everything-claude-code

test(hooks): regression coverage for round 1 review fixes

9 new cases locking in the behavior added by the previous two
commits. Each was verified to fail before the fix and pass after.

Greptile — quote-aware depth counting:
  - blocks $(echo ")"; (npm run dev))
  - blocks (echo ")"; npm run dev)
  - allows $(echo "(npm run dev)") — () inside double-quoted body is literal

Greptile — brace groups:
  - blocks { npm run dev; }
  - blocks echo hi && { npm run dev; }
  - allows {npm run dev} — bash brace-group syntax requires a space after {

CodeRabbit — missing package-manager variants:
  - blocks yarn run dev (yarn 1.x convention)
  - blocks bun dev (bun bare form)

CodeRabbit nitpick — symmetric quote test:
  - blocks echo "$(npm run dev)" — double-quoted substitution still substitutes

The `{npm run dev}` allow case is intentional: bash treats `{` as
a reserved word only when followed by whitespace. The pre-fix code
already passed this through, but until now we never asserted it,
so a future change to brace handling could silently start blocking
literal `{npm` tokens.

Jamkris · 2026-05-14 12:24:45 +09:00

85d33748e0

fix(hooks): cover brace groups + yarn-run/bun-bare dev variants

Two false-negatives surfaced in PR #1889 review:

1. Brace-group bypass (Greptile).
   `{ npm run dev; }` evaluates the dev command in the *current*
   shell — semantically distinct from `( ... )` but with the same
   effect for this hook. `splitShellSegments` correctly cleaves the
   group at `;` into `["{ npm run dev", "}"]`, but the first segment's
   leading token under `readToken` is the bare `{`, which was not in
   `DEV_COMMAND_WORDS`, so the dev-pattern check was skipped.

   Fix: treat `{` and `}` as no-op tokens in `getLeadingCommandWord`
   so we keep walking to the real command word. Matches how shell
   itself parses brace groups (the braces are reserved words, not
   commands). Bash requires a space after `{` and a terminator before
   `}` for an actual group, so `{npm run dev}` correctly remains
   allowed (single token `{npm`, not in `DEV_COMMAND_WORDS`).

2. Missing yarn-run / bun-bare variants (CodeRabbit).
   Both `yarn dev` *and* `yarn run dev` are valid (the latter is what
   `package.json` actually wires `dev` to under yarn 1.x). The same
   `(run )?` symmetry applies to bun. The previous `DEV_PATTERN` only
   matched `yarn\s+dev` and `bun\s+run\s+dev`, allowing the cross
   forms to pass through silently.

   Fix: `yarn(?:\s+run)?\s+dev` and `bun(?:\s+run)?\s+dev` — same
   shape `pnpm(?:\s+run)?\s+dev` was already using.

Verified after this commit (every form now exits 2):

  { npm run dev; }
  { npm run dev ; }
  echo hi && { npm run dev; }
  ({ npm run dev; })
  $( { npm run dev; } )
  yarn run dev
  bun dev

Verified still allowed (no regression):

  echo "{ npm run dev; }"   # literal inside double quotes
  {npm run dev}             # not a brace group per bash syntax

Jamkris · 2026-05-14 12:23:55 +09:00

e2eaf4ac2f

fix(lib): track quote state inside command-substitution depth counters

Greptile flagged a bypass in PR #1889: `$(echo ")"; (npm run dev))`
threaded the depth-counting loops in `extractCommandSubstitutions`
and `extractSubshellGroups` to terminate early, because a literal `)`
inside double quotes was treated as a real closing paren. The
truncated body then ended in a dangling `"` that toggled `inDouble`
in the outer scan, masking the subsequent `(npm run dev)` group from
extraction.

Reproduced (before this commit) by piping the synthetic PreToolUse
payload `{"tool_input":{"command":"$(echo \")\"; (npm run dev))"}}`
into `scripts/hooks/pre-bash-dev-server-block.js` and observing
exit 0 (allow) where the dev pattern is clearly present.

