feat: add machine learning engineering workflow

Port the current-source-safe command documentation subset from stale PR #1687.\n\nEach copied command page maps to an English source file unchanged since the stale PR base; fastapi-review remains deferred because #1687 did not include a matching zh-CN translation.

.agents/skills/frontend-patterns/SKILL.md

@@ -17,6 +17,12 @@ Modern frontend patterns for React, Next.js, and performant user interfaces.
 - Handling client-side routing and navigation
 - Building accessible, responsive UI patterns
 
+## Privacy and Data Boundaries
+
+Frontend examples should use synthetic or domain-generic data. Do not collect, log, persist, or display credentials, access tokens, SSNs, health data, payment details, private emails, phone numbers, or other sensitive personal data unless the user explicitly requests a scoped implementation with appropriate validation, redaction, and access controls.
+
+Avoid adding analytics, tracking pixels, third-party scripts, or external data sinks without explicit approval. When handling user data, prefer least-privilege APIs, client-side redaction before logging, and server-side validation for every boundary.
+
 ## Component Patterns
 
 ### Composition Over Inheritance

.agents/skills/mle-workflow/SKILL.md

@@ -0,0 +1,344 @@
+---
+name: mle-workflow
+description: Production machine-learning engineering workflow for data contracts, reproducible training, model evaluation, deployment, monitoring, and rollback. Use when building, reviewing, or hardening ML systems beyond one-off notebooks.
+allowed-tools: Read, Write, Edit, Bash, Grep, Glob
+---
+
+# Machine Learning Engineering Workflow
+
+Use this skill to turn model work into a production ML system with clear data contracts, repeatable training, measurable quality gates, deployable artifacts, and operational monitoring.
+
+## When to Activate
+
+- Planning or reviewing a production ML feature, model refresh, ranking system, recommender, classifier, embedding workflow, or forecasting pipeline
+- Converting notebook code into a reusable training, evaluation, batch inference, or online inference pipeline
+- Designing model promotion criteria, offline/online evals, experiment tracking, or rollback paths
+- Debugging failures caused by data drift, label leakage, stale features, artifact mismatch, or inconsistent training and serving logic
+- Adding model monitoring, canary rollout, shadow traffic, or post-deploy quality checks
+
+## Scope Calibration
+
+Use only the lanes that fit the system in front of you. This skill is useful for ranking, search, recommendations, classifiers, forecasting, embeddings, LLM workflows, anomaly detection, and batch analytics, but it should not force one architecture onto all of them.
+
+- Do not assume every model has supervised labels, online serving, a feature store, PyTorch, GPUs, human review, A/B tests, or real-time feedback.
+- Do not add heavyweight MLOps machinery when a data contract, baseline, eval script, and rollback note would make the change reviewable.
+- Do make assumptions explicit when the project lacks labels, delayed outcomes, slice definitions, production traffic, or monitoring ownership.
+- Treat examples as interchangeable scaffolds. Replace metrics, serving mode, data stores, and rollout mechanics with the project-native equivalents.
+
+## Related Skills
+
+- `python-patterns` and `python-testing` for Python implementation and pytest coverage
+- `pytorch-patterns` for deep learning models, data loaders, device handling, and training loops
+- `eval-harness` and `ai-regression-testing` for promotion gates and agent-assisted regression checks
+- `database-migrations`, `postgres-patterns`, and `clickhouse-io` for data storage and analytics surfaces
+- `deployment-patterns`, `docker-patterns`, and `security-review` for serving, secrets, containers, and production hardening
+
+## Reuse the SWE Surface
+
+Do not treat MLE as separate from software engineering. Most ECC SWE workflows apply directly to ML systems, often with stricter failure modes:
+
+| SWE surface | MLE use |
+|-------------|---------|
+| `product-capability` / `architecture-decision-records` | Turn model work into explicit product contracts and record irreversible data, model, and rollout choices |
+| `repo-scan` / `codebase-onboarding` / `code-tour` | Find existing training, feature, serving, eval, and monitoring paths before introducing a parallel ML stack |
+| `plan` / `feature-dev` | Scope model changes as product capabilities with data, eval, serving, and rollback phases |
+| `tdd-workflow` / `python-testing` | Test feature transforms, split logic, metric calculations, artifact loading, and inference schemas before implementation |
+| `code-reviewer` / `mle-reviewer` | Review code quality plus ML-specific leakage, reproducibility, promotion, and monitoring risks |
+| `build-fix` / `pr-test-analyzer` | Diagnose broken CI, flaky evals, missing fixtures, and environment-specific model or dependency failures |
+| `quality-gate` / `test-coverage` | Require automated evidence for transforms, metrics, inference contracts, promotion gates, and rollback behavior |
+| `eval-harness` / `verification-loop` | Turn offline metrics, slice checks, latency budgets, and rollback drills into repeatable gates |
+| `ai-regression-testing` | Preserve every production bug as a regression: missing feature, stale label, bad artifact, schema drift, or serving mismatch |
+| `api-design` / `backend-patterns` | Design prediction APIs, batch jobs, idempotent retraining endpoints, and response envelopes |
+| `database-migrations` / `postgres-patterns` / `clickhouse-io` | Version labels, feature snapshots, prediction logs, experiment metrics, and drift analytics |
+| `deployment-patterns` / `docker-patterns` | Package reproducible training and serving images with health checks, resource limits, and rollback |
+| `canary-watch` / `dashboard-builder` | Make rollout health visible with model-version, slice, drift, latency, cost, and delayed-label dashboards |
+| `security-review` / `security-scan` | Check model artifacts, notebooks, prompts, datasets, and logs for secrets, PII, unsafe deserialization, and supply-chain risk |
+| `e2e-testing` / `browser-qa` / `accessibility` | Test critical product flows that consume predictions, including explainability and fallback UI states |
+| `benchmark` / `performance-optimizer` | Measure throughput, p95 latency, memory, GPU utilization, and cost per prediction or retrain |
+| `cost-aware-llm-pipeline` / `token-budget-advisor` | Route LLM/embedding workloads by quality, latency, and budget instead of defaulting to the largest model |
+| `documentation-lookup` / `search-first` | Verify current library behavior for model serving, feature stores, vector DBs, and eval tooling before coding |
+| `git-workflow` / `github-ops` / `opensource-pipeline` | Package MLE changes for review with crisp scope, generated artifacts excluded, and reproducible test evidence |
+| `strategic-compact` / `dmux-workflows` | Split long ML work into parallel tracks: data contract, eval harness, serving path, monitoring, and docs |
+
+## Ten MLE Task Simulations
+
+Use these simulations as coverage checks when planning or reviewing MLE work. A strong MLE workflow should reduce each task to explicit contracts, reusable SWE surfaces, automated evidence, and a reviewable artifact.
+
+| ID | Common MLE task | Streamlined ECC path | Required output | Pipeline lanes covered |
+|----|-----------------|----------------------|-----------------|------------------------|
+| MLE-01 | Frame an ambiguous prediction, ranking, recommender, classifier, embedding, or forecast capability | `product-capability`, `plan`, `architecture-decision-records`, `mle-workflow` | Iteration Compact naming who cares, decision owner, success metric, unacceptable mistakes, assumptions, constraints, and first experiment | product contract, stakeholder loss, risk, rollout |
+| MLE-02 | Define metric goals, labels, data sources, and the mistake budget | `repo-scan`, `database-reviewer`, `database-migrations`, `postgres-patterns`, `clickhouse-io` | Data and metric contract with entity grain, label timing, label confidence, feature timing, point-in-time joins, split policy, and dataset snapshot | data contract, metric design, leakage, reproducibility |
+| MLE-03 | Build a baseline model and scoring path before adding complexity | `tdd-workflow`, `python-testing`, `python-patterns`, `code-reviewer` | Baseline scorer with confusion matrix, calibration notes, latency/cost estimate, known weaknesses, and tests for score shape and determinism | baseline, scoring, testing, serving parity |
+| MLE-04 | Generate features from hypotheses about what separates outcomes | `python-patterns`, `pytorch-patterns`, `docker-patterns`, `deployment-patterns` | Feature plan and transform module covering signal source, missing values, outliers, correlations, leakage checks, and train/serve equivalence | feature pipeline, leakage, training, artifacts |
+| MLE-05 | Tune thresholds, configs, and model complexity under tradeoffs | `eval-harness`, `ai-regression-testing`, `quality-gate`, `test-coverage` | Threshold/config report comparing precision, recall, F1, AUC, calibration, group slices, latency, cost, complexity, and acceptable error classes | evaluation, threshold, promotion, regression |
+| MLE-06 | Run error analysis and turn mistakes into the next experiment | `eval-harness`, `ai-regression-testing`, `mle-reviewer`, `silent-failure-hunter` | Error cluster report for false positives, false negatives, ambiguous labels, stale features, missing signals, and bug traces with lessons captured | error analysis, bug trace, iteration, regression |
+| MLE-07 | Package a model artifact for batch or online inference | `api-design`, `backend-patterns`, `security-review`, `security-scan` | Versioned artifact bundle with preprocessing, config, dependency constraints, schema validation, safe loading, and PII-safe logs | artifact, security, inference contract |
+| MLE-08 | Ship online serving or batch scoring with feedback capture | `api-design`, `backend-patterns`, `e2e-testing`, `browser-qa`, `accessibility` | Prediction endpoint or batch job with response envelope, timeout, batching, fallback, model version, confidence, feedback logging, and product-flow tests | serving, batch inference, fallback, user workflow |
+| MLE-09 | Roll out a model with shadow traffic, canary, A/B test, or rollback | `canary-watch`, `dashboard-builder`, `verification-loop`, `performance-optimizer` | Rollout plan naming traffic split, dashboards, p95 latency, cost, quality guardrails, rollback artifact, and rollback trigger | deployment, canary, rollback |
+| MLE-10 | Operate, debug, and refresh a production model after launch | `silent-failure-hunter`, `dashboard-builder`, `mle-reviewer`, `doc-updater`, `github-ops` | Observation ledger and refresh plan with drift checks, delayed-label health, alert owners, runbook updates, retrain criteria, and PR evidence | monitoring, incident response, retraining |
+
+## Iteration Compact
+
+Before touching model code, compress the work into one reviewable artifact. This should be short enough to fit in a PR description and precise enough that another engineer can challenge the tradeoffs.
+
+```text
+Goal:
+Who cares:
+Decision owner:
+User or system action changed by the model:
+Success metric:
+Guardrail metrics:
+Mistake budget:
+Unacceptable mistakes:
+Acceptable mistakes:
+Assumptions:
+Constraints:
+Labels and data snapshot:
+Baseline:
+Candidate signals:
+Threshold or config plan:
+Eval slices:
+Known risks:
+Next experiment:
+Rollback or fallback:
+```
+
+This compact is the MLE equivalent of a strong SWE design note. It keeps the team from optimizing a metric no one trusts, adding features that do not address the real error mode, or shipping complexity without a rollback.
+
+## Decision Brain
+
+Use this loop whenever the task is ambiguous, high-impact, or metric-heavy:
+
+1. Start from the decision, not the model. Name the action that changes downstream behavior.
+2. Name who cares and why. Different stakeholders pay different costs for false positives, false negatives, latency, compute spend, opacity, or missed opportunities.
+3. Convert ambiguity into hypotheses. Ask what signal would separate outcomes, what evidence would disprove it, and what simple baseline should be hard to beat.
+4. Research prior art or a nearby known problem before inventing a bespoke system.
+5. Score choices with `(probability, confidence) x (cost, severity, importance, impact)`.
+6. Consider adversarial behavior, incentives, selective disclosure, distribution shift, and feedback loops.
+7. Prefer the simplest change that reduces the most important mistake. Simplicity is not laziness; it is a way to minimize blunders while preserving iteration speed.
+8. Capture the decision, evidence, counterargument, and next reversible step.
+
+## Metric and Mistake Economics
+
+Choose metrics from failure costs, not habit:
+
+- Use a confusion matrix early so the team can discuss concrete false positives and false negatives instead of abstract accuracy.
+- Favor precision when the cost of an incorrect positive decision dominates.
+- Favor recall when the cost of a missed positive dominates.
+- Use F1 only when the precision/recall tradeoff is genuinely balanced and explainable.
+- Use AUC or ranking metrics when ordering quality matters more than a single threshold.
+- Track latency, throughput, memory, and cost as first-class metrics because they shape feasible model complexity.
+- Compare against a baseline and the current production model before celebrating an offline gain.
+- Treat real-world feedback signals as delayed labels with bias, lag, and coverage gaps; do not treat them as ground truth without analysis.
+
+Every metric choice should state which mistake it makes cheaper, which mistake it makes more likely, and who absorbs that cost.
+
+## Data and Feature Hypotheses
+
+Features should come from a theory of separation:
+
+- Text, categorical fields, numeric histories, graph relationships, recency, frequency, and aggregates are candidate signal families, not automatic features.
+- For every feature family, state why it should separate outcomes and how it could leak future information.
+- For noisy labels, consider adjudication, label confidence, soft targets, or confidence weighting.
+- For class imbalance, compare weighted loss, resampling, threshold movement, and calibrated decision rules.
+- For missing values, decide whether absence is informative, imputable, or a reason to abstain.
+- For outliers, decide whether to clip, bucket, investigate, or preserve them as rare but important signal.
+- For correlated features, check whether they are redundant, unstable, or proxies for unavailable future state.
+
+Do not add model complexity until error analysis shows that the baseline is failing for a reason additional signal or capacity can plausibly fix.
+
+## Error Analysis Loop
+
+After each baseline, training run, threshold change, or config change:
+
+1. Split mistakes into false positives, false negatives, abstentions, low-confidence cases, and system failures.
+2. Cluster errors by shared traits: language, entity type, source, time, geography, device, sparsity, recency, feature freshness, label source, or model version.
+3. Separate model mistakes from data bugs, label ambiguity, product ambiguity, instrumentation gaps, and serving mismatches.
+4. Trace each major cluster to one of four moves: better labels, better features, better threshold/config, or better product fallback.
+5. Preserve every important mistake as a regression test, eval slice, dashboard panel, or runbook entry.
+6. Write the next iteration as a falsifiable experiment, not a vague "improve model" task.
+
+The strongest MLE loop is not train -> metric -> ship. It is mistake -> cluster -> hypothesis -> experiment -> evidence -> simpler system.
+
+## Observation Ledger
+
+Keep a compact decision and evidence trail beside the code, PR, experiment report, or runbook:
+
+```text
+Iteration:
+Change:
+Why this mattered:
+Metric movement:
+Slice movement:
+False positives:
+False negatives:
+Unexpected errors:
+Decision:
+Tradeoff accepted:
+Lesson captured:
+Regression added:
+Debt created:
+Next iteration:
+```
+
+Use the ledger to make model work cumulative. The goal is for each iteration to make the next decision easier, not merely to produce another artifact.
+
+## Core Workflow
+
+### 1. Define the Prediction Contract
+
+Capture the product-level contract before writing model code:
+
+- Prediction target and decision owner
+- Input entity, output schema, confidence/calibration fields, and allowed latency
+- Batch, online, streaming, or hybrid serving mode
+- Fallback behavior when the model, feature store, or dependency is unavailable
+- Human review or override path for high-impact decisions
+- Privacy, retention, and audit requirements for inputs, predictions, and labels
+
+Do not accept "improve the model" as a requirement. Tie the model to an observable product behavior and a measurable acceptance gate.
+
+### 2. Lock the Data Contract
+
+Every ML task needs an explicit data contract:
+
+- Entity grain and primary key
+- Label definition, label timestamp, and label availability delay
+- Feature timestamp, freshness SLA, and point-in-time join rules
+- Train, validation, test, and backtest split policy
+- Required columns, allowed nulls, ranges, categories, and units
+- PII or sensitive fields that must not enter training artifacts or logs
+- Dataset version or snapshot ID for reproducibility
+
+Guard against leakage first. If a feature is not available at prediction time, or is joined using future information, remove it or move it to an analysis-only path.
+
+### 3. Build a Reproducible Pipeline
+
+Training code should be runnable by another engineer without hidden notebook state:
+
+- Use typed config files or dataclasses for all hyperparameters and paths
+- Pin package and model dependencies
+- Set random seeds and document any nondeterministic GPU behavior
+- Record dataset version, code SHA, config hash, metrics, and artifact URI
+- Save preprocessing logic with the model artifact, not separately in a notebook
+- Keep train, eval, and inference transformations shared or generated from one source
+- Make every step idempotent so retries do not corrupt artifacts or metrics
+
+Prefer immutable values and pure transformation functions. Avoid mutating shared data frames or global config during feature generation.
+
+```python
+import hashlib
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class TrainingConfig:
+    dataset_uri: str
+    model_dir: Path
+    seed: int
+    learning_rate: float
+    batch_size: int
+
+
+def artifact_name(config: TrainingConfig, code_sha: str) -> str:
+    config_key = f"{config.dataset_uri}:{config.seed}:{config.learning_rate}:{config.batch_size}"
+    config_hash = hashlib.sha256(config_key.encode("utf-8")).hexdigest()[:12]
+    return f"{code_sha[:12]}-{config_hash}"
+```
+
+### 4. Evaluate Before Promotion
+
+Promotion criteria should be declared before training finishes:
+
+- Baseline model and current production model comparison
+- Primary metric aligned to product behavior
+- Guardrail metrics for latency, calibration, fairness slices, cost, and error concentration
+- Slice metrics for important cohorts, geographies, devices, languages, or data sources
+- Confidence intervals or repeated-run variance when metrics are noisy
+- Failure examples reviewed by a human for high-impact models
+- Explicit "do not ship" thresholds
+
+```python
+PROMOTION_GATES = {
+    "auc": ("min", 0.82),
+    "calibration_error": ("max", 0.04),
+    "p95_latency_ms": ("max", 80),
+}
+
+
+def assert_promotion_ready(metrics: dict[str, float]) -> None:
+    missing = sorted(name for name in PROMOTION_GATES if name not in metrics)
+    if missing:
+        raise ValueError(f"Model promotion metrics missing required gates: {missing}")
+
+    failures = {
+        name: value
+        for name, (direction, threshold) in PROMOTION_GATES.items()
+        for value in [metrics[name]]
+        if (direction == "min" and value < threshold)
+        or (direction == "max" and value > threshold)
+    }
+    if failures:
+        raise ValueError(f"Model failed promotion gates: {failures}")
+```
+
+Use offline metrics as gates, not guarantees. When the model changes product behavior, plan shadow evaluation, canary rollout, or A/B testing before full rollout.
+
+### 5. Package for Serving
+
+An ML artifact is production-ready only when the serving contract is testable:
+
+- Model artifact includes version, training data reference, config, and preprocessing
+- Input schema rejects invalid, stale, or out-of-range features
+- Output schema includes model version and confidence or explanation fields when useful
+- Serving path has timeout, batching, resource limits, and fallback behavior
+- CPU/GPU requirements are explicit and tested
+- Prediction logs avoid PII and include enough identifiers for debugging and label joins
+- Integration tests cover missing features, stale features, bad types, empty batches, and fallback path
+
+Never let training-only feature code diverge from serving feature code without a test that proves equivalence.
+
+### 6. Operate the Model
+
+Model monitoring needs both system and quality signals:
+
+- Availability, error rate, timeout rate, queue depth, and p50/p95/p99 latency
+- Feature null rate, range drift, categorical drift, and freshness drift
+- Prediction distribution drift and confidence distribution drift
+- Label arrival health and delayed quality metrics
+- Business KPI guardrails and rollback triggers
+- Per-version dashboards for canaries and rollbacks
+
+Every deployment should have a rollback plan that names the previous artifact, config, data dependency, and traffic-switch mechanism.
+
+## Review Checklist
+
+- [ ] Prediction contract is explicit and testable
+- [ ] Data contract defines entity grain, label timing, feature timing, and snapshot/version
+- [ ] Leakage risks were checked against prediction-time availability
+- [ ] Training is reproducible from code, config, data version, and seed
+- [ ] Metrics compare against baseline and current production model
+- [ ] Slice metrics and guardrails are included for high-risk cohorts
+- [ ] Promotion gates are automated and fail closed
+- [ ] Training and serving transformations are shared or equivalence-tested
+- [ ] Model artifact carries version, config, dataset reference, and preprocessing
+- [ ] Serving path validates inputs and has timeout, fallback, and rollback behavior
+- [ ] Monitoring covers system health, feature drift, prediction drift, and delayed labels
+- [ ] Sensitive data is excluded from artifacts, logs, prompts, and examples
+
+## Anti-Patterns
+
+- Notebook state is required to reproduce the model
+- Random split leaks future data into validation or test sets
+- Feature joins ignore event time and label availability
+- Offline metric improves while important slices regress
+- Thresholds are tuned on the test set repeatedly
+- Training preprocessing is copied manually into serving code
+- Model version is missing from prediction logs
+- Monitoring only checks service uptime, not data or prediction quality
+- Rollback requires retraining instead of switching to a known-good artifact
+
+## Output Expectations
+
+When using this skill, return concrete artifacts: data contract, promotion gates, pipeline steps, test plan, deployment plan, or review findings. Call out unknowns that block production readiness instead of filling them with assumptions.

