Preserve full contributor head; refresh catalogs and Pi projection. Verify disposable Claude/Codex installs and resource discovery, with no automatic hooks or governance files.
Preserve full contributor history and current catalog. Actual process workflows cover concurrency, recovery, sprint planning and read-only status. Bound registry symlinks, counts and lock waits; preserve manually curated trigger provenance.
Keep both the new Polski locale and Bengali in every language switcher,
locale list and alias map; cross-link docs/pl and docs/bn. Resync catalog
counts (69 agents, 294 skills) and the skill-trigger registry digest.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
Preserve the Bengali and MyBatis catalog additions, keep Laravel storage examples disk-consistent, isolate ECC 2 test configuration with private permissions, and verify every command-referenced runtime script is published.
The conflicts were all counter bumps. Upstream moved 286 -> 292 skills while
staying at 94 command shims; this branch adds one of each, so the merged values
are 293 skills and 95 shims, carried across the English, Turkish and Chinese
docs. Upstream's 2.2.2 version is kept.
One line needed care and nearly went wrong: the v2.0.0 changelog entry records
"281 skills, 67 agents, 94 command shims". That 94 is a fact about a past
release, not a live counter, and a blanket substitution had rewritten it. It is
back to 94. The Discord snowflake and the Perl badge colour both contain "94"
too and are untouched.
While here, the pin was stale. It named 0.7.0, three minor versions behind, so
anyone installing through this skill got a tool without Gemini support, the
read-only doctor report, PNG export or the portable ledger. Raised to 0.10.0 —
knowingly, which is what the skill's own note asks for — and the documented
`npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball` was run to confirm
it resolves.
The agent list was stale for the same reason: Gemini CLI became a real adapter
in 0.9.0 and the skill still advertised three agents. Verified against the
published 0.10.0 tarball rather than from memory — `init --help` and `doctor`
both name Claude Code, Codex, Gemini CLI and OpenCode.
Resolve the 3 conflicts from 104 upstream commits (2.2.1 -> 2.2.2).
Merge resolution:
- .claude-plugin/plugin.json, .claude-plugin/marketplace.json: take the
upstream 2.2.2 version bump, keep the catalog counts at 69 agents /
293 skills. Upstream released 2.2.2 still describing 68/292, so neither
side could be taken whole.
- docs/ja-JP/README.md: upstream restructured the page, moving the hero
above the fold and replacing both markdown language selectors with a
single centered HTML block that also gained Español. Take that structure
and re-add বাংলা to the new selector.
- rules/common/agents.md: merged clean, but the roster line main added
reads "68 agents". Resync to 69 alongside the other catalog counts.
Verified: catalog.js reports 69 agents / 293 skills and confirms the
documentation counts match the repository catalog; the nine CI validators
and the command-registry check pass; bengali-language-surface.test.js is
7/7, including the selector and locale-parity assertions.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
Keep ${1} and echo $1 as Claude substitutions. Do not fail VAR=$1
function parameters or Perl/awk $1 compares. Sync catalog counts to
68 agents, 293 skills, and 95 commands after rebase onto main.
Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com>
Resolve the 19 conflicts from 314 upstream commits (all language-selector
and catalog-count lines), then fix the review threads still open on #2655.
Merge resolution:
- Keep both new locales: every language selector now lists Українська and বাংলা,
including the selectors that previously carried only one of them.
- Resync catalog counts to 69 agents / 293 skills across README.md, AGENTS.md,
README.zh-CN.md, docs/zh-CN/*, docs/tr/AGENTS.md, and the plugin manifests.
Review fixes:
- install-components.json: drop the explicit skill:bengali-nlp -> framework-language
mapping so the selector resolves to the generated single-skill component.
Selecting it installed 70 skill paths plus core modules; it now installs
skills/bengali-nlp only. (Greptile P1)
- docs/bn/README.md: point the Stars/Forks/Contributors badges at affaan-m/ECC
instead of affaan-m/everything-claude-code, align the header with the other
translations, add the 2.2.1 release section, and update 67+/281+ to 69/293.
- skills/bengali-nlp/SKILL.md: split the U+09F0-U+09FA row by character type;
reject empty search queries; replace the delimiter-only prompt boundary with
structured messages; require provider and locale checks before relying on the
bn-BD ICU collation; rewrite the isdigit() anti-pattern, which claimed the
method misses Bengali digits when it accepts them; add Best Practices and
Related Skills per the CONTRIBUTING template.
