Commit Graph

518 Commits

  • fix: update session file paths to use the home directory
    Updated the documentation for the `/resume-session` and `/save-session` commands to reflect the correct file paths, changing references from `.claude/sessions/` to `~/.claude/sessions/`. This ensures clarity on the global directory used for session management and maintains consistency across commands.
  • feat: add resume and save session commands for session management
    Introduced two new commands: `/resume-session` and `/save-session`. The `/resume-session` command allows users to load the most recent session file or a specific session file, providing a structured briefing of the session's context. The `/save-session` command captures the current session state, saving it to a dated file for future reference. Both commands enhance user experience by enabling seamless session continuity and context preservation.
  • fix: use general-purpose agent instead of Explore for skill-stocktake evaluation
    The Explore agent is a "Fast agent" optimized for codebase exploration,
    not deep reasoning. The skill-stocktake V4 design requires holistic AI
    judgment (actionability, scope fit, uniqueness, currency) which needs
    the full reasoning capability of the conversation's main model.
    
    Additionally, the Agent tool has no `model` parameter — specifying
    `model: opus` was silently ignored, causing the evaluation to run on
    the lightweight Explore model. This resulted in all skills receiving
    "Keep" verdicts without genuine critical analysis.
    
    Changing to `general-purpose` agent ensures evaluation runs on the
    conversation's main model (e.g., Opus 4.6), enabling the holistic
    judgment that V4 was designed for.
  • fix: resolve markdownlint MD001 heading level violation
    Change h4 (####) to h3 (###) for sub-steps 5a and 5b to comply with
    heading increment rule (headings must increment by one level at a time).
  • feat(commands): improve learn-eval with checklist-based holistic verdict
    Replace the 5-dimension numeric scoring rubric with a checklist + holistic
    verdict system (Save / Improve then Save / Absorb into [X] / Drop).
    
    Key improvements:
    - Explicit pre-save checklist: grep skills/ for duplicates, check MEMORY.md,
      consider appending to existing skills, confirm reusability
    - 4-way verdict instead of binary save/don't-save: adds "Absorb into [X]"
      to prevent skill file proliferation, and "Improve then Save" for iterative
      refinement
    - Verdict-specific confirmation flows tailored to each outcome
    - Design rationale explaining why holistic judgment outperforms numeric
      scoring with modern frontier models
  • feat: architecture improvements — test discovery, hooks schema, catalog, command map, coverage, cross-harness docs
    - AGENTS.md: sync skills count to 65+
    - tests/run-all.js: glob-based test discovery for *.test.js
    - scripts/ci/validate-hooks.js: validate hooks.json with ajv + schemas/hooks.schema.json
    - schemas/hooks.schema.json: hookItem.type enum command|notification
    - scripts/ci/catalog.js: catalog agents, commands, skills (--json | --md)
    - docs/COMMAND-AGENT-MAP.md: command → agent/skill map
    - docs/ARCHITECTURE-IMPROVEMENTS.md: improvement recommendations
    - package.json: ajv, c8 devDeps; npm run coverage
    - CONTRIBUTING.md: Cross-Harness and Translations section
    - .gitignore: coverage/
    
    Made-with: Cursor
  • feat: add everything-claude-code skill (#335)
    * feat: add everything-claude-code skill generated by ECC Tools
    
    * feat: add everything-claude-code instincts for continuous learning
    
    ---------
    
    Co-authored-by: ecc-tools[bot] <257055122+ecc-tools[bot]@users.noreply.github.com>
  • fix: add git fetch and use pinned checkout for update flow
    Address review feedback:
    - Add missing `git fetch origin` before comparing commits
    - Replace `git pull` with `git checkout <sha>` for deterministic updates
  • fix(skills): address review feedback on blueprint skill
    - Pin installation to specific commit hash (full SHA) to mitigate
      supply-chain risk (cubic-dev-ai feedback)
    - Add "When to Use", "How It Works", "Examples" sections to match
      repo skill format conventions (coderabbitai feedback)
    - Add review-before-update instructions for safe version upgrades
    - Emphasize zero-runtime-risk: pure Markdown, no executable code
  • docs: add comprehensive troubleshooting guide (fixes #326)
    Added a comprehensive troubleshooting guide for the Everything Claude Code (ECC) plugin, covering common issues, symptoms, causes, and solutions.
  • fix: read tool_response field in observe.sh (#377)
    Claude Code sends tool output as `tool_response` in PostToolUse hook
    payloads, but observe.sh only checked for `tool_output` and `output`.
    This caused all observations to have empty output fields, making the
    observer pipeline blind to tool results.
    
