everything-claude-code

perf(hooks): use direct require() instead of spawning child process

Invoke hook scripts directly via require() when they export a
run(rawInput) function, eliminating one Node.js process spawn per
hook invocation (~50-100ms).

Includes path traversal guard, timeouts, error logging, PR review
feedback, legacy hooks guard, normalized filePath, and restored
findProjectRoot config detection with package manager support.

Jonghyeok Park · 2026-03-11 10:45:27 +09:00

66498ae9ac

fix: extract BLOCKING_SEVERITIES constant, document broad catch

- Extract BLOCKING_SEVERITIES frozenset for extensible severity checks.
- Add inline comment on broad Exception catch explaining intentional
  SDK fault-tolerance pattern (BLE001 acknowledged).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 19:06:56 +01:00

9ea415c037

fix: dict anomaly access, configurable fail mode, exception type logging

- Add get_anomaly_attr() helper that handles both dict and object
  anomalies. The SDK's send_message() returns dicts, so getattr()
  was silently returning defaults -- critical blocking never triggered.
- Fix field name: "detail" -> "details" (matches SDK schema).
- Make fail-open/fail-closed configurable via INSAITS_FAIL_MODE env var
  (defaults to "open" for backward compatibility).
- Include exception type name in fail-open log for diagnostics.
- Normalize severity comparison with .upper() for case-insensitive matching.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:53:21 +01:00

e30109829b

fix: address cubic-dev-ai + coderabbit round 3 review

cubic-dev-ai P2: dev_mode now defaults to "false" (strict mode).
Users opt in to dev mode by setting INSAITS_DEV_MODE=true.

cubic-dev-ai P2: Move null-status check above stdout/stderr writes
in wrapper so partial/corrupt output is never leaked. Pass through
original raw input on signal kill, matching the result.error path.

coderabbit major: Wrap insAItsMonitor() and send_message() in
try/except so SDK errors don't crash the hook. Logs warning and
exits 0 (fail-open) on exception.

coderabbit nitpick: write_audit now creates a new dict (enriched)
instead of mutating the caller's event dict.

coderabbit nitpick: Extract magic numbers to named constants:
MIN_CONTENT_LENGTH=10, MAX_SCAN_LENGTH=4000, DEFAULT_MODEL.

Also: added env var documentation to module docstring.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:25:23 +01:00

68fc85ea49

fix: make dev_mode configurable via INSAITS_DEV_MODE env var

Defaults to true (no API key needed) but can be disabled by setting
INSAITS_DEV_MODE=false for production deployments with an API key.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:09:02 +01:00

0405ade5f4

fix: address cubic-dev-ai review — 3 issues

P1: Log non-ENOENT spawn errors (timeout, signal kill) to stderr
instead of silently exiting 0. Separate handling for result.error
and null result.status so users know when the security monitor
failed to run.

P1: Remove "async": true from hooks.json — async hooks run in the
background and cannot block tool execution. The security hook needs
to be synchronous so exit(2) actually prevents credential exposure
and other critical findings from proceeding.

P2: Remove dead tool_response/tool_result code from extract_content.
In a PreToolUse hook the tool hasn't executed yet, so tool_response
is never populated. Removed the variable and the unreachable branch
that appended its content.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 18:08:19 +01:00

6c56e541dd

fix: address CodeRabbit review — convert to PreToolUse, add type annotations, logging

Critical fixes:
- Convert hook from PostToolUse to PreToolUse so exit(2) blocking works
- Change all python references to python3 for cross-platform compat
- Add insaits-security-wrapper.js to bridge run-with-flags.js to Python

Standard fixes:
- Wrap hook with run-with-flags.js so users can disable via
  ECC_DISABLED_HOOKS="pre:insaits-security"
- Add "async": true to hooks.json entry
- Add type annotations to all function signatures (Dict, List, Tuple, Any)
- Replace all print() statements with logging module (stderr)
- Fix silent OSError swallow in write_audit — now logs warning
- Remove os.environ.setdefault('INSAITS_DEV_MODE') — pass dev_mode=True
  through monitor constructor instead
- Update hooks/README.md: moved to PreToolUse table, "detects" not
  "catches", clarify blocking vs non-blocking behavior

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 17:52:44 +01:00

44dc96d2c6

perf(hooks): eliminate npx overhead and merge biome invocations

- Use local node_modules/.bin/biome binary instead of npx (~200-500ms savings)
- Change post-edit-format from `biome format --write` to `biome check --write`
  (format + lint in one pass)
- Skip redundant biome check in quality-gate for JS/TS files already
  handled by post-edit-format
- Fix quality-gate to use findProjectRoot instead of process.cwd()
- Export run() function from both hooks for direct invocation
- Update tests to match shared resolve-formatter module usage

Jonghyeok Park · 2026-03-10 22:19:31 +09:00

e5d02000c3

feat(hooks): add shared resolve-formatter utility with caching

Extract project-root discovery, formatter detection, and binary
resolution into a reusable module. Caches results per-process to
avoid redundant filesystem lookups on every Edit hook invocation.

