Commit Graph
157 Commits
Author SHA1 Message Date
haelyra ba0520340f fix: reconcile reviewed sources and generated integration surfaces 2026-10-09 17:27:37 -04:00
haelyra 6139971817 merge: preserve tested token card source 3039 and synchronize catalog 2026-10-09 16:15:37 -04:00
haelyra c4f419bea0 merge: refresh reviewed stewardship source 3280 on current main 2026-10-09 16:02:58 -04:00
Md. Kishor MorolandKishor Morol bfaa53935a Merge upstream/main into feat/bengali-language-support
Keep both the new Polski locale and Bengali in every language switcher,
locale list and alias map; cross-link docs/pl and docs/bn. Resync catalog
counts (69 agents, 294 skills) and the skill-trigger registry digest.

Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
2026-10-03 19:54:18 -04:00
Affaan MustafaandGitHub c05b2d6614 chore: retire the Everything Claude Code name, ECC only (#3330)
* chore: retire the Everything Claude Code name, ECC only

Replace the expanded product name and the everything-claude-code slug
with ECC across READMEs, translated docs, harness folders, skills,
commands, scripts and examples. Repo URLs now point at affaan-m/ECC.

Rename repo-internal artifacts to ecc forms (ecc-conventions skill,
ecc-guardrails, ecc-research-playbook, ecc-team-config, ecc-instincts
with ecc-* ids) and update .claude/ecc-tools.json.

Legacy install ids, plugin dirs, package names and MCP prefixes stay
where existing installs resolve against them. The codex global-state
check and harness-audit repo detection accept the new name first and
the legacy one as a fallback. The Discord bot prefers ~/GitHub/ECC and
falls back to the nested legacy checkout path.

Refresh the skill-triggers registryDigest for the changed skill text.

* fix(ecc-tools): drop managed paths to the removed Claude repo skill

.claude/skills/<repo-skill>/SKILL.md was deleted in #2770 but stayed listed in
ecc-tools.json and the team config. Remove those entries and point the Claude
Code adapter at the existing .agents/skills/ecc-conventions/SKILL.md.
2026-10-01 17:50:41 -05:00
Affaan MustafaandGitHub 0348d7b6d7 chore(release): 2.2.3, ECC-only naming in pi/core and a longer npm publish wait (#3329)
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).

The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.

Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
2026-10-01 17:49:51 -05:00
haelyra 5ea629876e fix: reconcile stewardship batch on current main
Preserve the Bengali and MyBatis catalog additions, keep Laravel storage examples disk-consistent, isolate ECC 2 test configuration with private permissions, and verify every command-referenced runtime script is published.
2026-09-30 13:29:20 -04:00
Gunwoo 840eb53efd chore: sync MyBatis skill triggers with current catalog 2026-09-30 10:54:59 +09:00
affaan-m b150db1bb4 Merge reviewed PR2444 localization workflow into maintained batch
Preserve prior agent/docs/package changes; bind actual 293-skill registry.

Source-PR: https://github.com/affaan-m/ECC/pull/2444
2026-09-28 04:58:29 -04:00
affaan-m a0444eb8a6 feat(skills): add scoped JSON locale synchronization workflow
Preserve contributor history while applying the exact reviewed current-main repair.

Source-PR: https://github.com/affaan-m/ECC/pull/2444
Source-Parent: 21cb5e733f
Integration-Main: d3b8a3e908
Review-Manifest-SHA256: 4f76d01c75de844ab771a3d03e12e840565e73c6d8daa09ca7a1c0d3841e3607
2026-09-28 04:48:51 -04:00
affaan-m c1f9286e9a Merge main and reconcile agent inventory documentation
Preserve the contributor audit and current skill-first guidance. Document all
68 shipped agents, namespace the added routes, and retain the evaluator
Prompt Defense Baseline without changing capabilities.
2026-09-28 03:12:46 -04:00
iyashjayesh 036fa49779 Merge main, and raise the pinned CLI to 0.10.0
The conflicts were all counter bumps. Upstream moved 286 -> 292 skills while
staying at 94 command shims; this branch adds one of each, so the merged values
are 293 skills and 95 shims, carried across the English, Turkish and Chinese
docs. Upstream's 2.2.2 version is kept.

One line needed care and nearly went wrong: the v2.0.0 changelog entry records
"281 skills, 67 agents, 94 command shims". That 94 is a fact about a past
release, not a live counter, and a blanket substitution had rewritten it. It is
back to 94. The Discord snowflake and the Perl badge colour both contain "94"
too and are untouched.