- agents/bengali-reviewer.md: HIGH findings now need a fix or a written waiver
with an owner and expiry, otherwise the verdict is BLOCK.
- tests/ci/bengali-language-surface.test.js: parse fences so an unclosed
```python block fails, track a missing interpreter as skipped rather than
passed, assert the single-skill install plan, and check every language
selector instead of only the root README.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
Adds skills/rails-patterns alongside laravel-patterns and django-patterns: directory contract, skinny controllers with service objects, form and query objects, idiomatic ActiveRecord, background jobs, ViewComponent, Hotwire, and the Rails 8 Solid stack. Decisions defer to rules/ruby/patterns.md. Registered in install-modules (framework-language), agent.yaml, package files, and every skill count (292) across plugin, marketplace, AGENTS and README variants. Independent exact-head review passed with no P0/P1; validate-skills, catalog:check, install manifests, plugin manifest, unicode and personal-path checks all pass; CI 44/44 at the head.
* feat: bundle standalone taste distillation and application workflows
* docs: fix imported taste skill markdown lint
* docs: align Turkish agent catalog with taste skills
* refactor: make ECC the canonical reusable video engine
* fix: preserve video duration when applying image overlays
* fix: preserve background colors in image compositing
* fix: report best-effort duration targets and shortfalls
* feat: ship verified Fusion presets with compatibility provenance
* feat(tasteforge): preserve native edits in application bundles
* feat(tasteforge): compile local preservation without hosted input
* fix: update js-yaml to patched 4.3.2
* test: report bounded Stop wrapper failure diagnostics
* fix(tasteforge): fail closed on unsafe output names, missing overlays and cadence
- cli: default report and spec paths are derived from pack name and profile
genre; require the manifest's name pattern before using either as a
filename part so a traversal string cannot write outside cwd/out.
- apply_local: a pack without cadence.json, or with no measured shots and
no explicit mean_shot, raises instead of silently planning 1.0s shots and
reporting a measured cadence.
- legacy apply: a missing overlay aborts before any paid upload; forge()
would have rejected it after every take was generated.
- requirements-live: pin fal-client>=0.13.0, the first release whose
subscribe() accepts client_timeout.
Addresses the five P1 findings from the independent review of #3033.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015fxHRsydPqEcYngGbqkgt1
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Addresses the review on #3039. Four findings, all of them real.
Skills-first (Greptile P2). AGENTS.md says commands/ exists for compatibility and
the direction is skills-first, so the workflow now lives in skills/token-card
and commands/token-card.md is a thin shim pointing at it — 70 lines down to 28.
Unpinned remote code (CodeRabbit major, Greptile P1, CWE-494). The workflow ran
`npx -y @tokenchit/cli@latest` and handed whatever the registry currently serves
read access to local session logs. It is pinned to 0.7.0, the skill says to raise
the pin knowingly, gives the `npm view … dist.integrity` check, and step 1 is now
an explicit confirmation before the first download on a machine.
The "no network request" claim was false as written (both bots). `sync` sends
nothing, but the npx invocation around it is a registry download, and the
sentence read as though the whole step were offline. It now separates the two.
`--dry-run` wrote a file (Greptile P2). Step 1 created `.tokenchit.json` via
`init` before `sync --dry-run` ran, so a documented no-op mutated the tree.
Initialisation is skipped on a dry run and reported as prospective instead.
The README offer was unreachable (Greptile P2). "Stop after step 3" sat directly
below step 4, so the step that puts the card in the README — the whole point —
could never run. The boundary moved to after step 4; publishing still requires
being asked for by name.
Wiring: agent.yaml skills list, manifests/install-modules.json under
operator-workflows (beside cost-tracking and ecc-tools-cost-audit), and
package.json `files`, which the npm-publish-surface test requires to track the
module graph. `yarn install --mode=update-lockfile` leaves yarn.lock byte
identical, so nothing to commit there. docs/tr/AGENTS.md carries two skill counts
the catalog sync does not reach, both 286 -> 287.
npm test: 4396 passed, 0 failed. markdownlint clean on both files.
Curated skill delegating to the canonical tasteforge package in
Ito-Markets/ito-video: taste interviews, style-pack validation, offline
distillation with measured grounding, deterministic cadence application to
local footage, EDL/FCPXML export, and generated-media provenance audits.