.agents/skills/mle-workflow/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: "MLE Workflow"
+  short_description: "Production ML workflow and review gates"
+  brand_color: "#2563EB"
+  default_prompt: "Use $mle-workflow to plan or review a production ML pipeline."
+policy:
+  allow_implicit_invocation: true

.claude-plugin/PLUGIN_SCHEMA_NOTES.md

@@ -136,6 +136,7 @@ The test `plugin.json does NOT have explicit hooks declaration` in `tests/hooks/
 
 ECC keeps `.mcp.json` at the repository root for Codex plugin installs and manual MCP setup.
 Claude Code also auto-discovers plugin-root `.mcp.json` files by convention, which would bundle the same MCP servers into Claude plugin installs.
+The Claude plugin slug is intentionally short (`ecc`), but this opt-out is still required because legacy installs and strict provider gateways have failed on generated names from longer plugin identifiers.
 
 Keep this field in `.claude-plugin/plugin.json`:
 

.claude-plugin/marketplace.json

@@ -1,5 +1,5 @@
 {
-  "name": "everything-claude-code",
+  "name": "ecc",
   "owner": {
     "name": "Affaan Mustafa",
     "email": "me@affaanmustafa.com"
@@ -9,9 +9,9 @@
   },
   "plugins": [
     {
-      "name": "everything-claude-code",
+      "name": "ecc",
       "source": "./",
-      "description": "The most comprehensive Claude Code plugin — 48 agents, 182 skills, 68 legacy command shims, selective install profiles, and production-ready hooks for TDD, security scanning, code review, and continuous learning",
+      "description": "The most comprehensive Claude Code plugin — 54 agents, 204 skills, 69 legacy command shims, selective install profiles, and production-ready hooks for TDD, security scanning, code review, and continuous learning",
       "version": "2.0.0-rc.1",
       "author": {
         "name": "Affaan Mustafa",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
-  "name": "everything-claude-code",
+  "name": "ecc",
   "version": "2.0.0-rc.1",
-  "description": "Battle-tested Claude Code plugin for engineering teams — 48 agents, 182 skills, 68 legacy command shims, production-ready hooks, and selective install workflows evolved through continuous real-world use",
+  "description": "Battle-tested Claude Code plugin for engineering teams — 54 agents, 204 skills, 69 legacy command shims, production-ready hooks, and selective install workflows evolved through continuous real-world use",
   "author": {
     "name": "Affaan Mustafa",
     "url": "https://x.com/affaanmustafa"
@@ -23,6 +23,10 @@
     "best-practices"
   ],
   "mcpServers": {},
-  "skills": ["./skills/"],
-  "commands": ["./commands/"]
+  "skills": [
+    "./skills/"
+  ],
+  "commands": [
+    "./commands/"
+  ]
 }

.codex-plugin/README.md

@@ -12,7 +12,7 @@ This directory contains the **Codex plugin manifest** for Everything Claude Code
 
 ## What This Provides
 
-- **182 skills** from `./skills/` — reusable Codex workflows for TDD, security,
+- **200 skills** from `./skills/` — reusable Codex workflows for TDD, security,
   code review, architecture, and more
 - **6 MCP servers** — GitHub, Context7, Exa, Memory, Playwright, Sequential Thinking
 

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ecc",
   "version": "2.0.0-rc.1",
-  "description": "Battle-tested Codex workflows — 182 shared ECC skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.",
+  "description": "Battle-tested Codex workflows — 200 shared ECC skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.",
   "author": {
     "name": "Affaan Mustafa",
     "email": "me@affaanmustafa.com",
@@ -15,7 +15,7 @@
   "mcpServers": "./.mcp.json",
   "interface": {
     "displayName": "Everything Claude Code",
-    "shortDescription": "182 battle-tested ECC skills plus MCP configs for TDD, security, code review, and autonomous development.",
+    "shortDescription": "200 battle-tested ECC skills plus MCP configs for TDD, security, code review, and autonomous development.",
     "longDescription": "Everything Claude Code (ECC) is a community-maintained collection of Codex-ready skills and MCP configs evolved over 10+ months of intensive daily use. It covers TDD workflows, security scanning, code review, architecture decisions, operator workflows, and more — all in one installable plugin.",
     "developerName": "Affaan Mustafa",
     "category": "Productivity",

.codex/AGENTS.md

@@ -60,6 +60,12 @@ The sync script (`scripts/sync-ecc-to-codex.sh`) uses a Node-based TOML parser t
 - **`--update-mcp`** — explicitly replaces all ECC-managed servers with the latest recommended config (safely removes subtables like `[mcp_servers.supabase.env]`).
 - **User config is always preserved** — custom servers, args, env vars, and credentials outside ECC-managed sections are never touched.
 
+## External Action Boundaries
+
+Treat networked tools as read-only by default. Search, inspect, and draft freely within the user's requested scope, but require explicit user approval before posting, publishing, pushing, merging, opening paid jobs, dispatching remote agents, changing third-party resources, or modifying credentials.
+
+When approval is ambiguous, produce a local plan or draft artifact instead of taking the external action. Preserve user config and private state unless the user specifically asks for a scoped change.
+
 ## Multi-Agent Support
 
 Codex now supports multi-agent workflows behind the experimental `features.multi_agent` flag.

