. - Add scripts/lib/llm-summary.js: generateSessionSummary, extractConversationText, getContextRemainingPct, getContextThreshold, getLLMModel - Update scripts/hooks/session-end.js: trigger LLM when context < 20% or every 50 messages (env-configurable via ECC_LLM_SUMMARY_*) - Update scripts/hooks/pre-compact.js: generate LLM summary right before compaction and write it to the active session .tmp file - Add tests/lib/llm-summary.test.js: 18 unit tests - Update tests/hooks/hooks.test.js: 3 integration tests for new behaviour Recursion guard: sets ECC_SKIP_LLM_SUMMARY=1 in subprocess env so Stop hooks fired by the claude -p subprocess do not re-enter summarisation. Requires no ANTHROPIC_API_KEY — reuses Claude Code's own authentication. Co-authored-by: Hiroshi Tanaka <hiroshi_tanaka@MBAM3.local> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(deps): update anthropic requirement from >=0.25.0 to >=0.111.0 (#2329) Updates the requirements on [anthropic](https://github.com/anthropics/anthropic-sdk-python) to permit the latest version. - [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/anthropic-sdk-python/compare/v0.25.0...v0.111.0) --- updated-dependencies: - dependency-name: anthropic dependency-version: 0.111.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#2328) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml (#2330) Bumps [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator) from 1.4.0 to 2.1.0. - [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases) - [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) - [Commits](https://github.com/slsa-framework/slsa-github-generator/compare/68bad40844440577b33778c9f29077a3388838e9...f7dd8c54c2067bafc12ca7a55595d5ee9b75204a) --- updated-dependencies: - dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump cron from 0.16.0 to 0.17.0 in /ecc2 (#2333) Bumps [cron](https://github.com/zslayton/cron) from 0.16.0 to 0.17.0. - [Release notes](https://github.com/zslayton/cron/releases) - [Commits](https://github.com/zslayton/cron/commits) --- updated-dependencies: - dependency-name: cron dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): update pytest requirement from >=8.0 to >=9.1.1 (#2324) Updates the requirements on [pytest](https://github.com/pytest-dev/pytest) to permit the latest version. - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/8.0.0...9.1.1) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): update mypy requirement from >=1.10 to >=2.1.0 (#2326) Updates the requirements on [mypy](https://github.com/python/mypy) to permit the latest version. - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](https://github.com/python/mypy/compare/v1.10.0...v2.1.0) --- updated-dependencies: - dependency-name: mypy dependency-version: 2.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): update pytest-cov requirement from >=4.1 to >=7.1.0 (#2332) Updates the requirements on [pytest-cov](https://github.com/pytest-dev/pytest-cov) to permit the latest version. - [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest-cov/compare/v4.1.0...v7.1.0) --- updated-dependencies: - dependency-name: pytest-cov dependency-version: 7.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates (#2325) Bumps the actions-minor-and-patch group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node), [pnpm/action-setup](https://github.com/pnpm/action-setup) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `actions/setup-node` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v6.3.0...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) Updates `pnpm/action-setup` from 6.0.8 to 6.0.9 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor-and-patch - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the cargo-minor-and-patch group across 1 directory with 3 updates (#2387) Bumps the cargo-minor-and-patch group with 3 updates in the /ecc2 directory: [ratatui](https://github.com/ratatui/ratatui), [anyhow](https://github.com/dtolnay/anyhow) and [uuid](https://github.com/uuid-rs/uuid). Updates `ratatui` from 0.30.1 to 0.30.2 - [Release notes](https://github.com/ratatui/ratatui/releases) - [Changelog](https://github.com/ratatui/ratatui/blob/main/CHANGELOG.md) - [Commits](https://github.com/ratatui/ratatui/compare/ratatui-v0.30.1...ratatui-v0.30.2) Updates `anyhow` from 1.0.102 to 1.0.103 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.102...1.0.103) Updates `uuid` from 1.23.3 to 1.23.4 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/v1.23.3...v1.23.4) --- updated-dependencies: - dependency-name: ratatui dependency-version: 0.30.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-and-patch - dependency-name: anyhow dependency-version: 1.0.103 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-and-patch - dependency-name: uuid dependency-version: 1.23.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump eslint from 9.39.2 to 10.6.0 (#2260) Bumps [eslint](https://github.com/eslint/eslint) from 9.39.2 to 10.6.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.2...v10.6.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(ci): unbreak main after dependabot batch (checkout SHA + lint) (#2393) * fix(ci): track actions/checkout v7 SHA in supply-chain workflow test Dependabot #2328 bumped actions/checkout v6->v7, changing the pinned SHA in supply-chain-watch.yml; update the test's expected SHA to match. * Revert "feat(workflows): add orch-review native Workflow pilot (#2363)" This reverts commit 1031d312cc. * feat: add ecc-recipes skill (#2319) * feat: add ecc-recipes skill Maps a described workflow to the right ECC command-group with run-order and stop condition, and browses command-group recipe families. Fills the gap between ecc-guide (flat catalog) and prompt-optimizer (single-prompt match) by adding family grouping, run-order, and stop conditions. Advisory only; reads commands/ live. * fix(ecc-recipes): address review - flatten frontmatter origin/author/version to top-level (repo convention) - guard unset CMD_DIR before globbing; use find instead of ls - show burn-warning explicitly in output template * feat(ecc-recipes): add argument-hint for slash UI * feat(skills): add mailtrap-email-integration skill (#2288) Adds a new Tool Integration skill (mailtrap-email-integration) covering transactional email sending patterns: sandbox vs. production separation, API authentication, and domain verification. Focused on patterns that generalize beyond one vendor, per the repo's Skill Adaptation Policy. * docs(code-tour): document ref-field semantics to prevent PR-tour file-not-found (#2273) The code-tour skill mentioned the CodeTour 'ref' field only in an example, with no explanation of its behavior. CodeTour resolves each step's file content from the git revision named by 'ref' (not the working tree) whenever ref differs from HEAD, so any file that does not exist at that revision fails to open with 'The editor could not be opened because the file was not found' - even though the file is present on disk. This bit a generated PR tour where ref was set to the base branch (develop): every file ADDED by the PR is absent on the base, so all new-file steps 404'd while the tour tree and comments still rendered, making the cause non-obvious. Adds a 'The ref Field' section explaining the resolution behavior and the rule that PR tours must pin ref to the branch head (never the base), plus a validation step to confirm every referenced file exists at the chosen ref. * fix(gateguard): finish tool-agnostic checklist across edit gate and SKILL.md copies (#2274) b3268fef (#2272) made the write-gate "confirm no existing file" item tool-agnostic in the JS hook, but the rest of the checklist surface still names Glob/Grep. On hosts without those tools the agent still hits a dead tool call on: - the edit-gate "list importers" item in the hook (scripts/hooks/gateguard-fact-force.js) - both checklist items in all three SKILL.md copies (en, ja-JP, zh-CN) Apply the same wording b3268fef introduced — "(search the tree — Glob/Grep, or find/grep via Bash)" — to those five remaining spots so the whole gate is consistent. Prose-only; no logic change. Follow-up to #2272 / b3268fef. * feat(skills): harden the file upload validation section in django-security (#2338) * feat(skills): harden the file upload validation section in django-security * Update skills/django-security/SKILL.md Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * add missing stuff to second code block * add import to the top of the code block --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * docs(skills): update Prisma and Zod API patterns for cross-version compatibility (#2336) * docs(skills): update Prisma and Zod API patterns for cross-version compatibility - skills/prisma-patterns: show both adapter-based and direct PrismaClient initialization side-by-side; update import paths with conditional notes; rewrite version header to be release-agnostic - skills/backend-patterns: fix ZodError.errors -> ZodError.issues - skills/coding-standards: fix ZodError.errors -> ZodError.issues - skills/security-review: fix ZodError.errors -> ZodError.issues These API differences were discovered during implementation of a full-stack health assessment project. The updated code samples show both the new and old API forms so the skill remains useful regardless of which Prisma or Zod version is installed. Closes #2335 * fix(skills): revert Prisma client imports to '@prisma/client' The 'prisma' npm package is the CLI tool, not the runtime client. Using it as an import source would cause compile-time failures on all versions. '@prisma/client' remains the correct import source for the generated PrismaClient and Prisma namespace types. Found by Greptile during PR review. * feat(skills): make tdd-workflow test-runner aware (npm/pnpm/yarn/bun) (#2347) * feat(skills): make tdd-workflow test-runner aware (npm/pnpm/yarn/bun) Add "Step 0: Detect the Test Runner" so the RED/GREEN cycle no longer hardcodes `npm test`. Distinguishes the package manager from the test runner (a project can install with Bun yet run Jest/Vitest), adds a runner command matrix, and warns about `bun test` (native bun:test runner) vs `bun run test` (runs the package.json script) — a common ESM failure mode. Adds a Bun native test pattern section and links the bun-runtime skill. Applied to both the canonical skills/ copy and the .agents/skills/ Codex subset (manual sync per CONTRIBUTING). * docs(skills): apply <test>/<coverage> placeholders in tdd-workflow steps Address review feedback on PR #2347: Step 0 instructs the agent to substitute the detected runner command, but Steps 3/5/7, Run Coverage Report, Watch Mode, Pre-Commit, and CI/CD still showed literal `npm test` / `npm run test:coverage` — so an agent reaching those blocks could run npm test on a pnpm/bun project. Replace them with the <test> / <test-watch> / <coverage> placeholders from Step 0. Left untouched: the plan-handoff allowlist example and the Step 8 evidence-table samples (illustrative, not run-this instructions). Applied to both the canonical and Codex-subset copies. * docs(skills): make pre-commit lint runner-agnostic via <lint> placeholder Follow-up to PR #2347 review (CodeRabbit): the pre-commit example still used `npm run lint`, coupling it to npm after test/coverage were made runner-aware. Add a `<lint>` column to the Step 0 runner matrix (npm run lint / pnpm lint / yarn lint / bun run lint) and change the Pre-Commit Hook example to `<test> && <lint>`. Applied to both the canonical and Codex-subset copies. * chore: re-trigger CI (flaky windows/node20 npm cell) * refactor(commands): remove duplicated content in skill-create and learn-eval (#2348) skill-create: drop the "Example Output" section (53 lines) — it re-rendered the same skeleton already defined by the Step 3 output template, just with filled-in `my-app` values. learn-eval: drop the "Next Action" column from the 5b verdict table — it duplicated Step 6's "Verdict-specific confirmation flow". The table now carries Verdict + Meaning, and a pointer to Step 6 as the single source for each verdict's action. No behavior, frontmatter, or design-rationale changes. * chore(catalog): sync manifests after skill batch (#2319 #2288 #2273 #2274 #2338 #2336 #2347 #2348) (#2394) Regenerate catalog doc counts + command registry after merging the verified skill/agent batch. Local full suite was green (2924/2924) with these applied. * fix(clv2): align Python _update_registry schema with shell counterpart (#2369) * fix(clv2): align Python _update_registry schema with shell counterpart The Python `_update_registry` in instinct-cli.py wrote registry entries without the `id` and `created_at` fields, while the shell counterpart in detect-project.sh writes both. A projects.json entry could therefore have a different shape depending on which path (Python CLI or shell hook) last touched it. Emit the same field set and order as the shell version: id, name, root, remote, created_at (preserved from any existing entry), last_seen. Add regression tests asserting field parity and created_at preservation. Fixes #2299 * fix(clv2): guard _update_registry against a non-dict registry entry A malformed projects.json (a non-dict value for the current project id, e.g. null) would make existing.get("created_at", ...) raise and crash the update, losing the old code's ability to self-heal a corrupt per-entry value. Normalize existing to {} when it is not a dict so the entry is healed by the rewrite. Add a regression test for the malformed-entry path. * test(clv2): assert the first-write created_at == last_seen contract The new _update_registry tests only checked both timestamps were truthy. On the initial write both derive from the same `now`, so created_at must equal last_seen; assert that explicitly so a later refactor that breaks the contract is caught. Split the compound assertions into single-expression checks. * fix(clv2): heal a non-dict top-level registry in _update_registry A projects.json that is valid JSON but not a mapping (e.g. `[]` or a string) previously crashed _update_registry on registry.get(), before the per-entry guard could run, so the corrupt file could not be healed. Guard the top-level shape right after the load and fall back to {} so the rewrite repairs the file — matching the per-entry healing already in place. Resolves the remaining CodeRabbit finding on #2299. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * fix(clv2): serialize observer signal-counter to stop dropped increments (#2372) observe.sh bumps the SIGUSR1 throttle counter in ${PROJECT_DIR}/.observer-signal-counter with an unlocked read-modify-write. The hook runs on every tool call, so concurrent invocations read the same value, both increment, and lose a write, signaling the observer at unpredictable intervals and defeating the #521 throttle. Serialize the read-modify-write under a lock, and only ever bump the counter while that lock is held: - Prefer flock with a bounded -w wait (the OS auto-releases it when the fd closes or the process dies, so there is no stale lock and no lost increment); on a timeout the tick is skipped rather than bumped unlocked. - Fall back to an atomic mkdir lock on platforms without flock, with a bounded spin. An EXIT trap cleans up on normal completion; INT/TERM traps release the lock and exit, so a signal cannot drop the lock and then continue the read-modify-write without ownership. If the lock cannot be acquired in the budget the tick is skipped rather than raced. No hand-rolled PID stale-reclaim (which is racy and can delete a live re-acquirer's lock). - Guard the counter read against a corrupt (non-integer) file that would abort the hook under set -e. Add tests/hooks/observe-signal-counter-race.test.js: 20 concurrent observe.sh invocations must not lose increments (exact under flock; at most one dropped on the best-effort mkdir fallback), the runner rejects on any hook execution failure or hang, plus content guards for the lock and the corrupt-counter handling. Fixes #2296 * fix(clv2): surface SIGALRM timeout drops in observe.sh (#2373) * fix(clv2): surface SIGALRM timeout drops in observe.sh The inline-Python observation writers in observe.sh arm a signal.SIGALRM alarm (8s) so they self-terminate before the async hook's 10s timeout can orphan them (#2278). The handler _ecc_bail called sys.exit(0) with no logging, so when the alarm fired the in-flight observation was silently dropped: nothing was logged, no partial write occurred, and the shell saw a clean exit. There was no way to detect or count how many observations were being lost. Add a single stderr visibility line to both _ecc_bail handlers (the parse-error fallback path and the main observation-writing path) before sys.exit(0), using the repo's "[observe]" log prefix. Exit code stays 0: in a Claude Code hook a non-zero exit signals a block, so changing it would turn an internal timeout into a user-facing