Commit Graph

756 Commits

  • perf(hooks): move post-edit-format and post-edit-typecheck to strict-only (#757)
    * perf(hooks): move post-edit-format and post-edit-typecheck to strict-only
    
    These hooks fire synchronously on every Edit call with 15-30s timeouts
    each. During multi-file refactors this adds 5-10 minutes of overhead.
    
    Moving them from standard,strict to strict-only means they won't fire
    in the default profile but are still available for users who want the
    extra validation.
    
    Fixes #735
    
    * Also update OpenCode plugin to strict-only for format/typecheck
    
    The OpenCode plugin had the same standard,strict profile for
    post:edit:format and post:edit:typecheck, so OpenCode users on the
    default profile would still get the per-edit overhead.
  • feat(hooks): add config protection hook to block linter config manipulation (#758)
    * feat(hooks): add config protection hook to block linter config manipulation
    
    Agents frequently modify linter/formatter configs (.eslintrc, biome.json,
    .prettierrc, .ruff.toml, etc.) to make checks pass instead of fixing
    the actual code.
    
    This PreToolUse hook intercepts Write/Edit/MultiEdit calls targeting
    known config files and blocks them with a steering message that directs
    the agent to fix the source code instead.
    
    Covers: ESLint, Prettier, Biome, Ruff, ShellCheck, Stylelint, and
    Markdownlint configs.
    
    Fixes #733
    
    * Address review: fix dead code, add missing configs, export run()
    
    - Removed pyproject.toml from PROTECTED_FILES (was dead code since
      it was also in PARTIAL_CONFIG_FILES). Added comment explaining why
      it's intentionally excluded.
    - Removed PARTIAL_CONFIG_FILES entirely (no longer needed).
    - Added missing ESLint v9 TypeScript flat configs: eslint.config.ts,
      eslint.config.mts, eslint.config.cts
    - Added missing Prettier ESM config: prettier.config.mjs
    - Exported run() function for in-process execution via run-with-flags,
      avoiding the spawnSync overhead (~50-100ms per call).
    
    * Handle stdin truncation gracefully, log warning instead of fail-open
    
    If stdin exceeds 1MB, the JSON would be malformed and the catch
    block would silently pass through. Now we detect truncation and
    log a warning. The in-process run() path is not affected.
  • fix: safe Codex config sync — merge AGENTS.md + add-only MCP servers (#723)
    * fix: replace bash TOML surgery with Node add-only MCP merge
    
    The old sync script used awk/sed to remove and re-append MCP server
    sections in config.toml, causing credential extraction races, duplicate
    TOML tables, and 3 fragile code paths with 9 remove_section_inplace
    calls each.
    
    Replace with a Node script (scripts/codex/merge-mcp-config.js) that
    uses @iarna/toml to parse the config, then appends only missing ECC
    servers — preserving all existing content byte-for-byte. Warns on
    config drift, supports legacy aliases (context7 → context7-mcp), and
    adds --update-mcp flag for explicit refresh.
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix: address PR #723 review findings for Codex MCP merge
    
    - Use package-manager abstraction (scripts/lib/package-manager.js)
      instead of hardcoding pnpm — respects CLAUDE_PACKAGE_MANAGER,
      lock files, and project config
    - Add Yarn 1.x fallback to npx (yarn dlx unsupported in classic)
    - Add missing exa server to match .codex/config.toml baseline
    - Wire up findSubSections for --update-mcp nested subtable removal
      (fixes Greptile P1: Object.keys only returned top-level keys)
    - Fix resolvedLabel to prefer canonical entry over legacy alias
      when both exist (fixes context7/context7-mcp spurious warning)
    - Fix removeSectionFromText to handle inline TOML comments
    - Fix dry-run + --update-mcp to show removals before early return
    - Update README parity table: 4 → 7 servers, TOML-parser-based
    - Add non-npm install variants to README Codex quick start
    - Update package-lock.json for @iarna/toml
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix: address PR #723 review comments (preflight, marker validation)
    
    - Add Node.js and merge-mcp-config.js to preflight checks so the
      script fails fast before partial writes (CodeRabbit)
    - Validate marker counts: require exactly 1 BEGIN + 1 END in correct
      order for clean replacement (CodeRabbit)
    - Corrupted markers: strip all marker lines and re-append fresh block,
      preserving user content outside markers instead of overwriting
    - Move MCP_MERGE_SCRIPT to preflight section, remove duplicate
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    ---------
    
    Co-authored-by: Claude <noreply@anthropic.com>
    Co-authored-by: Happy <yesreply@happy.engineering>
  • fix(install): add rust, cpp, csharp to legacy language alias map (#747)
    * fix(install): add rust, cpp, csharp to legacy language alias map
    
    The legacy installer compatibility layer in install-manifests.js was
    missing entries for rust, cpp, and csharp — languages that have
    rules/ directories and (for rust/cpp) install-components.json entries.
    