While here, the pin was stale. It named 0.7.0, three minor versions behind, so
anyone installing through this skill got a tool without Gemini support, the
read-only doctor report, PNG export or the portable ledger. Raised to 0.10.0 —
knowingly, which is what the skill's own note asks for — and the documented
`npm view @tokenchit/cli@0.10.0 dist.integrity dist.tarball` was run to confirm
it resolves.

The agent list was stale for the same reason: Gemini CLI became a real adapter
in 0.9.0 and the skill still advertised three agents. Verified against the
published 0.10.0 tarball rather than from memory — `init --help` and `doctor`
both name Claude Code, Codex, Gemini CLI and OpenCode.
2026-09-27 01:19:05 +05:30
Gunwoo 50c4e93f31 chore: merge latest main into MyBatis contribution 2026-09-25 14:43:27 +09:00
Md. Kishor MorolandKishor Morol 300694069f chore: merge main into Bengali integration
Resolve the 3 conflicts from 104 upstream commits (2.2.1 -> 2.2.2).

Merge resolution:
- .claude-plugin/plugin.json, .claude-plugin/marketplace.json: take the
  upstream 2.2.2 version bump, keep the catalog counts at 69 agents /
  293 skills. Upstream released 2.2.2 still describing 68/292, so neither
  side could be taken whole.
- docs/ja-JP/README.md: upstream restructured the page, moving the hero
  above the fold and replacing both markdown language selectors with a
  single centered HTML block that also gained Español. Take that structure
  and re-add বাংলা to the new selector.
- rules/common/agents.md: merged clean, but the roster line main added
  reads "68 agents". Resync to 69 alongside the other catalog counts.

Verified: catalog.js reports 69 agents / 293 skills and confirms the
documentation counts match the repository catalog; the nine CI validators
and the command-registry check pass; bengali-language-surface.test.js is
7/7, including the selector and locale-parity assertions.

Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
2026-09-20 19:28:18 -04:00
Affaan MustafaandGitHub 91ba9b4cf6 Merge pull request #3133 from affaan-m/release/ecc-universal-2.2.2
release: ecc-universal 2.2.2
2026-09-19 16:41:20 -04:00
Md. Kishor MorolandKishor Morol f70e5c1c47 chore: merge main and address outstanding review feedback
Resolve the 19 conflicts from 314 upstream commits (all language-selector
and catalog-count lines), then fix the review threads still open on #2655.

Merge resolution:
- Keep both new locales: every language selector now lists Українська and বাংলা,
  including the selectors that previously carried only one of them.
- Resync catalog counts to 69 agents / 293 skills across README.md, AGENTS.md,
  README.zh-CN.md, docs/zh-CN/*, docs/tr/AGENTS.md, and the plugin manifests.

