Resolve the 3 conflicts from 104 upstream commits (2.2.1 -> 2.2.2).
Merge resolution:
- .claude-plugin/plugin.json, .claude-plugin/marketplace.json: take the
upstream 2.2.2 version bump, keep the catalog counts at 69 agents /
293 skills. Upstream released 2.2.2 still describing 68/292, so neither
side could be taken whole.
- docs/ja-JP/README.md: upstream restructured the page, moving the hero
above the fold and replacing both markdown language selectors with a
single centered HTML block that also gained Español. Take that structure
and re-add বাংলা to the new selector.
- rules/common/agents.md: merged clean, but the roster line main added
reads "68 agents". Resync to 69 alongside the other catalog counts.
Verified: catalog.js reports 69 agents / 293 skills and confirms the
documentation counts match the repository catalog; the nine CI validators
and the command-registry check pass; bengali-language-surface.test.js is
7/7, including the selector and locale-parity assertions.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
Preserve current main hook-loader and silent-output changes alongside the reviewed optional Polish documentation module. Package delta only adds docs/pl to shipped files.
Source-PR: https://github.com/affaan-m/ECC/pull/3121
Source-Head: 071f2dbd28
Root package.json declared no main or exports, so OpenCode npm plugin
resolution (import.meta.resolve) failed and the plugin was silently
skipped (#3127). The .opencode TypeScript sources imported siblings
with .js specifiers that only exist after compilation, so the home
install, which loads the .ts files in place, crashed the tool registry
with ERR_MODULE_NOT_FOUND (#3112).
Declare main/types/exports on the root package pointing at the
compiled plugin entry, switch the sources to .ts specifiers, and
enable allowImportingTsExtensions with rewriteRelativeImportExtensions
so the emitted dist keeps working .js specifiers. Add smoke tests that
build the package, resolve and import the entry by name from a temp
install, and verify every in-place relative import resolves.
Fixes#3127Fixes#3112
hooks/hooks.json already ships only schema-valid keys with metadata in the
hooks.metadata.json sidecar. Add scripts/ci/check-hooks-schema-keys.js, a
strict allowlist check that fails when hooks/hooks.json or
hooks/codex-hooks.json carry any key outside their loader's documented set,
wire it into the npm test chain, and cover it with fixture tests.
Refs #3138, #3114
Resolve the 19 conflicts from 314 upstream commits (all language-selector
and catalog-count lines), then fix the review threads still open on #2655.
Merge resolution:
- Keep both new locales: every language selector now lists Українська and বাংলা,
including the selectors that previously carried only one of them.
- Resync catalog counts to 69 agents / 293 skills across README.md, AGENTS.md,
README.zh-CN.md, docs/zh-CN/*, docs/tr/AGENTS.md, and the plugin manifests.
Review fixes:
- install-components.json: drop the explicit skill:bengali-nlp -> framework-language
mapping so the selector resolves to the generated single-skill component.
Selecting it installed 70 skill paths plus core modules; it now installs
skills/bengali-nlp only. (Greptile P1)
- docs/bn/README.md: point the Stars/Forks/Contributors badges at affaan-m/ECC
instead of affaan-m/everything-claude-code, align the header with the other
translations, add the 2.2.1 release section, and update 67+/281+ to 69/293.
- skills/bengali-nlp/SKILL.md: split the U+09F0-U+09FA row by character type;
reject empty search queries; replace the delimiter-only prompt boundary with
structured messages; require provider and locale checks before relying on the
bn-BD ICU collation; rewrite the isdigit() anti-pattern, which claimed the
method misses Bengali digits when it accepts them; add Best Practices and
Related Skills per the CONTRIBUTING template.
- agents/bengali-reviewer.md: HIGH findings now need a fix or a written waiver
with an owner and expiry, otherwise the verdict is BLOCK.
- tests/ci/bengali-language-surface.test.js: parse fences so an unclosed
```python block fails, track a missing interpreter as skipped rather than
passed, assert the single-skill install plan, and check every language
selector instead of only the root README.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
Adds skills/rails-patterns alongside laravel-patterns and django-patterns: directory contract, skinny controllers with service objects, form and query objects, idiomatic ActiveRecord, background jobs, ViewComponent, Hotwire, and the Rails 8 Solid stack. Decisions defer to rules/ruby/patterns.md. Registered in install-modules (framework-language), agent.yaml, package files, and every skill count (292) across plugin, marketplace, AGENTS and README variants. Independent exact-head review passed with no P0/P1; validate-skills, catalog:check, install manifests, plugin manifest, unicode and personal-path checks all pass; CI 44/44 at the head.