.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
       # Package manager setup
       - name: Setup pnpm
         if: matrix.pm == 'pnpm' && matrix.node != '18.x'
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
+        uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
         with:
           # Keep an explicit pnpm major because this repo's packageManager is Yarn.
           version: 10
@@ -77,7 +77,7 @@ jobs:
 
       - name: Cache npm
         if: matrix.pm == 'npm'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.npm-cache-dir.outputs.dir }}
           key: ${{ runner.os }}-node-${{ matrix.node }}-npm-${{ hashFiles('**/package-lock.json') }}
@@ -94,7 +94,7 @@ jobs:
 
       - name: Cache pnpm
         if: matrix.pm == 'pnpm'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.pnpm-cache-dir.outputs.dir }}
           key: ${{ runner.os }}-node-${{ matrix.node }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -115,7 +115,7 @@ jobs:
 
       - name: Cache yarn
         if: matrix.pm == 'yarn'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.yarn-cache-dir.outputs.dir }}
           key: ${{ runner.os }}-node-${{ matrix.node }}-yarn-${{ hashFiles('**/yarn.lock') }}
@@ -124,7 +124,7 @@ jobs:
 
       - name: Cache bun
         if: matrix.pm == 'bun'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.bun/install/cache
           key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
@@ -220,6 +220,10 @@ jobs:
         run: node scripts/ci/check-unicode-safety.js
         continue-on-error: false
 
+      - name: Validate no personal paths
+        run: node scripts/ci/validate-no-personal-paths.js
+        continue-on-error: false
+
   security:
     name: Security Scan
     runs-on: ubuntu-latest

.github/workflows/reusable-test.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Setup pnpm
         if: inputs.package-manager == 'pnpm' && inputs.node-version != '18.x'
-        uses: pnpm/action-setup@08c4be7e2e672a47d11bd04269e27e5f3e8529cb # v6.0.0
+        uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
         with:
           # Keep an explicit pnpm major because this repo's packageManager is Yarn.
           version: 10
@@ -67,7 +67,7 @@ jobs:
 
       - name: Cache npm
         if: inputs.package-manager == 'npm'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.npm-cache-dir.outputs.dir }}
           key: ${{ runner.os }}-node-${{ inputs.node-version }}-npm-${{ hashFiles('**/package-lock.json') }}
@@ -84,7 +84,7 @@ jobs:
 
       - name: Cache pnpm
         if: inputs.package-manager == 'pnpm'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.pnpm-cache-dir.outputs.dir }}
           key: ${{ runner.os }}-node-${{ inputs.node-version }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -105,7 +105,7 @@ jobs:
 
       - name: Cache yarn
         if: inputs.package-manager == 'yarn'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ steps.yarn-cache-dir.outputs.dir }}
           key: ${{ runner.os }}-node-${{ inputs.node-version }}-yarn-${{ hashFiles('**/yarn.lock') }}
@@ -114,7 +114,7 @@ jobs:
 
       - name: Cache bun
         if: inputs.package-manager == 'bun'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.bun/install/cache
           key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}

.github/workflows/reusable-validate.yml

@@ -50,3 +50,6 @@ jobs:
 
       - name: Check unicode safety
         run: node scripts/ci/check-unicode-safety.js
+
+      - name: Validate no personal paths
+        run: node scripts/ci/validate-no-personal-paths.js

.kiro/skills/search-first/SKILL.md

@@ -21,6 +21,12 @@ Use this skill when:
 - The user asks "add X functionality" and you're about to write code
 - Before creating a new utility, helper, or abstraction
 
+## Scope and Approval Rules
+
+Default to read-only research: inspect the repo, package metadata, docs, and public examples before recommending a dependency or integration. Do not install packages, configure MCP servers, publish artifacts, open PRs, or make external write actions from this skill unless the user has explicitly approved that action in the current task.
+
+When a candidate requires credentials, paid services, network writes, or project-wide config changes, return a recommendation and approval checkpoint instead of applying it directly.
+
 ## Workflow
 
 ```
@@ -45,9 +51,9 @@ Use this skill when:
 │     │ as-is   │  │  /Wrap   │  │  Custom  │  │
 │     └─────────┘  └──────────┘  └─────────┘  │
 ├─────────────────────────────────────────────┤
-│  5. IMPLEMENT                               │
-│     Install package / Configure MCP /       │
-│     Write minimal custom code               │
+│  5. APPROVAL CHECKPOINT / IMPLEMENT         │
+│     Recommend package / MCP / custom code   │
+│     Apply only after explicit approval      │
 └─────────────────────────────────────────────┘
 ```
 
@@ -55,10 +61,10 @@ Use this skill when:
 
 | Signal | Action |
 |--------|--------|
-| Exact match, well-maintained, MIT/Apache | **Adopt** — install and use directly |
-| Partial match, good foundation | **Extend** — install + write thin wrapper |
-| Multiple weak matches | **Compose** — combine 2-3 small packages |
-| Nothing suitable found | **Build** — write custom, but informed by research |
+| Exact match, well-maintained, MIT/Apache | **Adopt** — recommend the package and request approval before install or config changes |
+| Partial match, good foundation | **Extend** — recommend the package plus a thin wrapper, then wait for approval before applying |
+| Multiple weak matches | **Compose** — propose 2-3 small packages and the integration plan before installing anything |
+| Nothing suitable found | **Build** — explain why custom code is warranted, then implement only within the approved task scope |
 
 ## How to Use
 
@@ -135,8 +141,8 @@ Combine for progressive discovery:
 Need: Check markdown files for broken links
 Search: npm "markdown dead link checker"
 Found: textlint-rule-no-dead-link (score: 9/10)
-Action: ADOPT — npm install textlint-rule-no-dead-link
-Result: Zero custom code, battle-tested solution
+Action: ADOPT — recommend `textlint-rule-no-dead-link` and ask before installing it
+Result: Zero custom code if approved, battle-tested solution
 ```
 
 ### Example 2: "Add HTTP client wrapper"
@@ -144,8 +150,8 @@ Result: Zero custom code, battle-tested solution
 Need: Resilient HTTP client with retries and timeout handling
 Search: npm "http client retry", PyPI "httpx retry"
 Found: got (Node) with retry plugin, httpx (Python) with built-in retry
-Action: ADOPT — use got/httpx directly with retry config
-Result: Zero custom code, production-proven libraries
+Action: ADOPT — recommend `got`/`httpx` directly with retry config and ask before changing dependencies
+Result: Zero custom code if approved, production-proven libraries
 ```
 
 ### Example 3: "Add config file linter"
@@ -153,8 +159,8 @@ Result: Zero custom code, production-proven libraries
 Need: Validate project config files against a schema
 Search: npm "config linter schema", "json schema validator cli"
 Found: ajv-cli (score: 8/10)
-Action: ADOPT + EXTEND — install ajv-cli, write project-specific schema
-Result: 1 package + 1 schema file, no custom validation logic
+Action: ADOPT + EXTEND — recommend `ajv-cli` plus a project-specific schema, then wait for approval before install/write
+Result: 1 package + 1 schema file if approved, no custom validation logic
 ```
 
 ## Anti-Patterns

.opencode/opencode.json

@@ -22,6 +22,11 @@
   "plugin": [
     "./plugins"
   ],
+  "skills": {
+    "paths": [
+      "../skills"
+    ]
+  },
   "agent": {
     "build": {
       "description": "Primary coding agent for development work",

.qwen/QWEN.md

@@ -0,0 +1,25 @@
+# Qwen CLI Configuration
+
+This directory contains ECC's Qwen CLI install template.
+
+## Runtime Location
+
+The source `.qwen/` directory in this repository is copied into a user's home-level `~/.qwen/` install root when running:
+
+```bash
+./install.sh --target qwen --profile minimal
+```
+
+The managed install also writes `~/.qwen/ecc-install-state.json` so future ECC updates and uninstalls can distinguish ECC-owned files from user-owned Qwen configuration.
+
+## Installed Surface
+
+The Qwen target installs the same managed manifest modules used by other harness adapters:
+
+- `rules/`
+- `agents/`
+- `commands/`
+- `skills/`
+- `mcp-configs/`
+
+Hook runtime files are intentionally not selected for Qwen until the Qwen hook/event contract is verified.

AGENTS.md

@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — Agent Instructions
 
-This is a **production-ready AI coding plugin** providing 48 specialized agents, 182 skills, 68 commands, and automated hook workflows for software development.
+This is a **production-ready AI coding plugin** providing 54 specialized agents, 204 skills, 69 commands, and automated hook workflows for software development.
 
 **Version:** 2.0.0-rc.1
 
@@ -41,6 +41,7 @@ This is a **production-ready AI coding plugin** providing 48 specialized agents,
 | rust-reviewer | Rust code review | Rust projects |
 | rust-build-resolver | Rust build errors | Rust build failures |
 | pytorch-build-resolver | PyTorch runtime/CUDA/training errors | PyTorch build/training failures |
+| mle-reviewer | Production ML pipeline review | ML pipelines, evals, serving, monitoring, rollback |
 | typescript-reviewer | TypeScript/JavaScript code review | TypeScript/JavaScript projects |
 
 ## Agent Orchestration
@@ -145,9 +146,9 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat
 ## Project Structure
 
 ```
-agents/          — 48 specialized subagents
-skills/          — 182 workflow skills and domain knowledge
-commands/        — 68 slash commands
+agents/          — 54 specialized subagents
+skills/          — 204 workflow skills and domain knowledge
+commands/        — 69 slash commands
 hooks/           — Trigger-based automations
 rules/           — Always-follow guidelines (common + per-language)
 scripts/         — Cross-platform Node.js utilities

CONTRIBUTING.md

@@ -167,6 +167,8 @@ Short version:
 - [ ] Tested with Claude Code
 - [ ] Links to related skills
 - [ ] No sensitive data (API keys, tokens, paths)
+- [ ] Frontmatter declares `name:` matching the directory name
+- [ ] Frontmatter `description:` is an inline string or folded (`>`) scalar — not a literal block (`|`, `|-`, or `|+`), which preserves internal newlines and breaks flat-table renderers
 
 ### Example Skills
 

README.md

@@ -1,4 +1,4 @@
-**Language:** English | [Português (Brasil)](docs/pt-BR/README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md) | [日本語](docs/ja-JP/README.md) | [한국어](docs/ko-KR/README.md) | [Türkçe](docs/tr/README.md)
+**Language:** English | [Português (Brasil)](docs/pt-BR/README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md) | [日本語](docs/ja-JP/README.md) | [한국어](docs/ko-KR/README.md) | [Türkçe](docs/tr/README.md) | [Русский](docs/ru/README.md)
 
 # Everything Claude Code
 
@@ -25,10 +25,10 @@
 
 <div align="center">
 
-**Language / 语言 / 語言 / Dil**
+**Language / 语言 / 語言 / Dil / Язык**
 
 [**English**](README.md) | [Português (Brasil)](docs/pt-BR/README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md) | [日本語](docs/ja-JP/README.md) | [한국어](docs/ko-KR/README.md)
- | [Türkçe](docs/tr/README.md)
+ | [Türkçe](docs/tr/README.md) | [Русский](docs/ru/README.md)
 
 </div>
 
@@ -89,11 +89,12 @@ This repo is the raw code only. The guides explain everything.
 ### v2.0.0-rc.1 — Surface Refresh, Operator Workflows, and ECC 2.0 Alpha (Apr 2026)
 
 - **Dashboard GUI** — New Tkinter-based desktop application (`ecc_dashboard.py` or `npm run dashboard`) with dark/light theme toggle, font customization, and project logo in header and taskbar.
-- **Public surface synced to the live repo** — metadata, catalog counts, plugin manifests, and install-facing docs now match the actual OSS surface: 48 agents, 182 skills, and 68 legacy command shims.
+- **Public surface synced to the live repo** — metadata, catalog counts, plugin manifests, and install-facing docs now match the actual OSS surface: 54 agents, 204 skills, and 69 legacy command shims.
 - **Operator and outbound workflow expansion** — `brand-voice`, `social-graph-ranker`, `connections-optimizer`, `customer-billing-ops`, `ecc-tools-cost-audit`, `google-workspace-ops`, `project-flow-ops`, and `workspace-surface-audit` round out the operator lane.
 - **Media and launch tooling** — `manim-video`, `remotion-video-creation`, and upgraded social publishing surfaces make technical explainers and launch content part of the same system.
 - **Framework and product surface growth** — `nestjs-patterns`, richer Codex/OpenCode install surfaces, and expanded cross-harness packaging keep the repo usable beyond Claude Code alone.
 - **ECC 2.0 alpha is in-tree** — the Rust control-plane prototype in `ecc2/` now builds locally and exposes `dashboard`, `start`, `sessions`, `status`, `stop`, `resume`, and `daemon` commands. It is usable as an alpha, not yet a general release.
+- **Operator status snapshots** — `ecc status --markdown --write status.md` turns the local state store into a portable handoff covering readiness, active sessions, skill-run health, install health, pending governance events, and linked work items from Linear/GitHub/handoffs. Use `ecc work-items upsert ...` for manual entries, `ecc work-items sync-github --repo owner/repo` for PR/issue queue state, and `ecc status --exit-code` to fail automation when readiness needs attention.
 - **Ecosystem hardening** — AgentShield, ECC Tools cost controls, billing portal work, and website refreshes continue to ship around the core plugin instead of drifting into separate silos.
 
 ### v1.9.0 — Selective Install & Language Expansion (Mar 2026)
@@ -207,6 +208,23 @@ Add hooks later only if you want runtime enforcement:
 ./install.sh --target claude --modules hooks-runtime
 ```
 
+### Find the right components first
+
+If you are not sure which ECC profile or component to install, ask the packaged advisor from any project:
+
+```bash
+npx ecc consult "security reviews" --target claude
+```
+
+It returns matching components, related profiles, and preview/install commands. Use the preview command before installing if you want to inspect the exact file plan.
+
+For production ML/MLOps workflows, keep the install opt-in and component-scoped:
+
+```bash
+npx ecc consult "mlops training model deployment" --target claude
+npx ecc install --profile minimal --target claude --with capability:machine-learning
+```
+
 ### Step 1: Install the Plugin (Recommended)
 
 > NOTE: The plugin is convenient, but the OSS installer below is still the most reliable path if your Claude Code build has trouble resolving self-hosted marketplace entries.
@@ -216,7 +234,7 @@ Add hooks later only if you want runtime enforcement:
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Install plugin
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
 ### Naming + Migration Note
@@ -224,18 +242,18 @@ Add hooks later only if you want runtime enforcement:
 ECC now has three public identifiers, and they are not interchangeable:
 
 - GitHub source repo: `affaan-m/everything-claude-code`
-- Claude marketplace/plugin identifier: `everything-claude-code@everything-claude-code`
+- Claude marketplace/plugin identifier: `ecc@ecc`
 - npm package: `ecc-universal`
 
-This is intentional. Anthropic marketplace/plugin installs are keyed by a canonical plugin identifier, so ECC standardized on `everything-claude-code@everything-claude-code` to keep the listing name, `/plugin install`, `/plugin list`, and repo docs aligned to one public install surface. Older posts may still show the old short-form nickname; that shorthand is deprecated. Separately, the npm package stayed on `ecc-universal`, so npm installs and marketplace installs intentionally use different names.
+This is intentional. Anthropic marketplace/plugin installs are keyed by a canonical plugin identifier, so ECC uses `ecc@ecc` to keep tool names and slash-command namespaces short enough for strict Desktop/API validators. Older posts may still show the former long marketplace identifier; treat that as a legacy alias only. Separately, the npm package stayed on `ecc-universal`, so npm installs and marketplace installs intentionally use different names.
 
-### Step 2: Install Rules (Required)
+### Step 2: Install Rules Only If You Need Them
 
 > WARNING: **Important:** Claude Code plugins cannot distribute `rules` automatically.
 >
 > If you already installed ECC via `/plugin install`, **do not run `./install.sh --profile full`, `.\install.ps1 --profile full`, or `npx ecc-install --profile full` afterward**. The plugin already loads ECC skills, commands, and hooks. Running the full installer after a plugin install copies those same surfaces into your user directories and can create duplicate skills plus duplicate runtime behavior.
 >
-> For plugin installs, manually copy only the `rules/` directories you want. Start with `rules/common` plus one language or framework pack you actually use. Do not copy every rules directory unless you explicitly want all of that context in Claude.
+> For plugin installs, manually copy only the `rules/` directories you want under `~/.claude/rules/ecc/`. Start with `rules/common` plus one language or framework pack you actually use. Do not copy every rules directory unless you explicitly want all of that context in Claude.
 >
 > Use the full installer only when you are doing a fully manual ECC install instead of the plugin path.
 >
@@ -249,10 +267,10 @@ cd everything-claude-code
 # Install dependencies (pick your package manager)
 npm install        # or: pnpm install | yarn install | bun install
 
-# Plugin install path: copy only rules
-mkdir -p ~/.claude/rules
-cp -R rules/common ~/.claude/rules/
-cp -R rules/typescript ~/.claude/rules/
+# Plugin install path: copy only ECC rules into an ECC-owned namespace
+mkdir -p ~/.claude/rules/ecc
+cp -R rules/common ~/.claude/rules/ecc/
+cp -R rules/typescript ~/.claude/rules/ecc/
 
 # Fully manual ECC install path (use this instead of /plugin install)
 # ./install.sh --profile full
@@ -261,10 +279,10 @@ cp -R rules/typescript ~/.claude/rules/
 ```powershell
 # Windows PowerShell
 
