1731 Commits

This Branch

This Branch

All Branches

• fix(hooks): cost-tracker reads usage from transcript instead of stdin

  The Stop hook's stdin payload does not include `usage` or `model` —
  those fields exist only in the session transcript JSONL (per-assistant-turn
  `message.usage` blocks). The previous implementation looked for
  `input.usage.input_tokens` on stdin and silently produced zero-filled rows
  (observed: 2,340 rows captured with 0.0% non-zero token rate over 52 days).
  
  Fix: read `transcript_path` from Stop stdin, scan the JSONL, sum usage
  across all assistant turns. Use `message.model` to pick a rate tier
  (haiku/sonnet/opus). Track cache tokens separately (cache_creation and
  cache_read have distinct billing rates).
  
  Behavior note: Stop fires per assistant response, so each row in
  costs.jsonl represents the cumulative session total at that point.
  To get per-session cost: take the last row per session_id.
  
  Verified by reading a real Stop hook payload from
  .claude/projects/*/<uuid>.jsonl — payload contains
  {session_id, transcript_path, cwd, hook_event_name, ...} only,
  matching the published Claude Code hook spec.

  Levi-Evan · 2026-05-14 16:35:12 -04:00
  2707ef2eb2
• docs: sync ECC Tools hosted output scoring (#1891)
  Affaan Mustafa · 2026-05-13 23:02:23 -04:00
  4423f10cfb
• docs: sync ECC Tools hosted promotion readiness (#1890)
  Affaan Mustafa · 2026-05-13 22:39:01 -04:00
  3b12fb273f
• Sync ECC Tools status-aware depth plan roadmap (#1887)
  Affaan Mustafa · 2026-05-13 22:12:11 -04:00
  4fb80d8861
• Sync ECC Tools hosted status roadmap (#1886)
  Affaan Mustafa · 2026-05-13 21:49:42 -04:00
  a27831c13e
• Sync ECC Tools hosted result history roadmap (#1885)
  Affaan Mustafa · 2026-05-13 21:31:08 -04:00
  b24d762caa
• docs: sync roadmap after ECC-Tools hosted dispatch
  Affaan Mustafa · 2026-05-13 20:30:48 -04:00
  f94478e524
• docs: sync roadmap after ECC-Tools depth-plan check
  Affaan Mustafa · 2026-05-13 20:10:38 -04:00
  6cdac19764
• docs: sync roadmap after ECC-Tools team backlog job (#1880)
  Affaan Mustafa · 2026-05-13 19:44:49 -04:00
  af3a206412
• docs: sync roadmap after ECC-Tools AI cost job (#1878)
  Affaan Mustafa · 2026-05-13 19:26:48 -04:00
  20f00c1410
• docs: sync roadmap after ECC-Tools reference-set job (#1877)
  Affaan Mustafa · 2026-05-13 19:09:35 -04:00
  e7a6f137e5
• docs: sync roadmap after ECC-Tools harness job (#1876)
  Affaan Mustafa · 2026-05-13 18:50:45 -04:00
  7596502092
• docs: sync roadmap after ECC-Tools security evidence job (#1875)
  Affaan Mustafa · 2026-05-13 18:32:06 -04:00
  c04baa8c25
• docs: sync roadmap after ECC-Tools CI diagnostics (#1874)
  Affaan Mustafa · 2026-05-13 18:12:31 -04:00
  9082bdedac
• docs: sync roadmap after ECC-Tools hosted planning (#1872)
  Affaan Mustafa · 2026-05-13 12:48:50 -04:00
  3243a1c5d3
• docs: sync roadmap after ECC-Tools depth readiness (#1871)
  Affaan Mustafa · 2026-05-13 12:26:32 -04:00
  69401b28b3
• docs: sync roadmap after AgentShield corpus expansion

  Records AgentShield PR #82 and moves the next AgentShield roadmap slice to hosted evidence-pack workflow depth.

  Affaan Mustafa · 2026-05-13 09:04:34 -04:00
  9a5ed3223a
• docs: sync roadmap after AgentShield remediation workflows

  Records AgentShield PR #81 and advances the next AgentShield roadmap slice after remediation workflow phases landed.

  Affaan Mustafa · 2026-05-13 08:46:07 -04:00
  d844bd6bfc
• docs: sync roadmap after AgentShield corpus recommendations

  Syncs the ECC 2.0 GA roadmap after AgentShield PR #80 landed corpus accuracy recommendations.