Review fixes:
- install-components.json: drop the explicit skill:bengali-nlp -> framework-language
  mapping so the selector resolves to the generated single-skill component.
  Selecting it installed 70 skill paths plus core modules; it now installs
  skills/bengali-nlp only. (Greptile P1)
- docs/bn/README.md: point the Stars/Forks/Contributors badges at affaan-m/ECC
  instead of affaan-m/everything-claude-code, align the header with the other
  translations, add the 2.2.1 release section, and update 67+/281+ to 69/293.
- skills/bengali-nlp/SKILL.md: split the U+09F0-U+09FA row by character type;
  reject empty search queries; replace the delimiter-only prompt boundary with
  structured messages; require provider and locale checks before relying on the
  bn-BD ICU collation; rewrite the isdigit() anti-pattern, which claimed the
  method misses Bengali digits when it accepts them; add Best Practices and
  Related Skills per the CONTRIBUTING template.
- agents/bengali-reviewer.md: HIGH findings now need a fix or a written waiver
  with an owner and expiry, otherwise the verdict is BLOCK.
- tests/ci/bengali-language-surface.test.js: parse fences so an unclosed
  ```python block fails, track a missing interpreter as skipped rather than
  passed, assert the single-skill install plan, and check every language
  selector instead of only the root README.

Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
2026-09-17 01:11:01 -04:00
yashraj4 e404468a62 fix: correct agent location and add ecc: prefix to agent names in rules
- rules/common/agents.md: Fix incorrect location (was ~/.claude/agents/, now explains plugin ships with ecc@ecc)
- Add ecc: prefix to all agent names in tables and orchestration sections
- Update all 4 translated copies (es, ja-JP, zh-CN, tr) with same fixes
- Update root AGENTS.md with ecc: prefix for consistency

Fixes #3143
2026-09-16 23:07:27 +05:30
Affaan Mustafa e65f12bf7e release: ecc-universal 2.2.2 2026-09-15 14:22:02 -04:00
Rockwell Windsor RiceandGitHub 95b9fe157f feat(rails-patterns): add Rails framework patterns skill (#3074)
Adds skills/rails-patterns alongside laravel-patterns and django-patterns: directory contract, skinny controllers with service objects, form and query objects, idiomatic ActiveRecord, background jobs, ViewComponent, Hotwire, and the Rails 8 Solid stack. Decisions defer to rules/ruby/patterns.md. Registered in install-modules (framework-language), agent.yaml, package files, and every skill count (292) across plugin, marketplace, AGENTS and README variants. Independent exact-head review passed with no P0/P1; validate-skills, catalog:check, install manifests, plugin manifest, unicode and personal-path checks all pass; CI 44/44 at the head.
2026-09-12 01:48:16 +01:00
928c1dea72 feat(tasteforge): package reusable workflows and preserve native edits (#3033)
* feat: bundle standalone taste distillation and application workflows

* docs: fix imported taste skill markdown lint

* docs: align Turkish agent catalog with taste skills

* refactor: make ECC the canonical reusable video engine

* fix: preserve video duration when applying image overlays

* fix: preserve background colors in image compositing

* fix: report best-effort duration targets and shortfalls

* feat: ship verified Fusion presets with compatibility provenance

* feat(tasteforge): preserve native edits in application bundles

* feat(tasteforge): compile local preservation without hosted input

* fix: update js-yaml to patched 4.3.2

* test: report bounded Stop wrapper failure diagnostics

* fix(tasteforge): fail closed on unsafe output names, missing overlays and cadence

- cli: default report and spec paths are derived from pack name and profile
  genre; require the manifest's name pattern before using either as a
  filename part so a traversal string cannot write outside cwd/out.
- apply_local: a pack without cadence.json, or with no measured shots and
  no explicit mean_shot, raises instead of silently planning 1.0s shots and
  reporting a measured cadence.
- legacy apply: a missing overlay aborts before any paid upload; forge()
  would have rejected it after every take was generated.
- requirements-live: pin fal-client>=0.13.0, the first release whose
  subscribe() accepts client_timeout.

Addresses the five P1 findings from the independent review of #3033.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015fxHRsydPqEcYngGbqkgt1

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-10 15:31:36 +01:00
f8640355e4 Consolidate recovered eval framework and operator workflows (#3040)
* feat: consolidate offline eval and operator workflows

Compose the retained framework, operator skill, roadmap and cleanup ranges on current main. Preserve current release dependencies and keep candidate execution disabled pending OS containment. Repair draft/DOCX behavior, obligation uniqueness, trusted send and audience guidance, runner provenance and eval diagnostics.

Source-PR: 2930 0abe3727d2b500c6e4830bdeb47ed67cae3f4785