Provider (Fal) generation requires explicit separately authorized execution
and fails closed in ECC; local references never mean a saved provider
workflow. Registered in the opt-in media-generation install module, npm
files, and catalog counts via scripts/ci/catalog.js. Contract tests cover
frontmatter/triggers, the fail-closed boundary, manifest and npm-packed
discoverability (real tarball check opt-in via ECC_TEST_NPM_PACK=1).
* feat: add council-multi-model skill (heterogeneous Codex review)
Rebased onto latest main to resolve the merge conflict (the branch had gone
DIRTY as main advanced). Trimmed to just the skill files (no top-level
README/AGENTS edits), mirroring the merged #2381. Previously reviewed
favorably by greptile/coderabbit/daltino.
* feat: add Entry B (independent parallel propose + aggregate, MoA-style) alongside Entry A (review)
Splits the skill into two entries depending on what already exists:
Entry A (unchanged) reviews an existing draft. New Entry B has every
voice (Claude x3 + Codex if available) answer the same question fully
independently and in parallel, then aggregates without collapsing
disagreement or blending incompatible approaches into one hybrid.
For the heaviest decisions the two chain: B first, then A's review
step on the aggregation -- with an explicit honesty caveat when Codex
already proposed in B and so cannot independently judge the result.
* feat: prefer Codex MCP tool over the SDK script when available
mcp__codex__codex is now the primary path for both Entry A's
heterogeneous review and Entry B's independent proposal -- zero relay,
talks directly to OpenAI's backend, no temp file or shell escaping
needed. The openai-codex SDK script becomes the fallback for sessions
without that MCP tool configured; behavior and guardrails (read-only,
verbatim quoting, explicit 'absent' labeling) are unchanged.
* fix: register council-multi-model install path
* docs: sync skill catalog count
* fix: publish council-multi-model skill
* fix: harden council multi-model fallback
* docs: sync remaining skill count
* fix: narrow multi-model council to bounded review
* fix: address council adapter review feedback
* fix(council-multi-model): enforce tool-less Codex review
* fix(council-multi-model): close Codex tool boundary
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
* feat(skills): add dev-team skill — multi-persona collaborative session
Adds skills/dev-team/SKILL.md, a community skill inspired by the
BMAD Method's "party mode": PM, Architect, Developer, and QA respond
to the same topic in parallel, then a synthesis step names tensions
explicitly instead of averaging them.
Reads PROJECT-CONTEXT.md from the repo root when present, and offers
to generate it when missing, folding in the closed project-context
skill's (#2310) generation workflow per affaan-m's review — that
skill's premise (every agent reads the file) wasn't implemented
anywhere, so the capability now lives directly in the one skill that
actually reads it.
Rebuilt on current upstream/main as a skill-only diff: the shared
format-code.ts Windows fix and github-coordination branch-coverage
tests that were previously bundled here (and duplicated across the
story-lifecycle and project-context sibling PRs) now live in #2459.
* fix(manifests): register dev-team skill in workflow-quality install module
* fix(docs): repair README lint errors and Windows hook-install path regression
Fixes CI inherited from the README 2.1 restructure (19b05476):
- MD058: blank lines around tables (delegation map, Codex role configs)
- MD001: Option A/B headings under Ecosystem Tools h2 jump to h4
- MD024: duplicate 'What's included' headings (Codex, Copilot sections)
- restore %USERPROFILE%\\.claude escaping required by
tests/scripts/manual-hook-install-docs.test.js
* feat(skills): address review — trust boundary, harness-neutral I/O, contract test
Address maintainer review on #2309:
- untrusted-context boundary now travels with every persona prompt:
inline label on the context section, personas marked analysis-only
with no state-changing tool use
- personas receive a bounded declarative summary (≤150 words, fixed
fields, secrets and imperative content stripped) — never the raw
PROJECT-CONTEXT.md
- context loading uses harness-native file tools; POSIX-only
'test -f && cat' removed
- all references resolve on main: story-lifecycle follow-up replaced
with /plan and epic-* commands, ecc:plan-prd corrected to the
/plan-prd command; boundary vs team-builder and council made explicit
- added tests/docs/dev-team-skill.test.js contract test (roles,
parallel dispatch, synthesis guardrails, trust boundary, registration)
* docs: refresh Turkish skill count
* ci: retrigger checks (flaky stop-hooks-stdout timeout on macos node20 npm cell)
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
haelyra