tool block. The warning goes to stderr (not stdout) because both blocks redirect stdout into the observations file. Add tests/hooks/observe-signal-timeout.test.js: a static regression guard that every _ecc_bail handler logs to stderr before exiting and keeps exit 0, plus a behavioral check that runs the real handler text extracted from observe.sh and confirms a fired alarm exits 0 and emits the [observe] warning on stderr only. Fixes #2300 * test(clv2): exercise both _ecc_bail handlers end-to-end The behavioral SIGALRM-fire test ran only handlers[0] (the parse-error fallback path); the main observation-write path (handlers[1]) was covered only by the static regex guard. The write path is the higher-value one to verify end-to-end since it carries valid, parseable data that would succeed given more time, so a silent drop there is the worst case. Loop the behavioral check over every extracted handler so a regression that silenced the second handler's stderr write is caught at runtime, not just by the static guard. * test(clv2): select timeout handlers by marker, not array index The behavioral check looped over all extracted _ecc_bail handlers by index. If an unrelated _ecc_bail were ever added to observe.sh, the loop would either test the wrong block or be diluted. Filter the handlers to those carrying the "[observe] SIGALRM timeout" marker so the live SIGALRM check stays pinned to the two #2300 timeout handlers regardless of array order or future additions. * test(clv2): fail fast when python is missing in SIGALRM check The behavioral test returned early when no python interpreter was found, which the test harness records as a PASS — so the SIGALRM contract could go entirely unverified yet still look green. Throw instead, matching the existing insaits-security-monitor convention of failing when a required Python runtime is absent, and drop the in-test console.log. * test(clv2): add coverage for instinct-cli prune, projects ops, promote dry-run, normalize-url (#2374) * test(clv2): cover instinct-cli prune, projects ops, promote dry-run, normalize-url Add pytest coverage for previously-untested functions in skills/continuous-learning-v2/scripts/instinct-cli.py: - _normalize_remote_url: scp/https/file forms, credential + .git stripping, network lowercasing, case-preserving local paths, idempotence - _promote_specific dry-run: returns 0 and writes no global file - projects delete/gc/merge: invalid-id, not-found, dry-run, and force paths over registry + storage, asserting destructive ops are gated - cmd_prune: dry-run keeps files; non-dry-run deletes only expired; quiet Test-only change; no production code modified. Fixes #2302 * test(clv2): assert dry-run storage no-op and quiet-mode stderr silence Address CodeRabbit review on #2374: - projects gc/merge dry-run tests now also assert on-disk storage is untouched (empty1 project dir survives; nothing copied into dest personal), closing the gap where a storage-mutating dry-run regression would still pass. - cmd_prune quiet test now asserts stderr is empty too, not just stdout. * test(clv2): cover merge missing-destination and prune empty-pending branches * fix(clv2): archive observations only after successful analysis in observer-loop (#2386) analyze_observations moved observations.jsonl into observations.archive/ unconditionally, even when the Claude analysis failed (timeout, non-zero exit, rate limit). Because the analyzer only reads the live file, a failed batch was archived and never re-analyzed, silently dropping the instincts it would have produced. Return early on a non-zero analysis exit so the archive mv runs only on success, retaining observations for the next cycle to retry. Resolve the script's own directory from ${BASH_SOURCE[0]} (SCRIPT_DIR) so sibling scripts (session-guardian.sh) and relative helpers resolve correctly under both execution and sourcing, and add a source-guard so observer-loop.sh can be sourced without starting the loop. Add a regression test covering both the failure (retain) and success (archive) paths. Fixes #2370 * feat(continuous-learning-v2): make observer model configurable via ECC_OBSERVER_MODEL (#2390) * feat(continuous-learning-v2): make observer model configurable via ECC_OBSERVER_MODEL The observer hardcoded `--model haiku`. Parameterize as "${ECC_OBSERVER_MODEL:-haiku}": the haiku default is preserved (no behavior change for existing users), but users can opt into a stronger model — e.g. `ECC_OBSERVER_MODEL=opus` — for higher-quality instinct extraction. Useful on subscription plans where model cost isn't the limiting factor. * fix(continuous-learning-v2): address review — update wiring test + docs - Update source-inspection test to assert the ${ECC_OBSERVER_MODEL:-haiku} defaulting behavior (was matching the literal `claude --model haiku`, which this PR changed). All 31 tests pass. - Add guidance to raise ECC_OBSERVER_TIMEOUT_SECONDS for slower models (e.g. opus) so the 120s watchdog doesn't kill analysis mid-run. - Fix now-stale 'Haiku session' comment -> 'observer session' (model is configurable). * feat(rules,skills): add React Native / Expo rules pack and react-native-patterns skill (#2275) * feat(rules,skills): add React Native / Expo rules pack and react-native-patterns skill * fix(rules,skills): address review feedback — safeParse nav example, drop deprecated sentry-expo, memoize list renderItem, clarify New Architecture SDK support * fix(rules,skills): drop deprecated Flipper, surface permission-denied state in location hook * Add growth-log skill: methodology for effective learning capture (#2377) * Add growth-log skill: methodology for writing effective, transferable growth log entries * Add metadata.origin: ECC frontmatter per repo convention (Greptile feedback) * Re-sign: apply GPG-verified commit to growth-log branch (rebase artifact, content unchanged) * docs(growth-log): v1.1.0 — remove personal library structure, generic storage, delivery-gate optional companion * Stop hook: verify thinking quality at session end — task completeness, assumptions, stale logs, disk space (delivery-gate) (#2378) * Restore delivery-gate: Stop hook with learning capture enforcement (auto-closed by fork sync, now on clean branch) * Fix bot findings: log level→INFO (DISK_REMIND dead code), count_edits full transcript (not truncated), memory-dir-absent warning (not silent pass), SKILL.md description accuracy * Fix CodeRabbit feedback: treat missing memory-dir as all-stale on complex tasks (fail-close instead of fail-open) * Trigger bot re-review (no logic changes) * Fix: handle both stdin formats — raw transcript AND JSON with transcript_path (Greptile feedback) * Add debug log for memory-dir lookup path * Fix path encoding: replace colon with dash (not strip), matching Claude Code actual encoding on Windows * Fix SKILL.md: update How It Works for JSON+transcript_path, add English translation to CLAUDE.md block (Greptile feedback) * Fix: memory-dir absent → warn but don't block (prevents deadlock for new users per Greptile feedback) * fix: restore daltino-approved voice (thinking quality/收尾铁律) with technical patches Reverts 'session hygiene' rebranding. Preserves original approved framing while keeping technical improvements: - JSON transcript_path parsing documentation - filesystem mtime staleness check - 'skip tests for now' rationalization pattern - disk critically low explicit block condition * fix: remove stdout JSON echo — Stop hooks write feedback to stderr, not stdout Previously sys.stdout.write(raw) echoed the raw hook JSON payload to stdout, which Claude Code displays as the hook's response message. When the hook blocked (exit 2), Claude saw {"transcript_path":"...","session_id":"..."