1733 Commits

This Branch

This Branch

All Branches

• fix(hooks): address coderabbit review — use lstatSync for symlink paths

  CodeRabbit major on PR #1898: fs.statSync follows symlinks, so a dangling
  protected symlink (e.g. .eslintrc.js pointing at a missing target) would
  throw ENOENT and be treated as absent — letting an agent "replace" the
  symlink and bypass the protection.
  
  Swap statSync for lstatSync. lstat reports the link node itself regardless
  of whether its target exists, so protected entries that happen to be
  symlinks stay blocked. ENOENT handling is unchanged: only a genuinely
  missing path (no link, no file, no directory) counts as absent.
  
  Add a regression test that creates a dangling symlink at .eslintrc.js and
  verifies the hook still blocks Write. Skips cleanly on platforms/sandboxes
  that disallow symlink creation (EPERM/EACCES).

  gaurav0107 · 2026-05-15 01:09:43 +05:30
  7145ca9dfe
• fix(hooks): address greptile review — use statSync for true fail-closed

  Greptile P1 on PR #1898: fs.existsSync internally catches all errors and
  returns false, so the previous try/catch around it was dead code and the
  stated "fail-closed on EACCES" semantics weren't actually delivered. A
  file under a directory with no execute permission would read as absent
  and bypass the guard.
  
  Swap to fs.statSync with explicit ENOENT detection. Only ENOENT flips
  exists to false; every other error code (EACCES, EPERM, ELOOP, etc.)
  leaves exists=true so the modification guard is never silently weakened.
  
  Add a new test "allows first-time creation when the parent directory
  does not exist yet" that exercises the ENOENT path via a non-existent
  parent dir — pins the happy path into the regression suite.

  gaurav0107 · 2026-05-15 00:57:03 +05:30
  a8fe098c88
• fix(hooks): allow first-time creation of protected config files

  The config-protection hook blocks Write/Edit on any basename in the
  PROTECTED_FILES set, regardless of whether the file already exists. The
  hook's stated purpose is to prevent agents from softening rules in an
  existing config — but the same code path also blocks the legitimate
  bootstrap case of scaffolding a linter config into a project that has
  none.
  
  Add an fs.existsSync check inside run(): when the basename matches a
  protected entry and the file does not yet exist on disk, exit 0 and
  let the Write proceed. Keep the exit-2 block for all modifications to
  existing files. Stat errors (EACCES, etc.) fail closed — we treat the
  path as existing so the guard is never silently weakened.
  
  Update the existing "blocks protected config file edits" test to use a
  real temp file so the BLOCK path is still exercised, and add two new
  tests covering:
  
  - first-time creation of eslint.config.mjs is allowed (exit 0, raw
    passthrough, no stderr)
  - Edit against an existing .eslintrc.js is still blocked (exit 2, no
    stdout, BLOCKED message in stderr)
  
  Fixes #1873

  gaurav0107 · 2026-05-15 00:30:23 +05:30
  faa51fba11
• docs: sync ECC Tools hosted output scoring (#1891)
  Affaan Mustafa · 2026-05-13 23:02:23 -04:00
  4423f10cfb
• docs: sync ECC Tools hosted promotion readiness (#1890)
  Affaan Mustafa · 2026-05-13 22:39:01 -04:00
  3b12fb273f
• Sync ECC Tools status-aware depth plan roadmap (#1887)
  Affaan Mustafa · 2026-05-13 22:12:11 -04:00
  4fb80d8861
• Sync ECC Tools hosted status roadmap (#1886)
  Affaan Mustafa · 2026-05-13 21:49:42 -04:00
  a27831c13e
• Sync ECC Tools hosted result history roadmap (#1885)
  Affaan Mustafa · 2026-05-13 21:31:08 -04:00
  b24d762caa
• docs: sync roadmap after ECC-Tools hosted dispatch
  Affaan Mustafa · 2026-05-13 20:30:48 -04:00
  f94478e524
• docs: sync roadmap after ECC-Tools depth-plan check
  Affaan Mustafa · 2026-05-13 20:10:38 -04:00
  6cdac19764
• docs: sync roadmap after ECC-Tools team backlog job (#1880)
  Affaan Mustafa · 2026-05-13 19:44:49 -04:00
  af3a206412
• docs: sync roadmap after ECC-Tools AI cost job (#1878)
  Affaan Mustafa · 2026-05-13 19:26:48 -04:00
  20f00c1410
• docs: sync roadmap after ECC-Tools reference-set job (#1877)
  Affaan Mustafa · 2026-05-13 19:09:35 -04:00
  e7a6f137e5
• docs: sync roadmap after ECC-Tools harness job (#1876)
  Affaan Mustafa · 2026-05-13 18:50:45 -04:00
  7596502092
• docs: sync roadmap after ECC-Tools security evidence job (#1875)
  Affaan Mustafa · 2026-05-13 18:32:06 -04:00
  c04baa8c25
• docs: sync roadmap after ECC-Tools CI diagnostics (#1874)
  Affaan Mustafa · 2026-05-13 18:12:31 -04:00
  9082bdedac
• docs: sync roadmap after ECC-Tools hosted planning (#1872)
  Affaan Mustafa · 2026-05-13 12:48:50 -04:00
  3243a1c5d3
• docs: sync roadmap after ECC-Tools depth readiness (#1871)
  Affaan Mustafa · 2026-05-13 12:26:32 -04:00
  69401b28b3
• docs: sync roadmap after AgentShield corpus expansion

  Records AgentShield PR #82 and moves the next AgentShield roadmap slice to hosted evidence-pack workflow depth.