Fix: each `$(...)` and `(...)` body loop now tracks its own
single/double quote state and only treats `(` / `)` as depth
delimiters when outside quotes. The quoted `)` no longer closes
the group early, the body now extends to the real closing paren,
and the outer scan's quote state remains untouched.

After this commit:
  $ echo '{"tool_input":{"command":"$(echo \")\"; (npm run dev))"}}' \
      | node scripts/hooks/pre-bash-dev-server-block.js; echo $?
  2

The symmetric form `$(echo "(npm run dev)")` correctly remains
allowed (bash does not honor `(...)` inside double quotes).

Jamkris · 2026-05-14 12:22:22 +09:00

70b86d81c4

test(hooks): regression coverage for dev-server-block subshell bypass

Lock in the behavior added by the previous commit. Each new case was
verified to fail before the fix and pass after.

Bypasses now blocked (exit 2):
- \$(npm run dev)              command substitution
- \`npm run dev\`              backtick substitution
- echo \$(npm run dev)         substitution inside an argument
- (npm run dev)               plain subshell group
- \$(echo a; npm run dev)      substitution containing a sequenced segment
- (pnpm dev)                  plain subshell group, alt package manager

Allow cases — explicitly proven NOT to regress so the fix doesn't
over-block legitimate uses:
- (tmux new-session -d -s dev "npm run dev")   tmux launcher inside ()
- git commit -m '(npm run dev)'                literal in single quotes
- echo "(npm run dev)"                         literal in double quotes
  (bash does NOT subshell () inside double quotes)
- git commit -m '\$(npm run dev) fix'          literal in single quotes

Single- and double-quote allow cases are important: they distinguish a
real subshell construct from one that's just text inside a string,
which is what `extractSubshellGroups` / `extractCommandSubstitutions`
quote-awareness is for.

Jamkris · 2026-05-14 11:22:44 +09:00

4f4654bf21

fix(hooks): close subshell bypass in pre-bash-dev-server-block

Before this commit the dev-server-block hook ran the leading-command
and dev-pattern check only against the top-level segments returned by
`splitShellSegments`, which doesn't split on `$(...)`, backticks, or
plain `(...)`. That left the policy bypassable by wrapping a dev
command in any of those constructs:

  $(npm run dev)
  `npm run dev`
  echo $(npm run dev)
  (npm run dev)

Each verified by piping a synthetic PreToolUse payload into the hook
on this branch: every form above returned exit 0 (allow) where a plain
`npm run dev` correctly returned exit 2 (block).

Fix: expand the check space before running the leading-command rule.
A small BFS walks the raw command, harvesting bodies from
`extractCommandSubstitutions` (`$(...)` and backticks) and from
`extractSubshellGroups` (plain `(...)`), then splits each harvested
body through `splitShellSegments` and feeds the result into the
existing `isBlockedDevSegment` check.

This preserves every existing allow case (`tmux new-session -d -s dev
"npm run dev"`, quoted-string mentions like `git commit -m "npm run
dev fix"`, `echo hi`) because the leading-command rule is unchanged —
only the set of segments it runs against grew.

Known limitation, not fixed here: `eval "$(echo npm run dev)"` still
slips through because the substitution body's leading command is
`echo`, and statically modeling echo's output to recover the executed
command is out of scope. The same class affects `gateguard-fact-force`
(via `eval "$(echo rm -rf /)"` etc.) and is best addressed in both
hooks together as a follow-up rather than as a one-off here.

Jamkris · 2026-05-14 11:21:41 +09:00

a7e51e8046

feat(lib): add extractSubshellGroups for plain (...) subshells

`extractCommandSubstitutions` only walks `$(...)` and backticks — the two
shell constructs whose bodies are captured as strings. Bash also has
plain `(...)` subshells (e.g. `(npm run dev)`), where the body executes
in a child shell but is not value-captured. Our PreToolUse hooks need
to peer inside those too, because a `(...)` group bypasses the
top-level segment splitter just like `$(...)` does.

