Commit Graph

400 Commits

Author SHA1 Message Date
David W Miller
90dfd9505d feat: add orch-* orchestrator skill family (#2153)
* feat: add orch-* orchestrator skill family

Lightweight wrappers that orchestrate existing ECC agents through a gated Research -> Plan -> TDD -> Review -> Commit pipeline, right-sized per task.

- orch-pipeline: shared engine (phases, size classifier, two gates, agent map)
- orch-add-feature/change-feature/fix-defect/refine-code/build-mvp: thin wrappers delegating to the engine

* chore: register orch-* family in catalog, command registry, and agent.yaml (post-rebase onto green main)

---------

Co-authored-by: ECC Test <ecc@example.test>
2026-06-07 16:15:31 +08:00
Affaan Mustafa
e755c5f72b fix: make plugin hooks run on Node 21+ and green the suite under modern Node (#2184)
ROOT CAUSE: hooks load plugin-hook-bootstrap.js via
`node -e "...; process.argv.splice(1,0,s); require(s)"`. On Node 21+,
require.main is `undefined` under --eval, so the `if (require.main === module)`
guard was false and main() never ran — every plugin hook silently no-op'd
(e.g. the MCP-health PreToolUse hook stopped blocking). CI (Node 18/20) hid
this; it only surfaces on Node 21+. Fix: also run main() when require.main is
undefined (the eval-bootstrap case), while staying dormant on real imports.

Also clears pre-existing main debt the full local suite enforces:
- catalog:sync — README/docs agent+skill counts drifted after recent merges
- tests/ci/supply-chain-watch-workflow: update checkout SHA to the merged v6.0.3 (#2183)
- markdownlint + check-unicode-safety --write across docs/skills

Suite: 2683/2683 green under Node v25; lint + unicode clean.

Co-authored-by: ECC Test <ecc@example.test>
2026-06-07 16:05:28 +08:00
elmochilyas
06c376ae8b feat(skills): add laravel-security, laravel-tdd, and php-reviewer agent (#2122)
* feat(skills): add laravel-security, laravel-tdd, and php-reviewer agent

* fix: resolve code review findings across laravel-security, laravel-tdd, and php-reviewer

- laravel-security: replace env() with config() in runtime code,
  replace wildcard trusted proxies with CIDR ranges, remove blanket
  api/* CSRF exclusion, fix validated() return type, add null-safe
  rate limiter user access, sync mimes/extensions allowlists,
  replace #[Encrypted] with ShouldBeEncrypted, fix RateLimited args
- laravel-tdd: remove global withoutExceptionHandling() from setUp,
  remove contradictory assertNothingOutgoing(), fix undefined
  variable, replace invalid PHPUnit --min-coverage flag
- php-reviewer: fix Python contamination, add automated check
  requirement to approval criteria

* fix: align php-reviewer approval criteria and use config dot-notation keys

- agents/php-reviewer.md: sync approval criteria with .txt file version
  (add automated checks requirement for consistency across harnesses)
- skills/laravel-security/SKILL.md: replace raw env names with proper
  Laravel dot-notation config keys (app.key, services.stripe.*, etc.)
  so config() returns valid values instead of null

* fix: remove unnecessary secret validation for SMTP password
2026-06-07 13:29:12 +08:00
V Karthikeyan Nair
66e28b5fb1 feat(skills): add fastapi-patterns skill (#2129) 2026-06-07 13:29:10 +08:00
Adna Salković
07812091aa feat(skills): add codehealth-mcp skill and CodeScene MCP config (#2077)
* feat(skills): add codehealth-mcp skill and CodeScene MCP config

* docs(skills): add When to Use, How It Works, and Examples sections

* docs(skills): clarify MCP opt-in, data boundaries, and offline behavior

Address security review on PR #2077: no bundled credentials, document what
tools read locally, failure behavior when MCP is unavailable, and README
wording that Code Health MCP is optional and not enabled by default.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: adnasalk-notus <adna.salkovic@notus.hr>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-07 13:26:54 +08:00
Andrea Cavallo
ff1bfa1b77 feat: add intent-driven-development skill (#2092)
* feat: add intent-driven-development skill

Converts ambiguous feature or engineering requests into scoped,
verifiable acceptance criteria before implementation starts.

- Chooses between Quick Capture (low/moderate risk) and Full
  Acceptance Brief (security, data, migration, cross-system changes)
- Reads repo context before asking questions; only asks what cannot
  be inferred
- Non-blocking by default: records criteria and proceeds unless a
  real risk requires confirmation
- Rule 9: when an AC fails mid-implementation due to architectural
  constraints, marks it [revised], updates scope/verification method,
  and re-presents only changed criteria rather than silently dropping
- Output template includes Revision Log for traceability across
  multiple implementation cycles

* fix: add canonical When to Activate, How It Works, and Examples sections

Required for auto-activation mechanism detection per CONTRIBUTING.md
and existing skill conventions. Sections inserted after the intro
and before Operating Rules.