} instead of the actual blocking reason from stderr. This made the gate functionally silent from Claude's perspective — it could not guide Claude to the corrective action (update growth-log / free disk). Fix per Greptile feedback: stop echo, let stderr messages reach Claude. * fix: remove duplicate disk-critical log line * docs(delivery-gate): v1.1.0 — accurate scope (deterministic checks, not reasoning), warning vs block table, CI/CD analogy, limitations section, self-audit pairing * fix(delivery-gate): expand rationalization regex coverage (R3/R4) — match "we can fix" and "integration tests" variants * chore: bump version to 1.1.1 to re-trigger CI checks * feat: add loop-design-check skill (design + review goal-oriented agent loops) (#2381) * chore(catalog): sync manifests + fix skill emoji (wave 2) (#2395) * chore(catalog): sync manifests after skill batch (#2275 #2377 #2378 #2381) Update skill counts (273 -> 277) across catalog docs after the verified skill batch. * fix(skills): replace emoji with ASCII in growth-log + loop-design-check check-unicode-safety (pre-push gate) bans emoji in SKILL.md; the merged #2377 and #2381 slipped through run-all.js. Swap U+274C/U+2705 for 'Avoid:'/'Bad:'/'Good:'. * fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) (#2409) * fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410) * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) The inline node -e resolver blob was duplicated ~60x across hooks.json, command docs, and translations. Each copy inlined the full ~700-char plugin-root search using a spread over nested array literals (p.join(d,'plugins',...s) over [['ecc'],...]), which breaks Windows hook execution due to shell quoting (#2368). Collapse every copy to a 250-char locator that loads the committed resolve-ecc-root module and delegates to resolveEccRoot() — no spread, no nested array literals, no escaped double quotes. The real search logic now lives in one tested module. Also route session-start-bootstrap.js through resolveEccRoot() instead of its own duplicated reimplementation, and fix the auto-update.md 'marketplace' (singular) typo along the way. Guard tests updated: discovery behavior is asserted against resolveEccRoot(); the inline is asserted to delegate and to contain no Windows-fragile constructs. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(resolve-ecc-root): restore full env-unset discovery in inline resolver Address Greptile review on #2410: when CLAUDE_PLUGIN_ROOT is unset the delegating inline could only load the resolver module from ~/.claude, returning ~/.claude without ever reaching the plugin/cache search. Restore the old inline's discovery breadth (exact plugin roots + versioned cache) Windows-safely (no spread, nested arrays, or escaped quotes), then delegate the authoritative decision to resolveEccRoot(). Add regression tests for plugin-subdir and versioned-cache bootstrap with env unset. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: docs/COMMAND-REGISTRY.json check fails on fresh Windows clone (missing .gitattributes) (#2437) * fix: add .gitattributes to force LF line endings for text files npm run command-registry:check (part of npm test) fails on a fresh clone on Windows with the common core.autocrlf=true setting: git checks out docs/COMMAND-REGISTRY.json with CRLF, but generate-command-registry.js always writes LF, so the strict string comparison in checkRegistry() never matches. Forcing LF via .gitattributes makes checkouts consistent across platforms regardless of a contributor's local autocrlf setting. * fix: normalize CRLF line endings to LF per .gitattributes pyproject.toml, src/llm/__init__.py, src/llm/prompt/builder.py, src/llm/providers/claude.py, and tests/test_builder.py had CRLF line endings committed to the repo, inconsistent with the rest of the codebase. Renormalized via 'git add --renormalize .' now that .gitattributes enforces eol=lf. --------- Co-authored-by: Affaan Mustafa <me@affaanmustafa.com> * feat(workflows): re-land orch-review workflow + add /orch-review command (#2400) * feat(workflows): re-land orch-review workflow + add /orch-review command Re-lands #2363 (reverted by #2393 to unbreak main's lint) and fixes the root cause so it stays green: - Restore workflows/orch-review.workflow.js + workflows/README.md. - eslint.config.js: ignore 'workflows/**/*.workflow.*' and '.claude/workflows/**' per the maintainer's note in #2393. Workflow DSL scripts use both top-level export (ESM) and top-level return (the runtime wraps them in an async fn), which no single eslint sourceType can parse — they must be excluded, not lint-fixed. 'npx eslint .' is green with this ignore. - Add commands/orch-review.md (the /orch-review surface) + regenerate docs/COMMAND-REGISTRY.json. Supersedes #2397 (command-only), which referenced the reverted workflow. * fix(workflows): address orch-review bot review findings - Verifier uncertainty no longer demotes blockers (Greptile P1 + CodeRabbit): isReal=false only refutes when confidence >= 0.8; low-confidence 'false' is treated as uncertain and kept blocking (fail closed). - Treat the diff (and finding text) as untrusted input in both review and verify prompts; ignore embedded directives (prompt-injection hardening). - Validate changedFiles entries are strings, not just that it is an array. - Enforce proof for HIGH/CRITICAL in FINDINGS_SCHEMA, not only in the prompt. - Remove in-place mutation in dimension build + dedup merge (immutable). - /orch-review: extract & validate a numeric PR id before shelling out to gh. - Docs: complete the stats example, soften wording, refresh follow-up list. * style(workflows): apply formatter to orch-review assembly * fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) (#2409) * fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410) * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) The inline node -e resolver blob was duplicated ~60x across hooks.json, command docs, and translations. Each copy inlined the full ~700-char plugin-root search using a spread over nested array literals (p.join(d,'plugins',...s) over [['ecc'],...]), which breaks Windows hook execution due to shell quoting (#2368). Collapse every copy to a 250-char locator that loads the committed resolve-ecc-root module and delegates to resolveEccRoot() — no spread, no nested array literals, no escaped double quotes. The real search logic now lives in one tested module. Also route session-start-bootstrap.js through resolveEccRoot() instead of its own duplicated reimplementation, and fix the auto-update.md 'marketplace' (singular) typo along the way. Guard tests updated: discovery behavior is asserted against resolveEccRoot(); the inline is asserted to delegate and to contain no Windows-fragile constructs. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(resolve-ecc-root): restore full env-unset discovery in inline resolver Address Greptile review on #2410: when CLAUDE_PLUGIN_ROOT is unset the delegating inline could only load the resolver module from ~/.claude, returning ~/.claude without ever reaching the plugin/cache search. Restore the old inline's discovery breadth (exact plugin roots + versioned cache) Windows-safely (no spread, nested arrays, or escaped quotes), then delegate the authoritative decision to resolveEccRoot(). Add regression tests for plugin-subdir and versioned-cache bootstrap with env unset. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: docs/COMMAND-REGISTRY.json check fails on fresh Windows clone (missing .gitattributes) (#2437) * fix: add .gitattributes to force LF line endings for text files npm run command-registry:check (part of npm test) fails on a fresh clone on Windows with the common core.autocrlf=true setting: git checks out docs/COMMAND-REGISTRY.json with CRLF, but generate-command-registry.js always writes LF, so the strict string comparison in checkRegistry() never matches. Forcing LF via .gitattributes makes checkouts consistent across platforms regardless of a contributor's local autocrlf setting. * fix: normalize CRLF line endings to LF per .gitattributes pyproject.toml, src/llm/__init__.py, src/llm/prompt/builder.py, src/llm/providers/claude.py, and tests/test_builder.py had CRLF line endings committed to the repo, inconsistent with the rest of the codebase. Renormalized via 'git add --renormalize .' now that .gitattributes enforces eol=lf. --------- Co-authored-by: Affaan Mustafa <me@affaanmustafa.com> * chore(catalog): sync command counts (92->93) + register orch-review in agent.yaml surface --------- Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Boube <109886533+Cb2i@users.noreply.github.com> Co-authored-by: Affaan Mustafa <me@affaanmustafa.com> * docs: replace personal absolute paths with repo-relative agentshield/ paths --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Gaurav Dubey <gauravdubey0107@gmail.com> Co-authored-by: JongHyeok Park <jonghyeok.park@unitblack.co.kr> Co-authored-by: Daniel Nguyen <DANIEL@FINHUB.NET.AU> Co-authored-by: Gabriel Pitrella <gabriel98_@hotmail.com> Co-authored-by: Angad Singh Thind <angadsthind@gmail.com> Co-authored-by: angadsingh7666 <angdsingh7666@gmail.com> Co-authored-by: quadcent <vlada87ns@gmail.com> Co-authored-by: Vladimir Đuranović <vlada@MacBook-Pro.local> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Yang Cheng <ycg78@hotmail.com> Co-authored-by: jan <jan@w-saxs001.local> Co-authored-by: Tahiti18 <35585881+Tahiti18@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: phobicdotno <spamme.post@gmail.com> Co-authored-by: Karstein Phobic Nyvold Kvistad <karstein.kvistad@maritimerobotics.com> Co-authored-by: SSH._.WORLD <ssh97540@gmail.com> Co-authored-by: ChrisD <cdiamond@diamond.net> Co-authored-by: Christopher J Diamond <diamondcj@leidos.com> Co-authored-by: Hiroshi Tanaka <viveregratis1982@gmail.com> Co-authored-by: Hiroshi Tanaka <hiroshi_tanaka@MBAM3.local> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: KyawZinLatt <mr.kyawzinlattt@gmail.com> Co-authored-by: Awa Dieudonne <dieudonneawa7@gmail.com> Co-authored-by: Carlos Carvallo <carloscarvallo87@gmail.com> Co-authored-by: Jun <39075334+mc856@users.noreply.github.com> Co-authored-by: jvirgovic <jvirgovic@proton.me> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: weizhiyuan <104509245+m18897829375@users.noreply.github.com> Co-authored-by: jack-finance-able <jack@finance-able.com> Co-authored-by: Yeris Rifan <yerisrifan@gmail.com> Co-authored-by: YuhaoLin2005 <lin_yuhao2005@163.com> Co-authored-by: Seekers2001 <jiaxinleifm@outlook.com> Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Boube <109886533+Cb2i@users.noreply.github.com>	2026-07-03 20:35:58 -07:00
6 people	914a58a716	feat(workflows): re-land orch-review workflow + add /orch-review command (#2400) ... * feat(workflows): re-land orch-review workflow + add /orch-review command Re-lands #2363 (reverted by #2393 to unbreak main's lint) and fixes the root cause so it stays green: - Restore workflows/orch-review.workflow.js + workflows/README.md. - eslint.config.js: ignore 'workflows/**/*.workflow.*' and '.claude/workflows/**' per the maintainer's note in #2393. Workflow DSL scripts use both top-level export (ESM) and top-level return (the runtime wraps them in an async fn), which no single eslint sourceType can parse — they must be excluded, not lint-fixed. 'npx eslint .' is green with this ignore. - Add commands/orch-review.md (the /orch-review surface) + regenerate docs/COMMAND-REGISTRY.json. Supersedes #2397 (command-only), which referenced the reverted workflow. * fix(workflows): address orch-review bot review findings - Verifier uncertainty no longer demotes blockers (Greptile P1 + CodeRabbit): isReal=false only refutes when confidence >= 0.8; low-confidence 'false' is treated as uncertain and kept blocking (fail closed). - Treat the diff (and finding text) as untrusted input in both review and verify prompts; ignore embedded directives (prompt-injection hardening). - Validate changedFiles entries are strings, not just that it is an array. - Enforce proof for HIGH/CRITICAL in FINDINGS_SCHEMA, not only in the prompt. - Remove in-place mutation in dimension build + dedup merge (immutable). - /orch-review: extract & validate a numeric PR id before shelling out to gh. - Docs: complete the stats example, soften wording, refresh follow-up list. * style(workflows): apply formatter to orch-review assembly * fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) (#2409) * fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410) * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) The inline node -e resolver blob was duplicated ~60x across hooks.json, command docs, and translations. Each copy inlined the full ~700-char plugin-root search using a spread over nested array literals (p.join(d,'plugins',...s) over [['ecc'],...]), which breaks Windows hook execution due to shell quoting (#2368). Collapse every copy to a 250-char locator that loads the committed resolve-ecc-root module and delegates to resolveEccRoot() — no spread, no nested array literals, no escaped double quotes. The real search logic now lives in one tested module. Also route session-start-bootstrap.js through resolveEccRoot() instead of its own duplicated reimplementation, and fix the auto-update.md 'marketplace' (singular) typo along the way. Guard tests updated: discovery behavior is asserted against resolveEccRoot(); the inline is asserted to delegate and to contain no Windows-fragile constructs. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(resolve-ecc-root): restore full env-unset discovery in inline resolver Address Greptile review on #2410: when CLAUDE_PLUGIN_ROOT is unset the delegating inline could only load the resolver module from ~/.claude, returning ~/.claude without ever reaching the plugin/cache search. Restore the old inline's discovery breadth (exact plugin roots + versioned cache) Windows-safely (no spread, nested arrays, or escaped quotes), then delegate the authoritative decision to resolveEccRoot(). Add regression tests for plugin-subdir and versioned-cache bootstrap with env unset. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: docs/COMMAND-REGISTRY.json check fails on fresh Windows clone (missing .gitattributes) (#2437) * fix: add .gitattributes to force LF line endings for text files npm run command-registry:check (part of npm test) fails on a fresh clone on Windows with the common core.autocrlf=true setting: git checks out docs/COMMAND-REGISTRY.json with CRLF, but generate-command-registry.js always writes LF, so the strict string comparison in checkRegistry() never matches. Forcing LF via .gitattributes makes checkouts consistent across platforms regardless of a contributor's local autocrlf setting. * fix: normalize CRLF line endings to LF per .gitattributes pyproject.toml, src/llm/__init__.py, src/llm/prompt/builder.py, src/llm/providers/claude.py, and tests/test_builder.py had CRLF line endings committed to the repo, inconsistent with the rest of the codebase. Renormalized via 'git add --renormalize .' now that .gitattributes enforces eol=lf. --------- Co-authored-by: Affaan Mustafa <me@affaanmustafa.com> * chore(catalog): sync command counts (92->93) + register orch-review in agent.yaml surface --------- Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Boube <109886533+Cb2i@users.noreply.github.com> Co-authored-by: Affaan Mustafa <me@affaanmustafa.com>	2026-07-03 20:26:40 -07:00
5 people	3af4676e99	refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410) ... * fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock (YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry) format so npm ci and immutable yarn installs both pass. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) The inline node -e resolver blob was duplicated ~60x across hooks.json, command docs, and translations. Each copy inlined the full ~700-char plugin-root search using a spread over nested array literals (p.join(d,'plugins',...s) over [['ecc'],...]), which breaks Windows hook execution due to shell quoting (#2368). Collapse every copy to a 250-char locator that loads the committed resolve-ecc-root module and delegates to resolveEccRoot() — no spread, no nested array literals, no escaped double quotes. The real search logic now lives in one tested module. Also route session-start-bootstrap.js through resolveEccRoot() instead of its own duplicated reimplementation, and fix the auto-update.md 'marketplace' (singular) typo along the way. Guard tests updated: discovery behavior is asserted against resolveEccRoot(); the inline is asserted to delegate and to contain no Windows-fragile constructs. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(resolve-ecc-root): restore full env-unset discovery in inline resolver Address Greptile review on #2410: when CLAUDE_PLUGIN_ROOT is unset the delegating inline could only load the resolver module from ~/.claude, returning ~/.claude without ever reaching the plugin/cache search. Restore the old inline's discovery breadth (exact plugin roots + versioned cache) Windows-safely (no spread, nested arrays, or escaped quotes), then delegate the authoritative decision to resolveEccRoot(). Add regression tests for plugin-subdir and versioned-cache bootstrap with env unset. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: affaan <affaan@itomarkets.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-07-03 20:01:17 -07:00
Affaan MustafaandGitHub	81af407619	chore(catalog): sync manifests + fix skill emoji (wave 2) (#2395) ... * chore(catalog): sync manifests after skill batch (#2275 #2377 #2378 #2381) Update skill counts (273 -> 277) across catalog docs after the verified skill batch. * fix(skills): replace emoji with ASCII in growth-log + loop-design-check check-unicode-safety (pre-push gate) bans emoji in SKILL.md; the merged #2377 and #2381 slipped through run-all.js. Swap U+274C/U+2705 for 'Avoid:'/'Bad:'/'Good:'.	2026-06-29 19:44:51 -07:00