This commit adds a sibling extractor with the same conventions as
`extractCommandSubstitutions`:

- single quotes literal — `'(npm run dev)'` is a string, ignored
- double quotes literal for parens — `"(npm run dev)"` is a string
  (bash only honors `$(...)`, not bare `(...)`, inside double quotes)
- skips `$(...)` and backtick spans so we don't double-extract
  bodies the other helper already handles
- recurses into its own bodies for nested groups

No consumer yet; the next commit wires both extractors into
`scripts/hooks/pre-bash-dev-server-block.js` to close the subshell
bypass surface.

Jamkris · 2026-05-14 11:17:46 +09:00

04dc03c3af

feat(lib): extract shell command-substitution parser to shared lib

Extract the `extractCommandSubstitutions` function originally
introduced in scripts/hooks/gateguard-fact-force.js (PR #1853
round 2) into scripts/lib/shell-substitution.js so other PreToolUse
hooks can reuse the same single-quote-aware, double-quote-aware,
nested-subshell-aware parser without duplicating it.

No behavior change in this commit — the function body is copied
verbatim and exposed via `module.exports`. The next commit wires it
into scripts/hooks/pre-bash-dev-server-block.js to close that hook's
own subshell-bypass holes.

gateguard-fact-force.js still defines its own private copy of the
function; consolidating both call sites onto this shared lib is a
follow-up worth doing once this PR lands, but is intentionally out
of scope here to keep the diff focused on the dev-server-block fix.

Jamkris · 2026-05-14 11:10:40 +09:00

0a380c3e85

Sync ECC Tools hosted status roadmap (#1886 )

Affaan Mustafa · 2026-05-13 21:49:42 -04:00

a27831c13e

Sync ECC Tools hosted result history roadmap (#1885 )

Affaan Mustafa · 2026-05-13 21:31:08 -04:00

b24d762caa

docs: sync roadmap after ECC-Tools hosted dispatch

Affaan Mustafa · 2026-05-13 20:30:48 -04:00

f94478e524

docs: sync roadmap after ECC-Tools depth-plan check

Affaan Mustafa · 2026-05-13 20:10:38 -04:00

6cdac19764

docs: sync roadmap after ECC-Tools team backlog job (#1880 )

Affaan Mustafa · 2026-05-13 19:44:49 -04:00

af3a206412

docs: sync roadmap after ECC-Tools AI cost job (#1878 )

Affaan Mustafa · 2026-05-13 19:26:48 -04:00

20f00c1410

docs: sync roadmap after ECC-Tools reference-set job (#1877 )

Affaan Mustafa · 2026-05-13 19:09:35 -04:00

e7a6f137e5

docs: sync roadmap after ECC-Tools harness job (#1876 )

Affaan Mustafa · 2026-05-13 18:50:45 -04:00

7596502092

docs: sync roadmap after ECC-Tools security evidence job (#1875 )

Affaan Mustafa · 2026-05-13 18:32:06 -04:00

c04baa8c25

docs: sync roadmap after ECC-Tools CI diagnostics (#1874 )

Affaan Mustafa · 2026-05-13 18:12:31 -04:00

9082bdedac

docs: sync roadmap after ECC-Tools hosted planning (#1872 )

Affaan Mustafa · 2026-05-13 12:48:50 -04:00

3243a1c5d3

docs: sync roadmap after ECC-Tools depth readiness (#1871 )

Affaan Mustafa · 2026-05-13 12:26:32 -04:00

69401b28b3

docs: sync roadmap after AgentShield corpus expansion

Records AgentShield PR #82 and moves the next AgentShield roadmap slice to hosted evidence-pack workflow depth.

Affaan Mustafa · 2026-05-13 09:04:34 -04:00

9a5ed3223a

docs: sync roadmap after AgentShield remediation workflows

Records AgentShield PR #81 and advances the next AgentShield roadmap slice after remediation workflow phases landed.

Affaan Mustafa · 2026-05-13 08:46:07 -04:00

d844bd6bfc

docs: sync roadmap after AgentShield corpus recommendations

Syncs the ECC 2.0 GA roadmap after AgentShield PR #80 landed corpus accuracy recommendations.