This is the foundation for eliminating npx overhead in format hooks.

Jonghyeok Park · 2026-03-10 22:17:02 +09:00

f331d3ecc9

docs(ko-KR): add Korean translation for examples

Translate 6 CLAUDE.md examples (project, user, SaaS Next.js, Django API,
Go microservice, Rust API) and copy statusline.json config.

hahmee · 2026-03-10 17:09:23 +09:00

526a9070e6

fix: resolve PR 371 portability regressions

Affaan Mustafa · 2026-03-09 22:49:43 -07:00

af51fcacb7

test: fix windows path shims for formatter hooks

Affaan Mustafa · 2026-03-09 22:49:43 -07:00

1c5e07ff77

docs: clarify opencode npm plugin scope

Affaan Mustafa · 2026-03-09 22:49:43 -07:00

d66bd6439b

fix: harden hook portability and plugin docs

Affaan Mustafa · 2026-03-09 22:49:43 -07:00

440178d697

docs(ko-KR): add Korean terminology glossary

Add TERMINOLOGY.md with translation conventions and term mappings
to ensure consistency across all 58 translated files.

hahmee · 2026-03-10 14:28:14 +09:00

3144b96faa

docs(ko-KR): complete all command translations with full examples

Add missing example sessions, code blocks, and detailed sections
to 14 command files that were previously summarized versions.

hahmee · 2026-03-10 13:59:43 +09:00

3e9c207c25

docs(ko-KR): complete missing sections in code-reviewer and planner translations

- code-reviewer: add code examples (deep nesting, useEffect deps, key props,
  N+1 queries), Project-Specific Guidelines section, cost-awareness check
- planner: add Worked Example (Stripe Subscriptions) and Red Flags sections

hahmee · 2026-03-10 13:39:16 +09:00

cbe2e68c26

docs(ko-KR): add Korean translation for skills

- 15 skill categories (17 files): coding-standards, tdd-workflow,
  frontend-patterns, backend-patterns, security-review (2 files),
  postgres-patterns, verification-loop, continuous-learning,
  continuous-learning-v2, eval-harness, iterative-retrieval,
  strategic-compact, golang-patterns, golang-testing, clickhouse-io,
  project-guidelines-example

hahmee · 2026-03-10 13:29:00 +09:00

b3f8206d47

docs(ko-KR): add Korean translation for commands and agents

- commands: 18 files (build-fix, checkpoint, code-review, e2e, eval,
  go-build, go-review, go-test, learn, orchestrate, plan, refactor-clean,
  setup-pm, tdd, test-coverage, update-codemaps, update-docs, verify)
- agents: 12 files (architect, build-error-resolver, code-reviewer,
  database-reviewer, doc-updater, e2e-runner, go-build-resolver,
  go-reviewer, planner, refactor-cleaner, security-reviewer, tdd-guide)

hahmee · 2026-03-10 12:56:11 +09:00

a693d2e023

feat: add InsAIts PostToolUse security monitoring hook

- Add insaits-security-monitor.py: real-time AI security monitoring
  hook that catches credential exposure, prompt injection,
  hallucinations, and 20+ other anomaly types
- Update hooks.json with InsAIts PostToolUse entry
- Update hooks/README.md with InsAIts in PostToolUse table
- Add InsAIts MCP server entry to mcp-configs/mcp-servers.json

InsAIts (https://github.com/Nomadu27/InsAIts) is an open-source
runtime security layer for multi-agent AI. It runs 100% locally
and writes tamper-evident audit logs to .insaits_audit_session.jsonl.