* feat: bundle standalone taste distillation and application workflows
* docs: fix imported taste skill markdown lint
* docs: align Turkish agent catalog with taste skills
* refactor: make ECC the canonical reusable video engine
* fix: preserve video duration when applying image overlays
* fix: preserve background colors in image compositing
* fix: report best-effort duration targets and shortfalls
* feat: ship verified Fusion presets with compatibility provenance
* feat(tasteforge): preserve native edits in application bundles
* feat(tasteforge): compile local preservation without hosted input
* fix: update js-yaml to patched 4.3.2
* test: report bounded Stop wrapper failure diagnostics
* fix(tasteforge): fail closed on unsafe output names, missing overlays and cadence
- cli: default report and spec paths are derived from pack name and profile
genre; require the manifest's name pattern before using either as a
filename part so a traversal string cannot write outside cwd/out.
- apply_local: a pack without cadence.json, or with no measured shots and
no explicit mean_shot, raises instead of silently planning 1.0s shots and
reporting a measured cadence.
- legacy apply: a missing overlay aborts before any paid upload; forge()
would have rejected it after every take was generated.
- requirements-live: pin fal-client>=0.13.0, the first release whose
subscribe() accepts client_timeout.
Addresses the five P1 findings from the independent review of #3033.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015fxHRsydPqEcYngGbqkgt1
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
js-yaml < 4.3.2 is affected by a high-severity uncontrolled-resource-
consumption issue (CWE-400 / CWE-407, CVSS 7.5): maxTotalMergeKeys does
not limit CPU use for empty merge sources, allowing a crafted YAML
document with merge keys to cause a denial of service while parsing.
js-yaml is a direct runtime dependency (it is also pinned via `overrides`
and `resolutions`), so the bump is applied in all three package.json
locations and both lockfiles are regenerated. 4.3.2 is a non-breaking
patch release; `npm audit --audit-level=high` and an immutable
`yarn install` both pass afterward.
Advisory: https://github.com/advisories/GHSA-2883-xcg3-v3hh
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Keep npm and Yarn resolution policy aligned so both lockfile paths stay on the patched release.\n\nCo-authored-by: Svector-anu <svector-anu@users.noreply.github.com>
Following the hermes/openclaw (#2433) and kimi (#2441) adapter recipe.
What's included (adal-project adapter, project kind, ./.adal root, same
shape as kimi-project/joycode-project):
- scripts/lib/install-targets/adal-project.js — 10-line project-kind
adapter targeting ./.adal
- Registry + helpers platform-ownership wiring
- adal target on the 5 shared modules (rules-core, agents-core,
commands-core, platform-configs, workflow-quality) +
SUPPORTED_INSTALL_TARGETS + legacy-compat module
- .adal in platform-configs paths
- Both schema enums (install-modules, ecc-install-config), npm files
allowlist, installer help text, .adal/README.md stub
AdaL (adalagent.ai) is a terminal-based AI coding agent (by SylphAI)
built on AdalFlow, with native MCP support and project-scoped config
under ./.adal/ (skills, custom tools, memory) plus a root-level
AGENTS.md instructions file — matching the shape ECC already installs
into other AGENTS.md-based harnesses (Codex, OpenCode, Kimi).
Verified: full suite matches main's baseline (3334 passed, same
pre-existing failures unrelated to this change — OpenCode build/npm-pack
surface tests requiring build tooling not present in this sandbox);
catalog check passes (67 agents / 94 commands / 281 skills); dry-run
resolves Target: adal / Adapter: adal-project / root ./.adal with all 5
modules planned; doctor reports OK after a real install; uninstall
cleanly reverses all 458 operations.
Co-Authored-By: AdaL <adal@sylph.ai>
Curated skill delegating to the canonical tasteforge package in
Ito-Markets/ito-video: taste interviews, style-pack validation, offline
distillation with measured grounding, deterministic cadence application to
local footage, EDL/FCPXML export, and generated-media provenance audits.