Affaan Mustafa · 2026-05-13 08:28:12 -04:00

cf54c791e4

docs: sync roadmap after ECC-Tools PR draft tracking (#1865 )

Affaan Mustafa · 2026-05-13 08:11:09 -04:00

bd4369e1d5

docs: sync roadmap after AgentShield fingerprint hardening

Affaan Mustafa · 2026-05-13 07:53:15 -04:00

f2be190dcb

docs: sync roadmap after ECC-Tools hardening

Affaan Mustafa · 2026-05-13 07:32:55 -04:00

2afef0f18b

docs: mark JARVIS backend audit clean

Affaan Mustafa · 2026-05-13 07:15:13 -04:00

967e5c6922

docs: sync ECC 2.0 GA roadmap after hardening pass

Affaan Mustafa · 2026-05-13 06:59:20 -04:00

2d29643dd4

feat: add Ruby and Rails rules

Affaan Mustafa · 2026-05-13 06:27:08 -04:00

c2762dd569

docs: sync AgentShield adapter roadmap

Record AgentShield #68/#69 in the ECC GA roadmap and update the next enterprise slice.

Affaan Mustafa · 2026-05-13 04:43:58 -04:00

cb3509ee19

ci: gate observability on release safety evidence

Add release-safety evidence coverage to observability readiness and refresh rc.1 publication gate docs.

Affaan Mustafa · 2026-05-13 04:14:47 -04:00

42f04edc03

fix: fall back to ASCII instinct status bars

Fixes #1855

Affaan Mustafa · 2026-05-13 02:59:58 -04:00

d4728a0d80

fix: harden GateGuard destructive bash tokenizer

Co-authored-by: Jamkris <dltmdgus1412@gmail.com>

SeungHyun · 2026-05-13 02:43:04 -04:00

0e169fecbc

docs: sync AgentShield evidence-pack roadmap (#1854 )

Affaan Mustafa · 2026-05-13 02:22:05 -04:00

b2506f82f6

docs: record post-hardening rc1 release evidence (#1852 )

Affaan Mustafa · 2026-05-13 01:32:58 -04:00

f6e13ab520

ci: disable checkout credential persistence in privileged workflows (#1851 )

Affaan Mustafa · 2026-05-13 01:15:49 -04:00

209abd403b

harden: remove shell access from read-only analyzers (#1850 )

Affaan Mustafa · 2026-05-13 01:00:26 -04:00

2486732714

docs: gate ECC progress sync readiness

Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.

- add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
- add a `Tracker Sync` check to `scripts/observability-readiness.js`
- update observability tests with passing and missing-contract coverage
- update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence

Validation:
- node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
- npm run observability:ready -- --format json (18/18, ready true)
- npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
- git diff --check
- node tests/docs/ecc2-release-surface.test.js (18 passed)
- node tests/run-all.js (2378 passed, 0 failed)
- GitHub CI for #1849 green across Ubuntu, Windows, and macOS

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:38:18 -04:00

63f9bfc33f

docs: add supply-chain incident response playbook

Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.

- add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
- link the playbook from `SECURITY.md`
- reject `pull_request_target` workflows that restore or save shared dependency caches
- add a regression test for the new `pull_request_target + actions/cache` guardrail

Validation:
- node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
- node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
- npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
- npx markdownlint-cli '**/*.md' --ignore node_modules
- git diff --check
- node tests/run-all.js (2377 passed, 0 failed)
- GitHub CI for #1848 green across Ubuntu, Windows, and macOS

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:22:28 -04:00

cbecf5689d

docs: refresh rc1 release readiness evidence

Add the May 13 rc.1 publication evidence refresh and update the release-readiness/GA roadmap gates after #1846.