* fix: strengthen intent-driven-development skill per review

Address skill-quality review feedback on the intent-driven-development PR:

- Business/product constraints: add Operating Rule 2 forbidding inference
  of business rules, compliance/SLAs, pricing, retention, prioritization,
  and target users from code; surface the technical-vs-business split in
  How It Works, Discover Context, and a dedicated 'supplied, not inferred'
  section in the brief template.
- Eval-style pass/fail: add a Pass/Fail Examples section (failing vs
  passing AC, plus a misplaced business-rule context entry) and a 5-point
  Pass/Fail Rubric users can apply to the output.
- Renumber Operating Rules 1-10 accordingly; markdownlint clean.
2026-06-07 13:26:45 +08:00
linsy
28b78dd7bf feat: add inherit-legacy-style — prevent AI code style drift in legac… (#2098)
* feat: add inherit-legacy-style — prevent AI code style drift in legacy projects

- 4-dimension meta-architecture scan (File Anatomy, State & Control Flow, Infrastructure, Error Handling)
- Scale-adaptive (small=full read, large=smart sampling)
- Signal-threshold noise reduction with one-at-a-time grilling protocol
- Generates .ai-style-rules.md with persistent CLAUDE.md hook
- Language- and framework-agnostic

* fix: add AskUserQuestion to allowed-tools, add When to Use/How It Works/Examples sections per bot review

---------

Co-authored-by: wulinzai <linsywu@gmail.com>
2026-06-07 13:26:40 +08:00
xiaoxi
e4dfc1679b fix: surface legacy data warning in instinct-cli status (#2127)
* fix: surface legacy data warning in instinct-cli status (#2036)

When the data directory moved from ~/.claude/homunculus/ to the
XDG-compliant ~/.local/share/ecc-homunculus/, legacy installs with data
still in the old path saw "No instincts found" with no explanation.

Add _warn_legacy_data() to cmd_status so users get a clear, actionable
warning pointing them to the migration script or the CLV2_HOMUNCULUS_DIR
override. Wrap the directory scan in try/except to handle permission
errors gracefully.

Closes #2036

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix: address review feedback — drop unused f-strings, resolve absolute migrate path

Remove extraneous f-prefix from strings without interpolation (ruff F541).
Resolve migrate-homunculus.sh path relative to instinct-cli.py instead of
hard-coding a repo-relative path that only works from the repo root.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix: quote migrate script path to handle spaces

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: kky <lingmu141592@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-07 13:26:22 +08:00
nyxst4ck
3248ac69f0 docs: quote pip extras install example (#2130)
Co-authored-by: nyxst4ck <289980115+nyxst4ck@users.noreply.github.com>
2026-06-07 13:26:20 +08:00
konstapukarifastnetfi
8b24f63ede fix: refresh stale technical content in agents, rules, and skills (#2168)
Several published examples contained APIs that no longer exist, code that
does not run, or model versions that drifted from reality:

- agents/performance-optimizer.md used the web-vitals v3 API
  (getCLS/getFID/getLCP/getFCP/getTTFB) and reported FID. web-vitals v4
  renamed the imports to onCLS/onINP/onLCP/onFCP/onTTFB and FID was
  replaced by INP (target < 200ms)
- rules/common/performance.md pinned stale model versions in the
  model-selection guidance; refresh to the versions the repo itself uses
  (agent.yaml pins claude-opus-4-6) and add the PowerShell variant for
  MAX_THINKING_TOKENS next to the bash export
- skills/python-patterns/SKILL.md: both get_value examples referenced
  default_value without declaring the parameter (NameError); add
  default_value: Any = None to the EAFP and LBYL signatures
- skills/frontend-patterns/SKILL.md: the custom useQuery example rebuilt
  refetch whenever callers passed inline fetchers/options, re-triggering
  the effect after every state update (infinite fetch loop). Keep the
  latest fetcher/options in refs so refetch stays referentially stable.
  The PASS-labelled useMemo example mutated its input with in-place sort;
  copy before sorting
- skills/coding-standards/SKILL.md repeated the same PASS-labelled
  in-place-sort-in-useMemo example; same fix
- rules/typescript/security.md used a vendor-specific OPENAI_API_KEY in
  generic guidance; switch to a neutral API_KEY

