WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-17 23:28:04 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,657 Commits 72 Branches 18 Tags
967a5fa4baa610e462b3ac9c6eb7d4e1d95c8a4d
Commit Graph
2657 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
haelyra 967a5fa4ba Merge reviewed Claude hook registration and settings containment fixes 2026-09-07 16:38:41 -04:00
haelyra 17b70f56fc Merge reviewed PowerShell enforcement fixes for 2.2.1 
# Conflicts:
#	tests/hooks/gateguard-fact-force.test.js
 2026-09-07 16:38:41 -04:00
haelyra 743cc6983c Merge verified observer failure retention into 2.2.1 patch 2026-09-07 16:34:57 -04:00
haelyraandGitHub cf065358fb Merge pull request #2971 from wellkilo/fix/observer-analysis-completion-sentinel 
fix(continuous-learning-v2): require analysis completion sentinel
 2026-09-07 16:34:29 -04:00
haelyra dbe8bfbba9 fix(install): pin Claude settings parent during atomic replacement 
Reject directory replacement after temporary file creation or staging, preserve unrelated files during cleanup, and retry settings edits observed before the final rename. Add three regression tests for the review findings.
 2026-09-07 16:31:33 -04:00
haelyra 82bfd22578 docs(release): record reviewed patch candidates and limits 2026-09-07 16:29:28 -04:00
haelyra c85c39e01a fix(release): patch Yarn toml advisory and track 2.2.1 gates 2026-09-07 16:27:59 -04:00
haelyra e0252df02f fix: scope GateGuard exemptions to the project 
Address #2921 and complete the segment-anchoring direction in #2979. Preserve explicit absolute exemptions while denying accidental matches in unrelated projects.
 2026-09-07 16:27:01 -04:00
wakqasahmedandhaelyra fe3d82e280 fix(install): derive dependency versions from package.json, harden fixture isolation (#2822) 
Addresses Greptile's review on #2994:

- missing-dependency.js no longer hardcodes a second copy of the four
  runtime dependency versions; it reads them from package.json's
  dependencies field instead, so the two can't silently drift apart.
  describeMissingDependencyError() still recognizes a tracked
  dependency even if package.json can't be read for some reason,
  just without a version-pinned install command in that case.
- The regression test now asserts no ancestor directory of its
  temp fixture has a node_modules, so a stray one wouldn't let
  Node resolve ajv/sql.js from there and mask what the test is
  actually meant to exercise. Also copies package.json into the
  fixture, matching a real plugin-marketplace git clone and what
  the version-lookup above now needs.
 2026-09-07 16:26:10 -04:00
wakqasahmedandhaelyra ce11e8f690 fix(install): ship ajv/sql.js with the plugin install bundle (#2822) 
install-plan.js and install-apply.js both require ./lib/install/config at
load time, and that module required ajv unconditionally at the top of the
file even though ajv is only actually used when validating an
ecc-install.json. When ECC is installed via the Claude Code plugin
marketplace, the marketplace directory is a bare git clone with no
node_modules, so requiring ajv crashes commands like --list-profiles that
never touch install-config validation at all.

Same root cause in scripts/lib/control-pane/state.js: sql.js and
@iarna/toml were required at module scope even though they are only used
inside openSqlDatabase() and readTomlConfig(), so control-pane.js --help
crashed too.

Make both requires lazy so they only load when the feature that actually
needs them runs. For the case where ajv/sql.js/js-yaml/@iarna-toml is
genuinely needed and still missing, add a small helper that turns the raw
MODULE_NOT_FOUND into an actionable message naming the package and the
install command, instead of a stack trace (install-apply.js) or, worse, an
unhandled crash with a usage banner tacked on that reads like a bad
argument (install-plan.js, control-pane.js). Applied the same helper to
memory-mcp.mjs, where ajv is genuinely load-bearing (it compiles every MCP
tool's JSON schema up front) so it can't be made lazy the same way.

Added a regression test that copies just scripts/, schemas/, and
manifests/ into a directory with no node_modules anywhere above it in the
filesystem, which reproduces the plugin-marketplace install exactly, and
asserts install-plan.js and control-pane.js still work.
 2026-09-07 16:26:10 -04:00
haelyraandDavidHLP f2bcc00d69 fix(pi): prevent recursive compiled OMP hook execution 
Forward-port #2911 for #2909 and exercise the real adapter lifecycle with a recorded process boundary, including unavailable Node and invalid overrides.

Co-authored-by: DavidHLP <lysf15520112973@163.com>
 2026-09-07 16:26:10 -04:00
haelyraandjackie-cqz 20b1ba423e fix(hooks): preserve complete bounded passthrough payloads 
Forward-port #2925 for #2924 and verify ASCII and multibyte over-limit input suppression. Supersedes the overlapping direct-entrypoint fix in #2978.