Affaan MustafaandGitHub	be91f21837	chore(catalog): sync manifests after skill batch (#2319 #2288 #2273 #2274 #2338 #2336 #2347 #2348) (#2394) ... Regenerate catalog doc counts + command registry after merging the verified skill/agent batch. Local full suite was green (2924/2924) with these applied.	2026-06-29 18:39:22 -07:00
JunandGitHub	ec4925135c	fix(gateguard): finish tool-agnostic checklist across edit gate and SKILL.md copies (#2274) ... b3268fef (#2272) made the write-gate "confirm no existing file" item tool-agnostic in the JS hook, but the rest of the checklist surface still names Glob/Grep. On hosts without those tools the agent still hits a dead tool call on: - the edit-gate "list importers" item in the hook (scripts/hooks/gateguard-fact-force.js) - both checklist items in all three SKILL.md copies (en, ja-JP, zh-CN) Apply the same wording b3268fef introduced — "(search the tree — Glob/Grep, or find/grep via Bash)" — to those five remaining spots so the whole gate is consistent. Prose-only; no logic change. Follow-up to #2272 / b3268fef.	2026-06-29 18:38:24 -07:00
Affaan Mustafa	bd1be0c1ce	feat(layer4): line-range channel + trigger firing ... - Line precision: parse git diff --unified=0 into per-file changed line ranges (defaultWorkingSetFor), so two agents in the SAME file but DIFFERENT functions no longer false-collide. Overlap channel now uses the overlap coefficient (|A∩B|/min(|A|,|B|)) — high when one edit sits inside the other's region, low for disjoint ranges; whole-file edit = 1. Docstring + design doc updated. - Trigger firing: buildProximityTriggers() turns advisories into the concrete messages — transmit-intent to both on a Traffic Advisory, steer-away to the yielding agent + a hold notice on a Resolution Advisory. buildProximitySnapshot now returns triggers; dispatchProximityTriggers(triggers, {sendMessage}) delivers them through an injectable sink (the ECC messages table), best-effort. - 12 new tests (line-range disjoint vs overlapping, parseDiffRanges, triggers, dispatch). Full suite 2881/2881; lint green.	2026-06-20 17:30:52 -04:00
Affaan Mustafa	726972d735	feat(layer4): agent-space distance metric + TCAS-style collision avoidance (v0) ... The moat layer: spatial deconfliction for multiple agents (and humans) on one codebase, modeled on aircraft TCAS — measure how close two agents are in code-space, then transmit-intent (Traffic Advisory) and steer-away (Resolution Advisory) before they collide at the git layer. scripts/lib/agent-proximity/: - distance.js — the math: per-channel collision probabilities combined via noisy-OR R = 1 - Π(1 - ω·r). Channels: edit overlap (file + line-range Jaccard), dependency coupling (γ^(d-1) over the import graph, direction- agnostic — catches 'edit there breaks here' even when tree-distant), and tree proximity (LCA-based, soft prior). TCAS advise(): clear / advisory(transmit) / resolution(steer), with deterministic right-of-way priority so the maneuver is coordinated. closureRate() for approach-speed escalation. - graph.js — lightweight require/import dependency-graph builder (fs or in-memory). - index.js — scanAirspace(): pairwise advisories + 3D vector embedding (space- filling path embedding pulled toward dependency neighbours) so a 'where are the agents' visualization can render the file-cloud and watch agents crawl / steer. docs/design/agent-proximity.md — full mathematical formulation + protocol + viz + roadmap (v1 call-graph/symbol channels + live session-diff wiring; v2 cross- machine airspace over Tailscale, the zero-conflict-swarm demo). 17 tests; full suite 2869/2869; lint green.	2026-06-20 15:40:40 -04:00
Affaan Mustafa	b3268fef80	fix: resolve four bug reports (#2290, #2282, #2276, #2272) ... - #2290 suggest-compact: honor ECC_CONTEXT_WINDOW_TOKENS / CLAUDE_CODE_AUTO_COMPACT_WINDOW so 400k-window models (Opus 4.x) no longer report ~double context usage; add override + isolation tests in transcript-context.test.js. - #2282 install: bare-language syntax is legacy-only by design, but the error now distinguishes a supported-but-wrong-mode target (gemini/codex/…) from a genuinely unknown one and points to --profile/--modules/--skills. - #2276 cost-report: the command + cost-tracking skill targeted a SQLite DB no tracker writes. Repoint both at the real ~/.claude/metrics/costs.jsonl (JSONL, estimated_cost_usd), reduce cumulative-per-session snapshots to latest-per-session, and use node instead of sqlite3 for cross-platform support. - #2272 gateguard: make the 'confirm no existing file' checklist item tool-agnostic (Glob/Grep or find/grep via Bash) so hosts without a Glob tool don't get a dead tool call. Full suite 2839/2839; lint green.	2026-06-18 16:49:58 -04:00
3 people	71792fda81	feat: add Atlas Cloud as LLM/AI provider (#2279) ... * feat: add Atlas Cloud as OpenAI-compatible LLM provider - Add Atlas Cloud env vars to .env.example (ATLAS_API_KEY, ATLAS_BASE_URL) - Add docs/ATLAS-CLOUD-GUIDE.md with configuration, model list, and usage example - Atlas Cloud provides 59+ LLM models via OpenAI-compatible API at https://api.atlascloud.ai/v1 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(atlascloud): add Atlas Cloud provider implementation Wire Atlas Cloud in as a first-class OpenAI-compatible LLM provider, complementing the existing .env.example/docs entries. - src/llm/providers/atlas.py: AtlasProvider adapter (base_url https://api.atlascloud.ai/v1, default model deepseek-ai/deepseek-v4-pro); floors max_tokens to 512 for reasoning models; reads ATLAS_API_KEY (falls back to ATLASCLOUD_API_KEY), ATLAS_BASE_URL, ATLAS_MODEL - src/llm/core/types.py: add ProviderType.ATLAS - providers __init__/resolver: export + register AtlasProvider - tests: test_atlas_provider.py + resolver coverage for "atlas" Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-18 16:29:11 -04:00
xiaolei	20aaf84235	chore(catalog): sync skill counts after rebase on main	2026-06-16 09:05:48 +08:00
Affaan Mustafa	304a346aee	Merge pull request #2189 from affaan-m/feat/taste-skill ... feat: add taste skill — music-video creative direction. Catalog counts reconciled.	2026-06-15 14:08:24 -04:00
Affaan Mustafa	1c0c780452	Merge pull request #2236 from Victor-Casado/feat/github-native-coordination ... feat: add github-native coordination (epic-* commands + scripts + tests). Command registry + catalog reconciled.	2026-06-15 14:08:05 -04:00
Affaan Mustafa	1a08a21ac0	Merge pull request #2241 from itkdm/feat/add-vue-ecosystem ... feat: add Vue ecosystem review support (vue-reviewer agent, /vue-review command, vue-patterns skill). Duplicate rules/vue/* kept from #2250; catalog counts reconciled.	2026-06-15 14:07:31 -04:00
Affaan Mustafa	c8395472bf	Merge pull request #2221 from hretheum/feat/add-brand-discovery-competitive-skills ... feat(skills): add brand-discovery and competitive benchmarking pipeline. Catalog counts reconciled.	2026-06-15 14:06:31 -04:00
Affaan Mustafa	1705cb72f0	Merge pull request #2220 from lamenting-hawthorn/feat/agent-self-evaluation ... feat(skills,agents): add agent-self-evaluation skill and agent-evaluator persona. Catalog counts reconciled.	2026-06-15 14:06:09 -04:00