Every hand-maintained copy of the affected content is synced in the same
change: locale mirrors (ja-JP, ko-KR, pt-BR, tr, zh-CN, zh-TW - each only
where it carries the affected file) and the .agents/.kiro/.cursor harness
mirrors. Two structural divergences are left alone and noted here:
.kiro/steering/performance.md has no extended-thinking control list to
carry the PowerShell variant, and docs/zh-TW/rules/performance.md keeps an
older condensed thinking section without the budget-cap line.
rules/zh/performance.md is intentionally untouched - the rules/zh tree is
being retired in a separate change
2026-06-07 13:26:01 +08:00
konstapukarifastnetfi
36bec90d45 docs: align command docs with shipped behavior (#2169)
- multi-{plan,execute,backend,frontend,workflow}.md: add an in-file
  prerequisite note for the external ccg-workflow runtime. README.md already
  warns these commands need codeagent-wrapper and the .ccg prompt tree, but
  users meeting them via the installed slash commands never see the README;
  the commands-core module still installs all five by default
- quality-gate.md: describe what scripts/hooks/quality-gate.js actually does.
  The doc advertised '/quality-gate [path] [--fix] [--strict]' with lint/type
  checks, but the script reads the file path from hook stdin JSON, toggles
  behavior via ECC_QUALITY_GATE_FIX / ECC_QUALITY_GATE_STRICT env vars, and
  runs formatters only (Biome/Prettier, gofmt, ruff format)
- claude-devfleet SKILL.md: add a Setup section pointing at the DevFleet
  server repository (github.com/LEC-AI/claude-devfleet, already disclosed in
  mcp-configs/mcp-servers.json) plus the SECURITY.md port-verification note;
  the skill previously assumed a running instance with no way to obtain one
- regenerate docs/COMMAND-REGISTRY.json for the quality-gate description
2026-06-07 13:25:58 +08:00
Kumario
70fde3c14f fix(skills): keep curl credentials out of argv (#2175)
* fix(skills): avoid curl credential argv leaks

* test(ci): guard secret curl examples
2026-06-07 13:25:45 +08:00
Sahil Aghara
e116d69c65 feat(skills): add kubernetes-patterns skill (#2178)
* feat(skills): add kubernetes-patterns skill

* fix(skills): address CodeRabbit review on kubernetes-patterns

- Add When to Use alias section (repo skill-format requirement)
- Add How It Works overview section (required schema)
- Add Examples quick-reference table (required schema)
- Fix RBAC: split into Pattern A (no API, token disabled) and
  Pattern B (needs API, token enabled) to resolve contradiction
  between automountServiceAccountToken: false and Role/RoleBinding
- Fix missing -n my-namespace flag on OOMKilled kubectl describe command
2026-06-07 13:25:41 +08:00
zucchini
a3d8d8ab92 fix(observer): auto-scale max_turns by analysis batch size (#2062)
* fix(observer): auto-scale max_turns by analysis batch size (#2035)

The hardcoded default of MAX_TURNS=20 is insufficient when
MAX_ANALYSIS_LINES=500 (also the default). Claude exhausts its turn
budget before it can write all discovered instinct files, producing:

  Error: Reached max turns (20)

Fix: when ECC_OBSERVER_MAX_TURNS is not explicitly set, compute
max_turns proportionally to the actual analysis batch size:
  max_turns = clamp(analysis_count / 10, 20, 100)

This gives:
  - 20–199 lines → 20 turns  (existing floor, unchanged)
  - 500 lines    → 50 turns  (resolves the reported failure)
  - 1000 lines   → 100 turns (cap)

Explicitly setting ECC_OBSERVER_MAX_TURNS still overrides the
auto-scaled value, preserving the existing escape hatch.

* test(observer): update max_turns test for auto-scaling; document validation

The max-turns budget test in tests/hooks/hooks.test.js still asserted the removed literal max_turns="${ECC_OBSERVER_MAX_TURNS:-20}", which would fail against the new auto-scaling logic. Assert the auto-scale formula and the 20/100 clamp bounds instead.

Also add the explanatory comment CodeRabbit requested above the max_turns sanitization block, clarifying it guards the explicit ECC_OBSERVER_MAX_TURNS override path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-07 13:25:29 +08:00
Gaurav Dubey
30ef079e7e fix(continuous-learning-v2): accept claude-vscode as valid entrypoint (#2134)
The observe.sh Layer 1 entrypoint guard short-circuits with exit 0 when
CLAUDE_CODE_ENTRYPOINT is not in {cli, sdk-ts, claude-desktop}. Claude
Code's VS Code extension sets CLAUDE_CODE_ENTRYPOINT=claude-vscode, so
VS Code users see no observations recorded — observations.jsonl never
gets created and the instinct pipeline stays empty.

