everything-claude-code

fix: refresh orchestration follow-up after #414 (#430 )

Affaan Mustafa · 2026-03-16 14:29:28 -07:00

f12bb90924

feat: add Codex CLI customization scripts (#336 )

* chore(codex): add global ecc sync script and pnpm mcp config

* chore(codex): include codex supplement when syncing agents

* feat(codex): add global git safety hooks and QA/rule prompt packs

* feat(codex): add global regression sanity check command

---------

Co-authored-by: TGreen87 <your-email@example.com>

Tom Green · 2026-03-16 14:02:40 -07:00

5bd183f4a7

feat(design): skill health dashboard mockup (#518 )

* feat(Design): skill health dashboard mockup

* fix(comments): code according to comments

Aryan Tejani · 2026-03-16 14:01:41 -07:00

89044e8c33

fix: export run() to avoid Windows spawnSync issues (#431 )

- session-end-marker.js now exports run() function
- Enables in-process execution via run-with-flags.js
- Avoids spawnSync cross-platform issues on Windows
- Maintains backward compatibility with direct CLI execution

Fixes #429

Co-authored-by: 阳虎 <yanghu@yanghudeMacBook-Pro.local>

yang1002378395-cmyk · 2026-03-16 13:38:47 -07:00

9fcbe9751c

fix(ci): enforce catalog count integrity (#525 )

* fix(ci): enforce catalog count integrity

* test: harden catalog structure parsing

Justin Philpott · 2026-03-16 13:37:51 -07:00

01ed1b3b03

Add PowerShell installer wrapper and update documentation (#532 )

* Add install.ps1 PowerShell wrapper and tests

Add a Windows-native PowerShell wrapper (install.ps1) that resolves symlinks and delegates to the Node-based installer runtime. Update README with PowerShell usage examples and cross-platform npx entrypoint guidance. Point the ecc-install bin to the Node installer (scripts/install-apply.js) in package.json (and refresh package-lock), include install.ps1 in package files, and add tests: a new install-ps1.test.js and a tweak to install-sh.test.js to skip on Windows. These changes provide native Windows installer support while keeping npm-compatible cross-platform invocation.

* Improve tests for Windows HOME/USERPROFILE

Make tests more cross-platform by ensuring HOME and USERPROFILE are kept in sync and by normalizing test file paths for display.

- tests/lib/session-adapters.test.js: set USERPROFILE when temporarily setting HOME and restore previous USERPROFILE on teardown.
- tests/run-all.js: use a normalized displayPath (forward-slash separated) for logging and error messages so output is consistent across platforms.
- tests/scripts/ecc.test.js & tests/scripts/session-inspect.test.js: build envOverrides from options.env and add HOME <-> USERPROFILE fallbacks so spawned child processes receive both variables when only one is provided.

These changes prevent test failures and inconsistent logs on Windows where USERPROFILE is used instead of HOME.

* Fix Windows paths and test flakiness

Improve cross-platform behavior and test stability.

- Remove unused createLegacyInstallPlan import from install-lifecycle.js.
- Change resolveInstallConfigPath to use path.normalize(path.join(cwd, configPath)) to produce normalized relative paths.
- Tests: add toBashPath and normalizedRelativePath helpers to normalize Windows paths for bash and comparisons.
- Make cleanupTestDir retry rmSync on transient Windows errors (EPERM/EBUSY/ENOTEMPTY) with short backoff using sleepMs.
- Ensure spawned test processes receive USERPROFILE and convert repo/detect paths to bash format when invoking bash.

These changes reduce Windows-specific failures and flakiness in the test suite and tidy up a small unused import.