Install: pip install insa-its

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Nomadu27 · 2026-03-10 01:02:58 +01:00

540f738cc7

Update recommended models to GPT 5.4

Affaan Mustafa · 2026-03-08 08:40:48 -07:00

0f416b0b9d

docs(ko-KR): add Korean translation for rules

hahmee · 2026-03-08 18:00:43 +09:00

b390fd141d

docs: add Korean (ko-KR) README and CONTRIBUTING translation

hahmee · 2026-03-08 17:58:02 +09:00

cb56d1a22d

fix: update hook integration tests for auto-tmux-dev behavior

PR #344 replaced the blocking dev-server hook with auto-tmux-dev.js
which transforms commands into tmux sessions (exit 0) instead of
blocking them (exit 2). Updated 2 tests to match the new behavior.

Affaan Mustafa · 2026-03-07 22:45:44 -08:00

6090401ccd

fix: remove internal sponsor/partner notes from public README

The "Traction & Distribution" section contained internal business
context (sponsor-call checklists, partner reporting instructions)
that doesn't belong in a user-facing README.

Affaan Mustafa · 2026-03-07 20:26:24 -08:00

e3314f41e4

Revert "fix: remove internal sponsor/partner notes from public README"

This reverts commit 27ee3a449b.

Affaan Mustafa · 2026-03-07 20:26:04 -08:00

036d8e872c

fix: remove internal sponsor/partner notes from public README

The "Traction & Distribution" section contained internal business
context (sponsor-call checklists, partner reporting instructions)
that doesn't belong in a user-facing README. Moved to docs/business/.

Affaan Mustafa · 2026-03-07 20:19:37 -08:00

27ee3a449b

docs: add guidance for project documentation capture (#355 )

Frank · 2026-03-07 14:48:11 -08:00

b994a076c2

Add Contributor Covenant Code of Conduct (#330 )

Added Contributor Covenant Code of Conduct to promote a harassment-free community.

Pangerkumzuk Longkumer · 2026-03-07 14:48:09 -08:00

e2d78d6def

feat(CLI): Add Antigravity IDE support via --target antigravity flag (#332 )

* feat(CLI): Add Antigravity IDE support via `--target antigravity` flag

This Pull Request introduces `--target antigravity` support within the installation script to bridge Everything Claude Code configurations smoothly onto the Antigravity IDE ecosystem.

### Key Changes
- Modified `install.sh` to parse and act on the new `--target antigravity` CLI arg.
- **Flattened Rules Conversion**: Logic automatically copies Language-agnostic (Common/Globs) rules as well as specific language stack rules into `common-*.md` and `{lang}-*.md` structures within `.agent/rules/`.
- **Workflow & Agent Aggregation**: Commands safely fall in `.agent/workflows/`, and `agents/` alongside `skills/` components are merged into `.agent/skills/`.
- Contains overwrite warnings to ensure local customized rules aren't completely overridden without consent.
- Minor updates to `README.md` to properly document the flag addition.

* Update install.sh

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

---------

Co-authored-by: dangnd1 <dangnd1@vnpay.vn>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Dang Nguyen · 2026-03-07 14:48:07 -08:00

9b69dd0d03

docs(zh-CN): sync Chinese docs with latest upstream changes (#341 )

* docs(zh-CN): sync Chinese docs with latest upstream changes

* docs(zh-CN): update link

---------

Co-authored-by: neo <neo.dowithless@gmail.com>

zdoc.app · 2026-03-07 14:48:02 -08:00

abcf38b085

Fixed CI Workflows Failure fixed (in response to PR#286) (#291 )

* Initial plan

* fix: remove malformed copilot-setup-steps.yml and fix hooks.json regex

Co-authored-by: pangerlkr <73515951+pangerlkr@users.noreply.github.com>

---------

Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>

Pangerkumzuk Longkumer · 2026-03-07 14:47:53 -08:00

da17d33ac3

fix(hooks): allow tmux-wrapped dev server commands (#321 )

* fix(hooks): fix shell splitter redirection/escape bugs, extract shared module

- Fix single & incorrectly splitting redirection operators (&>, >&, 2>&1)
- Fix escaped quotes (\", \') not being handled inside quoted strings
- Extract splitShellSegments into shared scripts/lib/shell-split.js
  to eliminate duplication between hooks.json, before-shell-execution.js,
  and pre-bash-dev-server-block.js
- Add comprehensive tests for shell splitting edge cases

* fix(hooks): handle backslash escapes outside quotes in shell splitter

Escaped operators like \&& and \; outside quotes were still being
treated as separators. Add escape handling for unquoted context.

zzzhizhi · 2026-03-07 14:47:49 -08:00

177dd36e23

fix: auto-start dev servers in tmux instead of blocking (#344 )