  Affaan Mustafa · 2026-05-13 08:28:12 -04:00
  cf54c791e4
• docs: sync roadmap after ECC-Tools PR draft tracking (#1865)
  Affaan Mustafa · 2026-05-13 08:11:09 -04:00
  bd4369e1d5
• docs: sync roadmap after AgentShield fingerprint hardening
  Affaan Mustafa · 2026-05-13 07:53:15 -04:00
  f2be190dcb
• docs: sync roadmap after ECC-Tools hardening
  Affaan Mustafa · 2026-05-13 07:32:55 -04:00
  2afef0f18b
• docs: mark JARVIS backend audit clean
  Affaan Mustafa · 2026-05-13 07:15:13 -04:00
  967e5c6922
• docs: sync ECC 2.0 GA roadmap after hardening pass
  Affaan Mustafa · 2026-05-13 06:59:20 -04:00
  2d29643dd4
• feat: add Ruby and Rails rules
  Affaan Mustafa · 2026-05-13 06:27:08 -04:00
  c2762dd569
• docs: sync AgentShield adapter roadmap

  Record AgentShield #68/#69 in the ECC GA roadmap and update the next enterprise slice.

  Affaan Mustafa · 2026-05-13 04:43:58 -04:00
  cb3509ee19
• ci: gate observability on release safety evidence

  Add release-safety evidence coverage to observability readiness and refresh rc.1 publication gate docs.

  Affaan Mustafa · 2026-05-13 04:14:47 -04:00
  42f04edc03
• fix: fall back to ASCII instinct status bars

  Fixes #1855

  Affaan Mustafa · 2026-05-13 02:59:58 -04:00
  d4728a0d80
• fix: harden GateGuard destructive bash tokenizer

  Co-authored-by: Jamkris <dltmdgus1412@gmail.com>

  SeungHyun · 2026-05-13 02:43:04 -04:00
  0e169fecbc
• docs: sync AgentShield evidence-pack roadmap (#1854)
  Affaan Mustafa · 2026-05-13 02:22:05 -04:00
  b2506f82f6
• docs: record post-hardening rc1 release evidence (#1852)
  Affaan Mustafa · 2026-05-13 01:32:58 -04:00
  f6e13ab520
• ci: disable checkout credential persistence in privileged workflows (#1851)
  Affaan Mustafa · 2026-05-13 01:15:49 -04:00
  209abd403b
• harden: remove shell access from read-only analyzers (#1850)
  Affaan Mustafa · 2026-05-13 01:00:26 -04:00
  2486732714
• docs: gate ECC progress sync readiness

  Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.
  
  - add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
  - add a `Tracker Sync` check to `scripts/observability-readiness.js`
  - update observability tests with passing and missing-contract coverage
  - update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence
  
  Validation:
  - node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
  - npm run observability:ready -- --format json (18/18, ready true)
  - npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
  - git diff --check
  - node tests/docs/ecc2-release-surface.test.js (18 passed)
  - node tests/run-all.js (2378 passed, 0 failed)
  - GitHub CI for #1849 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:38:18 -04:00
  63f9bfc33f
• docs: add supply-chain incident response playbook

  Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.
  
  - add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
  - link the playbook from `SECURITY.md`
  - reject `pull_request_target` workflows that restore or save shared dependency caches
  - add a regression test for the new `pull_request_target + actions/cache` guardrail
  
  Validation:
  - node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
  - node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
  - npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
  - npx markdownlint-cli '**/*.md' --ignore node_modules
  - git diff --check
  - node tests/run-all.js (2377 passed, 0 failed)
  - GitHub CI for #1848 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:22:28 -04:00
  cbecf5689d
• docs: refresh rc1 release readiness evidence

  Add the May 13 rc.1 publication evidence refresh and update the release-readiness/GA roadmap gates after #1846.
  
  - record current queue, security-gate, harness audit, adapter, observability, Node, markdownlint, release-surface, npm publish-surface, and ecc2 Rust evidence
  - update the publication-readiness checklist with the May 13 evidence artifact
  - normalize zh-CN CLAUDE list markers so markdownlint passes
  
  Validation:
  - node tests/docs/ecc2-release-surface.test.js
  - node tests/docs/harness-adapter-compliance.test.js
  - node tests/docs/stale-pr-salvage-ledger.test.js
  - npx markdownlint-cli '**/*.md' --ignore node_modules
  - git diff --check
  - node tests/run-all.js (2376 passed, 0 failed)
  - npm run harness:audit -- --format json (70/70)
  - npm run harness:adapters -- --check
  - npm run observability:ready -- --format json (16/16)
  - node tests/scripts/npm-publish-surface.test.js
  - cd ecc2 && cargo test (462 passed, 0 failed)
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:05:51 -04:00
  da04a6e344
• ci: require npm audit signature checks

  Require npm registry signature verification wherever workflow npm audit checks run.
  