Fredrik Hallerös · 2026-03-16 13:35:17 -07:00

17a6ef4edb

fix(harness-audit): make scoring deterministic with scripted rubric (#524 )

Chandan Semwal · 2026-03-16 13:34:30 -07:00

0ff1b594d0

fix: resolve all CI test failures (19 fixes across 6 files) (#519 )

- canonical-session: fall back to JSON file recording when the loaded
  state-store module has no writer methods (factory vs instance)
- install-executor: skip node_modules and .git dirs in listFilesRecursive
  to prevent ETIMEDOUT copying thousands of .opencode dependency files
- ecc.js: increase maxBuffer to 10MB for spawned subcommands to prevent
  ENOBUFS on large install plan JSON output
- install-apply.test: update Cursor and Antigravity path assertions to
  match flattened rule layout and remapped dirs (workflows, skills)
- ecc.test: increase maxBuffer in test runner to handle large output
- orchestrate-codex-worker.sh: guard against unreadable task file before
  cat, write failure status and handoff artifacts on early exit

Affaan Mustafa · 2026-03-16 01:59:53 -07:00

b48930974b

feat: record canonical session snapshots via adapters (#511 )

Affaan Mustafa · 2026-03-16 01:35:45 -07:00

426fc54456

feat: add SQLite state store and query CLI (#510 )

* feat: add SQLite state store and ECC status CLI

* fix: replace better-sqlite3 with sql.js to eliminate native module CI failures

better-sqlite3 requires native C++ compilation (node-gyp, prebuild-install)
which fails in CI across npm/pnpm on all platforms:
- npm ci: lock file out of sync with native transitive deps
- pnpm: native bindings not found at runtime
- Windows: native compilation fails entirely

sql.js is a pure JavaScript/WASM SQLite implementation with zero native
dependencies. The adapter in index.js wraps the sql.js API to match the
better-sqlite3 interface used by migrations.js and queries.js.

Key implementation detail: sql.js db.export() implicitly ends active
transactions, so the adapter defers disk writes (saveToDisk) until
after transaction commit via an inTransaction guard flag.

createStateStore is now async (sql.js requires async WASM init).
Updated status.js, sessions-cli.js, and tests accordingly.

Affaan Mustafa · 2026-03-16 01:32:21 -07:00

bae1129209

feat: add skill evolution foundation (#514 )

Affaan Mustafa · 2026-03-15 21:47:39 -07:00

d5371d28aa

feat: strengthen install lifecycle and target adapters (#512 )

* fix: strengthen install lifecycle adapters

* fix: restore template content on uninstall

Affaan Mustafa · 2026-03-15 21:47:31 -07:00

131f977841

feat: wire manifest resolution into install execution (#509 )

Affaan Mustafa · 2026-03-15 21:47:22 -07:00

1e0238de96

fix: harden observer hooks and test discovery (#513 )

Affaan Mustafa · 2026-03-15 21:47:15 -07:00

8878c6d6b0

feat: self-improving skills loop — observe, inspect, amend, evaluate

- Add skill health observation layer (execution logging, success/failure tracking)
- Add skill health inspector (trace recurring failures across runs)
- Add amendify mechanism (propose SKILL.md patches from failure evidence)
- Add evaluation scaffolding (compare amended vs original performance)
- Wire into session-inspect CLI: skills:health, skills:amendify, skills:evaluate
- 1145/1145 tests passing (+3 new)

Affaan Mustafa · 2026-03-14 23:21:18 -07:00

c53bba9e02

feat: expand session adapter registry with structured targets

- Registry accepts { type, value } structured targets
- Add --list-adapters and --target-type CLI flags to session-inspect
- Export adapter type from claude-history and dmux-tmux adapters
- 71 new session adapter tests, 34 new session-inspect tests
- All 1142 tests passing

Affaan Mustafa · 2026-03-14 19:09:26 -07:00

2b2777915e

merge: dmux worktree (selective install, orchestration, observer fixes)

Affaan Mustafa · 2026-03-14 12:55:56 -07:00

fcaf78e449

feat: orchestration harness, selective install, observer improvements

Affaan Mustafa · 2026-03-14 12:55:25 -07:00

4e028bd2d2

fix: accept shorter mixed-case session IDs (#408 )