Add claude-vscode to the allowlist, mirroring the precedent in #1522
which added claude-desktop the same way.

Add a regression test that spawns observe.sh under bash -x for each
allowed entrypoint (cli, sdk-ts, claude-desktop, claude-vscode) and
each denied entrypoint (unknown-host, claude-cody, mcp), asserting
that allowed entrypoints reach Layer 2's ECC_HOOK_PROFILE check while
denied entrypoints stop at Layer 1.

Fixes #2102
2026-06-07 13:01:24 +08:00
Chris Yau
898fd231ce fix: guard two script edge cases (tolerant package.json parse, set -u empty array) (#2088)
* fix: guard two script edge cases

- scripts/harness-audit.js: getRepoChecks() parsed package.json with raw
  JSON.parse(readText(...)), while the rest of the file (lines 218, 822)
  uses the tolerant safeParseJson(safeRead(...)). In repo target mode a
  project lacking package.json — or with malformed JSON — threw an uncaught
  exception and crashed the audit instead of degrading. Match the existing
  convention so the audit tolerates a missing/invalid package.json.

- skills/frontend-slides/scripts/export-pdf.sh: `set -- "${POSITIONAL[@]}"`
  expands an empty array under `set -u` on bash 3.2 (the macOS system bash),
  aborting with "POSITIONAL[@]: unbound variable" instead of printing the
  usage message when invoked with no positional args. Guard the expansion
  with ${POSITIONAL[@]+"${POSITIONAL[@]}"} (no-op safe under bash 3.2 set -u).

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

* fix: null-safe package.json access in getRepoChecks

Review follow-up (CodeRabbit + cubic): switching to safeParseJson at line
389 means packageJson can be null on a missing/malformed package.json, but
the quality-ci-validations check dereferenced packageJson.scripts before the
optional chaining could help — throwing TypeError instead of degrading.
Guard the base object with packageJson?.scripts?.test at the access site,
matching the file's existing convention (e.g. line 220 uses packageJson?.name).

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Happy <yesreply@happy.engineering>
2026-06-07 13:01:21 +08:00
Affaan Mustafa
bc8e12bb80 feat: add dynamic workflow team orchestration surface
Adds dynamic workflow/team orchestration skills, the content pack, and control-pane work-item/Kanban state DB support. Includes reviewer hardening for state-db CLI validation, optional state DB failure handling, and mergeStateStatus projection.
2026-06-04 21:45:13 +08:00
Alexis Le Dain
04c68e483a Add React language track with agents, skills, rules, and commands (#2024)
* feat(rules): add rules/react/ track

Five rule files mirroring per-language convention (coding-style,
hooks, patterns, security, testing). Each has `paths:` glob
frontmatter for auto-activation when editing matching files.

- coding-style.md: file extensions, naming, JSX, RSC boundary
- hooks.md: React hooks (NOT Claude Code hooks) — rules-of-hooks,
  dep arrays, cleanup, memoization, React 19 additions
- patterns.md: container/presentational split, state location
  decision tree, Suspense + error boundaries, forms, data fetching
- security.md: dangerouslySetInnerHTML, unsafe URL schemes,
  server-action validation, env-var leaks, CSP
- testing.md: RTL queries, userEvent, async, MSW, axe, anti-patterns

Each file extends typescript/* and common/* rules.

* feat(skills): add react-patterns, react-testing, react-performance

Three new skills under skills/ following the SKILL.md convention.

- react-patterns: React 18/19 idioms — hooks discipline, state
  location decision tree, server/client component boundary,
  Suspense + error boundaries, form actions (React 19), data
  fetching matrix, composition recipes, accessibility-first.
- react-testing: React Testing Library + Vitest/Jest, query
  priority order, userEvent, MSW network mocking, axe a11y
  assertions, RTL vs Playwright CT boundary, TDD workflow.
- react-performance: 70-rule performance ruleset adapted from
  Vercel Labs react-best-practices (MIT) across 8 priority
  categories — waterfalls, bundle size, server-side, client
  fetch, re-render, rendering, JS micro, advanced patterns.
  Includes Lighthouse / Web Vitals mapping and attribution to
  upstream.

Cross-links between the three skills and out to frontend-patterns,
accessibility, e2e-testing, tdd-workflow.

* feat(agents): add react-reviewer and react-build-resolver

Two new agents covering React-specific code review and build error
resolution, plus matching .kiro/ mirrors and a routing pointer
edit on typescript-reviewer.