    Running `./install.sh rust` fails with "Unknown legacy language: rust"
    because LEGACY_LANGUAGE_ALIAS_TO_CANONICAL and
    LEGACY_LANGUAGE_EXTRA_MODULE_IDS didn't include these languages.
    
    Fixes the issue reported in #694 by @mpiton.
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix(install): complete csharp legacy support and add resolution tests
    
    - Add lang:csharp component to install-components.json with
      framework-language module (matching cpp/rust pattern)
    - Update csharp mapping in LEGACY_LANGUAGE_EXTRA_MODULE_IDS from
      empty array to ['framework-language']
    - Add end-to-end resolution tests for rust, cpp, and csharp verifying
      framework-language module is included in resolved moduleIds
    
    Addresses review feedback from Copilot, Greptile, CodeRabbit, and Cubic.
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    ---------
    
    Co-authored-by: Claude <noreply@anthropic.com>
    Co-authored-by: Happy <yesreply@happy.engineering>
  • Add Turkish (tr) docs and update README (#744)
    * Add Turkish (tr) docs and update README
    
    Add a full set of Turkish documentation under docs/tr (agents, changelog, CLAUDE guide, contributing, code of conduct, and many agents/commands/skills/rules files). Update README to include a link to the Turkish docs and increment the supported language count from 5 to 6. This commit adds localized guidance and references to help Turkish-speaking contributors and users.
    
    * Update docs/tr/TROUBLESHOOTING.md
    
    Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
    
    * Update docs/tr/README.md
    
    Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
    
    * docs(tr): fix license link and update readmes
    
    Update Turkish docs: change license badge link to point to repository root (../../LICENSE), increment displayed language count from 5 to 6, and remove two outdated related links from docs/tr/examples/README.md to keep references accurate.
    
    * Update docs/tr/commands/instinct-import.md
    
    Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
    
    * Update docs/tr/commands/checkpoint.md
    
    Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
  • fix: bump plugin.json and marketplace.json to v1.9.0
    Both files were stuck at v1.8.0, blocking upgrades via claudepluginhub.
  • Update docs/pt-BR/commands/eval.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Update docs/pt-BR/commands/plan.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Update docs/pt-BR/commands/orchestrate.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Update docs/pt-BR/agents/go-build-resolver.md
    Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
  • security: remove supply chain risks, external promotions, and unauthorized credits
    - Remove zenith.chat references and @DRodriguezFX shoutout from README
    - Remove Inspiration Credits section (already in CHANGELOG.md)
    - Remove awesome-agent-skills reference from Links
    - Remove Plankton H3 section by @alxfazio (skill stays in skills/)
    - Remove brand names (InsAIts, VideoDB, Evos) from v1.9.0 notes
    - Remove @ericcai0814 individual credit from README (kept in CHANGELOG)
    - Add Security Guide to Links section
    - Replace curl-pipe-to-bash in autonomous-loops with review warning
    - Replace git clone in plankton-code-quality with review warning
    - Replace pip install git+ in agent-eval with review warning
    - Replace npm install -g in dmux-workflows with review warning
    - Add commercial API notice to nutrient-document-processing
    - Remove VideoDB maintainer credit from videodb skill
    - Replace skill-creator.app link with ECC-Tools GitHub App reference
  • Update docs/pt-BR/commands/go-review.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Update docs/pt-BR/commands/eval.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Update docs/pt-BR/commands/plan.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Merge pull request #728 from zdocapp/zh-CN-pr
    docs(zh-CN): sync Chinese docs with latest upstream changes
  • docs: publish The Shorthand Guide to Everything Agentic Security
    Full article with embedded images: attack chain diagram, sandboxing
    comparison, sanitization visual, observability logging, ghostyy overflow.
    Tweet quotes from @TalBeerySec, @HedgieMarkets, @blackorbird formatted
    as blockquotes. Stats table fixed. Code blocks tagged. Links to shorthand
    and longform guides at bottom.
  • docs: add SECURITY.md, publish agentic security guide, remove openclaw guide
    - Add SECURITY.md with vulnerability reporting policy
    - Publish "The Shorthand Guide to Everything Agentic Security" with attack
      vectors, sandboxing, sanitization, CVEs, and AgentShield coverage
    - Add security guide to README guides section (3-column layout)
    - Remove unpublished openclaw guide
    - Copy security article images to assets/images/security/
  • feat(agents): add flutter-reviewer agent and skill (#716)
    Library-agnostic Flutter/Dart code reviewer that adapts to the project's
    chosen state management solution (BLoC, Riverpod, Provider, GetX, MobX,
    Signals) and architecture pattern (Clean Architecture, MVVM, feature-first).
    