Frank · 2026-03-12 23:29:50 -07:00

c5acb5ac32

fix: preserve orchestration launcher compatibility

Affaan Mustafa · 2026-03-12 15:40:25 -07:00

2d43541f0e

fix: resolve lint regression in plan parsing

Affaan Mustafa · 2026-03-12 15:35:12 -07:00

c5b8a0783e

fix: address remaining orchestration review comments

Affaan Mustafa · 2026-03-12 15:34:05 -07:00

af318b8f04

fix: harden orchestration status and skill docs

Affaan Mustafa · 2026-03-12 15:07:57 -07:00

52daf17cb5

fix: resolve orchestration lint errors

Affaan Mustafa · 2026-03-12 14:49:05 -07:00

ad4ef58a8e

feat: add orchestration workflows and harness skills

Affaan Mustafa · 2026-03-12 14:49:05 -07:00

4d4ba25d11

fix: resolve orchestration lint errors

Affaan Mustafa · 2026-03-12 09:35:03 -07:00

bdf4befb3e

feat: add orchestration workflows and harness skills

Affaan Mustafa · 2026-03-12 09:26:36 -07:00

2349e21731

Revert "feat: add orchestration workflows and harness skills"

This reverts commit cb43402d7d.

Affaan Mustafa · 2026-03-12 09:26:12 -07:00

bfc73866c9

feat: add orchestration workflows and harness skills

Affaan Mustafa · 2026-03-12 08:53:52 -07:00

cb43402d7d

Merge origin/main into feat/insaits-security-hook

Affaan Mustafa · 2026-03-10 20:48:59 -07:00

5a5d647825

fix: make insaits hook opt-in

Affaan Mustafa · 2026-03-10 20:47:09 -07:00

9c1e8dd1e4

Merge remote-tracking branch 'origin/main' into feat/optimize-biome-hooks

# Conflicts:
#	tests/hooks/hooks.test.js
#	tests/run-all.js

Affaan Mustafa · 2026-03-10 20:25:22 -07:00

d239d873d8

fix: align architecture tooling with current hooks docs

Affaan Mustafa · 2026-03-10 19:36:57 -07:00

7705051910

feat: architecture improvements — test discovery, hooks schema, catalog, command map, coverage, cross-harness docs

- AGENTS.md: sync skills count to 65+
- tests/run-all.js: glob-based test discovery for *.test.js
- scripts/ci/validate-hooks.js: validate hooks.json with ajv + schemas/hooks.schema.json
- schemas/hooks.schema.json: hookItem.type enum command|notification
- scripts/ci/catalog.js: catalog agents, commands, skills (--json | --md)
- docs/COMMAND-AGENT-MAP.md: command → agent/skill map
- docs/ARCHITECTURE-IMPROVEMENTS.md: improvement recommendations
- package.json: ajv, c8 devDeps; npm run coverage
- CONTRIBUTING.md: Cross-Harness and Translations section
- .gitignore: coverage/

Made-with: Cursor

kinshukdutta · 2026-03-10 19:36:57 -07:00

a50349181a

refactor: deduplicate config lists and unify resolveFormatterBin branches

Extract BIOME_CONFIGS and PRETTIER_CONFIGS as shared constants to eliminate
duplication between PROJECT_ROOT_MARKERS and detectFormatter(). Unify the
biome/prettier branches in resolveFormatterBin() via a FORMATTER_PACKAGES
map. Remove redundant path.resolve() in quality-gate.js.

Jonghyeok Park · 2026-03-11 10:45:28 +09:00

67841042d6

fix(hooks): add Windows .cmd support with shell injection guard

Handle Windows .cmd shim resolution via spawnSync with strict path
validation. Removes shell:true injection risk, uses strict equality,
and restores .cmd support with path injection guard.

Jonghyeok Park · 2026-03-11 10:45:28 +09:00

0a3afbe38f

perf(hooks): use direct require() instead of spawning child process

Invoke hook scripts directly via require() when they export a
run(rawInput) function, eliminating one Node.js process spawn per
hook invocation (~50-100ms).

Includes path traversal guard, timeouts, error logging, PR review
feedback, legacy hooks guard, normalized filePath, and restored
findProjectRoot config detection with package manager support.