- react-reviewer: slim React-only lanes (hooks rules,
  dangerouslySetInnerHTML, unsafe URL schemes, key prop, state
  mutation, derived-state-in-effect, server/client component
  boundary, accessibility, render performance, Server Action
  validation, env-var leaks). Explicitly delegates generic
  TypeScript/async/Node concerns to typescript-reviewer. Both
  agents should be invoked together on .tsx/.jsx PRs.
- react-build-resolver: React build/bundler/runtime hydration
  failures across Vite, webpack, Next.js, CRA, Parcel, esbuild,
  Bun, Rsbuild. Handles JSX/TSX compile errors, tsconfig fixes,
  Next.js App Router server/client boundary errors, hydration
  mismatches, duplicated React copies, Tailwind/PostCSS pipeline.
- .kiro/agents/react-reviewer.json + react-build-resolver.json:
  Kiro IDE format mirrors following the per-language precedent.
- typescript-reviewer: routing pointer added to its MEDIUM React
  block — defers to /react-review for React-specific concerns
  while keeping its block as fallback for repos that only invoke
  typescript-reviewer.

All agents carry the standard Prompt Defense Baseline stanza.

* feat(commands): add /react-review /react-build /react-test

Three new slash commands invoking the React agents.

- /react-review: invokes react-reviewer. Documents the routing
  rule with typescript-reviewer — both should run together on
  TSX/JSX PRs. Lists CRITICAL/HIGH/MEDIUM rule categories and
  the automated checks (eslint with react-hooks + jsx-a11y,
  tsc --noEmit, npm audit).
- /react-build: invokes react-build-resolver. Documents bundler
  detection, common failure patterns, fix strategy, and stop
  conditions.
- /react-test: enforces TDD with React Testing Library + Vitest
  or Jest, behavior-focused queries, userEvent + MSW patterns,
  axe accessibility assertions, coverage targets.

Each command file has the required description: frontmatter and
follows the per-language command convention (cpp-test, go-test,
kotlin-test, etc.).

* chore: wire react track into manifests and stack mappings

- agent.yaml: add react-patterns, react-performance, react-testing
  to the skills array; add react-build, react-review, react-test to
  the commands array (alphabetically inserted to satisfy the
  ci/agent-yaml-surface sync test).
- config/project-stack-mappings.json: extend the `react` stack
  entry — add "react" to rules array (was ["common","typescript",
  "web"]); add react-patterns, react-performance, react-testing,
  accessibility to the skills array.
- docs/COMMAND-REGISTRY.json: bump totalCommands 75 -> 78; add
  three new entries (react-build, react-review, react-test) with
  primaryAgents / allAgents / skills wiring. react-review's
  allAgents includes typescript-reviewer to reflect the dual-agent
  routing convention.
- CLAUDE.md: add Skills-table row mapping *.tsx / *.jsx /
  components/** to react-patterns + react-testing skills and
  the /react-review, /react-build, /react-test commands.

* chore(catalog): sync counts to 62 agents / 78 commands / 235 skills

Auto-generated via `node scripts/ci/catalog.js --write --text`
after the react track additions:

- 2 new agents: react-reviewer, react-build-resolver (60 -> 62)
- 3 new commands: react-build, react-review, react-test (75 -> 78)
- 3 new skills: react-patterns, react-performance, react-testing
  (232 -> 235)

Files updated by the catalog sync:
- .claude-plugin/plugin.json description string
- .claude-plugin/marketplace.json plugin description
- README.md quick-start summary, project tree, feature parity tables
- README.zh-CN.md quick-start summary
- AGENTS.md project structure summary
- docs/zh-CN/README.md parity table
- docs/zh-CN/AGENTS.md project structure summary

All counts now match the filesystem catalog (verified by
ci/catalog.test.js).

* feat(kiro): add react agent markdown companions to JSON entries

* feat(kiro): add react skills into manifests

* fix(ci): sync catalog counts, registry, and package files for react track

- .claude-plugin/{plugin,marketplace}.json: bump description counts to 62/235/78
- docs/COMMAND-REGISTRY.json: regenerate to include quality-gate and react commands
- package.json: add skills/react-{patterns,performance,testing}/ to files allowlist so npm-publish-surface aligns with install-modules manifest

* fix(react): address PR #2024 review feedback

Critical:
- Remove undefined/.claude/session-aliases.json containing __proto__ prototype-pollution
  fixture committed by accident in a7333c14