Co-authored-by: jackie-cqz <2557911191@qq.com>
 2026-09-07 16:26:10 -04:00
haelyra bf0ac4e4b3 fix: reject late PowerShell scalar resolution 2026-09-07 16:23:30 -04:00
wellkilo f59cfd57c2 fix(install): harden Claude settings lifecycle 2026-09-07 01:57:04 +08:00
wellkilo 26d3e0038b fix(install): surface Claude settings failures 2026-09-07 01:13:20 +08:00
wellkilo 569e5a36bb feat(install): register manual Claude hooks 2026-09-07 00:53:13 +08:00
haelyra db88758cbd fix: preserve linear PowerShell tokenization 2026-09-05 17:47:26 -04:00
haelyra 99668f0ef5 fix: resolve nested PowerShell command tokens 2026-09-05 17:38:20 -04:00
haelyra cb5311222d fix: scan inline PowerShell command parameters 2026-09-05 17:29:02 -04:00
haelyra 56552d964f docs: record final ECC-039 verification 2026-09-05 16:58:31 -04:00
haelyra f43195a255 fix: expand nested PowerShell command scalars 2026-09-05 16:57:10 -04:00
haelyra 8eeac94af3 fix: preserve PowerShell expansion semantics 2026-09-05 16:32:15 -04:00
haelyra 3ad828db47 fix: address PowerShell review bypasses 2026-09-05 16:12:58 -04:00
wellkilo 63dea9c925 fix: harden observer completion handling 2026-09-06 00:01:49 +08:00
wellkilo 3a384ca698 fix: require observer analysis completion sentinel 2026-09-05 23:42:46 +08:00
haelyra d9f6091ee8 fix: close PowerShell destructive command gate bypass 2026-09-04 15:02:57 -04:00
haelyraandGitHub e04ea0b9cc Merge pull request #2949 from affaan-m/dependabot/github_actions/actions-minor-and-patch-6512b1d693 
chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the actions-minor-and-patch group across 1 directory
 2026-09-03 16:51:15 -04:00
dependabot[bot]andGitHub 6a1e0c1bc5 chore(deps): bump softprops/action-gh-release 
Bumps the actions-minor-and-patch group with 1 update in the / directory: [softprops/action-gh-release](https://github.com/softprops/action-gh-release).


Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/3d0d9888cb7fd7b750713d6e236d1fcb99157228...efb35369e0ad2afab669f228072c1b0d510eae64)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 20:05:14 +00:00
haelyraandGitHub d1955a66f6 Merge pull request #2948 from haelyra/maint/dependabot-2026-09-03 
chore(deps): consolidate verified Dependabot updates
 2026-09-03 16:03:10 -04:00
haelyra 8059798888 fix(deps): pin patched @humanfs/node 
Keep npm and Yarn resolution policy aligned so both lockfile paths stay on the patched release.\n\nCo-authored-by: Svector-anu <svector-anu@users.noreply.github.com>
 2026-09-03 15:08:04 -04:00
haelyra b74e0add1d test: synchronize dependency update coverage 2026-09-03 15:00:31 -04:00
dependabot[bot]andhaelyra d330b57a50 chore(deps): bump @humanfs/node 
Bumps the npm-security group with 1 update in the / directory: [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node).


Updates `@humanfs/node` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
  dependency-group: npm-security
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:59:21 -04:00
dependabot[bot]andhaelyra bd97cbe451 chore(deps): bump the npm-minor-and-patch group across 1 directory with 6 updates 
Bumps the npm-minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.1` | `1.14.2` |
| @opencode-ai/plugin | `1.17.3` | `1.18.25` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.4.0` |
| [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.9.1` |
| [globals](https://github.com/sindresorhus/globals) | `17.4.0` | `17.11.0` |
| [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli) | `0.48.0` | `0.49.1` |



Updates `sql.js` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](https://github.com/sql-js/sql.js/compare/v1.14.1...v1.14.2)

Updates `@opencode-ai/plugin` from 1.17.3 to 1.18.25

Updates `@types/node` from 26.1.2 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `eslint` from 10.6.0 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.9.1)

Updates `globals` from 17.4.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.4.0...v17.11.0)

Updates `markdownlint-cli` from 0.48.0 to 0.49.1
- [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases)
- [Commits](https://github.com/igorshubovych/markdownlint-cli/compare/v0.48.0...v0.49.1)

---
updated-dependencies:
- dependency-name: "@opencode-ai/plugin"
  dependency-version: 1.18.19
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: markdownlint-cli
  dependency-version: 0.49.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: sql.js
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:59:21 -04:00
dependabot[bot]andhaelyra 8dfa7cec0a chore(deps): bump the cargo-minor-and-patch group across 1 directory with 4 updates 
Bumps the cargo-minor-and-patch group with 4 updates in the /ecc2 directory: [rusqlite](https://github.com/rusqlite/rusqlite), [ureq](https://github.com/algesten/ureq), [thiserror](https://github.com/dtolnay/thiserror) and [uuid](https://github.com/uuid-rs/uuid).