* fix: auto-start development servers in tmux instead of blocking

Replace blocking PreToolUse hook that used process.exit(2) with an auto-transform hook that:
- Detects development server commands
- Wraps them in tmux with directory-based session names
- Runs server detached so Claude Code is not blocked
- Provides confirmation message with log viewing instructions

Benefits:
- Development servers no longer block Claude Code execution
- Each project gets its own tmux session (allows multiple projects)
- Logs remain accessible via 'tmux capture-pane -t <session>'
- Non-blocking: if tmux unavailable, command still runs (graceful fallback)

Implementation:
- Created scripts/hooks/auto-tmux-dev.js with transform logic
- Updated hooks.json to reference the script instead of inline node command
- Applied same fix to cached plugin version (1.4.1) for immediate effect

* fix: resolve PR #344 code review issues in auto-tmux-dev.js

Critical fixes:
- Fix variable scope: declare 'input' before try block, not inside
- Fix shell injection: sanitize sessionName and escape cmd for shell
- Replace unused execFileSync import with spawnSync

Improvements:
- Add real Windows support using cmd /k window launcher
- Add tmux availability check with graceful fallback
- Update header comment to accurately describe platform support

Test coverage:
- Valid JSON input: transforms command for respective platform
- Invalid JSON: passes through raw data unchanged
- Unsupported tools: gracefully falls back to original command
- Shell metacharacters: sanitized in sessionName, escaped in cmd

* fix: correct cmd.exe escape sequence for double quotes on Windows

Use double-quote doubling ('""') instead of backslash-escape ('\\\") for cmd.exe syntax.
Backslash escaping is Unix convention and not recognized by cmd.exe. This fixes quoted
arguments in dev server commands on Windows (e.g., 'npm run dev --filter="my-app"').

Helbetica · 2026-03-07 14:47:46 -08:00

7bed751db0

fix: force UTF-8 for instinct CLI file IO (#353 )

Frank · 2026-03-07 14:47:35 -08:00

e9577e34f1

fix(hooks): scrub secrets and harden hook security (#348 )

* fix(hooks): scrub secrets and harden hook security

- Scrub common secret patterns (api_key, token, password, etc.) from
  observation logs before persisting to JSONL (observe.sh)
- Auto-purge observation files older than 30 days (observe.sh)
- Strip embedded credentials from git remote URLs before saving to
  projects.json (detect-project.sh)
- Add command prefix allowlist to runCommand — only git, node, npx,
  which, where are permitted (utils.js)
- Sanitize CLAUDE_SESSION_ID in temp file paths to prevent path
  traversal (suggest-compact.js)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(hooks): address review feedback from CodeRabbit and Cubic

- Reject shell command-chaining operators (;|&`) in runCommand, strip
  quoted sections before checking to avoid false positives (utils.js)
- Remove command string from blocked error message to avoid leaking
  secrets (utils.js)
- Fix Python regex quoting: switch outer shell string from double to
  single quotes so regex compiles correctly (observe.sh)
- Add optional auth scheme match (Bearer, Basic) to secret scrubber
  regex (observe.sh)
- Scope auto-purge to current project dir and match only archived
  files (observations-*.jsonl), not live queue (observe.sh)
- Add second fallback after session ID sanitization to prevent empty
  string (suggest-compact.js)
- Preserve backward compatibility when credential stripping changes
  project hash — detect and migrate legacy directories
  (detect-project.sh)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(hooks): block $() substitution, fix Bearer redaction, add security tests

- Add $ and \n to blocked shell metacharacters in runCommand to prevent
  command substitution via $(cmd) and newline injection (utils.js)
- Make auth scheme group capturing so Bearer/Basic is preserved in
  redacted output instead of being silently dropped (observe.sh)
- Add 10 unit tests covering runCommand allowlist blocking (rm, curl,
  bash prefixes) and metacharacter rejection (;|&`$ chaining), plus
  error message leak prevention (utils.test.js)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(hooks): scrub parse-error fallback, strengthen security tests

Address remaining reviewer feedback from CodeRabbit and Cubic:

- Scrub secrets in observe.sh parse-error fallback path (was writing
  raw unsanitized input to observations file)
- Remove redundant re.IGNORECASE flag ((?i) inline flag already set)
- Add inline comment documenting quote-stripping limitation trade-off
- Fix misleading test name for error-output test
- Add 5 new security tests: single-quote passthrough, mixed
  quoted+unquoted metacharacters, prefix boundary (no trailing space),
  npx acceptance, and newline injection
- Improve existing quoted-metacharacter test to actually exercise
  quote-stripping logic

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(security): block $() and backtick inside quotes in runCommand

Shell evaluates $() and backticks inside double quotes, so checking
only the unquoted portion was insufficient. Now $ and ` are rejected
anywhere in the command string, while ; | & remain quote-aware.