  Affaan Mustafa · 2026-05-13 09:04:34 -04:00
  9a5ed3223a
• docs: sync roadmap after AgentShield remediation workflows

  Records AgentShield PR #81 and advances the next AgentShield roadmap slice after remediation workflow phases landed.

  Affaan Mustafa · 2026-05-13 08:46:07 -04:00
  d844bd6bfc
• docs: sync roadmap after AgentShield corpus recommendations

  Syncs the ECC 2.0 GA roadmap after AgentShield PR #80 landed corpus accuracy recommendations.

  Affaan Mustafa · 2026-05-13 08:28:12 -04:00
  cf54c791e4
• docs: sync roadmap after ECC-Tools PR draft tracking (#1865)
  Affaan Mustafa · 2026-05-13 08:11:09 -04:00
  bd4369e1d5
• docs: sync roadmap after AgentShield fingerprint hardening
  Affaan Mustafa · 2026-05-13 07:53:15 -04:00
  f2be190dcb
• docs: sync roadmap after ECC-Tools hardening
  Affaan Mustafa · 2026-05-13 07:32:55 -04:00
  2afef0f18b
• docs: mark JARVIS backend audit clean
  Affaan Mustafa · 2026-05-13 07:15:13 -04:00
  967e5c6922
• docs: sync ECC 2.0 GA roadmap after hardening pass
  Affaan Mustafa · 2026-05-13 06:59:20 -04:00
  2d29643dd4
• feat: add Ruby and Rails rules
  Affaan Mustafa · 2026-05-13 06:27:08 -04:00
  c2762dd569
• docs: sync AgentShield adapter roadmap

  Record AgentShield #68/#69 in the ECC GA roadmap and update the next enterprise slice.

  Affaan Mustafa · 2026-05-13 04:43:58 -04:00
  cb3509ee19
• ci: gate observability on release safety evidence

  Add release-safety evidence coverage to observability readiness and refresh rc.1 publication gate docs.

  Affaan Mustafa · 2026-05-13 04:14:47 -04:00
  42f04edc03
• fix: fall back to ASCII instinct status bars

  Fixes #1855

  Affaan Mustafa · 2026-05-13 02:59:58 -04:00
  d4728a0d80
• fix: harden GateGuard destructive bash tokenizer

  Co-authored-by: Jamkris <dltmdgus1412@gmail.com>

  SeungHyun · 2026-05-13 02:43:04 -04:00
  0e169fecbc
• docs: sync AgentShield evidence-pack roadmap (#1854)
  Affaan Mustafa · 2026-05-13 02:22:05 -04:00
  b2506f82f6
• docs: record post-hardening rc1 release evidence (#1852)
  Affaan Mustafa · 2026-05-13 01:32:58 -04:00
  f6e13ab520
• ci: disable checkout credential persistence in privileged workflows (#1851)
  Affaan Mustafa · 2026-05-13 01:15:49 -04:00
  209abd403b
• harden: remove shell access from read-only analyzers (#1850)
  Affaan Mustafa · 2026-05-13 01:00:26 -04:00
  2486732714
• docs: gate ECC progress sync readiness

  Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.
  
  - add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
  - add a `Tracker Sync` check to `scripts/observability-readiness.js`
  - update observability tests with passing and missing-contract coverage
  - update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence
  
  Validation:
  - node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
  - npm run observability:ready -- --format json (18/18, ready true)
  - npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
  - git diff --check
  - node tests/docs/ecc2-release-surface.test.js (18 passed)
  - node tests/run-all.js (2378 passed, 0 failed)
  - GitHub CI for #1849 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:38:18 -04:00
  63f9bfc33f
• docs: add supply-chain incident response playbook

  Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.
  
  - add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
  - link the playbook from `SECURITY.md`
  - reject `pull_request_target` workflows that restore or save shared dependency caches
  - add a regression test for the new `pull_request_target + actions/cache` guardrail
  
  Validation:
  - node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
  - node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
  - npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
  - npx markdownlint-cli '**/*.md' --ignore node_modules
  - git diff --check
  - node tests/run-all.js (2377 passed, 0 failed)
  - GitHub CI for #1848 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:22:28 -04:00
  cbecf5689d
• docs: refresh rc1 release readiness evidence

  Add the May 13 rc.1 publication evidence refresh and update the release-readiness/GA roadmap gates after #1846.
  