Updates `rusqlite` from 0.40.1 to 0.40.2
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](https://github.com/rusqlite/rusqlite/compare/v0.40.1...v0.40.2)

Updates `ureq` from 3.3.0 to 3.4.0
- [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md)
- [Commits](https://github.com/algesten/ureq/compare/3.3.0...3.4.0)

Updates `thiserror` from 2.0.19 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](https://github.com/dtolnay/thiserror/compare/2.0.19...2.0.20)

Updates `uuid` from 1.24.0 to 1.26.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.24.0...v1.26.0)

---
updated-dependencies:
- dependency-name: rusqlite
  dependency-version: 0.40.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
- dependency-name: ureq
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-and-patch
- dependency-name: uuid
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:59:21 -04:00
dependabot[bot]andhaelyra 45a48d5e1b chore(deps): bump the actions-minor-and-patch group across 1 directory with 2 updates 
Bumps the actions-minor-and-patch group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [pnpm/action-setup](https://github.com/pnpm/action-setup).


Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

Updates `pnpm/action-setup` from 6.0.9 to 6.0.10
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
  dependency-version: 6.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:59:21 -04:00
haelyra 23fb7e0c79 ci: avoid redundant Python dependency floors 2026-09-03 14:59:01 -04:00
haelyraandGitHub 22e8cf01d0 test(ci): scale repair timeout on Windows (#2942) 2026-09-02 20:48:57 -04:00
haelyraandGitHub d3652039ac test(hooks): drain bootstrap children asynchronously (#2941) 
* test(hooks): drain bootstrap children asynchronously

* test(hooks): harden async supervisor lifecycle

* test(hooks): accept Windows child stdin closure
 2026-09-02 19:55:26 -04:00
haelyraandGitHub 11813f968c test(hooks): avoid repeated giant wrapper payloads (#2940) 
* test(hooks): avoid repeated giant wrapper payloads

* test(hooks): assert callback-governed wrapper exits
 2026-09-02 17:47:04 -04:00
haelyraandGitHub 90430ab3a7 test(ci): tolerate loaded macOS hook runners (#2939) 2026-09-02 16:37:08 -04:00
haelyraandGitHub 348f80a89b fix(security): update fast-uri to 3.1.7 (#2936) 2026-09-02 15:13:20 -04:00
Wu ShuwenandGitHub de899ac472 fix(tests): preserve session alias HOME isolation (#2877) 2026-09-02 14:24:39 -04:00
haelyraandGitHub ca185ef5f7 chore(release): prepare signed 2.2.1 patch (#2920) 2026-08-31 18:14:22 -04:00
Affaan MustafaandGitHub a104765bf2 docs(ito-compute): document ito accept and ito_accept MCP workflow (#2893) 
* docs(ito-compute): document ito accept and ito_accept MCP workflow

Updates the canonical ECC skill to cover the new quote acceptance path:
- CLI: ecc ito accept <ticket-id>
- MCP: ito_accept tool
- Explicit buyer-authority guard before accepting
- Clear statement that accept routes to desk, does not purchase

* test(ito-compute): assert the four-tool MCP boundary including ito_accept

The exact-boundary test pinned the three-tool description. Runtime
ito-compute-cli now exposes ito_accept (Ito-Markets/ito-cloud-runtime#1453),
so the template boundary assertion moves to four tools.

* docs(ito-compute): drop the firm-quote gate from the accept workflow

Desk quotes are indicative_paper in production (a firm quote requires the
separate human-held signing path and cannot reach the client), so gating
accept on 'a firm quote is ready' described an unfireable condition. Align
with the runtime contract: accept routes the current desk quote to human
review and the result carries quote_class (ito-cloud-runtime#1453).
 2026-08-31 15:16:16 -04:00
haelyraandGitHub 005eff40fd fix(install): harden universal setup release path (#2888) 
* fix(install): harden universal setup release path

* docs(adal): use ecc-universal doctor command
 2026-08-30 18:54:00 -04:00
haelyraandGitHub ce64e417fd Merge pull request #2913 from affaan-m/fix/opencode-hook-consent 
fix(install): preserve opencode non-hook defaults
 2026-08-30 15:52:28 -04:00
haelyra 64d0d9436f fix(install): preserve opencode non-hook defaults 2026-08-30 15:35:47 -04:00
haelyraandGitHub 19e2f2b46d Merge pull request #2912 from affaan-m/fix/packed-install-hook-consent 
test(ci): confirm hooks in packed target smoke
 2026-08-30 15:20:35 -04:00
haelyra d26b9cccee test(ci): confirm hooks in packed target smoke 2026-08-30 15:19:01 -04:00
haelyraandGitHub 8211578ee7 Merge pull request #2715 from affaan-m/feat/hook-runtime-consent 
feat(install): require an explicit hook decision at the apply layer
 2026-08-30 15:13:28 -04:00