Addresses CodeRabbit and Cubic review feedback on PR #348.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

jtzingsheim1 · 2026-03-07 14:47:31 -08:00

9661a6f042

docs: add upstream tracking flag to push example (#327 )

Co-authored-by: Hao Wang <haosen.wang@example.com>

Sense_wang · 2026-03-05 15:36:36 -08:00

03b3e0d0da

Merge pull request #334 from affaan-m/codex/release-1.8.0-core

feat: v1.8.0 harness release (core reliability + parity + new commands)

Affaan Mustafa · 2026-03-05 12:48:57 -08:00

v1.8.0 1797e79129

fix: normalize hook command execution in integration tests

Affaan Mustafa · 2026-03-05 12:43:53 -08:00

1f8b3eaba7

fix: stabilize windows hook and claw tests

Affaan Mustafa · 2026-03-05 12:37:24 -08:00

d1f44e89e2

docs: add sponsorship playbook and monthly metrics automation

Affaan Mustafa · 2026-03-04 16:17:12 -08:00

5fe40f4a63

docs: strengthen sponsor optics with live metrics and tiers

Affaan Mustafa · 2026-03-04 15:29:37 -08:00

c4a5a69dbd

Update install.sh

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Dang Nguyen · 2026-03-04 14:51:06 -08:00

5e1472263d

feat(CLI): Add Antigravity IDE support via --target antigravity flag

This Pull Request introduces `--target antigravity` support within the installation script to bridge Everything Claude Code configurations smoothly onto the Antigravity IDE ecosystem.

- Modified `install.sh` to parse and act on the new `--target antigravity` CLI arg.
- **Flattened Rules Conversion**: Logic automatically copies Language-agnostic (Common/Globs) rules as well as specific language stack rules into `common-*.md` and `{lang}-*.md` structures within `.agent/rules/`.
- **Workflow & Agent Aggregation**: Commands safely fall in `.agent/workflows/`, and `agents/` alongside `skills/` components are merged into `.agent/skills/`.
- Contains overwrite warnings to ensure local customized rules aren't completely overridden without consent.
- Minor updates to `README.md` to properly document the flag addition.

dangnd1 · 2026-03-04 14:51:06 -08:00

61485f91ad

docs: add upstream tracking flag to push example

Hao Wang · 2026-03-04 14:49:53 -08:00

57eb9361db

Add Contributor Covenant Code of Conduct

Added Contributor Covenant Code of Conduct to promote a harassment-free community.

Pangerkumzuk Longkumer · 2026-03-04 14:49:53 -08:00

98643ef6e6

fix(commands): make ace-tool MCP optional in multi-* commands with built-in fallbacks

The multi-* commands (multi-plan, multi-execute, multi-workflow, multi-backend,
multi-frontend) previously required ace-tool MCP (Augment Code) which is a paid
service. This change makes ace-tool completely optional by:

- Changing "MUST call" to "If ace-tool MCP is available" for enhance_prompt
- Changing mandatory search_context calls to optional with fallback procedures
- Adding detailed fallback instructions using Claude Code built-in tools
  (Glob, Grep, Read, Task/Explore agent) when ace-tool is unavailable
- Updating all translations (ja-JP, zh-CN) to match

This ensures multi-* commands work out of the box without ace-tool MCP configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

to.watanabe · 2026-03-04 14:49:53 -08:00

f94707d429

feat: deliver v1.8.0 harness reliability and parity updates

Affaan Mustafa · 2026-03-04 14:48:06 -08:00

48b883d741

chore: replace external repo links with @username attribution

Affaan Mustafa · 2026-03-03 12:32:35 -08:00

32e9c293f0

feat(skills): add autonomous-loops and plankton-code-quality skills

- autonomous-loops: 6 loop patterns from simple claude -p pipelines to
  RFC-driven DAG orchestration (Ralphinho, infinite-agentic-loop,
  continuous-claude, de-sloppify pattern)
- plankton-code-quality: write-time enforcement integration guide
- README: updated directory listing and Plankton description

Sources: enitrat/ralphinho, disler/infinite-agentic-loop,
AnandChowdhary/continuous-claude, alexfazio/plankton

Affaan Mustafa · 2026-03-03 12:16:57 -08:00

cd129edef0

1673 Commits