High:
- agents/react-build-resolver.md: replace brittle `test -o $(grep -l ...)` and
  `test -a -n $(grep ...)` detection with explicit `{ ... || grep -q ...; }` so
  bundler detection no longer breaks when grep returns empty
- agents/react-build-resolver.md: drop hardcoded `npm i react@^19 react-dom@^19`
  remediation; replace with version-agnostic pair-upgrade note that honors the
  project's installed major (17/18/19) — surgical fix principle
- commands/react-review.md: guard `tsc --noEmit -p tsconfig.json` with
  `[ -f tsconfig.json ] &&` so the review skips cleanly on JS-only projects

Medium:
- rules/react/security.md: correct the React-18-blocks-javascript-URL claim
  (React only warns in dev; production navigation is not blocked)
- rules/react/security.md: correct CRA env-var exposure row (CRA exposes
  REACT_APP_*, NODE_ENV, PUBLIC_URL — not 'all' variables)
- skills/react-testing/SKILL.md: instantiate QueryClient once outside the
  wrapper closure so React Query cache survives re-renders (flaky-test fix)
- skills/react-testing/SKILL.md: restore console.error spy with mockRestore()
  in a try/finally so the mock does not leak across tests
- commands/react-test.md: switch outer example-session fence to 4 backticks
  so the inner ```tsx/```bash blocks don't prematurely terminate it

* fix(kiro): mirror react-build-resolver react 19 conditional remediation

Discussion r3272907106 flagged the kiro json variant still carrying the hardcoded
'npm i react@^19 react-dom@^19' line that the .md companion already dropped.
Replace with the same conditional, version-agnostic guidance so both variants
stay in sync.

* fix(react): bump react-build example session fence to 4 backticks

Discussion r3272907144 flagged the same nested-fence issue in
commands/react-build.md that we fixed earlier in commands/react-test.md.
The outer triple-backtick text block was being prematurely terminated by
the inner bash/tsx fences inside the Example Session.

* fix(react): bump react-review example usage fence to 4 backticks

Discussion r3272907201 flagged the same nested-fence issue in
commands/react-review.md. The outer triple-backtick text block was
being prematurely terminated by the inner tsx/ts fences inside the
Example Usage transcript.

* fix(docs): clarify commands row as legacy shims in feature parity table

Discussion r3272912003: README comparison table said 'PASS: 78 commands'
while the install-section and quick-start prose use 'legacy command shims'.
Aligned the comparison-table cell to 'PASS: 78 commands (legacy shims)' so
the count word survives the catalog-validator regex while making the legacy
nature explicit.

Widened the catalog comparison-table commands regex to tolerate an optional
parenthetical after the count word, so both the existing 'X commands' and
the new 'X commands (legacy shims)' phrasings validate without breaking
older READMEs/translations.

* Update rules/react/security.md

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

* fix(react): guard tsc in react-build-resolver diagnostic commands

Discussion r3288910205: the agent prompt instructed an unconditional
'tsc --noEmit -p tsconfig.json', which adds noise (or hard-fails) on
JavaScript-only projects with no tsconfig.json or no installed TypeScript.

Replaced with 'test -f tsconfig.json && npx --yes tsc --noEmit -p tsconfig.json'
in both variants:
- agents/react-build-resolver.md
- .kiro/agents/react-build-resolver.json (prompt string mirrored)

Mirrors the same guard already applied to commands/react-review.md in de135f61.

* fix(react): pin tsc resolution to local install in build resolver

Discussion r3289054157: previous fix used 'npx --yes tsc' which auto-installs
the latest TypeScript from npm when none is local, producing version drift
and non-reproducible typecheck results across machines.

Switched to 'npx --no-install tsc' in both variants so the diagnostic uses
only the project's pinned TypeScript and fails fast if it isn't installed:
- agents/react-build-resolver.md
- .kiro/agents/react-build-resolver.json (prompt string mirrored)

* feat(counts): resolve counts for agents, skills...

* fix(ci): regen command registry for golang-testing entry

Removes stale kotlin-patterns entry to satisfy command-registry:check.

