Commit Graph

512 Commits

  • feat(commands): improve learn-eval with checklist-based holistic verdict
    Replace the 5-dimension numeric scoring rubric with a checklist + holistic
    verdict system (Save / Improve then Save / Absorb into [X] / Drop).
    
    Key improvements:
    - Explicit pre-save checklist: grep skills/ for duplicates, check MEMORY.md,
      consider appending to existing skills, confirm reusability
    - 4-way verdict instead of binary save/don't-save: adds "Absorb into [X]"
      to prevent skill file proliferation, and "Improve then Save" for iterative
      refinement
    - Verdict-specific confirmation flows tailored to each outcome
    - Design rationale explaining why holistic judgment outperforms numeric
      scoring with modern frontier models
  • feat: architecture improvements — test discovery, hooks schema, catalog, command map, coverage, cross-harness docs
    - AGENTS.md: sync skills count to 65+
    - tests/run-all.js: glob-based test discovery for *.test.js
    - scripts/ci/validate-hooks.js: validate hooks.json with ajv + schemas/hooks.schema.json
    - schemas/hooks.schema.json: hookItem.type enum command|notification
    - scripts/ci/catalog.js: catalog agents, commands, skills (--json | --md)
    - docs/COMMAND-AGENT-MAP.md: command → agent/skill map
    - docs/ARCHITECTURE-IMPROVEMENTS.md: improvement recommendations
    - package.json: ajv, c8 devDeps; npm run coverage
    - CONTRIBUTING.md: Cross-Harness and Translations section
    - .gitignore: coverage/
    
    Made-with: Cursor
  • feat: add everything-claude-code skill (#335)
    * feat: add everything-claude-code skill generated by ECC Tools
    
    * feat: add everything-claude-code instincts for continuous learning
    
    ---------
    
    Co-authored-by: ecc-tools[bot] <257055122+ecc-tools[bot]@users.noreply.github.com>
  • fix: add git fetch and use pinned checkout for update flow
    Address review feedback:
    - Add missing `git fetch origin` before comparing commits
    - Replace `git pull` with `git checkout <sha>` for deterministic updates
  • fix(skills): address review feedback on blueprint skill
    - Pin installation to specific commit hash (full SHA) to mitigate
      supply-chain risk (cubic-dev-ai feedback)
    - Add "When to Use", "How It Works", "Examples" sections to match
      repo skill format conventions (coderabbitai feedback)
    - Add review-before-update instructions for safe version upgrades
    - Emphasize zero-runtime-risk: pure Markdown, no executable code
  • docs: add comprehensive troubleshooting guide (fixes #326)
    Added a comprehensive troubleshooting guide for the Everything Claude Code (ECC) plugin, covering common issues, symptoms, causes, and solutions.
  • fix: read tool_response field in observe.sh (#377)
    Claude Code sends tool output as `tool_response` in PostToolUse hook
    payloads, but observe.sh only checked for `tool_output` and `output`.
    This caused all observations to have empty output fields, making the
    observer pipeline blind to tool results.
    
    Adds `tool_response` as the primary field to check, with backward-
    compatible fallback to the existing `tool_output` and `output` fields.
  • fix: update hook integration tests for auto-tmux-dev behavior
    PR #344 replaced the blocking dev-server hook with auto-tmux-dev.js
    which transforms commands into tmux sessions (exit 0) instead of
    blocking them (exit 2). Updated 2 tests to match the new behavior.
  • fix: remove internal sponsor/partner notes from public README
    The "Traction & Distribution" section contained internal business
    context (sponsor-call checklists, partner reporting instructions)
    that doesn't belong in a user-facing README.
  • fix: remove internal sponsor/partner notes from public README
    The "Traction & Distribution" section contained internal business
    context (sponsor-call checklists, partner reporting instructions)
    that doesn't belong in a user-facing README. Moved to docs/business/.
  • Add Contributor Covenant Code of Conduct (#330)
    Added Contributor Covenant Code of Conduct to promote a harassment-free community.
  • feat(CLI): Add Antigravity IDE support via --target antigravity flag (#332)
    * feat(CLI): Add Antigravity IDE support via `--target antigravity` flag
    
    This Pull Request introduces `--target antigravity` support within the installation script to bridge Everything Claude Code configurations smoothly onto the Antigravity IDE ecosystem.
    