-# Plugin install path: copy only rules
-New-Item -ItemType Directory -Force -Path "$HOME/.claude/rules" | Out-Null
-Copy-Item -Recurse rules/common "$HOME/.claude/rules/"
-Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
+# Plugin install path: copy only ECC rules into an ECC-owned namespace
+New-Item -ItemType Directory -Force -Path "$HOME/.claude/rules/ecc" | Out-Null
+Copy-Item -Recurse rules/common "$HOME/.claude/rules/ecc/"
+Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/ecc/"
 
 # Fully manual ECC install path (use this instead of /plugin install)
 # .\install.ps1 --profile full
@@ -293,7 +311,7 @@ If you choose this path, stop there. Do not also run `/plugin install`.
 
 If ECC feels duplicated, intrusive, or broken, do not keep reinstalling it on top of itself.
 
-- **Plugin path:** remove the plugin from Claude Code, then delete the specific rule folders you manually copied under `~/.claude/rules/`.
+- **Plugin path:** remove the plugin from Claude Code, then delete the specific rule folders you manually copied under `~/.claude/rules/ecc/`.
 - **Manual installer / CLI path:** from the repo root, preview removal first:
 
 ```bash
@@ -330,17 +348,17 @@ If you stacked methods, clean up in this order:
 # Skills are the primary workflow surface.
 # Existing slash-style command names still work while ECC migrates off commands/.
 
-# Plugin install uses the namespaced form
+# Plugin install uses the canonical namespaced form
 /ecc:plan "Add user authentication"
 
 # Manual install keeps the shorter slash form:
 # /plan "Add user authentication"
 
 # Check available commands
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
-**That's it!** You now have access to 48 agents, 182 skills, and 68 legacy command shims.
+**That's it!** You now have access to 54 agents, 204 skills, and 69 legacy command shims.
 
 ### Dashboard GUI
 
@@ -418,6 +436,12 @@ export ECC_HOOK_PROFILE=standard
 
 # Comma-separated hook IDs to disable
 export ECC_DISABLED_HOOKS="pre:bash:tmux-reminder,post:edit:typecheck"
+
+# Cap SessionStart additional context (default: 8000 chars)
+export ECC_SESSION_START_MAX_CHARS=4000
+
+# Disable SessionStart additional context entirely for low-context/local-model setups
+export ECC_SESSION_START_CONTEXT=off
 ```
 
 ---
@@ -432,7 +456,7 @@ everything-claude-code/
 |   |-- plugin.json         # Plugin metadata and component paths
 |   |-- marketplace.json    # Marketplace catalog for /plugin marketplace add
 |
-|-- agents/           # 36 specialized subagents for delegation
+|-- agents/           # 54 specialized subagents for delegation
 |   |-- planner.md           # Feature implementation planning
 |   |-- architect.md         # System design decisions
 |   |-- tdd-guide.md         # Test-driven development
@@ -460,6 +484,7 @@ everything-claude-code/
 |   |-- rust-reviewer.md     # Rust code review
 |   |-- rust-build-resolver.md # Rust build error resolution
 |   |-- pytorch-build-resolver.md # PyTorch/CUDA training errors
+|   |-- mle-reviewer.md      # Production ML pipeline, eval, serving, and monitoring review
 |
 |-- skills/           # Workflow definitions and domain knowledge
 |   |-- coding-standards/           # Language best practices
@@ -521,6 +546,7 @@ everything-claude-code/
 |   |-- liquid-glass-design/         # iOS 26 Liquid Glass design system (NEW)
 |   |-- foundation-models-on-device/ # Apple on-device LLM with FoundationModels (NEW)
 |   |-- swift-concurrency-6-2/       # Swift 6.2 Approachable Concurrency (NEW)
+|   |-- mle-workflow/               # Production ML data contracts, evals, deployment, monitoring (NEW)
 |   |-- perl-patterns/             # Modern Perl 5.36+ idioms and best practices (NEW)
 |   |-- perl-security/             # Perl security patterns, taint mode, safe I/O (NEW)
 |   |-- perl-testing/              # Perl TDD with Test2::V0, prove, Devel::Cover (NEW)
@@ -564,7 +590,7 @@ everything-claude-code/
 |   |-- verify.md           # /verify - Prefer the verification-loop skill
 |   |-- orchestrate.md      # /orchestrate - Prefer dmux-workflows or multi-workflow
 |
-|-- rules/            # Always-follow guidelines (copy to ~/.claude/rules/)
+|-- rules/            # Always-follow guidelines (copy to ~/.claude/rules/ecc/)
 |   |-- README.md            # Structure overview and installation guide
 |   |-- common/              # Language-agnostic principles
 |   |   |-- coding-style.md    # Immutability, file organization
@@ -751,7 +777,7 @@ The easiest way to use this repo - install as a Claude Code plugin:
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Install the plugin
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
 Or add directly to your `~/.claude/settings.json`:
@@ -767,7 +793,7 @@ Or add directly to your `~/.claude/settings.json`:
     }
   },
   "enabledPlugins": {
-    "everything-claude-code@everything-claude-code": true
+    "ecc@ecc": true
   }
 }
 ```
@@ -781,17 +807,17 @@ This gives you instant access to all commands, agents, skills, and hooks.
 > git clone https://github.com/affaan-m/everything-claude-code.git
 >
 > # Option A: User-level rules (applies to all projects)
-> mkdir -p ~/.claude/rules
-> cp -r everything-claude-code/rules/common ~/.claude/rules/
-> cp -r everything-claude-code/rules/typescript ~/.claude/rules/   # pick your stack
-> cp -r everything-claude-code/rules/python ~/.claude/rules/
-> cp -r everything-claude-code/rules/golang ~/.claude/rules/
-> cp -r everything-claude-code/rules/php ~/.claude/rules/
+> mkdir -p ~/.claude/rules/ecc
+> cp -r everything-claude-code/rules/common ~/.claude/rules/ecc/
+> cp -r everything-claude-code/rules/typescript ~/.claude/rules/ecc/   # pick your stack
+> cp -r everything-claude-code/rules/python ~/.claude/rules/ecc/
+> cp -r everything-claude-code/rules/golang ~/.claude/rules/ecc/
+> cp -r everything-claude-code/rules/php ~/.claude/rules/ecc/
 >
 > # Option B: Project-level rules (applies to current project only)
-> mkdir -p .claude/rules
-> cp -r everything-claude-code/rules/common .claude/rules/
-> cp -r everything-claude-code/rules/typescript .claude/rules/     # pick your stack
+> mkdir -p .claude/rules/ecc
+> cp -r everything-claude-code/rules/common .claude/rules/ecc/
+> cp -r everything-claude-code/rules/typescript .claude/rules/ecc/     # pick your stack
 > ```
 
 ---
@@ -808,21 +834,22 @@ git clone https://github.com/affaan-m/everything-claude-code.git
 cp everything-claude-code/agents/*.md ~/.claude/agents/
 
 # Copy rules directories (common + language-specific)
-mkdir -p ~/.claude/rules
-cp -r everything-claude-code/rules/common ~/.claude/rules/
-cp -r everything-claude-code/rules/typescript ~/.claude/rules/   # pick your stack
-cp -r everything-claude-code/rules/python ~/.claude/rules/
-cp -r everything-claude-code/rules/golang ~/.claude/rules/
-cp -r everything-claude-code/rules/php ~/.claude/rules/
+mkdir -p ~/.claude/rules/ecc
+cp -r everything-claude-code/rules/common ~/.claude/rules/ecc/
+cp -r everything-claude-code/rules/typescript ~/.claude/rules/ecc/   # pick your stack
+cp -r everything-claude-code/rules/python ~/.claude/rules/ecc/
+cp -r everything-claude-code/rules/golang ~/.claude/rules/ecc/
+cp -r everything-claude-code/rules/php ~/.claude/rules/ecc/
 
 # Copy skills first (primary workflow surface)
 # Recommended (new users): core/general skills only
-cp -r everything-claude-code/.agents/skills/* ~/.claude/skills/
-cp -r everything-claude-code/skills/search-first ~/.claude/skills/
+mkdir -p ~/.claude/skills/ecc
+cp -r everything-claude-code/.agents/skills/* ~/.claude/skills/ecc/
+cp -r everything-claude-code/skills/search-first ~/.claude/skills/ecc/
 
 # Optional: add niche/framework-specific skills only when needed
 # for s in django-patterns django-tdd laravel-patterns springboot-patterns; do
-# cp -r everything-claude-code/skills/$s ~/.claude/skills/
+# cp -r everything-claude-code/skills/$s ~/.claude/skills/ecc/
 # done
 
 # Optional: keep maintained slash-command compatibility during migration
@@ -859,7 +886,9 @@ Windows note: the Claude config directory is `%USERPROFILE%\\.claude`, not `~/cl
 
 Claude plugin installs intentionally do not auto-enable ECC's bundled MCP server definitions. This avoids overlong plugin MCP tool names on strict third-party gateways while keeping manual MCP setup available.
 
-Copy desired MCP server definitions from `mcp-configs/mcp-servers.json` into your official Claude Code config in `~/.claude/settings.json`, or into a project-scoped `.mcp.json` if you want repo-local MCP access.
+Use Claude Code's `/mcp` command or CLI-managed MCP setup for live Claude Code server changes. Use `/mcp` for Claude Code runtime disables; Claude Code persists those choices in `~/.claude.json`.
+
+For repo-local MCP access, copy desired MCP server definitions from `mcp-configs/mcp-servers.json` into a project-scoped `.mcp.json`.
 
 If you already run your own copies of ECC-bundled MCPs, set:
 
@@ -867,7 +896,7 @@ If you already run your own copies of ECC-bundled MCPs, set:
 export ECC_DISABLED_MCPS="github,context7,exa,playwright,sequential-thinking,memory"
 ```
 
-ECC-managed install and Codex sync flows will skip or remove those bundled servers instead of re-adding duplicates.
+ECC-managed install and Codex sync flows will skip or remove those bundled servers instead of re-adding duplicates. `ECC_DISABLED_MCPS` is an ECC install/sync filter, not a live Claude Code toggle.
 
 **Important:** Replace `YOUR_*_HERE` placeholders with your actual API keys.
 
@@ -955,6 +984,7 @@ Not sure where to start? Use this quick reference. Skills are the canonical work
 | Review Python code | `/python-review` | python-reviewer |
 | Review TypeScript/JavaScript code | *(invoke `typescript-reviewer` directly)* | typescript-reviewer |
 | Audit database queries | *(auto-delegated)* | database-reviewer |
+| Review production ML changes | `mle-workflow` skill + `mle-reviewer` agent | mle-reviewer |
 
 ### Common Workflows
 
@@ -990,7 +1020,7 @@ e2e-testing skill                             → e2e-runner: critical user flow
 <summary><b>How do I check which agents/commands are installed?</b></summary>
 
 ```bash
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 This shows all available agents, commands, and skills from the plugin.
@@ -1030,15 +1060,9 @@ Official references:
 <details>
 <summary><b>My context window is shrinking / Claude is running out of context</b></summary>
 
-Too many MCP servers eat your context. Each MCP tool description consumes tokens from your 200k window, potentially reducing it to ~70k.
+Too many MCP servers eat your context. Each MCP tool description consumes tokens from your 200k window, potentially reducing it to ~70k. SessionStart context is capped at 8000 characters by default; lower it with `ECC_SESSION_START_MAX_CHARS=4000` or disable it with `ECC_SESSION_START_CONTEXT=off` for local-model or low-context setups.
 
-**Fix:** Disable unused MCPs per project:
-```json
-// In your project's .claude/settings.json
-{
-  "disabledMcpServers": ["supabase", "railway", "vercel"]
-}
-```
+**Fix:** Disable unused MCPs from Claude Code with `/mcp`. Claude Code writes those runtime choices to `~/.claude.json`; `.claude/settings.json` and `.claude/settings.local.json` are not reliable toggles for already-loaded MCP servers.
 
 Keep under 10 MCPs enabled and under 80 tools active.
 </details>
@@ -1053,8 +1077,8 @@ Yes. Use Option 2 (manual installation) and copy only what you need:
 cp everything-claude-code/agents/*.md ~/.claude/agents/
 
 # Just rules
-mkdir -p ~/.claude/rules/
-cp -r everything-claude-code/rules/common ~/.claude/rules/
+mkdir -p ~/.claude/rules/ecc/
+cp -r everything-claude-code/rules/common ~/.claude/rules/ecc/
 ```
 
 Each component is fully independent.
@@ -1069,6 +1093,8 @@ Yes. ECC is cross-platform:
 - **OpenCode**: Full plugin support in `.opencode/`. See [OpenCode Support](#opencode-support).
 - **Codex**: First-class support for both macOS app and CLI, with adapter drift guards and SessionStart fallback. See PR [#257](https://github.com/affaan-m/everything-claude-code/pull/257).
 - **Antigravity**: Tightly integrated setup for workflows, skills, and flattened rules in `.agent/`. See [Antigravity Guide](docs/ANTIGRAVITY-GUIDE.md).
+- **JoyCode / CodeBuddy**: Project-local selective install adapters for commands, agents, skills, and flattened rules. See [JoyCode Adapter Guide](docs/JOYCODE-GUIDE.md).
+- **Qwen CLI**: Home-directory selective install adapter for commands, agents, skills, rules, and Qwen config. See [Qwen CLI Adapter Guide](docs/QWEN-GUIDE.md).
 - **Non-native harnesses**: Manual fallback path for Grok and similar interfaces. See [Manual Adaptation Guide](docs/MANUAL-ADAPTATION-GUIDE.md).
 - **Claude Code**: Native — this is the primary target.
 </details>
@@ -1133,7 +1159,7 @@ These are not bundled with ECC and are not audited by this repo, but they are wo
 
 ## Cursor IDE Support
 
-ECC provides **full Cursor IDE support** with hooks, rules, agents, skills, commands, and MCP configs adapted for Cursor's native format.
+ECC provides Cursor IDE support with hooks, rules, agents, skills, commands, and MCP configs adapted for Cursor's project layout.
 