* fix: keep local Claude settings out of React track PR

---------

Co-authored-by: AlexisLeDain <a.ledain@docoon.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Affaan Mustafa <affaan@dcube.ai>
2026-05-28 07:32:52 -04:00
Affaan Mustafa
5b4c4bda97 fix(docs): wrap integration reference links 2026-05-25 14:11:05 -04:00
Chet
d29dad1688 feat: add marketing campaign agent skill and command (#2031)
Adds marketing-agent, marketing-campaign skill, and marketing-campaign command. Pre-validated in a synthetic current-main merge.
2026-05-25 14:10:35 -04:00
ndesv21
61dd56901b feat(skills): add social publisher skill (#2052)
Adds a SocialClaw-backed social-publisher skill. Pre-validated in a synthetic current-main merge.
2026-05-25 14:10:32 -04:00
HJ
8fb728d7eb feat(skills): add frontend accessibility skill (#2048)
Adds the frontend-a11y skill for React and Next.js accessibility patterns. Pre-validated against current main with validate-skills and markdownlint.
2026-05-25 14:09:14 -04:00
Affaan Mustafa
228ceb8913 fix(docs): wrap Next.js proxy reference link 2026-05-25 14:08:41 -04:00
Alexis D.
3ffab636ad fix(nextjs-turbopack): document proxy.ts middleware filename (#2033)
Documents proxy.ts as the current Next.js/Turbopack middleware filename.
2026-05-25 14:06:50 -04:00
Affaan Mustafa
5bacdf49c8 feat: publish ECC 2.0 skill pack surfaces 2026-05-25 14:02:05 -04:00
Affaan Mustafa
bc519e5b8e fix(learning): add project registry maintenance 2026-05-19 12:51:18 -04:00
Da Wei
922d2d8f8b Add Blender motion state inspection skill
Adds the Blender motion state inspection skill with maintainer refinements for tools metadata, usage guidance, meter-scale threshold assumptions, and Blender interpreter notes.
2026-05-18 04:11:31 -04:00
Tiandy Tian
812d4d060a Delete skills/strategic-compact/suggest-compact.sh
useless file
2026-05-17 23:06:35 -04:00
Affaan Mustafa
caee7cf79c docs(uncloud): add skill activation structure 2026-05-17 21:48:05 -04:00
David Parry
2e5f30f695 docs(uncloud): add wildcard DNS tip for external device routing 2026-05-17 21:48:05 -04:00
David Parry
8b6aed0b80 feat(skills): add uncloud skill 2026-05-17 21:48:05 -04:00
Affaan Mustafa
6d130cfcd5 fix: reduce observer hook scanner signatures 2026-05-16 15:26:25 -04:00
Affaan Mustafa
039c7f111a chore: clean up lint blockers 2026-05-16 03:30:30 -04:00
Affaan Mustafa
9e973b29fb docs: remove emoji from recsys skill 2026-05-15 23:28:58 -04:00
mehmet turac
4b96af8f6a feat: add recsys-pipeline-architect skill (community) 2026-05-15 23:28:58 -04:00
wp_duality
acbc152375 feat(skills): enrich windows-desktop-e2e with trace/dpi/diagnostics (#1925)
* feat(skills): enrich windows-desktop-e2e with trace/dpi/diagnostics

- opt-in E2E_TRACE for step-level screenshots + JSONL action log;
  text content redacted by default (E2E_TRACE_INCLUDE_TEXT to opt in)
- DPI/scaling rules + debug_match() helper for screenshot fallback
- flaky table covers Qt5 set_edit_text fallback and off-screen controls

* docs: fix windows e2e debug helper

---------

Co-authored-by: Affaan Mustafa <affaan@dcube.ai>
2026-05-15 08:11:30 -04:00
Affaan Mustafa
9af04f3965 fix: harden dashboard canary and IOC coverage 2026-05-15 02:06:46 -04:00
Affaan Mustafa
4546a2c144 fix: salvage dashboard and canary-watch PRs (#1915)
Salvage focused changes from #1910 and #1911 on a maintainer-owned branch after full CI.

- enrich canary-watch discovery terms for post-deploy verification prompts
- narrow dashboard bare except handlers, add debug logging, and avoid double-configuring widgets

Co-authored-by: EunCHanPark <93873648+EunCHanPark@users.noreply.github.com>
Co-authored-by: shenchangmin <503228482@qq.com>
2026-05-15 01:57:21 -04:00
Affaan Mustafa
375d750b4c fix: integrate recent hook and docs PRs (#1905)
Integrates useful changes from #1882, #1884, #1889, #1893, #1898, #1899, and #1903:
- fix rule install docs to preserve language directories
- correct Ruby security command examples
- harden dev-server hook command-substitution parsing
- add Prisma patterns skill and catalog/package surfaces
- allow first-time protected config creation while blocking existing configs
- read cost metrics from Stop hook transcripts
- emit suggest-compact additionalContext on stdout

Co-authored-by: Jamkris <dltmdgus1412@gmail.com>
Co-authored-by: Levi-Evan <levishantz@gmail.com>
Co-authored-by: gaurav0107 <gauravdubey0107@gmail.com>
Co-authored-by: richm-spp <richard.millar@salarypackagingplus.com.au>
Co-authored-by: zomia <zomians@outlook.jp>
Co-authored-by: donghyeun02 <donghyeun02@gmail.com>
2026-05-14 21:37:28 -04:00
James M. ZHOU
d1710bd2e7 Update/Add comprehensive tinystruct patterns reference documentation (#1895)
* feat: update tinystruct-patterns skill with comprehensive expert knowledge

