mirror of https://github.com/affaan-m/ECC.git synced 2026-08-17 21:15:40 +02:00

Files

T

Gaurav Dubey 9d1ecb0754 fix(opencode): resolve command agent ids to registered opencode agents (#2477 )

The `.opencode/commands/*.md` frontmatter referenced agents with the Claude
Code plugin namespace (`agent: everything-claude-code:<name>`), but ECC's
opencode integration registers its agents unscoped in `opencode.json`'s
`agent` map (`code-reviewer`, `planner`, ...), and that file's own `command`
section already references them unscoped. The `everything-claude-code:` scope
resolves under no opencode config (the opencode plugin package is
`ecc-universal`, and inline-config agents are bare), so subtask commands like
`/code-review` hard-fail with `Agent not found: everything-claude-code:code-reviewer`.
Non-subtask commands fall back to the default agent and appear to work — which
is why only some commands failed.

Strip the `everything-claude-code:` prefix from all 30 command frontmatter
agent ids so they match the registered agents, fix the MIGRATION.md example,
and replace the test that enforced the broken scoped invariant with one that
asserts each command agent id is a registered opencode agent (fails on the old
scoped ids, passes on the fix).

Fixes #2477

2026-07-10 09:46:40 +05:30

2.6 KiB

Raw Permalink Blame History

description, agent, subtask

description	agent	subtask
Run AgentShield against agent, hook, MCP, permission, and secret surfaces.	security-reviewer	true

Security Scan Command

Run AgentShield against the current project or a target path, then turn the findings into a prioritized remediation plan.

Usage

path (optional): defaults to the current project. Use a .claude/ path, a repo root, or a checked-in template directory.
--format: output format. Use json for CI, markdown for handoffs, and html for standalone review reports.
--min-severity: filters lower-priority findings.
--fix: applies only AgentShield fixes explicitly marked as safe and auto-fixable.

Deterministic Engine

Prefer the packaged scanner:

npx ecc-agentshield scan --path "${TARGET_PATH:-.}" --format text

For local AgentShield development, run from the AgentShield checkout:

npm run scan -- --path "${TARGET_PATH:-.}" --format text

Do not invent findings. Use AgentShield output as the source of truth and separate scanner facts from follow-up judgment.

Review Checklist

Identify active runtime findings first:
- hardcoded secrets
- broad permissions
- executable hooks
- MCP servers with shell, filesystem, remote transport, or unpinned npx
- agent prompts that handle untrusted content without defenses
Separate lower-confidence inventory:
- docs examples
- template examples
- plugin manifests
- project-local optional settings
For each critical or high finding, return:
- file path
- severity
- runtime confidence
- why it matters
- exact remediation
- whether it is safe to auto-fix
If --fix is requested, state the planned edits before applying fixes.
Re-run the scan after fixes and report the before/after score.

Output Contract

Return:

Security grade and score.
Counts by severity and runtime confidence.
Critical/high findings with exact paths.
Lower-confidence findings grouped separately.
A remediation order.
Commands run and whether the scan was local, CI, or npx-backed.

CI Pattern

Use AgentShield in GitHub Actions for enforced gates:

- uses: affaan-m/agentshield@v1
  with:
    path: "."
    min-severity: "medium"
    fail-on-findings: true

Arguments

$ARGUMENTS:

optional target path
optional AgentShield flags

2.6 KiB Raw Permalink Blame History