- record current queue, security-gate, harness audit, adapter, observability, Node, markdownlint, release-surface, npm publish-surface, and ecc2 Rust evidence
- update the publication-readiness checklist with the May 13 evidence artifact
- normalize zh-CN CLAUDE list markers so markdownlint passes

Validation:
- node tests/docs/ecc2-release-surface.test.js
- node tests/docs/harness-adapter-compliance.test.js
- node tests/docs/stale-pr-salvage-ledger.test.js
- npx markdownlint-cli '**/*.md' --ignore node_modules
- git diff --check
- node tests/run-all.js (2376 passed, 0 failed)
- npm run harness:audit -- --format json (70/70)
- npm run harness:adapters -- --check
- npm run observability:ready -- --format json (16/16)
- node tests/scripts/npm-publish-surface.test.js
- cd ecc2 && cargo test (462 passed, 0 failed)

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:05:51 -04:00

da04a6e344

ci: require npm audit signature checks

Require npm registry signature verification wherever workflow npm audit checks run.

- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior

Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846

Affaan Mustafa · 2026-05-12 23:48:56 -04:00

797f283036

feat: add GitHub Copilot prompt support

Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.

Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Girish Kanjiyani · 2026-05-12 23:00:00 -04:00

766f4ee1d8

docs: tighten agent capability posture

Remove shell access from two agents that do not need it and reword PyTorch autograd guidance that AgentShield flagged as encoded-payload-like text. AgentShield remains B/75 while findings drop 316->310 and high findings drop 26->21. Local tests passed 2369/2369; full GitHub Actions matrix green.

Affaan Mustafa · 2026-05-12 22:44:39 -04:00

ff1594ea99

fix: close block-no-verify bypass holes

Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

SeungHyun · 2026-05-12 22:28:12 -04:00

6be241a463

docs: add prompt defense baselines

Add compact prompt-defense baselines to active ECC prompt surfaces and copied CLAUDE examples. AgentShield prompt-defense findings are now zero; local tests passed 2366/2366.

Affaan Mustafa · 2026-05-12 22:22:57 -04:00

393d397efa

ci: harden workflow install boundaries

- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

Affaan Mustafa · 2026-05-12 21:55:36 -04:00

daf0355531

ci: ignore install scripts in release workflows (#1839 )

Affaan Mustafa · 2026-05-12 21:36:36 -04:00

33db548be3

feat: add homelab config skills (VLAN segmentation, Pi-hole DNS, WireGuard VPN) (#1838 )

* feat: add homelab config skills (VLAN, Pi-hole, WireGuard)

Adds three homelab configuration skills, extracted from the stale PR #1413
with the same safety treatment applied to the previously accepted batch:

- homelab-vlan-segmentation: IoT/guest/trusted/server VLAN design for UniFi,
  pfSense/OPNsense, and MikroTik. All firewall rules add isolation, not remove
  protections. Added change-window guidance and AP trunk port clarification.

- homelab-pihole-dns: Pi-hole install, blocklists, DNS-over-HTTPS, local DNS
  records, troubleshooting. Docker is now the lead install method; bare-metal
  uses inspect-first pattern before running the installer script.

- homelab-wireguard-vpn: WireGuard server, peer config, split tunnel, DDNS.
  Replaced broad iptables FORWARD ACCEPT with scoped directional rules
  (wg0→eth0 forward + established return only). Credentials moved to env
  files with explicit notes against inline secrets and version control.

Continues the contribution from PR #1413; the eight skills/agents from
that PR are already in main via #1729 and #1731.

* docs: harden homelab skill pack

---------

Co-authored-by: Affaan Mustafa <affaan@dcube.ai>

Arsal Sajjad · 2026-05-12 21:20:53 -04:00

71ed7c58d4

chore: bump rand lockfile advisory (#1837 )

Affaan Mustafa · 2026-05-12 21:07:37 -04:00

7f3dfde6d7

test: stabilize ECC2 dashboard conflict refresh (#1836 )

Affaan Mustafa · 2026-05-12 20:51:29 -04:00

bbb0350ed6

fix: patch supply chain lockfiles (#1835 )

Affaan Mustafa · 2026-05-12 20:25:53 -04:00

820e07fdaa

1734 Commits