4 people	eb5ad2b009	feat(agents): add spec-miner agent for brownfield spec extraction (#2253) ... * feat(agents): add spec-miner agent for brownfield spec extraction Mines behavioral specs (Requirements + Invariants) from existing codebases without OpenSpec. Fully self-bootstrapping with sample-and-expand token strategy. Produces flat, delta-ready spec.md files with machine-parseable metadata (id, entities, enforced, depends_on, triggers). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs: bump agent catalog count from 64 to 65 for spec-miner All documentation and plugin manifests now reflect the new agent total. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: add spec-miner to routing table and clarify id field requirement - Add spec-miner to AGENTS.md agent table and orchestration hints - Fix id field in output template: was marked [optional] but Rule #7 requires it when enforced is known Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: update catalog skills count from 261 to 262 across all docs The upstream added a 262nd skill but documentation references across 7 files still reported 261. The CI validate step (scripts/ci/catalog.js --text) caught the mismatch — this only runs on PRs, not on direct pushes to main. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: replace emoji characters with text equivalents in spec-miner agent The unicode safety check (check-unicode-safety.js) blocks emoji characters. Replace ❌ with FAIL: per the project's targeted replacement convention. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: add Write tool to spec-miner agent tools list The agent generates spec output files at openspec/specs/<capability>/spec.md and requires the Write tool to create them. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: address review bot comments - tool guardrails and metadata schema consistency - Add Tool guardrails section: scoping Write to openspec/specs/ path, Bash to read-only - Fix deferred/uncertainty comments to follow key: value schema (deferred: file list, uncertainty: reason) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: strengthen Prompt Defense Baseline for repository content and Bash boundaries Add two defense points: treat all repo content as untrusted prompt-injection vector, and explicitly reject Bash commands that mutate, exfiltrate, or write outside the allowed openspec/specs/ path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: strip explanatory prose from id metadata comment to preserve key:value format The id comments included explanatory text after the value, which would be stored verbatim in copied specs and break stable delta matching. The explanation is already covered by Format Rule #7. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: restore README.md to upstream baseline with only catalog count changes The README was corrupted during cherry-pick conflict resolution — an older fork version was introduced, changing release notes links, badge URLs, sponsor sections, and other content. Restore to upstream/main (5b173d2) and re-apply only the agent count (64→65) using catalog.js --write. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: restore all catalog files to upstream baseline, keep only intentional changes The cherry-pick during rebase introduced a stale fork version of multiple files via git checkout --theirs conflict resolution. Restore from upstream/main and re-apply only: - Agent counts: 64→65 (all 7 catalog-tracked files) - Skills counts: 261→262 (where needed) - AGENTS.md: spec-miner routing table + orchestration hint (our additions) This reverts unintended regressions: - Version downgrades (2.0.0 → 2.0.0-rc.1) in marketplace.json, plugin.json, AGENTS.md, docs/zh-CN/AGENTS.md, docs/zh-CN/README.md - Badge URL changes (api.ecc.tools dynamic → hardcoded) in Chinese READMEs - Deleted v2.0.0 stable release sections in Chinese READMEs - Wrong release notes path (2.0.0-rc.1 → 2.0.0) in README.md Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: lege962 <1515808962@qq.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-15 14:02:02 -04:00
He DongandGitHub	c3fd4137b9	fix(skills): replace star ratings with ASCII N/5 (#2194) ... Change-Id: I72b7d094bb982070706595255536b69aa5998862	2026-06-15 13:48:54 -04:00
Bujidao	86e2a2061a	feat: add Vue ecosystem review support	2026-06-12 19:14:31 +08:00
Affaan MustafaandGitHub	7777656bf5	fix: context-size /compact trigger, Codex marketplace plugin path, live README badges (#2237) ... - suggest-compact hook now reads the latest usage record from the session transcript and suggests /compact at a window-scaled token threshold (160k/200k window, 250k/1M window; COMPACT_CONTEXT_THRESHOLD and COMPACT_CONTEXT_INTERVAL overridable), re-firing per 60k-token growth bucket; tool-call count stays as the secondary signal (#2155) - Codex repo marketplace now points at ./plugins/ecc instead of ./ — Codex never discovers plugins whose local marketplace source.path is the marketplace root (verified on Codex CLI 0.137.0); plugins/ecc is a thin folder referencing root skills/.mcp.json per maintainer direction on #2097; docs flag plugin mode as experimental with the upstream blocker openai/codex#26037 linked (#2128) - README badges for installs/stars/forks now use shields endpoint badges backed by api.ecc.tools (live install count 3,712 vs the stale static 150), which also eliminates shields' 'Unable to select next GitHub token from pool' render in the stars badge Closes #2155 Closes #2128	2026-06-11 16:21:53 -04:00
Eryk Orłowski	f810c19c13	fix(ci): catalog sync, markdownlint, unicode safety, unsupported frontmatter key ... catalog:sync: update skill count 261→265 in README.md, AGENTS.md, docs/zh-CN/AGENTS.md, .claude-plugin/plugin.json markdownlint: - MD009: strip trailing spaces in 10_purpose-why, 20_positioning, 40_personality-archetype, 50_voice-tone, 60_narrative-story, 90_SYNTHESIS (both skills/ and .agents/skills/ copies) - MD037: wrap ___ placeholders in backticks in 70_founder-tension.md:39 - MD028: replace blank lines inside blockquotes with bare > in 90_SYNTHESIS.md unicode-safety: replace U+2194 (↔) with ASCII <-> in 50_voice-tone.md and competitive-report-structure/SKILL.md (both copies) codex-validator: remove unsupported `origin: community` key from brand-discovery, competitive-platform-analysis, competitive-report-structure, benchmark-methodology SKILL.md files (both copies)	2026-06-11 21:58:42 +02:00
Eryk OrłowskiandClaude Sonnet 4.6	fe37e5426a	feat(skills): add brand-discovery and competitive benchmarking pipeline ... Adds four community skills covering brand identity discovery and a three-skill competitive benchmarking pipeline. **brand-discovery** — Adaptive multi-session brand identity interview spanning 8 modules (purpose, positioning, audience, personality, voice, narrative, founder-brand tension, synthesis). Uses laddering, 5 Whys, and projective techniques. State persisted to disk via state.json so sessions resume across conversations without losing elicited knowledge. Frameworks: Sinek, Dunford, Baker, Enns, Kapferer, Aaker, Neumeier, Mark & Pearson, Lencioni. Includes 8 module output templates in references/. **competitive-platform-analysis** — Scopes and tiers a competitor set before benchmarking begins. Categorizes candidates along 8 generic creative-industry axes (positioning stance, specialization, size/model, engagement format, distinctiveness posture, evidence model, brand strength, market/reach) into Direct / Adjacent / Aspirational tiers. Includes a pre-filter scoring matrix. First step in the pipeline. **benchmark-methodology** — Scores each competitor across 9 weighted dimensions (positioning 18%, brand voice 15%, visual craft 15%, offer packaging 12%, evidence 12%, enterprise-readiness 10%, thought leadership 8%, pricing 5%, client's strategic tension 5%) with explicit 1–5 rubrics and bias controls. Produces one profile card per competitor. **competitive-report-structure** — Assembles scored cards into a decision-grade report: executive summary, landscape map, competitor tiers, heatmap matrix, deep dives, white-space and threats, strategic recommendations, sources appendix. brand-discovery complements brand-voice (ECC): brand-voice extracts a style profile from existing source material; brand-discovery elicits identity from scratch through structured interviews when no prior material exists. A competitive set scoped without the client's positioning brief is noise, not intelligence — each skill enforces this by requiring the brief before proceeding. The 9-dimension scoring framework deliberately reports the client's strategic tension as two separate poles (never averaged) because the gap between them is the strategic finding. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-11 21:57:55 +02:00
Victor CasadoandClaude Sonnet 4.6	64470f4307	feat: add github-native coordination (epic-* commands + scripts + tests) ... Adds a GitHub-native coordination layer on top of ECC: Commands (7 new slash commands): - epic-claim, epic-sync, epic-validate, epic-publish - epic-review, epic-unblock, epic-decompose Scripts: - scripts/github-coordination.js — CLI entry point - scripts/lib/github-coordination.js — core library (state machine, gh API wrappers) - scripts/status.js — coordination status reporter Config: - config/github-native-coordination.json — labels, review policy, validation gates Tests: - tests/lib/github-coordination.test.js — 15 unit tests for pure functions - tests/scripts/github-coordination.test.js — integration/CLI test suite Registry: - docs/COMMAND-REGISTRY.json — adds 7 epic-* entries, totalCommands 84 → 91 No encoding changes, no prp-* modifications, no Windows shims. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-11 12:58:11 -04:00