    Adds `tool_response` as the primary field to check, with backward-
    compatible fallback to the existing `tool_output` and `output` fields.
  • fix: update hook integration tests for auto-tmux-dev behavior
    PR #344 replaced the blocking dev-server hook with auto-tmux-dev.js
    which transforms commands into tmux sessions (exit 0) instead of
    blocking them (exit 2). Updated 2 tests to match the new behavior.
  • fix: remove internal sponsor/partner notes from public README
    The "Traction & Distribution" section contained internal business
    context (sponsor-call checklists, partner reporting instructions)
    that doesn't belong in a user-facing README.
  • fix: remove internal sponsor/partner notes from public README
    The "Traction & Distribution" section contained internal business
    context (sponsor-call checklists, partner reporting instructions)
    that doesn't belong in a user-facing README. Moved to docs/business/.
  • Add Contributor Covenant Code of Conduct (#330)
    Added Contributor Covenant Code of Conduct to promote a harassment-free community.
  • feat(CLI): Add Antigravity IDE support via --target antigravity flag (#332)
    * feat(CLI): Add Antigravity IDE support via `--target antigravity` flag
    
    This Pull Request introduces `--target antigravity` support within the installation script to bridge Everything Claude Code configurations smoothly onto the Antigravity IDE ecosystem.
    
    ### Key Changes
    - Modified `install.sh` to parse and act on the new `--target antigravity` CLI arg.
    - **Flattened Rules Conversion**: Logic automatically copies Language-agnostic (Common/Globs) rules as well as specific language stack rules into `common-*.md` and `{lang}-*.md` structures within `.agent/rules/`.
    - **Workflow & Agent Aggregation**: Commands safely fall in `.agent/workflows/`, and `agents/` alongside `skills/` components are merged into `.agent/skills/`.
    - Contains overwrite warnings to ensure local customized rules aren't completely overridden without consent.
    - Minor updates to `README.md` to properly document the flag addition.
    
    * Update install.sh
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: dangnd1 <dangnd1@vnpay.vn>
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
  • docs(zh-CN): sync Chinese docs with latest upstream changes (#341)
    * docs(zh-CN): sync Chinese docs with latest upstream changes
    
    * docs(zh-CN): update link
    
    ---------
    
    Co-authored-by: neo <neo.dowithless@gmail.com>
  • Fixed CI Workflows Failure fixed (in response to PR#286) (#291)
    * Initial plan
    
    * fix: remove malformed copilot-setup-steps.yml and fix hooks.json regex
    
    Co-authored-by: pangerlkr <73515951+pangerlkr@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
  • fix(hooks): allow tmux-wrapped dev server commands (#321)
    * fix(hooks): fix shell splitter redirection/escape bugs, extract shared module
    
    - Fix single & incorrectly splitting redirection operators (&>, >&, 2>&1)
    - Fix escaped quotes (\", \') not being handled inside quoted strings
    - Extract splitShellSegments into shared scripts/lib/shell-split.js
      to eliminate duplication between hooks.json, before-shell-execution.js,
      and pre-bash-dev-server-block.js
    - Add comprehensive tests for shell splitting edge cases
    
    * fix(hooks): handle backslash escapes outside quotes in shell splitter
    
    Escaped operators like \&& and \; outside quotes were still being
    treated as separators. Add escape handling for unquoted context.
  • fix: auto-start dev servers in tmux instead of blocking (#344)
    * fix: auto-start development servers in tmux instead of blocking
    
    Replace blocking PreToolUse hook that used process.exit(2) with an auto-transform hook that:
    - Detects development server commands
    - Wraps them in tmux with directory-based session names
    - Runs server detached so Claude Code is not blocked
    - Provides confirmation message with log viewing instructions
    
    Benefits:
    - Development servers no longer block Claude Code execution
    - Each project gets its own tmux session (allows multiple projects)
    - Logs remain accessible via 'tmux capture-pane -t <session>'
    - Non-blocking: if tmux unavailable, command still runs (graceful fallback)
    
    Implementation:
    - Created scripts/hooks/auto-tmux-dev.js with transform logic
    - Updated hooks.json to reference the script instead of inline node command
    - Applied same fix to cached plugin version (1.4.1) for immediate effect
    
    * fix: resolve PR #344 code review issues in auto-tmux-dev.js
    
    Critical fixes:
    - Fix variable scope: declare 'input' before try block, not inside
    - Fix shell injection: sanitize sessionName and escape cmd for shell
    - Replace unused execFileSync import with spawnSync
    
    Improvements:
    - Add real Windows support using cmd /k window launcher
    - Add tmux availability check with graceful fallback
    - Update header comment to accurately describe platform support
    