Provider (Fal) generation requires explicit separately authorized execution
and fails closed in ECC; local references never mean a saved provider
workflow. Registered in the opt-in media-generation install module, npm
files, and catalog counts via scripts/ci/catalog.js. Contract tests cover
frontmatter/triggers, the fail-closed boundary, manifest and npm-packed
discoverability (real tarball check opt-in via ECC_TEST_NPM_PACK=1).
* feat: add thin Pi adapter mounting ECC's canonical skills and commands
Adds first-class Pi (@earendil-works/pi-coding-agent) support as a thin
adapter layer, following the maintainer review on #2352. ECC's canonical
assets stay the single source of truth: nothing is copied or generated
under .pi/.
The `pi` manifest in package.json points Pi directly at `skills/` and
`commands/`. No transformation is needed — ECC's SKILL.md files already
follow the Agent Skills standard Pi implements, and ECC's command
frontmatter is already Pi's prompt-template format.
.pi/extensions/index.ts is the only adapter logic. It:
- uses Pi's documented `pi.on(...)` lifecycle, not an undocumented event bus
- resolves hook scripts from the installed package via `__dirname`, never
`process.cwd()`, so global installs work from any project directory
- runs hooks with `execFile(process.execPath, [...])` and no shell, so paths
containing spaces or shell metacharacters are safe
- invokes hooks through ECC's own `run-with-flags.js`, so `ECC_HOOK_PROFILE`
and `ECC_DISABLED_HOOKS` keep gating hooks under Pi
- runs hooks in the user's project directory so project detection stays
correct, while resolving the scripts themselves package-relative
- injects the SessionStart hook's `additionalContext` into the system prompt
on the next `before_agent_start`
- isolates hook failures behind a timeout and an output limit
- registers `/ecc-doctor` for install diagnostics
Registers `.pi` in the platform-configs install module and adds a Pi row to
the harness adapter compliance matrix.
Verified against Pi 0.84.1: a global `pi install` exposes 285 skills and 94
commands resolved from `skills/` and `commands/`, plus `/ecc-doctor`, with
no generated copies.
Scope deliberately excludes subagents, chains, approval gates, todos,
profiles, and MCP; ECC works in Pi without any companion package.
* fix: address review findings on the Pi adapter
Bot review on #2759 surfaced two real runtime defects and several
hardening gaps.
Runtime fixes:
- Attach an `error` listener to the hook child's stdin. `stdin.end()`
writes asynchronously, so a hook that exits, short-circuits, or is
killed by the timeout before reading the payload raises EPIPE as an
`error` event that the surrounding try/catch cannot see. Unhandled,
that event would terminate the Pi session and break the isolation
guarantee the adapter documents.
- Clear `pendingContext` at the top of the `session_start` handler. Pi
can start a new session (/new, /resume, /fork) before
`before_agent_start` consumes the previous value; if the newer hook
then failed, the next agent start received context describing a
different session's project state.
- Replace `require.resolve` companion detection with a read of Pi's own
`packages` list, honoring `PI_CODING_AGENT_DIR`. Pi installs packages
under its config directory, which is not on Node's module resolution
path from the extension, so the previous check reported every
companion as missing no matter what was installed.
Compliance matrix: remove internal semicolons and a trailing period from
the Pi record's list entries. The renderer joins entries with "; ", so
those characters split one entry into several in the rendered cell.
Tests: run profile gating against the temp skeleton instead of the real
checkout so it cannot leave marker artifacts behind; count files under
.pi/ by walking disk rather than git, so untracked copies cannot bypass
the regression guard; allow negated phrasing in the README heuristic;
pin the adapter's real parser guards with source assertions so the local
mirrors cannot silently diverge; add coverage for EPIPE isolation, stale
context clearing, and companion detection.
* docs: point users at existing companion Pi packages instead of bundling them
Every capability listed as out of scope is already provided by a maintained
community Pi package: pi-subagents, @juicesharp/rpiv-ask-user-question,
@juicesharp/rpiv-todo, and pi-mcp-adapter for MCP.
Pi supports pulling other pi packages in via dependencies plus
bundledDependencies, but this adapter deliberately does not. Bundling would
ship third-party code that executes with full user permissions in every ECC
install, turn optional capabilities into mandatory ones, and add four
fast-moving pins to maintain.
Instead /ecc-doctor now prints the exact `pi install npm:<name>` command for
each companion it does not find, so adopting one stays a deliberate user
choice.