Affaan MustafaandGitHub	75b5d64fc3	docs: sync skill count to 262 after config-gc skill landed (#2230) ... npm run catalog:sync — #2216 added skills/config-gc without bumping documented counts, leaving catalog:check (and npm test) red on main.	2026-06-11 01:22:34 -04:00
3 people	e4a0062d9b	docs(zh-CN): translate ecc-guide and parallel-execution-optimizer skills (#2217) ... * docs(zh-CN): translate ecc-guide and parallel-execution-optimizer skills Adds Simplified Chinese translations for two untranslated skills, following the existing docs/zh-CN/skills/ conventions (frontmatter name/origin preserved, code blocks and output templates kept in English, prose fully translated). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(zh-CN): polish two phrasings per review Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-11 01:01:28 -04:00
4 people	6da4490c76	docs(zh-CN): add Chinese translation of SKILL-DEVELOPMENT-GUIDE (#2200) ... * docs(zh-CN): add Chinese translation of SKILL-DEVELOPMENT-GUIDE Translate the comprehensive Skill Development Guide to Chinese, enabling Chinese-speaking contributors to learn how to create effective ECC skills. * fix(docs): correct all relative links in zh-CN translation Fix CONTRIBUTING.md link to zh-CN local copy, and skills links to point to repo-root skills/ directory instead of non-existent docs/skills/. --------- Co-authored-by: lege962 <1515808962@qq.com> Co-authored-by: legeZZZ <277193585+legeZZZ@users.noreply.github.com>	2026-06-11 01:00:57 -04:00
3 people	ff768db363	feat(mcp): single-connector default set + connector policy (#2219) ... Reduce the default .mcp.json to one connector (chrome-devtools) per the new policy in docs/MCP-CONNECTOR-POLICY.md: a default earns its slot only if it is universal AND MCP beats a CLI/API wrapped in a skill. June 2026 audit verdicts: github -> gh via github-ops skill; context7 -> REST via documentation-lookup; exa -> harness-native search (+ exa-search skill); memory -> native harness memory + instincts; playwright -> playwright CLI skills (vendor moved agent flows off MCP); sequential-thinking -> native extended thinking. All six remain opt-in in mcp-configs/mcp-servers.json. Tests updated: plugin-manifest policy assertions + install-apply Cursor expectations. Co-authored-by: ECC Test <ecc@example.test>	2026-06-09 23:28:35 -04:00
ECC Test	8ad4151095	ci: remove copilot code-review surface	2026-06-09 21:42:38 -04:00
ECC Test	29edd57708	release: 2.0.0 — the agent harness operating system ... Graduate 2.0.0-rc.1 to stable. Bump version across package, plugin, marketplace, OpenCode, agent metadata, VERSION, and all localized docs. Add 2.0.0 release notes + README sections (en/zh/pt-BR/tr), CHANGELOG entry, and the ECC community Discord bot (dependency-free gateway client + guild command registrar). Update copilot-support and release-surface tests for the sponsored-review migration and the 2.0.0 surface.	2026-06-09 21:40:40 -04:00
3 people	90dfd9505d	feat: add orch-* orchestrator skill family (#2153) ... * feat: add orch-* orchestrator skill family Lightweight wrappers that orchestrate existing ECC agents through a gated Research -> Plan -> TDD -> Review -> Commit pipeline, right-sized per task. - orch-pipeline: shared engine (phases, size classifier, two gates, agent map) - orch-add-feature/change-feature/fix-defect/refine-code/build-mvp: thin wrappers delegating to the engine * chore: register orch-* family in catalog, command registry, and agent.yaml (post-rebase onto green main) --------- Co-authored-by: ECC Test <ecc@example.test>	2026-06-07 16:15:31 +08:00
3 people	e755c5f72b	fix: make plugin hooks run on Node 21+ and green the suite under modern Node (#2184) ... ROOT CAUSE: hooks load plugin-hook-bootstrap.js via `node -e "...; process.argv.splice(1,0,s); require(s)"`. On Node 21+, require.main is `undefined` under --eval, so the `if (require.main === module)` guard was false and main() never ran — every plugin hook silently no-op'd (e.g. the MCP-health PreToolUse hook stopped blocking). CI (Node 18/20) hid this; it only surfaces on Node 21+. Fix: also run main() when require.main is undefined (the eval-bootstrap case), while staying dormant on real imports. Also clears pre-existing main debt the full local suite enforces: - catalog:sync — README/docs agent+skill counts drifted after recent merges - tests/ci/supply-chain-watch-workflow: update checkout SHA to the merged v6.0.3 (#2183) - markdownlint + check-unicode-safety --write across docs/skills Suite: 2683/2683 green under Node v25; lint + unicode clean. Co-authored-by: ECC Test <ecc@example.test>	2026-06-07 16:05:28 +08:00
fxdvandGitHub	8eedcff5ac	fix(commands): resolve active plugin root in /instinct-status (#2037) (#2059) ... The `/instinct-status` slash command template expanded `${CLAUDE_PLUGIN_ROOT}` directly and documented a manual-install fallback to `~/.claude/skills/continuous-learning-v2/scripts/instinct-cli.py`. When users had both an active plugin install (under `~/.claude/plugins/cache/<slug>/<org>/<version>/`) and a legacy `~/.claude/skills/continuous-learning-v2/` directory left over from a previous manual install, an empty `CLAUDE_PLUGIN_ROOT` (which Claude Code does not always populate in slash-command shell contexts) silently made the command read the stale legacy install while the active plugin hooks and observer wrote to the new XDG path. The user saw "No instincts found" while the system was actively learning — exactly the divergence the bug reporter spent hours diagnosing. Replace the brittle two-block template with the same inline resolver pattern that `hooks/hooks.json` and `/sessions` / `/skill-health` already use: env var → standard install → known plugin roots → plugin cache walk → fallback. The resolver is the canonical `INLINE_RESOLVE` constant from `scripts/lib/resolve-ecc-root.js`, so no new code is introduced — just consistent adoption of the existing pattern. Apply the same fix to all five copies of the command: - commands/instinct-status.md (canonical) - .opencode/commands/instinct-status.md - docs/zh-CN/commands/instinct-status.md - docs/ja-JP/commands/instinct-status.md - docs/tr/commands/instinct-status.md Extend tests/lib/command-plugin-root.test.js with an assertion that the canonical instinct-status.md uses the inline resolver and no longer hard-codes the legacy `~/.claude/skills/...` fallback (regression guard). zh-CN copy: polish the Chinese phrasing per LanguageTool feedback (`使用与 ... 相同的解析器` → `以与 ... 相同的解析器`) so the verb is introduced by an explicit preposition instead of reading as an awkward verb-object construction.	2026-06-07 13:27:05 +08:00
3 people	d7dcd10c8a	docs: add Urdu (ur) README translation (#2061) ... * docs: add Urdu (ur) README translation Adds docs/ur/README.md — a full Urdu translation of the main README. Urdu is spoken by 230M+ people globally, with a large developer community in Pakistan. This follows the same structure as existing translations (de-DE, ja-JP, ko-KR, etc.). * docs(ur): sync install catalog counts with current repo metadata The Urdu README stated 60 agents / 232 skills / 75 legacy command shims, but the current repo metadata and English README use 61 / 246 / 76. Update to match so Urdu users following the install guide do not see a verification mismatch (flagged in review). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-07 13:27:03 +08:00
Infinity_BlockandGitHub	81c9150512	fix(docs): sync marketplace add URL across translated READMEs (#2050) (#2068) ... PR #2050 updated the root README.zh-CN.md install commands after the everything-claude-code → ECC rename, but the same stale marketplace URL remained in nine docs/<locale>/README.md copies. Align those quick-start and self-hosted install blocks so /plugin install ecc@ecc resolves the ecc marketplace instead of everything-claude-code.	2026-06-07 13:26:58 +08:00
3 people	ac0f11c640	docs: add Spanish (es) translation (#2095) ... Adds a complete Spanish translation of the ECC documentation under docs/es/, mirroring the Turkish (docs/tr/) translation in scope. 141 files covering agents, commands, rules, skills, contexts, examples, and core docs. Updates root README.md with the Spanish language link. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-07 13:26:42 +08:00