    Test coverage:
    - Valid JSON input: transforms command for respective platform
    - Invalid JSON: passes through raw data unchanged
    - Unsupported tools: gracefully falls back to original command
    - Shell metacharacters: sanitized in sessionName, escaped in cmd
    
    * fix: correct cmd.exe escape sequence for double quotes on Windows
    
    Use double-quote doubling ('""') instead of backslash-escape ('\\\") for cmd.exe syntax.
    Backslash escaping is Unix convention and not recognized by cmd.exe. This fixes quoted
    arguments in dev server commands on Windows (e.g., 'npm run dev --filter="my-app"').
  • fix(hooks): scrub secrets and harden hook security (#348)
    * fix(hooks): scrub secrets and harden hook security
    
    - Scrub common secret patterns (api_key, token, password, etc.) from
      observation logs before persisting to JSONL (observe.sh)
    - Auto-purge observation files older than 30 days (observe.sh)
    - Strip embedded credentials from git remote URLs before saving to
      projects.json (detect-project.sh)
    - Add command prefix allowlist to runCommand — only git, node, npx,
      which, where are permitted (utils.js)
    - Sanitize CLAUDE_SESSION_ID in temp file paths to prevent path
      traversal (suggest-compact.js)
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(hooks): address review feedback from CodeRabbit and Cubic
    
    - Reject shell command-chaining operators (;|&`) in runCommand, strip
      quoted sections before checking to avoid false positives (utils.js)
    - Remove command string from blocked error message to avoid leaking
      secrets (utils.js)
    - Fix Python regex quoting: switch outer shell string from double to
      single quotes so regex compiles correctly (observe.sh)
    - Add optional auth scheme match (Bearer, Basic) to secret scrubber
      regex (observe.sh)
    - Scope auto-purge to current project dir and match only archived
      files (observations-*.jsonl), not live queue (observe.sh)
    - Add second fallback after session ID sanitization to prevent empty
      string (suggest-compact.js)
    - Preserve backward compatibility when credential stripping changes
      project hash — detect and migrate legacy directories
      (detect-project.sh)
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(hooks): block $() substitution, fix Bearer redaction, add security tests
    
    - Add $ and \n to blocked shell metacharacters in runCommand to prevent
      command substitution via $(cmd) and newline injection (utils.js)
    - Make auth scheme group capturing so Bearer/Basic is preserved in
      redacted output instead of being silently dropped (observe.sh)
    - Add 10 unit tests covering runCommand allowlist blocking (rm, curl,
      bash prefixes) and metacharacter rejection (;|&`$ chaining), plus
      error message leak prevention (utils.test.js)
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(hooks): scrub parse-error fallback, strengthen security tests
    
    Address remaining reviewer feedback from CodeRabbit and Cubic:
    
    - Scrub secrets in observe.sh parse-error fallback path (was writing
      raw unsanitized input to observations file)
    - Remove redundant re.IGNORECASE flag ((?i) inline flag already set)
    - Add inline comment documenting quote-stripping limitation trade-off
    - Fix misleading test name for error-output test
    - Add 5 new security tests: single-quote passthrough, mixed
      quoted+unquoted metacharacters, prefix boundary (no trailing space),
      npx acceptance, and newline injection
    - Improve existing quoted-metacharacter test to actually exercise
      quote-stripping logic
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(security): block $() and backtick inside quotes in runCommand
    
    Shell evaluates $() and backticks inside double quotes, so checking
    only the unquoted portion was insufficient. Now $ and ` are rejected
    anywhere in the command string, while ; | & remain quote-aware.
    
    Addresses CodeRabbit and Cubic review feedback on PR #348.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    ---------
    
    Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
  • Merge pull request #334 from affaan-m/codex/release-1.8.0-core
    feat: v1.8.0 harness release (core reliability + parity + new commands)
  • Update install.sh
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
  • feat(CLI): Add Antigravity IDE support via --target antigravity flag
    This Pull Request introduces `--target antigravity` support within the installation script to bridge Everything Claude Code configurations smoothly onto the Antigravity IDE ecosystem.
    
    - Modified `install.sh` to parse and act on the new `--target antigravity` CLI arg.
    - **Flattened Rules Conversion**: Logic automatically copies Language-agnostic (Common/Globs) rules as well as specific language stack rules into `common-*.md` and `{lang}-*.md` structures within `.agent/rules/`.
    - **Workflow & Agent Aggregation**: Commands safely fall in `.agent/workflows/`, and `agents/` alongside `skills/` components are merged into `.agent/skills/`.
    - Contains overwrite warnings to ensure local customized rules aren't completely overridden without consent.
    - Minor updates to `README.md` to properly document the flag addition.