Source-PR: 2931 992b49c44ed872def49675b791168b8fcd091df6
Source-PR: 2932 4a193dd13041cb7a6bebf4d2e910a0cd32bcc797
Source-PR: 2933 59cdfe500a91949ba1415f1edd7279620f21e804
Source-Base: ca185ef5f7

* fix: repair foundation CI and update js-yaml

* fix: reconcile pending-delete capsule locks after close

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-10 13:20:52 +01:00
iyashjayesh 51fe0e9163 Move token-card to a skill, pin the CLI, and fix three doc contradictions
Addresses the review on #3039. Four findings, all of them real.

Skills-first (Greptile P2). AGENTS.md says commands/ exists for compatibility and
the direction is skills-first, so the workflow now lives in skills/token-card
and commands/token-card.md is a thin shim pointing at it — 70 lines down to 28.

Unpinned remote code (CodeRabbit major, Greptile P1, CWE-494). The workflow ran
`npx -y @tokenchit/cli@latest` and handed whatever the registry currently serves
read access to local session logs. It is pinned to 0.7.0, the skill says to raise
the pin knowingly, gives the `npm view … dist.integrity` check, and step 1 is now
an explicit confirmation before the first download on a machine.

The "no network request" claim was false as written (both bots). `sync` sends
nothing, but the npx invocation around it is a registry download, and the
sentence read as though the whole step were offline. It now separates the two.

`--dry-run` wrote a file (Greptile P2). Step 1 created `.tokenchit.json` via
`init` before `sync --dry-run` ran, so a documented no-op mutated the tree.
Initialisation is skipped on a dry run and reported as prospective instead.

The README offer was unreachable (Greptile P2). "Stop after step 3" sat directly
below step 4, so the step that puts the card in the README — the whole point —
could never run. The boundary moved to after step 4; publishing still requires
being asked for by name.

Wiring: agent.yaml skills list, manifests/install-modules.json under
operator-workflows (beside cost-tracking and ecc-tools-cost-audit), and
package.json `files`, which the npm-publish-surface test requires to track the
module graph. `yarn install --mode=update-lockfile` leaves yarn.lock byte
identical, so nothing to commit there. docs/tr/AGENTS.md carries two skill counts
the catalog sync does not reach, both 286 -> 287.

npm test: 4396 passed, 0 failed. markdownlint clean on both files.
2026-09-09 12:58:07 +05:30
iyashjayesh 1052523127 feat(commands): add token-card command 2026-09-09 11:50:14 +05:30
haelyraandGitHub ca185ef5f7 chore(release): prepare signed 2.2.1 patch (#2920) 2026-08-31 18:14:22 -04:00
affaan 9c450046be feat(skills): add tasteforge-video skill for repeatable taste-driven video work
Curated skill delegating to the canonical tasteforge package in
Ito-Markets/ito-video: taste interviews, style-pack validation, offline
distillation with measured grounding, deterministic cadence application to
local footage, EDL/FCPXML export, and generated-media provenance audits.
Provider (Fal) generation requires explicit separately authorized execution
and fails closed in ECC; local references never mean a saved provider
workflow. Registered in the opt-in media-generation install module, npm
files, and catalog counts via scripts/ci/catalog.js. Contract tests cover
frontmatter/triggers, the fail-closed boundary, manifest and npm-packed
discoverability (real tarball check opt-in via ECC_TEST_NPM_PACK=1).
2026-08-18 12:04:33 +00:00
Gunwoo 0d0ee2c9c1 chore: merge current main into MyBatis contribution 2026-08-17 01:20:46 +09:00
Affaan Mustafa 9ba25b9360 fix: harden Nasiko artifact lifecycle 2026-08-15 02:22:29 -04:00
Affaan MustafaGitHubCodeRabbitcoderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
fc1d11839c feat(skills): consolidate Itô market skills into ito-baskets; align ito-training fail-closed contract (#2770)
* feat(skills): consolidate Itô market skills into ito-baskets; align ito-training fail-closed contract

- Replace ito-basket-compare, ito-market-intelligence, ito-data-atlas-agent,
  and ito-trade-planner with one read-only ito-baskets skill (index, compare,
  brief, worksheet modes) preserving every non-advisory, provenance,
  freshness, and recovery contract
- Extend the GET-only client with anonymous basket-index/basket-detail
  commands that validate the ito.public_basket_read.v1 contract and never
  transmit a credential to public routes
- Rewrite ito-training to the same fail-closed availability-check structure
  as ito-inference: pre-spawn rejection, server-verified booking entitlement,
  opaque confirmation-ref, manifest digest binding, idempotent lifecycle
- Update install module, npm files, README/docs catalog counts (287 -> 284),
  and add consolidated contract tests

* test: anchor Itô API origin assertion (CodeQL js/regex/missing-regexp-anchor)

* test: avoid URL-literal substring assertion (CodeQL js/incomplete-url-substring-sanitization)

* fix: apply CodeRabbit auto-fixes