 ### Quick Start (Cursor)
 
@@ -1156,11 +1182,17 @@ ECC provides **full Cursor IDE support** with hooks, rules, agents, skills, comm
 | Hook Events | 15 | sessionStart, beforeShellExecution, afterFileEdit, beforeMCPExecution, beforeSubmitPrompt, and 10 more |
 | Hook Scripts | 16 | Thin Node.js scripts delegating to `scripts/hooks/` via shared adapter |
 | Rules | 34 | 9 common (alwaysApply) + 25 language-specific (TypeScript, Python, Go, Swift, PHP) |
-| Agents | Shared | Via AGENTS.md at root (read by Cursor natively) |
-| Skills | Shared + Bundled | Via AGENTS.md at root and `.cursor/skills/` for translated additions |
+| Agents | 48 | `.cursor/agents/ecc-*.md` when installed; prefixed to avoid collisions with user or marketplace agents |
+| Skills | Shared + Bundled | `.cursor/skills/` for translated additions |
 | Commands | Shared | `.cursor/commands/` if installed |
 | MCP Config | Shared | `.cursor/mcp.json` if installed |
 
+### Cursor Loading Notes
+
+ECC does not install root `AGENTS.md` into `.cursor/`. Cursor treats nested `AGENTS.md` files as directory context, so copying ECC's repo identity into a host project would pollute that project.
+
+Cursor-native loading behavior can vary by Cursor build. ECC installs agents as `.cursor/agents/ecc-*.md`; if your Cursor build does not expose project agents, those files still work as explicit reference definitions instead of hidden global prompt context.
+
 ### Hook Architecture (DRY Adapter Pattern)
 
 Cursor has **more hook events than Claude Code** (20 vs 8). The `.cursor/hooks/adapter.js` module transforms Cursor's stdin JSON to Claude Code's format, allowing existing `scripts/hooks/*.js` to be reused without duplication.
@@ -1317,9 +1349,9 @@ The configuration is automatically detected from `.opencode/opencode.json`.
 
 | Feature | Claude Code | OpenCode | Status |
 |---------|-------------|----------|--------|
-| Agents | PASS: 48 agents | PASS: 12 agents | **Claude Code leads** |
-| Commands | PASS: 68 commands | PASS: 31 commands | **Claude Code leads** |
-| Skills | PASS: 182 skills | PASS: 37 skills | **Claude Code leads** |
+| Agents | PASS: 54 agents | PASS: 12 agents | **Claude Code leads** |
+| Commands | PASS: 69 commands | PASS: 31 commands | **Claude Code leads** |
+| Skills | PASS: 204 skills | PASS: 37 skills | **Claude Code leads** |
 | Hooks | PASS: 8 event types | PASS: 11 events | **OpenCode has more!** |
 | Rules | PASS: 29 rules | PASS: 13 instructions | **Claude Code leads** |
 | MCP Servers | PASS: 14 servers | PASS: Full | **Full parity** |
@@ -1422,9 +1454,9 @@ ECC is the **first plugin to maximize every major AI coding tool**. Here's how e
 
 | Feature | Claude Code | Cursor IDE | Codex CLI | OpenCode |
 |---------|------------|------------|-----------|----------|
-| **Agents** | 48 | Shared (AGENTS.md) | Shared (AGENTS.md) | 12 |
-| **Commands** | 68 | Shared | Instruction-based | 31 |
-| **Skills** | 182 | Shared | 10 (native format) | 37 |
+| **Agents** | 54 | Shared (AGENTS.md) | Shared (AGENTS.md) | 12 |
+| **Commands** | 69 | Shared | Instruction-based | 31 |
+| **Skills** | 204 | Shared | 10 (native format) | 37 |
 | **Hook Events** | 8 types | 15 types | None yet | 11 types |
 | **Hook Scripts** | 20+ scripts | 16 scripts (DRY adapter) | N/A | Plugin hooks |
 | **Rules** | 34 (common + lang) | 34 (YAML frontmatter) | Instruction-based | 13 instructions |
@@ -1510,7 +1542,8 @@ The `strategic-compact` skill (included in this plugin) suggests `/compact` at l
 
 - Keep under 10 MCPs enabled per project
 - Keep under 80 tools active
-- Use `disabledMcpServers` in project config to disable unused ones
+- Use `/mcp` to disable unused Claude Code MCP servers; those runtime choices persist in `~/.claude.json`
+- Use `ECC_DISABLED_MCPS` only to filter ECC-generated MCP configs during install/sync flows
 
 ### Agent Teams Cost Warning
 

README.zh-CN.md

@@ -102,12 +102,12 @@
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # 安装插件
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
-> 安装名称说明：较早的帖子里可能还会出现旧的短别名。那个旧缩写现在已经废弃。Anthropic 的 marketplace/plugin 安装是按规范化插件标识符寻址的，因此 ECC 统一为 `everything-claude-code@everything-claude-code`，这样市场条目、安装命令、`/plugin list` 输出和仓库文档都使用同一个公开名称，不再出现两个名字指向同一插件的混乱。
+> 安装名称说明：较早的帖子里可能还会出现较长的旧标识符。Anthropic 的 marketplace/plugin 安装是按规范化插件标识符寻址的，因此 ECC 现在统一为 `ecc@ecc`，让工具名和 slash command 命名空间保持简短。
 
-### 第二步：安装规则（必需）
+### 第二步：仅在需要时安装规则
 
 > WARNING: **重要提示：** Claude Code 插件无法自动分发 `rules`。
 >
@@ -157,10 +157,10 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 # /plan "添加用户认证"
 
 # 查看可用命令
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
-**完成！** 你现在可以使用 48 个代理、182 个技能和 68 个命令。
+**完成！** 你现在可以使用 54 个代理、204 个技能和 69 个命令。
 