  - record current queue, security-gate, harness audit, adapter, observability, Node, markdownlint, release-surface, npm publish-surface, and ecc2 Rust evidence
  - update the publication-readiness checklist with the May 13 evidence artifact
  - normalize zh-CN CLAUDE list markers so markdownlint passes
  
  Validation:
  - node tests/docs/ecc2-release-surface.test.js
  - node tests/docs/harness-adapter-compliance.test.js
  - node tests/docs/stale-pr-salvage-ledger.test.js
  - npx markdownlint-cli '**/*.md' --ignore node_modules
  - git diff --check
  - node tests/run-all.js (2376 passed, 0 failed)
  - npm run harness:audit -- --format json (70/70)
  - npm run harness:adapters -- --check
  - npm run observability:ready -- --format json (16/16)
  - node tests/scripts/npm-publish-surface.test.js
  - cd ecc2 && cargo test (462 passed, 0 failed)
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:05:51 -04:00
  da04a6e344
• ci: require npm audit signature checks

  Require npm registry signature verification wherever workflow npm audit checks run.
  
  - add npm audit signatures to CI Security Scan and maintenance security audit jobs
  - teach the workflow security validator to reject npm audit without signature verification
  - keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior
  
  Validation:
  - node tests/run-all.js (2376 passed, 0 failed)
  - CI current-head matrix green on #1846

  Affaan Mustafa · 2026-05-12 23:48:56 -04:00
  797f283036
• feat: add GitHub Copilot prompt support

  Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.
  
  Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
  Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

  Girish Kanjiyani · 2026-05-12 23:00:00 -04:00
  766f4ee1d8
• docs: tighten agent capability posture

  Remove shell access from two agents that do not need it and reword PyTorch autograd guidance that AgentShield flagged as encoded-payload-like text. AgentShield remains B/75 while findings drop 316->310 and high findings drop 26->21. Local tests passed 2369/2369; full GitHub Actions matrix green.

  Affaan Mustafa · 2026-05-12 22:44:39 -04:00
  ff1594ea99
• fix: close block-no-verify bypass holes

  Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

  SeungHyun · 2026-05-12 22:28:12 -04:00
  6be241a463
• docs: add prompt defense baselines

  Add compact prompt-defense baselines to active ECC prompt surfaces and copied CLAUDE examples. AgentShield prompt-defense findings are now zero; local tests passed 2366/2366.

  Affaan Mustafa · 2026-05-12 22:22:57 -04:00
  393d397efa
• ci: harden workflow install boundaries

  - run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

  Affaan Mustafa · 2026-05-12 21:55:36 -04:00
  daf0355531
• ci: ignore install scripts in release workflows (#1839)
  Affaan Mustafa · 2026-05-12 21:36:36 -04:00
  33db548be3
• feat: add homelab config skills (VLAN segmentation, Pi-hole DNS, WireGuard VPN) (#1838)

  * feat: add homelab config skills (VLAN, Pi-hole, WireGuard)
  
  Adds three homelab configuration skills, extracted from the stale PR #1413
  with the same safety treatment applied to the previously accepted batch:
  
  - homelab-vlan-segmentation: IoT/guest/trusted/server VLAN design for UniFi,
    pfSense/OPNsense, and MikroTik. All firewall rules add isolation, not remove
    protections. Added change-window guidance and AP trunk port clarification.
  
  - homelab-pihole-dns: Pi-hole install, blocklists, DNS-over-HTTPS, local DNS
    records, troubleshooting. Docker is now the lead install method; bare-metal
    uses inspect-first pattern before running the installer script.
  
  - homelab-wireguard-vpn: WireGuard server, peer config, split tunnel, DDNS.
    Replaced broad iptables FORWARD ACCEPT with scoped directional rules
    (wg0→eth0 forward + established return only). Credentials moved to env
    files with explicit notes against inline secrets and version control.
  
  Continues the contribution from PR #1413; the eight skills/agents from
  that PR are already in main via #1729 and #1731.
  
  * docs: harden homelab skill pack
  
  ---------
  
  Co-authored-by: Affaan Mustafa <affaan@dcube.ai>

  Arsal Sajjad · 2026-05-12 21:20:53 -04:00
  71ed7c58d4
• chore: bump rand lockfile advisory (#1837)
  Affaan Mustafa · 2026-05-12 21:07:37 -04:00
  7f3dfde6d7
• test: stabilize ECC2 dashboard conflict refresh (#1836)
  Affaan Mustafa · 2026-05-12 20:51:29 -04:00
  bbb0350ed6
• fix: patch supply chain lockfiles (#1835)
  Affaan Mustafa · 2026-05-12 20:25:53 -04:00
  820e07fdaa
• docs: record AgentShield baseline CLI (#1834)
  Affaan Mustafa · 2026-05-12 20:15:09 -04:00
  c229b74d41