Fixed 1 file(s) based on 1 unresolved review comment.

Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
2026-08-12 15:52:26 -04:00
haelyra 2cc58dfa45 feat: integrate Bengali language support 2026-08-11 23:58:29 -04:00
haelyra 649a1ef9fd chore: merge main into MyBatis contribution 2026-08-11 16:40:24 -04:00
5a2453e167 feat: add council-multi-model skill (heterogeneous Codex review) (#2281)
* feat: add council-multi-model skill (heterogeneous Codex review)

Rebased onto latest main to resolve the merge conflict (the branch had gone
DIRTY as main advanced). Trimmed to just the skill files (no top-level
README/AGENTS edits), mirroring the merged #2381. Previously reviewed
favorably by greptile/coderabbit/daltino.

* feat: add Entry B (independent parallel propose + aggregate, MoA-style) alongside Entry A (review)

Splits the skill into two entries depending on what already exists:
Entry A (unchanged) reviews an existing draft. New Entry B has every
voice (Claude x3 + Codex if available) answer the same question fully
independently and in parallel, then aggregates without collapsing
disagreement or blending incompatible approaches into one hybrid.
For the heaviest decisions the two chain: B first, then A's review
step on the aggregation -- with an explicit honesty caveat when Codex
already proposed in B and so cannot independently judge the result.

* feat: prefer Codex MCP tool over the SDK script when available

mcp__codex__codex is now the primary path for both Entry A's
heterogeneous review and Entry B's independent proposal -- zero relay,
talks directly to OpenAI's backend, no temp file or shell escaping
needed. The openai-codex SDK script becomes the fallback for sessions
without that MCP tool configured; behavior and guardrails (read-only,
verbatim quoting, explicit 'absent' labeling) are unchanged.

* fix: register council-multi-model install path

* docs: sync skill catalog count

* fix: publish council-multi-model skill

* fix: harden council multi-model fallback

* docs: sync remaining skill count

* fix: narrow multi-model council to bounded review

* fix: address council adapter review feedback

* fix(council-multi-model): enforce tool-less Codex review

* fix(council-multi-model): close Codex tool boundary

---------

Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
2026-08-11 16:30:04 -04:00
e990c0c7ed feat(skills): add dev-team skill — multi-persona collaborative session (#2309)
* feat(skills): add dev-team skill — multi-persona collaborative session

Adds skills/dev-team/SKILL.md, a community skill inspired by the
BMAD Method's "party mode": PM, Architect, Developer, and QA respond
to the same topic in parallel, then a synthesis step names tensions
explicitly instead of averaging them.

Reads PROJECT-CONTEXT.md from the repo root when present, and offers
to generate it when missing, folding in the closed project-context
skill's (#2310) generation workflow per affaan-m's review — that
skill's premise (every agent reads the file) wasn't implemented
anywhere, so the capability now lives directly in the one skill that
actually reads it.

Rebuilt on current upstream/main as a skill-only diff: the shared
format-code.ts Windows fix and github-coordination branch-coverage
tests that were previously bundled here (and duplicated across the
story-lifecycle and project-context sibling PRs) now live in #2459.

* fix(manifests): register dev-team skill in workflow-quality install module

* fix(docs): repair README lint errors and Windows hook-install path regression

Fixes CI inherited from the README 2.1 restructure (19b05476):
- MD058: blank lines around tables (delegation map, Codex role configs)
- MD001: Option A/B headings under Ecosystem Tools h2 jump to h4
- MD024: duplicate 'What's included' headings (Codex, Copilot sections)
- restore %USERPROFILE%\\.claude escaping required by
  tests/scripts/manual-hook-install-docs.test.js

* feat(skills): address review — trust boundary, harness-neutral I/O, contract test

Address maintainer review on #2309:
- untrusted-context boundary now travels with every persona prompt:
  inline label on the context section, personas marked analysis-only
  with no state-changing tool use
- personas receive a bounded declarative summary (≤150 words, fixed
  fields, secrets and imperative content stripped) — never the raw
  PROJECT-CONTEXT.md
- context loading uses harness-native file tools; POSIX-only
  'test -f && cat' removed
- all references resolve on main: story-lifecycle follow-up replaced
  with /plan and epic-* commands, ecc:plan-prd corrected to the
  /plan-prd command; boundary vs team-builder and council made explicit
- added tests/docs/dev-team-skill.test.js contract test (roles,
  parallel dispatch, synthesis guardrails, trust boundary, registration)

* docs: refresh Turkish skill count

* ci: retrigger checks (flaky stop-hooks-stdout timeout on macos node20 npm cell)

---------

Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
2026-08-11 12:17:03 -04:00