Jonghyeok Park · 2026-03-11 10:45:27 +09:00

66498ae9ac

fix: extract BLOCKING_SEVERITIES constant, document broad catch

- Extract BLOCKING_SEVERITIES frozenset for extensible severity checks.
- Add inline comment on broad Exception catch explaining intentional
  SDK fault-tolerance pattern (BLE001 acknowledged).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 19:06:56 +01:00

9ea415c037

fix: dict anomaly access, configurable fail mode, exception type logging

- Add get_anomaly_attr() helper that handles both dict and object
  anomalies. The SDK's send_message() returns dicts, so getattr()
  was silently returning defaults -- critical blocking never triggered.
- Fix field name: "detail" -> "details" (matches SDK schema).
- Make fail-open/fail-closed configurable via INSAITS_FAIL_MODE env var
  (defaults to "open" for backward compatibility).
- Include exception type name in fail-open log for diagnostics.
- Normalize severity comparison with .upper() for case-insensitive matching.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:53:21 +01:00

e30109829b

fix: address cubic-dev-ai + coderabbit round 3 review

cubic-dev-ai P2: dev_mode now defaults to "false" (strict mode).
Users opt in to dev mode by setting INSAITS_DEV_MODE=true.

cubic-dev-ai P2: Move null-status check above stdout/stderr writes
in wrapper so partial/corrupt output is never leaked. Pass through
original raw input on signal kill, matching the result.error path.

coderabbit major: Wrap insAItsMonitor() and send_message() in
try/except so SDK errors don't crash the hook. Logs warning and
exits 0 (fail-open) on exception.

coderabbit nitpick: write_audit now creates a new dict (enriched)
instead of mutating the caller's event dict.

coderabbit nitpick: Extract magic numbers to named constants:
MIN_CONTENT_LENGTH=10, MAX_SCAN_LENGTH=4000, DEFAULT_MODEL.

Also: added env var documentation to module docstring.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:25:23 +01:00

68fc85ea49

fix: make dev_mode configurable via INSAITS_DEV_MODE env var

Defaults to true (no API key needed) but can be disabled by setting
INSAITS_DEV_MODE=false for production deployments with an API key.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:09:02 +01:00

0405ade5f4

fix: address cubic-dev-ai review — 3 issues

P1: Log non-ENOENT spawn errors (timeout, signal kill) to stderr
instead of silently exiting 0. Separate handling for result.error
and null result.status so users know when the security monitor
failed to run.

P1: Remove "async": true from hooks.json — async hooks run in the
background and cannot block tool execution. The security hook needs
to be synchronous so exit(2) actually prevents credential exposure
and other critical findings from proceeding.

P2: Remove dead tool_response/tool_result code from extract_content.
In a PreToolUse hook the tool hasn't executed yet, so tool_response
is never populated. Removed the variable and the unreachable branch
that appended its content.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:08:19 +01:00

6c56e541dd

fix: address CodeRabbit review — convert to PreToolUse, add type annotations, logging

Critical fixes:
- Convert hook from PostToolUse to PreToolUse so exit(2) blocking works
- Change all python references to python3 for cross-platform compat
- Add insaits-security-wrapper.js to bridge run-with-flags.js to Python

Standard fixes:
- Wrap hook with run-with-flags.js so users can disable via
  ECC_DISABLED_HOOKS="pre:insaits-security"
- Add "async": true to hooks.json entry
- Add type annotations to all function signatures (Dict, List, Tuple, Any)
- Replace all print() statements with logging module (stderr)
- Fix silent OSError swallow in write_audit — now logs warning
- Remove os.environ.setdefault('INSAITS_DEV_MODE') — pass dev_mode=True
  through monitor constructor instead
- Update hooks/README.md: moved to PreToolUse table, "detects" not
  "catches", clarify blocking vs non-blocking behavior

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 17:52:44 +01:00

44dc96d2c6

perf(hooks): eliminate npx overhead and merge biome invocations

- Use local node_modules/.bin/biome binary instead of npx (~200-500ms savings)
- Change post-edit-format from `biome format --write` to `biome check --write`
  (format + lint in one pass)
- Skip redundant biome check in quality-gate for JS/TS files already
  handled by post-edit-format
- Fix quality-gate to use findProjectRoot instead of process.cwd()
- Export run() function from both hooks for direct invocation
- Update tests to match shared resolve-formatter module usage

Jonghyeok Park · 2026-03-10 22:19:31 +09:00

e5d02000c3

feat(hooks): add shared resolve-formatter utility with caching

Extract project-root discovery, formatter detection, and binary
resolution into a reusable module. Caches results per-process to
avoid redundant filesystem lookups on every Edit hook invocation.