 ### multi-* 命令需要额外配置
 
@@ -546,7 +546,7 @@ Claude Code v2.1+ 会**按照约定自动加载**已安装插件中的 `hooks/ho
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # 安装插件
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
 或直接添加到你的 `~/.claude/settings.json`：
@@ -562,7 +562,7 @@ Claude Code v2.1+ 会**按照约定自动加载**已安装插件中的 `hooks/ho
     }
   },
   "enabledPlugins": {
-    "everything-claude-code@everything-claude-code": true
+    "ecc@ecc": true
   }
 }
 ```

SECURITY.md

@@ -45,6 +45,53 @@ This policy covers:
 - MCP configurations shipped with ECC
 - The AgentShield security scanner ([github.com/affaan-m/agentshield](https://github.com/affaan-m/agentshield))
 
+## Operational Guidance
+
+### Secrets Handling
+
+`mcp-configs/mcp-servers.json` is a **template**. All `YOUR_*_HERE` values must be replaced at install time from env-vars or a secrets manager. Never commit real credentials. If a secret is accidentally committed, rotate it immediately and rewrite history; do not rely on a plain revert.
+
+The same rule applies to your user-scope Claude Code config (`~/.claude/settings.json` or `%USERPROFILE%\.claude\settings.json`). That file is outside this repository, but it is commonly shared via `claude doctor` output, screenshots, or bug reports. Do not hardcode PATs, API keys, or OAuth tokens into its `mcpServers[*].env` blocks; resolve them at spawn time from the OS keychain or env-vars your MCP server already supports. A quick audit:
+
+```bash
+# macOS / Linux
+grep -EnH '(TOKEN|SECRET|KEY|PASSWORD)\s*"\s*:\s*"[A-Za-z0-9_-]{16,}"' ~/.claude/settings.json
+# Windows PowerShell
+Select-String -Path "$env:USERPROFILE\.claude\settings.json" -Pattern '(TOKEN|SECRET|KEY|PASSWORD)"\s*:\s*"[A-Za-z0-9_-]{16,}"'
+```
+
+If the audit matches, rotate the secret at the issuing provider, then move it out of the file (per-provider env-var or `credentialHelper` for servers that support it).
+
+### Local MCP Ports
+
+Some bundled MCP servers connect over plain HTTP to a localhost port (e.g. `devfleet` to `http://localhost:18801/mcp`). Before first use, verify the listening process:
+
+```bash
+# Windows
+netstat -ano | findstr :18801
+# macOS / Linux
+lsof -iTCP:18801 -sTCP:LISTEN
+```
+
+Compare the PID against the expected devfleet binary. Any other process on that port can intercept MCP traffic.
+
+## Triage: suspicious `<system-reminder>` blocks
+
+ECC runs inside Claude Code, which injects **ephemeral client-side system reminders** into the model's input on every turn (TodoWrite nudges, date-changed notices, file-modified notices, etc.). These blocks:
+
+- typically end with phrasing like *"ignore if not applicable"* or *"NEVER mention this reminder to the user"* / *"Don't tell the user this, since they are already aware"*; that wording is Anthropic's own prompt, not a malicious tail;
+- are added by the CLI per turn and are **not persisted** in the session transcript at `~/.claude/projects/<slug>/<sessionId>.jsonl`.
+
+That combination makes them easy to mistake for a prompt-injection appended to a tool result. Before treating one as an attack, verify:
+
+1. Is the block actually in a file under this repo? `grep -rEn "system-reminder|NEVER mention|DO NOT mention" .`; if nothing, it is not carried by the repo.
+2. Is the block stored in the transcript? Inspect the current session's `.jsonl`; if the exact text does not appear inside a `tool_result` body there, it is a client-injected ephemeral reminder, not a payload from any tool.
+3. Is the content contextually consistent with Anthropic's known reminders (TodoWrite nudge, date-changed, file-modified notice)? If yes, it is the ephemeral-reminder mechanism and no action is needed.
+
+Escalate to Anthropic only if a block is **both** (a) present in the transcript inside a `tool_result` **and** (b) not attributable to the file or URL that was actually read. Minimal report: a fresh session, a read of a clean local file, the exact text observed, and the transcript excerpt. Send to <https://github.com/anthropics/claude-code/issues> (non-sensitive) or <mailto:security@anthropic.com> (embargo-class).
+
+Do not sanitize repo files in response to ephemeral reminders; they are not the carrier.
+
 ## Security Resources
 
 - **AgentShield**: Scan your agent config for vulnerabilities — `npx ecc-agentshield scan`

agent.yaml

@@ -152,6 +152,7 @@ commands:
   - cpp-review
   - cpp-test
   - evolve
+  - fastapi-review
   - feature-dev
   - flutter-build
   - flutter-review

agents/a11y-architect.md

@@ -3,7 +3,6 @@ name: a11y-architect
 description: Accessibility Architect specializing in WCAG 2.2 compliance for Web and Native platforms. Use PROACTIVELY when designing UI components, establishing design systems, or auditing code for inclusive user experiences.
 model: sonnet
 tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
-model: opus
 ---
 
 You are a Senior Accessibility Architect. Your goal is to ensure that every digital product is Perceivable, Operable, Understandable, and Robust (POUR) for all users, including those with visual, auditory, motor, or cognitive disabilities.

agents/fastapi-reviewer.md

@@ -0,0 +1,70 @@
+---
+name: fastapi-reviewer
+description: Reviews FastAPI applications for async correctness, dependency injection, Pydantic schemas, security, OpenAPI quality, testing, and production readiness.
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+You are a senior FastAPI reviewer focused on production Python APIs.
+
+## Review Scope
+
+- FastAPI app construction, routing, middleware, and exception handling.
+- Pydantic request, update, and response models.
+- Async database and HTTP patterns.
+- Dependency injection for database sessions, auth, pagination, and settings.
+- Authentication, authorization, CORS, rate limits, logging, and secret handling.
+- Test dependency overrides and client setup.
+- OpenAPI metadata and generated docs.
+
+## Out of Scope
+
+- Non-FastAPI frameworks unless they directly interact with the FastAPI app.
+- Broad Python style review already covered by `python-reviewer`.
+- Dependency additions without a concrete problem and maintenance rationale.
+
+## Review Workflow
+
+1. Locate the app entry point, usually `main.py`, `app.py`, or `app/main.py`.
+2. Identify routers, schemas, dependencies, database session setup, and tests.
+3. Run available local checks when safe, such as `pytest`, `ruff`, `mypy`, or `uv run pytest`.
+4. Review the changed files first, then inspect adjacent definitions needed to prove findings.
+5. Report only actionable issues with file and line references when available.
+
+## Finding Priorities
+
+### Critical
+
+- Hardcoded secrets or tokens.
+- SQL built through string interpolation.
+- Passwords, token hashes, or internal auth fields exposed in response models.
+- Auth dependencies that can be bypassed or do not validate expiry/signature.
+
+### High
+
+- Blocking database or HTTP clients inside async routes.
+- Database sessions created inline in handlers instead of dependencies.
+- Test overrides targeting the wrong dependency.
+- `allow_origins=["*"]` combined with credentialed CORS.
+- Missing request validation for write endpoints.
+
+### Medium
+
+- Missing pagination on list endpoints.
+- OpenAPI docs missing response models or error response descriptions.
+- Duplicated route logic that should move into a service/dependency.
+- Missing timeout settings for external HTTP clients.
+
+## Output Format
+
+```text
+[SEVERITY] Short issue title
+File: path/to/file.py:42
+Issue: What is wrong and why it matters.
+Fix: Concrete change to make.
+```
+
+End with:
+
+- `Tests checked:` commands run or why they were skipped.
+- `Residual risk:` anything important that could not be verified.

agents/mle-reviewer.md

@@ -0,0 +1,153 @@
+---
+name: mle-reviewer
+description: Production machine-learning engineering reviewer for data contracts, feature pipelines, training reproducibility, offline/online evaluation, model serving, monitoring, and rollback. Use when ML, MLOps, model training, inference, feature store, or evaluation code changes.
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+# MLE Reviewer
+
+You are a senior machine-learning engineering reviewer focused on moving model code from "works in a notebook" to production-safe ML systems. Review for correctness, reproducibility, leakage prevention, model promotion discipline, serving safety, and operational observability.
+
+## Start Here
+
+1. Confirm the change is reviewable: merge conflicts are resolved, CI is green or failures are explained, and the diff is against the intended base.
+2. Inspect recent changes: `git diff --stat` and `git diff -- '*.py' '*.sql' '*.yaml' '*.yml' '*.json' '*.toml' '*.ipynb'`.
+3. Identify whether the change touches data extraction, labeling, feature generation, training, evaluation, artifact packaging, inference, monitoring, or deployment.
+4. Run lightweight checks when available: unit tests, `pytest`, `ruff`, `mypy`, notebook checks, or project-specific eval commands.
+5. Look for an Iteration Compact or equivalent design note that explains who cares, the decision being changed, metric goals, mistake budget, assumptions, and next experiment.
+6. Review the changed files against the production ML checklist below.
+
+Do not rewrite the system unless asked. Report concrete findings with file and line references, ordered by severity.
+
+## Reuse Existing Review Lanes
+
+MLE review should compose existing SWE review surfaces instead of replacing them:
+
+- Use `python-reviewer` for Python style, typing, error handling, dependency hygiene, and unsafe deserialization.
+- Use `pytorch-build-resolver` when tensor shape, device placement, gradient, CUDA, DataLoader, or AMP failures block training/inference.
+- Use `database-reviewer` for feature tables, label stores, prediction logs, experiment metrics, and point-in-time query performance.
+- Use `security-reviewer` for secrets, PII, prompt/data leakage, artifact integrity, unsafe pickle/joblib loading, and supply-chain risk.
+- Use `performance-optimizer` for latency, memory, batching, GPU utilization, cold start, and cost per prediction.
+- Use `build-error-resolver` for CI, dependency, native extension, CUDA, and environment-specific failures outside PyTorch itself.
+- Use `pr-test-analyzer` when the change claims coverage but does not prove leakage, schema drift, serving fallback, or promotion-gate behavior.
+- Use `silent-failure-hunter` when pipelines can appear green while skipping data, labels, eval slices, alerts, or artifact publication.
+- Use `e2e-runner` for product flows where predictions affect user-visible or business-critical behavior.
+- Use `a11y-architect` when prediction explanations, confidence states, or fallback UI need to be accessible.
+- Use `doc-updater` when new model contracts, promotion gates, dashboards, or rollback runbooks need durable project documentation.
+- Use `documentation-lookup` before relying on evolving ML serving, vector DB, feature store, or eval-framework APIs.
+
+## Critical Review Areas
+
+### Problem Framing and Decision Quality
+
+- The change starts from a user or system decision, not from model architecture preference.
+- Stakeholders and failure costs are explicit: false positives, false negatives, latency, compute spend, opacity, and missed opportunities.
+- Metric choices follow the mistake budget instead of relying on generic accuracy.
+- Assumptions, constraints, and missing requirements are visible enough to challenge.
+- The proposed change is the simplest plausible experiment that addresses the dominant error mode.
+- Prior art or a nearby known problem was checked before introducing a bespoke approach.
+- Adversarial behavior, incentives, selective disclosure, distribution shift, and feedback loops were considered when relevant.
+
+### Metrics, Thresholds, and Error Analysis
+
+- Baseline and current production behavior are compared before model complexity increases.
+- Precision, recall, F1, AUC, calibration, latency, cost, and group/slice metrics are used only when they match the decision context.
+- Thresholds and configs are treated as product decisions with explicit tradeoffs, not magic constants.
+- False positives and false negatives are inspected directly and clustered by shared traits.
+- Important mistakes are traced to label quality, missing signal, threshold/config choice, product ambiguity, data bug, or serving mismatch.
+- Lessons from errors become regression tests, eval slices, dashboard panels, or runbook entries.
+
+### Data Contract and Leakage
+
+- Entity grain, primary key, label timestamp, feature timestamp, and snapshot/version are explicit.
+- Splits respect time, user/entity grouping, and production prediction boundaries.
+- Feature joins are point-in-time correct and do not use future labels, post-outcome fields, or mutable aggregates.
+- Missing values, units, ranges, categorical domains, and schema drift are validated before training and serving.
+- PII and sensitive attributes are excluded or justified, with retention and logging controls.
+
+### Training Reproducibility
+
+- Training is runnable from code, config, dataset version, and seed without notebook state.
+- Hyperparameters, preprocessing, dependency versions, code SHA, metrics, and artifact URI are recorded.
+- Randomness and GPU nondeterminism are handled deliberately.
+- Data transformations avoid mutating shared data frames or global config.
+- Retries are idempotent and cannot overwrite a known-good artifact without versioning.
+
+### Evaluation and Promotion
+
+- Metrics compare against a baseline and current production model.
+- Promotion gates are declared before selection and fail closed.
+- Slice metrics cover important cohorts, traffic sources, geographies, devices, languages, and sparse segments.
+- Calibration, latency, cost, fairness, and business guardrails are included when relevant.
+- Test data is not repeatedly tuned against.
+- Regression tests cover known model, data, and serving failure modes.
+
+### Serving and Deployment
+
+- Training and serving transformations are shared or equivalence-tested.
+- Input schema rejects stale, missing, invalid, and out-of-range features.
+- Output schema includes model version and confidence or calibration fields when useful.
+- Inference path has timeouts, resource limits, batching behavior, and fallback logic.
+- Artifact packaging includes preprocessing, config, version, dataset reference, and dependency constraints.
+- Rollout plan supports shadow traffic, canary, A/B test, or immediate rollback as appropriate.
+
+### Monitoring and Incident Response
+
+- Monitoring covers service health, feature drift, prediction drift, label arrival, delayed quality, and business guardrails.
+- Logs include enough identifiers to join predictions to delayed labels without leaking sensitive data.
+- Alerts have thresholds and owners.
+- Rollback names the previous artifact, config, data dependency, and traffic switch.
+- On-call runbooks include common failure modes: stale features, missing labels, model server overload, schema drift, and bad artifact promotion.
+
+## Common Blockers
+
+- Random train/test split on time-dependent or user-dependent data.
+- Feature generation uses fields that are unavailable at prediction time.
+- Offline metric improves while key slices regress.
+- Training preprocessing was copied into serving code manually.
+- Model version is absent from prediction logs.
+- Promotion depends on a notebook, manual chart, or local file.
+- Monitoring only checks uptime, not data or prediction quality.
+- Rollback requires retraining.
+- Secrets, credentials, or PII appear in datasets, notebooks, logs, prompts, or artifacts.
+
+## Diagnostic Commands
+
+Use what exists in the project. Do not install new packages without approval.
+
+```bash
+pytest
+ruff check .
+mypy .
+python -m pytest tests/ -k "model or feature or eval or inference"
+git grep -nE "train_test_split|random_split|fit_transform|predict_proba|model_version|feature_store|artifact"
+git grep -nE "customer_id|email|phone|ssn|api_key|secret|token" -- '*.py' '*.sql' '*.ipynb'
+```
+
+For notebooks, inspect executed outputs and hidden state. Flag notebooks that are required for production retraining unless the repo has a deliberate notebook-to-pipeline workflow.
+
+## Output Format
+
+```text
+[SEVERITY] Issue title
+File: path/to/file.py:42
+Issue: What is wrong and why it matters for production ML
+Fix: Concrete correction or gate to add
+```
+
+End with:
+
+```text
+Decision: APPROVE | APPROVE WITH WARNINGS | BLOCK
+Primary risks: data leakage | irreproducible training | weak eval | unsafe serving | missing monitoring | other
+Tests run: commands and outcomes
+```
+
+## Approval Criteria
+
+- **APPROVE**: No critical/high MLE risks and relevant tests or eval gates pass.
+- **APPROVE WITH WARNINGS**: Medium issues only, with explicit follow-up.
+- **BLOCK**: Any plausible leakage, irreproducible promotion, unsafe serving behavior, missing rollback for production deployment, sensitive data exposure, or critical eval gap.
+
+Reference skill: `mle-workflow`.

agents/network-config-reviewer.md

@@ -0,0 +1,97 @@
+---
+name: network-config-reviewer
+description: Reviews router and switch configurations for security, correctness, stale references, risky change-window commands, and missing operational guardrails.
+tools: ["Read", "Grep"]
+model: sonnet
+---
+
+You are a senior network configuration reviewer. You audit proposed or existing
+router and switch configuration and return prioritized findings with evidence.
+
+## Scope
+
+- Cisco IOS and IOS-XE style running configuration.
+- Interface, VLAN, ACL, VTY, AAA, SNMP, NTP, logging, routing, and banner blocks.
+- Proposed change snippets that will be pasted into a change window.
+- Read-only review only. Do not apply configuration or suggest live testing that
+  removes protections.
+
+## Review Workflow
+
+1. Identify the device role, platform, and change intent if they are present.
+2. Parse configuration sections: interfaces, routing, ACLs, line vty, AAA, SNMP,
+   logging, NTP, and banners.
+3. Check the proposed change first, then adjacent existing config needed to prove
+   a finding.
+4. Report only findings with enough evidence to act on.
+5. Separate hard blockers from best-practice improvements.
+
+## Severity Guide
+
+### Critical
+
+- Plaintext or default credentials.
+- `snmp-server community public` or `private`, especially with write access.
+- Telnet-only management or internet-facing VTY access with no source restriction.
+- Proposed destructive commands such as `reload`, `erase`, `format`, broad
+  `no interface`, or removing an entire routing process without rollback context.
+
+### High
+
+- SSH v1, weak enable password usage, missing AAA where the environment expects it.
+- ACLs referenced by interfaces or routing policy but not defined.
+- Route-maps, prefix-lists, or community-lists referenced by BGP but not defined.
+- Subnet overlaps or duplicate interface IPs.
+
+### Medium
+
+- No NTP, timestamps, remote logging, or saved rollback evidence.
+- Management-plane access not limited to a management subnet.
+- Missing descriptions on important uplinks, trunks, or routed links.
+
+### Low
+
+- Naming, comment, and documentation cleanup.
+- Suggested monitoring additions that are not required for the change to be safe.
+
+## Output Format
+
+```text
+## Network Configuration Review: <hostname or unknown device>
+
+### Critical
+[CRITICAL-1] <finding>
+File/section: <line or block>
+Evidence: <specific config snippet or command>
+Risk: <what can break or be exposed>
+Fix: <safe remediation or change-window prerequisite>
+
+### High
+...
+
+### Summary
+| Severity | Count |
+| --- | ---: |
+| Critical | 0 |
+| High | 0 |
+| Medium | 0 |
+| Low | 0 |
+
+Verdict: PASS | WARNING | BLOCK
+Tests checked: <what was inspected>
+Residual risk: <what could not be verified>
+```
+
+Use `BLOCK` for any Critical finding or proposed destructive change without a
+rollback plan. Use `WARNING` for High or Medium findings that do not block a
+maintenance window by themselves. Use `PASS` only when no actionable findings are
+present.
+
+## Safety Rules
+
+- Do not recommend removing ACLs, disabling firewall rules, or opening VTY access
+  as a diagnostic shortcut.
+- Prefer read-only confirmation commands such as `show running-config`,
+  `show ip access-lists`, `show ip route`, `show logging`, and `show interfaces`.
+- If a command changes device state, label it as a proposed fix and require a
+  maintenance window, rollback plan, and verification step.

agents/network-troubleshooter.md

@@ -0,0 +1,119 @@
+---
+name: network-troubleshooter
+description: Diagnoses network connectivity, routing, DNS, interface, and policy symptoms with a read-only OSI-layer workflow and evidence-backed root cause summary.
+tools: ["Read", "Bash", "Grep"]
+model: sonnet
+---
+
+You are a senior network troubleshooting agent. You diagnose symptoms
+systematically and produce a concise root cause summary with evidence.
+
+## Scope
+
+- Connectivity, packet loss, slow links, DNS failures, route reachability, BGP
+  neighbor state, VLAN reachability, and ACL/firewall symptoms.
+- Router, switch, Linux host, and homelab environments.
+- Read-only diagnosis. Do not apply configuration changes while diagnosing.
+
+## Workflow
+
+1. Characterize the symptom.
+   - What fails?
+   - Who is affected?
+   - When did it start?
+   - What changed recently?
+2. Pick the starting layer, then work downward or upward as evidence requires.
+3. Ask for missing command output only when it changes the diagnosis.
+4. Confirm that the suspected cause explains all observed symptoms.
+5. End with a root cause summary and verification plan.
+
+## Layer Checks
+
+### Layer 1 and 2
+
+Use for link-down, packet loss, CRCs, drops, and VLAN mismatch symptoms.
+
+```text
+show interfaces <interface> status
+show interfaces <interface>
+show vlan brief
+show spanning-tree vlan <id>
+```
+
+Look for down/down state, CRC counters increasing, duplex mismatch, wrong access
+VLAN, blocked spanning-tree state, or trunk VLANs missing from the allowed list.
+
+### Layer 3
+
+Use for gateway, routing, and reachability symptoms.
+
+```text
+show ip interface brief
+show ip route <destination>
+ping <destination> source <interface-or-ip>
+traceroute <destination> source <interface-or-ip>
+```
+
+Look for missing connected routes, wrong next hop, asymmetric routing, stale static
+routes, or a default route that points to the wrong upstream.
+
+### DNS
+
+Use when IP connectivity works but names fail.
+
+```text
+dig @<local-dns> <name>
+dig @<known-good-resolver> <name>
+nslookup <name> <local-dns>
+```
+
+If public DNS works but local DNS fails, focus on the resolver, DHCP DNS option,
+firewall rules to UDP/TCP 53, or local zones.
+
+### Policy And Firewall
+
+Use read-only counters and logs. Do not remove policy to test.
+
+```text
+show ip access-lists <name>
+show running-config interface <interface>
+show logging | include <interface>|ACL|DENY|DROP
+```
+
+If a deny counter increments for the failing flow, propose a narrow allow rule and
+verification step instead of disabling the ACL.
+