0e0df5a6e7 feat(agents): add rag-pipeline-reviewer agent (#2446)
* feat(agents): add rag-pipeline-reviewer agent

* fix: correct model field syntax

* fix: address review feedback - add prompt defense baseline, fix context_recall gap, register in AGENTS.md

* chore: update agent count to 68, add trailing newline

* chore: fix agent count consistency in project structure section

* fix: sync Turkish agent catalog count

---------

Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
2026-08-10 22:08:48 -04:00
Gunwoo d516259b3b feat(skills): add MyBatis persistence patterns 2026-08-11 09:35:22 +09:00
Seekers2001andGitHub bed96afa42 Add living-docs-governance skill (maintain-phase project doc system) (#2277)
* feat: add living-docs-governance skill (maintain-phase project doc system)

Rebased onto latest main to resolve the merge conflict (the branch had gone
DIRTY as main advanced). Trimmed to just the skill file (no top-level
README/AGENTS edits), mirroring the merged #2381. Previously approved by
@powershello before this rebase.

* fix: register living-docs-governance install path

* docs: sync skill catalog count

* fix: publish living-docs-governance skill

* fix: adopt existing docs before adding governance files
2026-08-10 17:10:01 -04:00
Affaan MustafaandGitHub f16a6ff2a6 fix: ship new Itô skills through install manifests (#2704)
* fix: ship new Ito skills through install manifests

* ci: audit shipped dependencies separately from tooling

* test(release): pass previous version to heading helper
2026-08-07 14:14:21 -04:00
52a3babd5d feat(skills): add secure terminal opener (#2650)
* test(skills): define terminal opener contract

* feat(skills): add secure terminal opener

* fix(skills): report detached terminal errors

* docs: sync terminal opener skill count

* fix(security): require explicit terminal launch

* test(skills): cover terminal opener review findings

* fix(skills): bound terminal launch waits

* test(skills): cover terminal fallback output

* fix(skills): report terminal mux fallback

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-06 17:24:34 -04:00
28e53a0bc1 feat(install): add guided multi-harness installer (#2649)
* feat(install): add guided Claude plugin setup

* fix: support Claude command shims on Windows

* feat: support safe Claude plugin scope migration

* fix(install): preserve interactive setup terminal

* fix(install): auto-migrate setup scope changes

* feat(install): add guided multi-harness installer

* fix(install): sync Yarn binary metadata

* fix(install): handle wizard EOF on Node 18

* ci: allow installer matrix tests to finish

* test(install): allow slower PowerShell delegation

* fix(install): harden guided provider reconciliation

* test(install): harden packaged and local compatibility

* chore: prepare guided installer release 2.2.0

* fix(install): report refreshed Codex marketplace state

* fix(install): verify managed content provenance

* test(install): allow empty Yarn smoke fixture

* test(install): invoke Windows package shims safely

* fix(install): close cross-platform release gaps

* fix(install): require trusted GitHub origins

* fix(install): preserve hook profile precedence

* refactor(install): centralize trusted GitHub origins

* ci: retrigger workflow run after merge of main

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-06 15:39:49 -04:00
GitHub CopilotandCopilot App 4acd6aa687 docs: agent architecture audit fixes
- Add Prompt Defense Baseline to agent-evaluator (was the only agent missing it)
- Update AGENTS.md to document all 67 agents (36 were previously unlisted)
- Add routing guidance for 11 additional agents in orchestration section
- Count in header kept at 67 (matches actual agents/ folder count)

Audit findings (documented but not changed):
- 3 agents (doc-updater, opensource-forker, opensource-packager) use model:haiku
  with Write/Edit tools; intentional for lightweight pipeline tasks
- 6 agents have non-standard color: field (loop-operator, harness-optimizer,
  gan-*, performance-optimizer); may be harness-specific UI metadata
- 7 agents are <=60 lines; thin but sufficient for narrow scope

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-07-28 23:25:43 +02:00
Affaan Mustafa 6f452d48d2 chore: bump plugin version to 2.1.0 2026-07-27 14:05:24 -04:00
Affaan MustafaandGitHub 4d0b501b05 feat: add cross-harness memory vault (#2581)
Add a local-first, cross-harness memory vault with CLI and MCP surfaces, bounded search and storage, harness-scoped visibility, setup guidance, and comprehensive tests.
2026-07-26 02:46:59 -07:00
Seekers2001andGitHub ad8db87780 feat(skills): add contract-first collaboration workflow (#2567)
Add a contract-first workflow for consumer/provider collaboration, including shared artifact authority, compatibility review, generated-type and runtime verification, and safe handling of contract-driven tooling.
2026-07-26 00:05:22 -07:00
Affaan MustafaandGitHub bc774282e6 feat: connect ECC to canonical Ito compute CLI (#2558) 2026-07-23 19:28:55 -07:00