    ### Key Changes
    - Modified `install.sh` to parse and act on the new `--target antigravity` CLI arg.
    - **Flattened Rules Conversion**: Logic automatically copies Language-agnostic (Common/Globs) rules as well as specific language stack rules into `common-*.md` and `{lang}-*.md` structures within `.agent/rules/`.
    - **Workflow & Agent Aggregation**: Commands safely fall in `.agent/workflows/`, and `agents/` alongside `skills/` components are merged into `.agent/skills/`.
    - Contains overwrite warnings to ensure local customized rules aren't completely overridden without consent.
    - Minor updates to `README.md` to properly document the flag addition.
    
    * Update install.sh
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: dangnd1 <dangnd1@vnpay.vn>
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
  • docs(zh-CN): sync Chinese docs with latest upstream changes (#341)
    * docs(zh-CN): sync Chinese docs with latest upstream changes
    
    * docs(zh-CN): update link
    
    ---------
    
    Co-authored-by: neo <neo.dowithless@gmail.com>
  • Fixed CI Workflows Failure fixed (in response to PR#286) (#291)
    * Initial plan
    
    * fix: remove malformed copilot-setup-steps.yml and fix hooks.json regex
    
    Co-authored-by: pangerlkr <73515951+pangerlkr@users.noreply.github.com>
    
    ---------
    
    Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
  • fix(hooks): allow tmux-wrapped dev server commands (#321)
    * fix(hooks): fix shell splitter redirection/escape bugs, extract shared module
    
    - Fix single & incorrectly splitting redirection operators (&>, >&, 2>&1)
    - Fix escaped quotes (\", \') not being handled inside quoted strings
    - Extract splitShellSegments into shared scripts/lib/shell-split.js
      to eliminate duplication between hooks.json, before-shell-execution.js,
      and pre-bash-dev-server-block.js
    - Add comprehensive tests for shell splitting edge cases
    
    * fix(hooks): handle backslash escapes outside quotes in shell splitter
    
    Escaped operators like \&& and \; outside quotes were still being
    treated as separators. Add escape handling for unquoted context.
  • fix: auto-start dev servers in tmux instead of blocking (#344)
    * fix: auto-start development servers in tmux instead of blocking
    
    Replace blocking PreToolUse hook that used process.exit(2) with an auto-transform hook that:
    - Detects development server commands
    - Wraps them in tmux with directory-based session names
    - Runs server detached so Claude Code is not blocked
    - Provides confirmation message with log viewing instructions
    
    Benefits:
    - Development servers no longer block Claude Code execution
    - Each project gets its own tmux session (allows multiple projects)
    - Logs remain accessible via 'tmux capture-pane -t <session>'
    - Non-blocking: if tmux unavailable, command still runs (graceful fallback)
    
    Implementation:
    - Created scripts/hooks/auto-tmux-dev.js with transform logic
    - Updated hooks.json to reference the script instead of inline node command
    - Applied same fix to cached plugin version (1.4.1) for immediate effect
    
    * fix: resolve PR #344 code review issues in auto-tmux-dev.js
    
    Critical fixes:
    - Fix variable scope: declare 'input' before try block, not inside
    - Fix shell injection: sanitize sessionName and escape cmd for shell
    - Replace unused execFileSync import with spawnSync
    
    Improvements:
    - Add real Windows support using cmd /k window launcher
    - Add tmux availability check with graceful fallback
    - Update header comment to accurately describe platform support
    
    Test coverage:
    - Valid JSON input: transforms command for respective platform
    - Invalid JSON: passes through raw data unchanged
    - Unsupported tools: gracefully falls back to original command
    - Shell metacharacters: sanitized in sessionName, escaped in cmd
    
    * fix: correct cmd.exe escape sequence for double quotes on Windows
    
    Use double-quote doubling ('""') instead of backslash-escape ('\\\") for cmd.exe syntax.
    Backslash escaping is Unix convention and not recognized by cmd.exe. This fixes quoted
    arguments in dev server commands on Windows (e.g., 'npm run dev --filter="my-app"').
  • fix(hooks): scrub secrets and harden hook security (#348)
    * fix(hooks): scrub secrets and harden hook security
    
    - Scrub common secret patterns (api_key, token, password, etc.) from
      observation logs before persisting to JSONL (observe.sh)
    - Auto-purge observation files older than 30 days (observe.sh)
    - Strip embedded credentials from git remote URLs before saving to
      projects.json (detect-project.sh)
    - Add command prefix allowlist to runCommand — only git, node, npx,
      which, where are permitted (utils.js)
    - Sanitize CLAUDE_SESSION_ID in temp file paths to prevent path
      traversal (suggest-compact.js)
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(hooks): address review feedback from CodeRabbit and Cubic
    