+## Output Format
+
+```text
+## Diagnosis: <one-line likely root cause>
+
+Symptom: <reported failure>
+Affected scope: <host, VLAN, subnet, site, or unknown>
+Layer: <where the fault was found>
+
+Evidence:
+- `<command>` -> <what it proved>
+- `<command>` -> <what it ruled out>
+
+Root cause:
+<specific explanation>
+
+Recommended fix:
+1. <safe action or config change to schedule>
+2. <rollback or maintenance note if relevant>
+
+Verification:
+- `<command>` should show <expected result>
+
+Residual risk:
+<what still needs device access, logs, or timing evidence>
+```
+
+## Guardrails
+
+- Prefer evidence over guesses.
+- Never recommend temporarily removing ACLs, firewall rules, authentication, or
+  management-plane restrictions.
+- If a live command changes state, label it clearly as a remediation step, not a
+  diagnostic command.

agents/swift-build-resolver.md

@@ -0,0 +1,161 @@
+---
+name: swift-build-resolver
+description: Swift/Xcode build, compilation, and dependency error resolution specialist. Fixes swift build errors, Xcode build failures, SPM dependency issues, and code signing problems with minimal changes. Use when Swift builds fail.
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: sonnet
+---
+
+# Swift Build Error Resolver
+
+You are an expert Swift build error resolution specialist. Your mission is to fix Swift compilation errors, Xcode build failures, and dependency problems with **minimal, surgical changes**.
+
+## Core Responsibilities
+
+1. Diagnose `swift build` / `xcodebuild` errors
+2. Fix type checker and protocol conformance errors
+3. Resolve Swift Concurrency and `Sendable` issues
+4. Handle SPM dependency and version resolution failures
+5. Fix Xcode project configuration and code signing issues
+
+## Diagnostic Commands
+
+Run these in order:
+
+```bash
+swift build 2>&1
+if command -v swiftlint >/dev/null 2>&1; then swiftlint lint --quiet 2>&1; else echo "[info] swiftlint not installed - skipping lint"; fi
+swift package resolve 2>&1
+swift package show-dependencies 2>&1
+swift test 2>&1
+```
+
+For Xcode projects:
+
+```bash
+xcodebuild -list 2>&1
+xcrun simctl list devices available 2>&1 | head -20   # find an available simulator
+xcodebuild -scheme <Scheme> -destination 'generic/platform=iOS Simulator' build 2>&1 | tail -50
+xcodebuild -showBuildSettings 2>&1 | grep -E 'SWIFT_VERSION|CODE_SIGN|PRODUCT_BUNDLE_IDENTIFIER'
+```
+
+## Resolution Workflow
+
+```text
+1. swift build           -> Parse error message and error code
+2. Read affected file    -> Understand type and protocol context
+3. Apply minimal fix     -> Only what's needed
+4. swift build           -> Verify fix
+5. swiftlint lint        -> Check for warnings (if swiftlint is installed)
+6. swift test            -> Ensure nothing broke
+```
+
+## Common Fix Patterns
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `cannot find type 'X' in scope` | Missing import or typo | Add `import Module` or fix name |
+| `value of type 'X' has no member 'Y'` | Wrong type or missing extension | Fix type or add missing method |
+| `cannot convert value of type 'X' to expected type 'Y'` | Type mismatch | Add conversion, cast, or fix type annotation |
+| `type 'X' does not conform to protocol 'Y'` | Missing required members | Implement missing protocol requirements |
+| `missing return in closure expected to return 'X'` | Incomplete closure body | Add explicit return statement |
+| `expression is 'async' but is not marked with 'await'` | Missing `await` | Add `await` keyword |
+| `non-sendable type 'X' passed in implicitly asynchronous call` | Sendable violation | Add `Sendable` conformance or restructure |
+| `actor-isolated property cannot be referenced from non-isolated context` | Actor isolation mismatch | Add `await`, mark caller as `async`, or use `nonisolated` |
+| `reference to captured var 'X' in concurrently-executing code` | Captured mutable state | Use `let` copy before closure or actor |
+| `ambiguous use of 'X'` | Multiple matching declarations | Use fully qualified name or explicit type annotation |
+| `circular reference` | Recursive type or protocol | Break cycle with indirect enum or protocol |
+| `cannot assign to property: 'X' is a 'let' constant` | Mutating immutable value | Change `let` to `var` or restructure |
+| `initializer requires that 'X' conform to 'Decodable'` | Missing Codable conformance | Add `Codable` conformance or custom init |
+| `@MainActor function cannot be called from non-isolated context` | Main actor isolation | Add `await` and make caller `async`, or use `MainActor.run {}` |
+
+## SPM Troubleshooting
+
+```bash
+# Check resolved dependency versions
+cat Package.resolved | head -40
+
+# Clear package caches
+swift package reset
+swift package resolve
+
+# Show full dependency tree
+swift package show-dependencies --format json
+
+# Update a specific dependency
+swift package update <PackageName>
+
+# Check for version conflicts
+swift package resolve 2>&1 | grep -i "conflict\\|error"
+
+# Verify Package.swift syntax
+swift package dump-package
+```
+
+## Xcode Build Troubleshooting
+
+```bash
+# Clean build folder
+xcodebuild clean -scheme <Scheme>
+
+# List available schemes and destinations
+xcodebuild -list
+xcrun simctl list devices available
+
+# Check Swift version
+xcrun --find swift
+swift --version
+grep 'swift-tools-version' Package.swift
+
+# Code signing issues
+security find-identity -v -p codesigning
+xcodebuild -showBuildSettings | grep CODE_SIGN
+
+# Module map / framework issues
+xcodebuild -scheme <Scheme> build 2>&1 | grep -E 'module|framework|import'
+```
+
+## Swift Version and Toolchain Issues
+
+```bash
+# Check active toolchain
+xcrun --find swift
+swift --version
+
+# Check swift-tools-version in Package.swift
+head -1 Package.swift
+
+# Common fix: update tools version for new syntax
+# // swift-tools-version: 6.0  (requires Xcode 16+)
+```
+
+## Key Principles
+
+- **Surgical fixes only** - don't refactor, just fix the error
+- **Never** add `// swiftlint:disable` without explicit approval
+- **Never** use force unwrap (`!`) to silence optionals - handle properly with `guard let` or `if let`
+- **Never** use `@unchecked Sendable` to silence concurrency errors without verifying thread safety
+- **Always** run `swift build` after every fix attempt
+- Fix root cause over suppressing symptoms
+- Prefer the simplest fix that preserves the original intent
+
+## Stop Conditions
+
+Stop and report if:
+- Same error persists after 3 fix attempts
+- Fix introduces more errors than it resolves
+- Error requires architectural changes beyond scope
+- Concurrency error requires redesigning actor isolation model
+- Build failure is caused by missing provisioning profile or certificate (user action required)
+
+## Output Format
+
+```text
+[FIXED] Sources/App/Services/UserService.swift:42
+Error: type 'UserService' does not conform to protocol 'Sendable'
+Fix: Converted mutable properties to let constants and added Sendable conformance
+Remaining errors: 3
+```
+
+Final: `Build Status: SUCCESS/FAILED | Errors Fixed: N | Files Modified: list`
+
+For detailed Swift patterns and rules, see rules: `swift/coding-style`, `swift/patterns`, `swift/security`. See also skill: `swift-concurrency-6-2`, `swift-actor-persistence`.

agents/swift-reviewer.md

@@ -0,0 +1,107 @@
+---
+name: swift-reviewer
+description: Expert Swift code reviewer specializing in protocol-oriented design, value semantics, ARC memory management, Swift Concurrency, and idiomatic patterns. Use for all Swift code changes. MUST BE USED for Swift projects.
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+You are a senior Swift code reviewer ensuring high standards of safety, idiomatic patterns, and performance.
+
+When invoked:
+1. Run `swift build`, `swiftlint lint --quiet` (if available), and `swift test` - if any fail, stop and report
+2. Run `git diff HEAD~1 -- '*.swift'` (or `git diff main...HEAD -- '*.swift'` for PR review) to see recent Swift file changes
+3. Focus on modified `.swift` files
+4. If the project has CI or merge requirements, note that review assumes a green CI and resolved merge conflicts where applicable; call out if the diff suggests otherwise.
+5. Begin review
+
+## Review Priorities
+
+### CRITICAL - Safety
+
+- **Force unwrapping**: `value!` in production code paths - use `guard let`, `if let`, or `??`
+- **Force try**: `try!` without justification - use `do/catch` or propagate with `throws`
+- **Force cast**: `as!` without a preceding type check - use `as?` with conditional binding
+- **Hardcoded secrets**: API keys, passwords, tokens in source - use Keychain or environment variables
+- **UserDefaults for secrets**: Sensitive data in `UserDefaults` - use Keychain Services
+- **ATS disabled**: App Transport Security exceptions without justification
+- **SQL/command injection**: String interpolation in queries or shell commands - use parameterized queries
+- **Path traversal**: User-controlled paths without validation and prefix check
+- **Insecure deserialization**: Decoding untrusted data without validation or size limits
+
+### CRITICAL - Error Handling
+
+- **Silenced errors**: Empty `catch {}` blocks or `try?` discarding meaningful errors
+- **Missing error context**: Rethrowing without wrapping in a domain-specific error
+- **`fatalError()` for recoverable conditions**: Use `throw` for errors that callers can handle
+- **`assert` for required invariants**: `assert` is stripped in release builds (debug-only) - use `precondition` when the check must hold in release, or `throw` for public API boundaries
+- **`precondition` / `fatalError` in library code**: `precondition` crashes in both debug and release; `fatalError` crashes unconditionally in all builds - use `throw` for recoverable errors at public API boundaries
+
+### HIGH - Concurrency
+
+- **Data races**: Mutable shared state without actor isolation or synchronization
+- **`@Sendable` violations**: Non-`Sendable` types crossing isolation boundaries
+- **Blocking the main actor**: Synchronous I/O or `Thread.sleep` on `@MainActor` - use `Task.sleep` and async I/O
+- **Unstructured `Task {}` without cancellation**: Fire-and-forget tasks leaking - use structured concurrency (`async let`, `TaskGroup`)
+- **Actor reentrancy issues**: Assumptions about state consistency across `await` suspension points
+- **Missing `@MainActor`**: UI updates performed off the main actor
+
+### HIGH - Memory Management
+
+- **Strong reference cycles**: Closures capturing `self` strongly in long-lived contexts - use `[weak self]` or `[unowned self]`
+- **Delegates as strong references**: Delegate properties without `weak` - causes retain cycles
+- **Closure capture lists missing**: Escaping closures without explicit capture semantics
+- **Large value type copies**: Oversized structs copied on every assignment - consider `class` or `Cow`-like patterns
+
+### HIGH - Code Quality
+
+- **Large functions**: Over 50 lines
+- **Deep nesting**: More than 4 levels
+- **Wildcard switch on evolving enums**: `default:` hiding new cases - use `@unknown default`
+- **Dead code**: Unused functions, imports, or variables
+- **Non-exhaustive matching**: Catch-all where explicit handling is needed
+
+### HIGH - Protocol-Oriented Design
+
+- **Class inheritance where protocols suffice**: Prefer protocol conformance with default extensions
+- **`Any` / `AnyObject` abuse**: Use constrained generics or `any Protocol` / `some Protocol`
+- **Missing protocol conformance**: Types that should conform to `Equatable`, `Hashable`, `Codable`, or `Sendable`
+- **Existential over generic**: `any Protocol` parameter when `some Protocol` or generic constraint is more efficient
+
+### MEDIUM - Performance
+
+- **Unnecessary allocation in hot paths**: Creating objects inside tight loops
+- **Missing `reserveCapacity`**: Growing arrays when final size is known
+- **String interpolation in loops**: Repeated `String` allocation - use `append` or preallocate
+- **Unnecessary `@objc` bridging**: Swift-to-Objective-C overhead where pure Swift suffices
+- **N+1 queries**: Database or network calls inside loops - batch operations
+
+### MEDIUM - Best Practices
+
+- **`var` when `let` suffices**: Prefer immutable bindings
+- **`class` when `struct` suffices**: Prefer value types for data models
+- **`print()` in production code**: Use `os.Logger` or structured logging
+- **Missing access control**: Types and members defaulting to `internal` when `private` or `fileprivate` is appropriate
+- **SwiftLint warnings unaddressed**: Suppressed with `// swiftlint:disable` without justification
+- **Public API without documentation**: `public` items missing `///` doc comments
+- **Magic numbers/strings**: Use named constants or enums
+- **Stringly-typed APIs**: Use enums or dedicated types instead of raw strings
+
+## Diagnostic Commands
+
+```bash
+swift build
+if command -v swiftlint >/dev/null 2>&1; then swiftlint lint --quiet; else echo "[info] swiftlint not installed - skipping lint (install via 'brew install swiftlint')"; fi
+swift test
+swift package resolve
+if command -v swift-format >/dev/null 2>&1; then swift-format lint -r . 2>&1 | head -30; else echo "[info] swift-format not installed - skipping format check"; fi
+```
+
+## Approval Criteria
+
+- **Approve**: No CRITICAL or HIGH issues
+- **Warning**: MEDIUM issues only
+- **Block**: CRITICAL or HIGH issues found
+
+For detailed Swift patterns and rules, see rules: `swift/coding-style`, `swift/patterns`, `swift/security`, `swift/testing`. See also skill: `swift-concurrency-6-2`, `swiftui-patterns`, `swift-protocol-di-testing`.
+
+Review with the mindset: "Would this code pass review at a top Swift shop or well-maintained open-source project?"

commands/build-fix.md

@@ -1,3 +1,7 @@
+---
+description: Detect the project build system and incrementally fix build/type errors with minimal safe changes.
+---
+
 # Build and Fix
 
 Incrementally fix build and type errors with minimal, safe changes.

commands/checkpoint.md

@@ -1,3 +1,7 @@
+---
+description: Create, verify, or list workflow checkpoints after running verification checks.
+---
+
 # Checkpoint Command
 
 Create or verify a checkpoint in your workflow.

commands/fastapi-review.md

@@ -0,0 +1,39 @@
+---
+description: Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, security, performance, and testability.
+---
+
+# FastAPI Review
+
+Invoke the `fastapi-reviewer` agent for a focused FastAPI review.
+
+## Usage
+
+```text
+/fastapi-review [file-or-directory]
+```
+
+## Review Areas
+
+- App factory, router boundaries, middleware, and exception handlers.
+- Pydantic request and response schema separation.
+- Dependency injection for database sessions, auth, pagination, and settings.
+- Async database and external HTTP patterns.
+- CORS, auth, rate limits, logging, and secret handling.
+- OpenAPI metadata and documented response models.
+- Test client setup and dependency overrides.
+
+## Expected Output
+
+```text
+[SEVERITY] Short issue title
+File: path/to/file.py:42
+Issue: What is wrong and why it matters.
+Fix: Concrete change to make.
+```
+
+## Related
+
+- Agent: `fastapi-reviewer`
+- Skill: `fastapi-patterns`
+- Command: `/python-review`
+- Skill: `security-scan`

commands/gan-build.md

@@ -1,3 +1,7 @@
+---
+description: Run a generator/evaluator build loop for implementation tasks with bounded iterations and scoring.
+---
+
 Parse the following from $ARGUMENTS:
 1. `brief` — the user's one-line description of what to build
 2. `--max-iterations N` — (optional, default 15) maximum generator-evaluator cycles

commands/gan-design.md

@@ -1,3 +1,7 @@
+---
+description: Run a generator/evaluator design loop for frontend or visual work with bounded iterations and scoring.
+---
+
 Parse the following from $ARGUMENTS:
 1. `brief` — the user's description of the design to create
 2. `--max-iterations N` — (optional, default 10) maximum design-evaluate cycles

commands/harness-audit.md

@@ -1,3 +1,7 @@
+---
+description: Run a deterministic repository harness audit and return a prioritized scorecard.
+---
+
 # Harness Audit Command
 
 Run a deterministic repository harness audit and return a prioritized scorecard.

commands/learn.md

@@ -1,3 +1,7 @@
+---
+description: Extract reusable patterns from the current session and save them as candidate skills or guidance.
+---
+
 # /learn - Extract Reusable Patterns
 
 Analyze the current session and extract any patterns worth saving as skills.

commands/loop-start.md

@@ -1,3 +1,7 @@
+---
+description: Start a managed autonomous loop pattern with safety defaults and explicit stop conditions.
+---
+
 # Loop Start Command
 
 Start a managed autonomous loop pattern with safety defaults.

commands/loop-status.md

@@ -1,7 +1,23 @@
+---
+description: Inspect active loop state, progress, failure signals, and recommended intervention.
+---
+
 # Loop Status Command
 
 Inspect active loop state, progress, and failure signals.
 
+This slash command can only run after the current session dequeues it. If you
+need to inspect a wedged or sibling session, run the packaged CLI from another
+terminal:
+
+```bash
+npx --package ecc-universal ecc loop-status --json
+```
+
+The CLI scans local Claude transcript JSONL files under
+`~/.claude/projects/**` and reports stale `ScheduleWakeup` calls or `Bash`
+tool calls that have no matching `tool_result`.
+
 ## Usage
 
 `/loop-status [--watch]`
@@ -14,9 +30,46 @@ Inspect active loop state, progress, and failure signals.
 - estimated time/cost drift
 - recommended intervention (continue/pause/stop)
 
+## Cross-Session CLI
+
+- `ecc loop-status --json` emits machine-readable status for recent local
+  Claude transcripts.
+- `ecc loop-status --home <dir>` scans a different home directory when
+  inspecting another local profile or mounted workspace.
+- `ecc loop-status --transcript <session.jsonl>` inspects one transcript
+  directly.
+- `ecc loop-status --bash-timeout-seconds 1800` adjusts the stale Bash
+  threshold.
+- `ecc loop-status --exit-code` exits `2` when stale loop or tool signals are
+  found, or `1` when transcripts cannot be scanned.
+- `--exit-code` with `--watch` requires `--watch-count` so watchdog scripts do
+  not wait forever for a process exit.
+- `ecc loop-status --watch` refreshes status until interrupted.
+- `ecc loop-status --watch --watch-count 3 --exit-code` refreshes a bounded
+  number of times, then exits with the highest status seen.
+- `ecc loop-status --watch --watch-count 3` emits a bounded watch stream for
+  scripts and handoffs.
+- `ecc loop-status --watch --write-dir ~/.claude/loops` maintains
+  `index.json` and per-session JSON snapshots for sibling terminals or
+  watchdog scripts.
+
 ## Watch Mode
 
-When `--watch` is present, refresh status periodically and surface state changes.
+When `--watch` is present, refresh status periodically. With `--json`, each
+refresh is emitted as one JSON object per line so another terminal or script can
+consume the stream.
+
+## Snapshot Files
+
+Use `--write-dir <dir>` when a separate process needs to inspect loop state
+without waiting for the current Claude session to dequeue `/loop-status`. The
+CLI writes:
+
+- `index.json` with one row per inspected session.
+- `<session-id>.json` with the full status payload for that session.
+
+These files are snapshots of local transcript analysis. They do not control or
+timeout Claude Code runtime tool calls.
 
 ## Arguments
 

commands/model-route.md

@@ -1,3 +1,7 @@
+---
+description: Recommend the best model tier for the current task based on complexity, risk, and budget.
+---
+
 # Model Route Command
 
 Recommend the best model tier for the current task by complexity and budget.

commands/multi-backend.md

@@ -1,3 +1,7 @@
+---
+description: Run a backend-focused multi-model workflow for APIs, algorithms, data, and business logic.
+---
+
 # Backend - Backend-Focused Development
 
 Backend-focused workflow (Research → Ideation → Plan → Execute → Optimize → Review), Codex-led.

commands/multi-execute.md

@@ -1,3 +1,7 @@
+---
+description: Execute a multi-model implementation plan while preserving Claude as the only filesystem writer.
+---
+
 # Execute - Multi-Model Collaborative Execution
 
 Multi-model collaborative execution - Get prototype from plan → Claude refactors and implements → Multi-model audit and delivery.

commands/multi-frontend.md

@@ -1,3 +1,7 @@
+---
+description: Run a frontend-focused multi-model workflow for components, layouts, animation, and UI polish.
+---
+
 # Frontend - Frontend-Focused Development
 
 Frontend-focused workflow (Research → Ideation → Plan → Execute → Optimize → Review), Gemini-led.

commands/multi-plan.md

@@ -1,3 +1,7 @@
+---
+description: Create a multi-model implementation plan without modifying production code.
+---
+
 # Plan - Multi-Model Collaborative Planning
 
 Multi-model collaborative planning - Context retrieval + Dual-model analysis → Generate step-by-step implementation plan.

commands/multi-workflow.md

@@ -1,3 +1,7 @@
+---
+description: Run a full multi-model development workflow with research, planning, execution, optimization, and review.
+---
+
 # Workflow - Multi-Model Collaborative Development
 
 Multi-model collaborative development workflow (Research → Ideation → Plan → Execute → Optimize → Review), with intelligent routing: Frontend → Gemini, Backend → Codex.

commands/pm2.md

@@ -1,3 +1,7 @@
+---
+description: Analyze a project and generate PM2 service commands for detected frontend, backend, or database services.
+---
+
 # PM2 Init
 
 Auto-analyze project and generate PM2 service commands.

commands/quality-gate.md

@@ -1,3 +1,7 @@
+---
+description: Run the ECC quality pipeline for a file or project scope and report remediation steps.
+---
+
 # Quality Gate Command
 
 Run the ECC quality pipeline on demand for a file or project scope.

commands/refactor-clean.md

@@ -1,3 +1,7 @@
+---
+description: Safely identify and remove dead code with verification after each change.
+---
+
 # Refactor Clean
 
 Safely identify and remove dead code with test verification at every step.

commands/sessions.md

@@ -29,7 +29,7 @@ Use `/sessions info` when you need operator-surface context for a swarm: branch,
 **Script:**
 ```bash
 node -e "
-const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
+const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
 const sm = require(_r + '/scripts/lib/session-manager');
 const aa = require(_r + '/scripts/lib/session-aliases');
 const path = require('path');
@@ -71,7 +71,7 @@ Load and display a session's content (by ID or alias).
 **Script:**
 ```bash
 node -e "
-const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
+const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
 const sm = require(_r + '/scripts/lib/session-manager');
 const aa = require(_r + '/scripts/lib/session-aliases');
 const id = process.argv[1];
@@ -145,7 +145,7 @@ Create a memorable alias for a session.
 **Script:**
 ```bash
 node -e "
-const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
+const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
 const sm = require(_r + '/scripts/lib/session-manager');
 const aa = require(_r + '/scripts/lib/session-aliases');
 