a511395613 feat: Plan Canvas, a browser review canvas for plans (#2467)
* feat: add Plan Canvas - browser annotate-and-approve review for plan artifacts

- scripts/plan-canvas.js CLI (open/await/end/stop/server; bin ecc-plan-canvas)
- loopback server + ECC-styled chrome + annotation SDK + zero-dep markdown renderer
- Approve/Request-changes verdicts wired to the /plan confirmation gate
- plan-canvas skill, /plan-canvas command, SessionStart hook surfacing open reviews
- shared scripts/lib/loopback-guard.js extracted from control-pane (API re-exported)
- 121 new tests incl. full-workflow E2E; registered in manifests, catalog, registry

Inspired by lavish-axi (https://github.com/kunchenguid/lavish-axi) by @kunchenguid;
original ECC-native implementation, not a port.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(plan-canvas): invoke via ecc-plan-canvas bin so the skill works from any project

Skill/command referenced a cwd-relative `node scripts/plan-canvas.js`, unusable
outside the ECC root. Switch to the ecc-plan-canvas bin (and $CLAUDE_PLUGIN_ROOT
fallback) and align CLI next_step hints so an agent can run it as a skill in any repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(plan-canvas): render Mermaid diagrams + ship Codex cross-harness surface

- markdown renderer emits <pre class="mermaid"> for ```mermaid blocks (source
  entity-escaped so the browser decodes it for the renderer while blocking injection)
- artifact template loads a pinned Mermaid build only when a diagram is present,
  themed to ECC dark, securityLevel strict, graceful offline fallback to source
  (ECC_PLAN_CANVAS_MERMAID_URL overrides for a local mirror)
- skill teaches Mermaid-for-diagrams and states the CLI+JSON loop is harness-agnostic
- add .agents/skills/plan-canvas (Codex) with agents/openai.yaml interface manifest
- register in install-modules workflow-quality paths; docs updated

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(plan-canvas): add demo screenshot

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): sync yarn.lock with new bin; add contributor checklist

- yarn.lock records the ecc-plan-canvas bin so Yarn hardened-mode install no
  longer wants to modify the lockfile on public PRs
- PR template + CONTRIBUTING gain a pre-push checklist covering the lockfile
  trap and the full skill/command/CLI registration surfaces

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Haley Chen <2022hachen@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-08 17:12:48 -04:00
JongHyeok ParkGitHubAffaan Mustafadevin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>affaanBoube
914a58a716 feat(workflows): re-land orch-review workflow + add /orch-review command (#2400)
* feat(workflows): re-land orch-review workflow + add /orch-review command

Re-lands #2363 (reverted by #2393 to unbreak main's lint) and fixes the
root cause so it stays green:

- Restore workflows/orch-review.workflow.js + workflows/README.md.
- eslint.config.js: ignore 'workflows/**/*.workflow.*' and '.claude/workflows/**'
  per the maintainer's note in #2393. Workflow DSL scripts use both top-level
  export (ESM) and top-level return (the runtime wraps them in an async fn),
  which no single eslint sourceType can parse — they must be excluded, not
  lint-fixed. 'npx eslint .' is green with this ignore.
- Add commands/orch-review.md (the /orch-review surface) + regenerate
  docs/COMMAND-REGISTRY.json.

Supersedes #2397 (command-only), which referenced the reverted workflow.

* fix(workflows): address orch-review bot review findings

- Verifier uncertainty no longer demotes blockers (Greptile P1 + CodeRabbit):
  isReal=false only refutes when confidence >= 0.8; low-confidence 'false'
  is treated as uncertain and kept blocking (fail closed).
- Treat the diff (and finding text) as untrusted input in both review and
  verify prompts; ignore embedded directives (prompt-injection hardening).
- Validate changedFiles entries are strings, not just that it is an array.
- Enforce proof for HIGH/CRITICAL in FINDINGS_SCHEMA, not only in the prompt.
- Remove in-place mutation in dimension build + dedup merge (immutable).
- /orch-review: extract & validate a numeric PR id before shelling out to gh.
- Docs: complete the stats example, soften wording, refresh follow-up list.

* style(workflows): apply formatter to orch-review assembly

* fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316) (#2409)

* fix(plan-orchestrate): detect ecc@ecc marketplace + emit ecc: agent prefix (#2316)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format

package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so
npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock
(YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry)
format so npm ci and immutable yarn installs both pass.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: affaan <affaan@itomarkets.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410)

