Carry forward PR #3049 at 65e6e5ee and repair its missing npm lockfile update. Preserve the exact canonical Yarn lock and confirm the actual OpenCode build/runtime workflow with clean npm installation. Existing audit findings are unchanged from the assigned base.
Carry forward PR #3055 at 92f53c4c onto ef648e01, preserving contributor attribution and current main. Focused maintainer fixes reuse shared input ceilings, preserve late root context through outer bootstrap, bound frontmatter before immutable parsing, and assert real oversized input in the limits workflow.
Adds a skill + matching delegated agent that draft Conventional
Commits-style messages by reading the repo's own git log norms
(prefix, scope, subject length) instead of assuming a fixed format.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Preserve PR #2968 contributor history, verified upstream claims, and target-specific metadata. Rebind the existing trigger registry metadata after the merge, retaining current trigger phrases and generation provenance. Portable Bun 1.4.2 isolation and parallel-timing examples passed; all five Markdown files and context profiles validated.
Preserve PR #2943 contributor history and rebind the existing trigger manifest to the 294-skill registry without changing trigger phrases or model provenance. Validated real read-only audit CLI, 66 focused Python tests, 239 full Python tests, five Node surface checks, catalog, install manifests, and context projections.
Carry forward the final scoped delta of PR #3119 at 60e82f95. Keep required dependency closure and select only modules reachable from successful requests; refresh the unchanged 293-skill registry binding.
Carry forward PR #3115ef475c79 and 780dfb78 onto current main. Preserve the newer hook-consent transforms during install and repair. Main already includes the source import fix from #3167.
main resolves SQL clients behind env -S and its launcher grammars, but a
destructive statement still passed under four forms:
- a shell -c inside a short-option cluster (bash -lc, sh -ec), since only
an exact -c was looked up;
- su, whose -c / --command / -lc value runs through the target user's
shell, before or after --;
- taskset, whose mask or CPU list precedes the command, like timeout's
duration;
- a command nested past the shell -c recursion limit, which was allowed
instead of denied.
The first three are checked like sh -c; past the limit the check now
fails closed.
main now inspects SQL clients behind env -S, time, nice, timeout and the
other supported launchers (2b9164c0, from #2829), so this merge takes
main's tree and the cases main still misses are re-applied on its
launcher grammar in the next commit.
The gateguard SKILL.md note changes the skill registry digest, so
ci/context-profiles.test.js reported the skill triggers manifest as
stale. Update the digest the way the earlier registry binding
refreshes did; the triggers themselves are unchanged.
* chore: retire the Everything Claude Code name, ECC only
Replace the expanded product name and the everything-claude-code slug
with ECC across READMEs, translated docs, harness folders, skills,
commands, scripts and examples. Repo URLs now point at affaan-m/ECC.
Rename repo-internal artifacts to ecc forms (ecc-conventions skill,
ecc-guardrails, ecc-research-playbook, ecc-team-config, ecc-instincts
with ecc-* ids) and update .claude/ecc-tools.json.
Legacy install ids, plugin dirs, package names and MCP prefixes stay
where existing installs resolve against them. The codex global-state
check and harness-audit repo detection accept the new name first and
the legacy one as a fallback. The Discord bot prefers ~/GitHub/ECC and
falls back to the nested legacy checkout path.
Refresh the skill-triggers registryDigest for the changed skill text.
* fix(ecc-tools): drop managed paths to the removed Claude repo skill
.claude/skills/<repo-skill>/SKILL.md was deleted in #2770 but stayed listed in
ecc-tools.json and the team config. Remove those entries and point the Claude
Code adapter at the existing .agents/skills/ecc-conventions/SKILL.md.
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
haelyra