This is the foundation for eliminating npx overhead in format hooks.

Jonghyeok Park · 2026-03-10 22:17:02 +09:00

f331d3ecc9

fix: resolve PR 371 portability regressions

Affaan Mustafa · 2026-03-09 22:49:43 -07:00

af51fcacb7

fix: harden hook portability and plugin docs

Affaan Mustafa · 2026-03-09 22:49:43 -07:00

440178d697

feat: add InsAIts PostToolUse security monitoring hook

- Add insaits-security-monitor.py: real-time AI security monitoring
  hook that catches credential exposure, prompt injection,
  hallucinations, and 20+ other anomaly types
- Update hooks.json with InsAIts PostToolUse entry
- Update hooks/README.md with InsAIts in PostToolUse table
- Add InsAIts MCP server entry to mcp-configs/mcp-servers.json

InsAIts (https://github.com/Nomadu27/InsAIts) is an open-source
runtime security layer for multi-agent AI. It runs 100% locally
and writes tamper-evident audit logs to .insaits_audit_session.jsonl.

Install: pip install insa-its

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 01:02:58 +01:00

540f738cc7

fix(hooks): allow tmux-wrapped dev server commands (#321 )

* fix(hooks): fix shell splitter redirection/escape bugs, extract shared module

- Fix single & incorrectly splitting redirection operators (&>, >&, 2>&1)
- Fix escaped quotes (\", \') not being handled inside quoted strings
- Extract splitShellSegments into shared scripts/lib/shell-split.js
  to eliminate duplication between hooks.json, before-shell-execution.js,
  and pre-bash-dev-server-block.js
- Add comprehensive tests for shell splitting edge cases

* fix(hooks): handle backslash escapes outside quotes in shell splitter

Escaped operators like \&& and \; outside quotes were still being
treated as separators. Add escape handling for unquoted context.

zzzhizhi · 2026-03-07 14:47:49 -08:00

177dd36e23

fix: auto-start dev servers in tmux instead of blocking (#344 )

* fix: auto-start development servers in tmux instead of blocking

Replace blocking PreToolUse hook that used process.exit(2) with an auto-transform hook that:
- Detects development server commands
- Wraps them in tmux with directory-based session names
- Runs server detached so Claude Code is not blocked
- Provides confirmation message with log viewing instructions

Benefits:
- Development servers no longer block Claude Code execution
- Each project gets its own tmux session (allows multiple projects)
- Logs remain accessible via 'tmux capture-pane -t <session>'
- Non-blocking: if tmux unavailable, command still runs (graceful fallback)

Implementation:
- Created scripts/hooks/auto-tmux-dev.js with transform logic
- Updated hooks.json to reference the script instead of inline node command
- Applied same fix to cached plugin version (1.4.1) for immediate effect

* fix: resolve PR #344 code review issues in auto-tmux-dev.js

Critical fixes:
- Fix variable scope: declare 'input' before try block, not inside
- Fix shell injection: sanitize sessionName and escape cmd for shell
- Replace unused execFileSync import with spawnSync

Improvements:
- Add real Windows support using cmd /k window launcher
- Add tmux availability check with graceful fallback
- Update header comment to accurately describe platform support

Test coverage:
- Valid JSON input: transforms command for respective platform
- Invalid JSON: passes through raw data unchanged
- Unsupported tools: gracefully falls back to original command
- Shell metacharacters: sanitized in sessionName, escaped in cmd

* fix: correct cmd.exe escape sequence for double quotes on Windows

Use double-quote doubling ('""') instead of backslash-escape ('\\\") for cmd.exe syntax.
Backslash escaping is Unix convention and not recognized by cmd.exe. This fixes quoted
arguments in dev server commands on Windows (e.g., 'npm run dev --filter="my-app"').

Helbetica · 2026-03-07 14:47:46 -08:00

7bed751db0

435 Commits