    - Reject shell command-chaining operators (;|&`) in runCommand, strip
      quoted sections before checking to avoid false positives (utils.js)
    - Remove command string from blocked error message to avoid leaking
      secrets (utils.js)
    - Fix Python regex quoting: switch outer shell string from double to
      single quotes so regex compiles correctly (observe.sh)
    - Add optional auth scheme match (Bearer, Basic) to secret scrubber
      regex (observe.sh)
    - Scope auto-purge to current project dir and match only archived
      files (observations-*.jsonl), not live queue (observe.sh)
    - Add second fallback after session ID sanitization to prevent empty
      string (suggest-compact.js)
    - Preserve backward compatibility when credential stripping changes
      project hash — detect and migrate legacy directories
      (detect-project.sh)
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(hooks): block $() substitution, fix Bearer redaction, add security tests
    
    - Add $ and \n to blocked shell metacharacters in runCommand to prevent
      command substitution via $(cmd) and newline injection (utils.js)
    - Make auth scheme group capturing so Bearer/Basic is preserved in
      redacted output instead of being silently dropped (observe.sh)
    - Add 10 unit tests covering runCommand allowlist blocking (rm, curl,
      bash prefixes) and metacharacter rejection (;|&`$ chaining), plus
      error message leak prevention (utils.test.js)
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(hooks): scrub parse-error fallback, strengthen security tests
    
    Address remaining reviewer feedback from CodeRabbit and Cubic:
    
    - Scrub secrets in observe.sh parse-error fallback path (was writing
      raw unsanitized input to observations file)
    - Remove redundant re.IGNORECASE flag ((?i) inline flag already set)
    - Add inline comment documenting quote-stripping limitation trade-off
    - Fix misleading test name for error-output test
    - Add 5 new security tests: single-quote passthrough, mixed
      quoted+unquoted metacharacters, prefix boundary (no trailing space),
      npx acceptance, and newline injection
    - Improve existing quoted-metacharacter test to actually exercise
      quote-stripping logic
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    * fix(security): block $() and backtick inside quotes in runCommand
    
    Shell evaluates $() and backticks inside double quotes, so checking
    only the unquoted portion was insufficient. Now $ and ` are rejected
    anywhere in the command string, while ; | & remain quote-aware.
    
    Addresses CodeRabbit and Cubic review feedback on PR #348.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    ---------
    
    Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
  • Merge pull request #334 from affaan-m/codex/release-1.8.0-core
    feat: v1.8.0 harness release (core reliability + parity + new commands)
  • Update install.sh
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
  • feat(CLI): Add Antigravity IDE support via --target antigravity flag
    This Pull Request introduces `--target antigravity` support within the installation script to bridge Everything Claude Code configurations smoothly onto the Antigravity IDE ecosystem.
    
    - Modified `install.sh` to parse and act on the new `--target antigravity` CLI arg.
    - **Flattened Rules Conversion**: Logic automatically copies Language-agnostic (Common/Globs) rules as well as specific language stack rules into `common-*.md` and `{lang}-*.md` structures within `.agent/rules/`.
    - **Workflow & Agent Aggregation**: Commands safely fall in `.agent/workflows/`, and `agents/` alongside `skills/` components are merged into `.agent/skills/`.
    - Contains overwrite warnings to ensure local customized rules aren't completely overridden without consent.
    - Minor updates to `README.md` to properly document the flag addition.
  • Add Contributor Covenant Code of Conduct
    Added Contributor Covenant Code of Conduct to promote a harassment-free community.
  • fix(commands): make ace-tool MCP optional in multi-* commands with built-in fallbacks
    The multi-* commands (multi-plan, multi-execute, multi-workflow, multi-backend,
    multi-frontend) previously required ace-tool MCP (Augment Code) which is a paid
    service. This change makes ace-tool completely optional by:
    
    - Changing "MUST call" to "If ace-tool MCP is available" for enhance_prompt
    - Changing mandatory search_context calls to optional with fallback procedures
    - Adding detailed fallback instructions using Claude Code built-in tools
      (Glob, Grep, Read, Task/Explore agent) when ace-tool is unavailable
    - Updating all translations (ja-JP, zh-CN) to match
    
    This ensures multi-* commands work out of the box without ace-tool MCP configured.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
  • feat(skills): add autonomous-loops and plankton-code-quality skills
    - autonomous-loops: 6 loop patterns from simple claude -p pipelines to
      RFC-driven DAG orchestration (Ralphinho, infinite-agentic-loop,
      continuous-claude, de-sloppify pattern)
    - plankton-code-quality: write-time enforcement integration guide
    - README: updated directory listing and Plankton description
    
    Sources: enitrat/ralphinho, disler/infinite-agentic-loop,
    AnandChowdhary/continuous-claude, alexfazio/plankton