* Update skills/tinystruct-patterns/SKILL.md

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Update skills/tinystruct-patterns/SKILL.md

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

* Update skills/tinystruct-patterns/references/database.md

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* Update testing.md

* Update database.md

---------

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-05-14 21:18:19 -04:00
Affaan Mustafa
d4728a0d80 fix: fall back to ASCII instinct status bars
Fixes #1855
2026-05-13 02:59:58 -04:00
Arsal Sajjad
71ed7c58d4 feat: add homelab config skills (VLAN segmentation, Pi-hole DNS, WireGuard VPN) (#1838)
* feat: add homelab config skills (VLAN, Pi-hole, WireGuard)

Adds three homelab configuration skills, extracted from the stale PR #1413
with the same safety treatment applied to the previously accepted batch:

- homelab-vlan-segmentation: IoT/guest/trusted/server VLAN design for UniFi,
  pfSense/OPNsense, and MikroTik. All firewall rules add isolation, not remove
  protections. Added change-window guidance and AP trunk port clarification.

- homelab-pihole-dns: Pi-hole install, blocklists, DNS-over-HTTPS, local DNS
  records, troubleshooting. Docker is now the lead install method; bare-metal
  uses inspect-first pattern before running the installer script.

- homelab-wireguard-vpn: WireGuard server, peer config, split tunnel, DDNS.
  Replaced broad iptables FORWARD ACCEPT with scoped directional rules
  (wg0→eth0 forward + established return only). Credentials moved to env
  files with explicit notes against inline secrets and version control.

Continues the contribution from PR #1413; the eight skills/agents from
that PR are already in main via #1729 and #1731.

* docs: harden homelab skill pack

---------

Co-authored-by: Affaan Mustafa <affaan@dcube.ai>
2026-05-12 21:20:53 -04:00
Affaan Mustafa
ab0f0187de feat: salvage frontend design guidance (#1816) 2026-05-12 14:44:17 -04:00
Affaan Mustafa
65c1502ecd feat: salvage cost tracking and skill scout (#1815) 2026-05-12 14:23:46 -04:00
Affaan Mustafa
f239379ebf feat: salvage Django Celery workflow (#1812)
Source: maintainer-owned salvage of useful Django reviewer/build-resolver/Celery work from stale PR #1310 by mrigank2seven.

- add django-reviewer and django-build-resolver agents

- add django-celery skill with timezone-aware scheduling example

- update catalog counts to 60 agents / 221 skills and record the May 12 salvage gap pass

Co-authored-by: MRIGANK GUPTA <mrigank2seven@users.noreply.github.com>
2026-05-12 13:20:33 -04:00
Alexis Le Dain
f03e200136 feat: add Quarkus handling
Adds Quarkus handling across the Java skill/reviewer surface, with maintainer follow-up fixes for duplicate catalog entries, required skill sections, localized snippet structure, and current main alignment.\n\nValidation run locally on the final PR head:\n- NODE_PATH=/Users/affoon/GitHub/ECC/everything-claude-code/node_modules node scripts/ci/validate-install-manifests.js\n- NODE_PATH=/Users/affoon/GitHub/ECC/everything-claude-code/node_modules node scripts/ci/validate-skills.js\n- NODE_PATH=/Users/affoon/GitHub/ECC/everything-claude-code/node_modules node scripts/ci/catalog.js --text\n- npx --yes markdownlint-cli docs/ECC-2.0-GA-ROADMAP.md\n- git diff --check\n- NODE_PATH=/Users/affoon/GitHub/ECC/everything-claude-code/node_modules node tests/run-all.js (2324 passed, 0 failed)
2026-05-12 09:30:26 -04:00
Affaan Mustafa
cb2a70ce72 docs: fix motion skill examples
Fix copied example issues from the adopted #1780 motion skills: live reduced-motion config, tokenized distances/easing/springs, valid shimmer skeleton JSX, and visibility cleanup.
2026-05-12 01:47:05 -04:00
Affaan Mustafa
f219a90f20 feat: add motion system skills
Adopts the motion skill content from PR #1780 and syncs the public catalog counts for the current main surface.

Co-authored-by: Jeff <peacelord1309@gmail.com>
2026-05-12 01:30:41 -04:00
Affaan Mustafa
629d4c0c61 docs: salvage agent and motion workflow skills 2026-05-11 22:16:11 -04:00
Affaan Mustafa
60782502d5 docs: salvage Quarkus framework skills 2026-05-11 21:58:52 -04:00