    Co-authored-by: Maciej Starosielec <maciej@code-snap.com>
    Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
  • fix: codex sync merges AGENTS.md instead of replacing it (#715)
    The sync script previously overwrote ~/.codex/AGENTS.md on every run,
    destroying any user-authored content. This adds marker-based merging
    (<!-- BEGIN ECC --> / <!-- END ECC -->) so only the ECC-managed section
    is replaced on subsequent runs, preserving user content outside the
    markers.
    
    Merge logic:
    - No file → create with markers
    - Both markers present (ordered, CRLF-safe) → replace only the ECC section
    - BEGIN without END (corrupted) → full replace (backup saved)
    - No markers at all → append ECC block (preserves existing content)
    
    Also fixes:
    - Symlink preservation: uses cat > instead of mv to write through symlinks
    - CRLF handling: strips \r in marker detection to handle Windows-edited files
    - Marker ordering: validates BEGIN appears before END, not just that both exist
    
    The legacy heading-match heuristic was intentionally removed per council
    review: any unmarked file is either user-authored (append is safe) or
    legacy ECC-generated (duplicates once, deduplicates on next run via
    markers). A timestamped backup is always saved before any mutation.
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-authored-by: Claude <noreply@anthropic.com>
    Co-authored-by: Happy <yesreply@happy.engineering>
  • feat(rules): add C# language support (#704)
    * feat(rules): add C# language support
    
    * feat: add everything-claude-code ECC bundle (#705)
    
    * feat: add everything-claude-code ECC bundle (.claude/ecc-tools.json)
    
    * feat: add everything-claude-code ECC bundle (.claude/skills/everything-claude-code/SKILL.md)
    
    * feat: add everything-claude-code ECC bundle (.agents/skills/everything-claude-code/SKILL.md)
    
    * feat: add everything-claude-code ECC bundle (.agents/skills/everything-claude-code/agents/openai.yaml)
    
    * feat: add everything-claude-code ECC bundle (.claude/identity.json)
    
    * feat: add everything-claude-code ECC bundle (.codex/agents/explorer.toml)
    
    * feat: add everything-claude-code ECC bundle (.codex/agents/reviewer.toml)
    
    * feat: add everything-claude-code ECC bundle (.codex/agents/docs-researcher.toml)
    
    * feat: add everything-claude-code ECC bundle (.claude/rules/everything-claude-code-guardrails.md)
    
    * feat: add everything-claude-code ECC bundle (.claude/research/everything-claude-code-research-playbook.md)
    
    * feat: add everything-claude-code ECC bundle (.claude/team/everything-claude-code-team-config.json)
    
    * feat: add everything-claude-code ECC bundle (.claude/enterprise/controls.md)
    
    * feat: add everything-claude-code ECC bundle (.claude/commands/database-migration.md)
    
    * feat: add everything-claude-code ECC bundle (.claude/commands/feature-development.md)
    
    * feat: add everything-claude-code ECC bundle (.claude/commands/add-language-rules.md)
    
    ---------
    
    Co-authored-by: ecc-tools[bot] <257055122+ecc-tools[bot]@users.noreply.github.com>
    
    * ci: retrigger
    
    ---------
    
    Co-authored-by: ecc-tools[bot] <257055122+ecc-tools[bot]@users.noreply.github.com>
  • feat: agent description compression with lazy loading (#696)
    * feat: add agent description compression with lazy loading (#491)
    
    Agent descriptions consume ~26k tokens (121KB across 27 agents). This adds
    a compression library with three modes:
    - catalog: metadata only (~2-3k tokens) for agent selection
    - summary: metadata + first paragraph (~4-5k tokens) for routing
    - full: no compression, for when agent is invoked
    
    Includes lazy-load function to fetch full agent body on demand.
    21 tests covering parsing, compression, filtering, and real agents dir.
    
    * fix: update JSDoc to include all stats fields in buildAgentCatalog
    
    Add compressedBytes and mode to the documented return type, matching
    the actual implementation.
  • fix(tests): resolve Windows CI test failures (#701)
    * fix(tests): skip bash tests on Windows and fix USERPROFILE in resolve-ecc-root
    
    - hooks.test.js: add SKIP_BASH guard for 8 bash-dependent tests
      (detect-project.sh, observe.sh) while keeping 207 Node.js tests running
    - resolve-ecc-root.test.js: add USERPROFILE to env overrides in 2
      INLINE_RESOLVE tests so os.homedir() resolves correctly on Windows
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix(tests): handle BOM in shebang stripping and skip worktree tests on Windows
    
    - validators.test.js: replace regex stripShebang with character-code
      approach that handles UTF-8 BOM before shebang line
    - detect-project-worktree.test.js: skip entire file on Windows since
      tests invoke bash scripts directly
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    ---------
    
    Co-authored-by: Claude <noreply@anthropic.com>
    Co-authored-by: Happy <yesreply@happy.engineering>