* fix(ci): resync lockfiles with package.json (eslint 10) + migrate yarn.lock to Yarn 4 format

package.json requires eslint@^10.6.0 but the committed locks pinned 9.39.2, so
npm ci aborted and Yarn 4 hardened mode rejected the stale v1-classic yarn.lock
(YN0028). Regenerate package-lock.json and rewrite yarn.lock in Yarn 4 (berry)
format so npm ci and immutable yarn installs both pass.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(ci): require clean probe exit for Windows shell/bash detection; add pyyaml dev dep

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368)

The inline node -e resolver blob was duplicated ~60x across hooks.json,
command docs, and translations. Each copy inlined the full ~700-char
plugin-root search using a spread over nested array literals
(p.join(d,'plugins',...s) over [['ecc'],...]), which breaks Windows hook
execution due to shell quoting (#2368).

Collapse every copy to a 250-char locator that loads the committed
resolve-ecc-root module and delegates to resolveEccRoot() — no spread, no
nested array literals, no escaped double quotes. The real search logic now
lives in one tested module. Also route session-start-bootstrap.js through
resolveEccRoot() instead of its own duplicated reimplementation, and fix
the auto-update.md 'marketplace' (singular) typo along the way.

Guard tests updated: discovery behavior is asserted against resolveEccRoot();
the inline is asserted to delegate and to contain no Windows-fragile
constructs.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(resolve-ecc-root): restore full env-unset discovery in inline resolver

Address Greptile review on #2410: when CLAUDE_PLUGIN_ROOT is unset the
delegating inline could only load the resolver module from ~/.claude,
returning ~/.claude without ever reaching the plugin/cache search. Restore
the old inline's discovery breadth (exact plugin roots + versioned cache)
Windows-safely (no spread, nested arrays, or escaped quotes), then delegate
the authoritative decision to resolveEccRoot(). Add regression tests for
plugin-subdir and versioned-cache bootstrap with env unset.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: affaan <affaan@itomarkets.com>
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix: docs/COMMAND-REGISTRY.json check fails on fresh Windows clone (missing .gitattributes) (#2437)

* fix: add .gitattributes to force LF line endings for text files

npm run command-registry:check (part of npm test) fails on a fresh clone
on Windows with the common core.autocrlf=true setting: git checks out
docs/COMMAND-REGISTRY.json with CRLF, but generate-command-registry.js
always writes LF, so the strict string comparison in checkRegistry()
never matches. Forcing LF via .gitattributes makes checkouts consistent
across platforms regardless of a contributor's local autocrlf setting.

* fix: normalize CRLF line endings to LF per .gitattributes

pyproject.toml, src/llm/__init__.py, src/llm/prompt/builder.py,
src/llm/providers/claude.py, and tests/test_builder.py had CRLF line
endings committed to the repo, inconsistent with the rest of the
codebase. Renormalized via 'git add --renormalize .' now that
.gitattributes enforces eol=lf.

---------

Co-authored-by: Affaan Mustafa <me@affaanmustafa.com>

* chore(catalog): sync command counts (92->93) + register orch-review in agent.yaml surface

---------

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: affaan <affaan@itomarkets.com>
Co-authored-by: Boube <109886533+Cb2i@users.noreply.github.com>
Co-authored-by: Affaan Mustafa <me@affaanmustafa.com>
2026-07-03 20:26:40 -07:00
Affaan MustafaandGitHub 81af407619 chore(catalog): sync manifests + fix skill emoji (wave 2) (#2395)
* chore(catalog): sync manifests after skill batch (#2275 #2377 #2378 #2381)

Update skill counts (273 -> 277) across catalog docs after the verified skill batch.

* fix(skills): replace emoji with ASCII in growth-log + loop-design-check

check-unicode-safety (pre-push gate) bans emoji in SKILL.md; the merged #2377
and #2381 slipped through run-all.js. Swap U+274C/U+2705 for 'Avoid:'/'Bad:'/'Good:'.
2026-06-29 19:44:51 -07:00
Affaan MustafaandGitHub be91f21837 chore(catalog): sync manifests after skill batch (#2319 #2288 #2273 #2274 #2338 #2336 #2347 #2348) (#2394)
Regenerate catalog doc counts + command registry after merging the verified
skill/agent batch. Local full suite was green (2924/2924) with these applied.
2026-06-29 18:39:22 -07:00
xiaolei 20aaf84235 chore(catalog): sync skill counts after rebase on main 2026-06-16 09:05:48 +08:00
Affaan Mustafa 304a346aee Merge pull request #2189 from affaan-m/feat/taste-skill
feat: add taste skill — music-video creative direction. Catalog counts reconciled.
2026-06-15 14:08:24 -04:00
Affaan Mustafa 1c0c780452 Merge pull request #2236 from Victor-Casado/feat/github-native-coordination
feat: add github-native coordination (epic-* commands + scripts + tests). Command registry + catalog reconciled.
2026-06-15 14:08:05 -04:00