Also corrects the MCP claim: Pi core has no MCP surface by design, but the
community pi-mcp-adapter package adds one. This adapter neither installs nor
verifies it, and ECC's MCP reference configs are not known to be compatible.
* docs: ECC's MCP configs work in Pi through pi-mcp-adapter, verbatim
Tested rather than assumed. The community pi-mcp-adapter package reads the
standard mcpServers format from .mcp.json and ~/.config/mcp/mcp.json, which
is exactly the format ECC already uses in .mcp.json and
mcp-configs/mcp-servers.json.
Verified against pi-mcp-adapter 2.21.2 in an isolated PI_CODING_AGENT_DIR:
copying mcp-configs/mcp-servers.json to a project's .mcp.json registers Pi's
`mcp` tool and `/mcp` command with all 35 ECC servers discovered, coexisting
with this adapter's /ecc-doctor. No translation layer and no ECC change are
needed, so this stops being a limitation and becomes documentation.
Recorded caveats: the adapter's first run against a new config performs
initialization that blocks in non-interactive mode, and only discovery was
verified, not live tool invocation.
ECC still neither installs nor depends on the package.
* feat: inject ECC's canonical engineering rules into Pi's system prompt
ECC's rules were the one durable asset the adapter did not deliver: skills
and commands reached Pi in full, but the 122 rule files that carry ECC's
coding style, testing, security, git workflow, and code-review standards
did not, so ECC in Pi was a library of skills rather than a set of
enforced standards.
Rules are read at runtime from the canonical rules/common/ directory of
the installed package and appended to the system prompt inside an
<ecc-engineering-rules> block. Nothing is copied or generated under .pi/,
which keeps the single-source-of-truth constraint this PR exists to
satisfy. Injection reuses the before_agent_start path already built for
session context, so no new lifecycle mapping is introduced.
Rules are re-applied every turn because they are standing policy, while
the session context stays one-shot and is consumed on first use.
agents.md, hooks.md, and performance.md are excluded: they describe Claude
Code primitives Pi does not have (Task/TodoWrite delegation, Claude hook
event types, thinking-budget toggles), so injecting them would point the
model at tools that are not there. A test asserts they stay excluded, and
a leakage test asserts none of those primitives appear in the injected
text. Language-specific rules under rules/<language>/ are out of scope for
this first adapter.
Injection is bounded by MAX_RULES_BYTES and can be disabled with
ECC_PI_RULES, following ECC's existing off-switch convention. /ecc-doctor
reports the state and injected size.
Measured on this repo: 7 files, 12,361 characters, roughly 3k tokens.
Also replaces a Function() call in the test helper with direct arithmetic,
and repins a stale assertion that pinned one spelling of the context
handoff rather than the guarantee (read before clear, clear before return).
* fix: /ecc-doctor misreported filtered packages and partial rule installs
Two reporting defects in /ecc-doctor, the command whose whole job is telling
a user what is actually installed.
Pi's settings accept a `packages` entry in two shapes: the bare source string
("npm:pi-subagents") and an object carrying that source alongside resource
filters ({ source: "npm:pi-subagents", skills: [] }). normalizePiPackageName
only recognized the string, so a user who narrowed which resources a companion
contributes was told the companion was not installed, along with an install
command for something already present. The source type still decides whether a
name is comparable, so an object wrapping a git source or a path stays
unrecognized exactly as before.
loadPortableRules drops rule files it cannot read, drops empty ones, and stops
at MAX_RULES_BYTES, but describeRulesStatus reported PORTABLE_RULE_FILES.length
regardless. A partial install that loaded 3 of 7 files reported "7 rule file(s)"
to the one command a user runs to find a partial install. The loaded count is
now tracked next to the cache and reported as a ratio, with the shortfall named.
Also reconciles the Notes bullet in .pi/README.md, which still called MCP out of
scope after the MCP section landed documenting that ECC's configs load in Pi
through pi-mcp-adapter.
Both defects were reported by CodeRabbit and verified against Pi's own
packages.md before fixing. Adapter tests go from 24 to 26; the two source
contracts that pinned the previous spellings now pin the new guards, so the
object-form unwrapping and the loaded-count reporting cannot be silently
reverted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* feat: add council-multi-model skill (heterogeneous Codex review)
Rebased onto latest main to resolve the merge conflict (the branch had gone
DIRTY as main advanced). Trimmed to just the skill files (no top-level
README/AGENTS edits), mirroring the merged #2381. Previously reviewed
favorably by greptile/coderabbit/daltino.