  - add npm audit signatures to CI Security Scan and maintenance security audit jobs
  - teach the workflow security validator to reject npm audit without signature verification
  - keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior
  
  Validation:
  - node tests/run-all.js (2376 passed, 0 failed)
  - CI current-head matrix green on #1846

  Affaan Mustafa · 2026-05-12 23:48:56 -04:00
  797f283036
• feat: add GitHub Copilot prompt support

  Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.
  
  Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
  Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

  Girish Kanjiyani · 2026-05-12 23:00:00 -04:00
  766f4ee1d8
• docs: tighten agent capability posture

  Remove shell access from two agents that do not need it and reword PyTorch autograd guidance that AgentShield flagged as encoded-payload-like text. AgentShield remains B/75 while findings drop 316->310 and high findings drop 26->21. Local tests passed 2369/2369; full GitHub Actions matrix green.

  Affaan Mustafa · 2026-05-12 22:44:39 -04:00
  ff1594ea99
• fix: close block-no-verify bypass holes

  Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

  SeungHyun · 2026-05-12 22:28:12 -04:00
  6be241a463
• docs: add prompt defense baselines

  Add compact prompt-defense baselines to active ECC prompt surfaces and copied CLAUDE examples. AgentShield prompt-defense findings are now zero; local tests passed 2366/2366.

  Affaan Mustafa · 2026-05-12 22:22:57 -04:00
  393d397efa
• ci: harden workflow install boundaries

  - run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

  Affaan Mustafa · 2026-05-12 21:55:36 -04:00
  daf0355531
• ci: ignore install scripts in release workflows (#1839)
  Affaan Mustafa · 2026-05-12 21:36:36 -04:00
  33db548be3
• feat: add homelab config skills (VLAN segmentation, Pi-hole DNS, WireGuard VPN) (#1838)

  * feat: add homelab config skills (VLAN, Pi-hole, WireGuard)
  
  Adds three homelab configuration skills, extracted from the stale PR #1413
  with the same safety treatment applied to the previously accepted batch:
  
  - homelab-vlan-segmentation: IoT/guest/trusted/server VLAN design for UniFi,
    pfSense/OPNsense, and MikroTik. All firewall rules add isolation, not remove
    protections. Added change-window guidance and AP trunk port clarification.
  
  - homelab-pihole-dns: Pi-hole install, blocklists, DNS-over-HTTPS, local DNS
    records, troubleshooting. Docker is now the lead install method; bare-metal
    uses inspect-first pattern before running the installer script.
  
  - homelab-wireguard-vpn: WireGuard server, peer config, split tunnel, DDNS.
    Replaced broad iptables FORWARD ACCEPT with scoped directional rules
    (wg0→eth0 forward + established return only). Credentials moved to env
    files with explicit notes against inline secrets and version control.
  
  Continues the contribution from PR #1413; the eight skills/agents from
  that PR are already in main via #1729 and #1731.
  
  * docs: harden homelab skill pack
  
  ---------
  
  Co-authored-by: Affaan Mustafa <affaan@dcube.ai>

  Arsal Sajjad · 2026-05-12 21:20:53 -04:00
  71ed7c58d4
• chore: bump rand lockfile advisory (#1837)
  Affaan Mustafa · 2026-05-12 21:07:37 -04:00
  7f3dfde6d7
• test: stabilize ECC2 dashboard conflict refresh (#1836)
  Affaan Mustafa · 2026-05-12 20:51:29 -04:00
  bbb0350ed6
• fix: patch supply chain lockfiles (#1835)
  Affaan Mustafa · 2026-05-12 20:25:53 -04:00
  820e07fdaa
• docs: record AgentShield baseline CLI (#1834)
  Affaan Mustafa · 2026-05-12 20:15:09 -04:00
  c229b74d41
• docs: define AgentShield enterprise roadmap (#1833)
  Affaan Mustafa · 2026-05-12 19:56:12 -04:00
  be42989746
• docs: record AgentShield PDF export decision (#1832)
  Affaan Mustafa · 2026-05-12 19:28:26 -04:00
  d2d8cda8b3