* feat: add Entry B (independent parallel propose + aggregate, MoA-style) alongside Entry A (review)
Splits the skill into two entries depending on what already exists:
Entry A (unchanged) reviews an existing draft. New Entry B has every
voice (Claude x3 + Codex if available) answer the same question fully
independently and in parallel, then aggregates without collapsing
disagreement or blending incompatible approaches into one hybrid.
For the heaviest decisions the two chain: B first, then A's review
step on the aggregation -- with an explicit honesty caveat when Codex
already proposed in B and so cannot independently judge the result.
* feat: prefer Codex MCP tool over the SDK script when available
mcp__codex__codex is now the primary path for both Entry A's
heterogeneous review and Entry B's independent proposal -- zero relay,
talks directly to OpenAI's backend, no temp file or shell escaping
needed. The openai-codex SDK script becomes the fallback for sessions
without that MCP tool configured; behavior and guardrails (read-only,
verbatim quoting, explicit 'absent' labeling) are unchanged.
* fix: register council-multi-model install path
* docs: sync skill catalog count
* fix: publish council-multi-model skill
* fix: harden council multi-model fallback
* docs: sync remaining skill count
* fix: narrow multi-model council to bounded review
* fix: address council adapter review feedback
* fix(council-multi-model): enforce tool-less Codex review
* fix(council-multi-model): close Codex tool boundary
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
* feat(skills): add dev-team skill — multi-persona collaborative session
Adds skills/dev-team/SKILL.md, a community skill inspired by the
BMAD Method's "party mode": PM, Architect, Developer, and QA respond
to the same topic in parallel, then a synthesis step names tensions
explicitly instead of averaging them.
Reads PROJECT-CONTEXT.md from the repo root when present, and offers
to generate it when missing, folding in the closed project-context
skill's (#2310) generation workflow per affaan-m's review — that
skill's premise (every agent reads the file) wasn't implemented
anywhere, so the capability now lives directly in the one skill that
actually reads it.
Rebuilt on current upstream/main as a skill-only diff: the shared
format-code.ts Windows fix and github-coordination branch-coverage
tests that were previously bundled here (and duplicated across the
story-lifecycle and project-context sibling PRs) now live in #2459.
* fix(manifests): register dev-team skill in workflow-quality install module
* fix(docs): repair README lint errors and Windows hook-install path regression
Fixes CI inherited from the README 2.1 restructure (19b05476):
- MD058: blank lines around tables (delegation map, Codex role configs)
- MD001: Option A/B headings under Ecosystem Tools h2 jump to h4
- MD024: duplicate 'What's included' headings (Codex, Copilot sections)
- restore %USERPROFILE%\\.claude escaping required by
tests/scripts/manual-hook-install-docs.test.js
* feat(skills): address review — trust boundary, harness-neutral I/O, contract test
Address maintainer review on #2309:
- untrusted-context boundary now travels with every persona prompt:
inline label on the context section, personas marked analysis-only
with no state-changing tool use
- personas receive a bounded declarative summary (≤150 words, fixed
fields, secrets and imperative content stripped) — never the raw
PROJECT-CONTEXT.md
- context loading uses harness-native file tools; POSIX-only
'test -f && cat' removed
- all references resolve on main: story-lifecycle follow-up replaced
with /plan and epic-* commands, ecc:plan-prd corrected to the
/plan-prd command; boundary vs team-builder and council made explicit
- added tests/docs/dev-team-skill.test.js contract test (roles,
parallel dispatch, synthesis guardrails, trust boundary, registration)
* docs: refresh Turkish skill count
* ci: retrigger checks (flaky stop-hooks-stdout timeout on macos node20 npm cell)
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
* feat: add living-docs-governance skill (maintain-phase project doc system)
Rebased onto latest main to resolve the merge conflict (the branch had gone
DIRTY as main advanced). Trimmed to just the skill file (no top-level
README/AGENTS edits), mirroring the merged #2381. Previously approved by
@powershello before this rebase.
* fix: register living-docs-governance install path
* docs: sync skill catalog count
* fix: publish living-docs-governance skill
* fix: adopt existing docs before adding governance files
* fix: ship new Ito skills through install manifests
* ci: audit shipped dependencies separately from tooling
* test(release): pass previous version to heading helper
haelyra