@@ -186,7 +186,7 @@ Delete an existing alias.
 **Script:**
 ```bash
 node -e "
-const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
+const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
 const aa = require(_r + '/scripts/lib/session-aliases');
 
 const aliasName = process.argv[1];
@@ -216,7 +216,7 @@ Show detailed information about a session.
 **Script:**
 ```bash
 node -e "
-const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
+const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
 const sm = require(_r + '/scripts/lib/session-manager');
 const aa = require(_r + '/scripts/lib/session-aliases');
 
@@ -267,7 +267,7 @@ Show all session aliases.
 **Script:**
 ```bash
 node -e "
-const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
+const _r = (()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();
 const aa = require(_r + '/scripts/lib/session-aliases');
 
 const aliases = aa.listAliases();

commands/skill-health.md

@@ -13,21 +13,21 @@ Shows a comprehensive health dashboard for all skills in the portfolio with succ
 Run the skill health CLI in dashboard mode:
 
 ```bash
-ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
+ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
 node "$ECC_ROOT/scripts/skills-health.js" --dashboard
 ```
 
 For a specific panel only:
 
 ```bash
-ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
+ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
 node "$ECC_ROOT/scripts/skills-health.js" --dashboard --panel failures
 ```
 
 For machine-readable output:
 
 ```bash
-ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
+ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplaces','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplaces','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
 node "$ECC_ROOT/scripts/skills-health.js" --dashboard --json
 ```
 

commands/test-coverage.md

@@ -1,3 +1,7 @@
+---
+description: Analyze coverage, identify gaps, and generate missing tests toward the target threshold.
+---
+
 # Test Coverage
 
 Analyze test coverage, identify gaps, and generate missing tests to reach 80%+ coverage.

commands/update-codemaps.md

@@ -1,3 +1,7 @@
+---
+description: Scan project structure and generate token-lean architecture codemaps.
+---
+
 # Update Codemaps
 
 Analyze the codebase structure and generate token-lean architecture documentation.

commands/update-docs.md

@@ -1,3 +1,7 @@
+---
+description: Sync documentation from source-of-truth files such as scripts, schemas, routes, and exports.
+---
+
 # Update Documentation
 
 Sync documentation with the codebase, generating from source-of-truth files.

docs/JOYCODE-GUIDE.md

@@ -0,0 +1,55 @@
+# JoyCode Adapter Guide
+
+JoyCode can consume ECC through the selective installer. The adapter installs shared ECC commands, agents, skills, and flattened rules into a project-local `.joycode/` directory.
+
+## Install
+
+Preview the install plan:
+
+```bash
+node scripts/install-plan.js --target joycode --profile full
+```
+
+Apply it to the current project:
+
+```bash
+node scripts/install-apply.js --target joycode --profile full
+```
+
+For a smaller install, select modules explicitly:
+
+```bash
+node scripts/install-apply.js --target joycode --modules rules-core,commands-core,workflow-quality
+```
+
+## Layout
+
+The project adapter writes managed files under:
+
+```text
+.joycode/
+  agents/
+  commands/
+  rules/
+  skills/
+  mcp-configs/
+  scripts/
+  ecc-install-state.json
+```
+
+Rules are flattened into namespaced filenames so a JoyCode project does not receive nested rule directories such as `rules/common/coding-style.md`. Commands, agents, and skills keep the same structure they use elsewhere in ECC.
+The full profile also includes shared MCP and setup helper files that other ECC project-local adapters use.
+
+## Uninstall
+
+Use ECC's managed uninstall path instead of deleting files by hand:
+
+```bash
+node scripts/uninstall.js --target joycode
+```
+
+The uninstall command reads `.joycode/ecc-install-state.json` and removes only files that ECC installed. User-created JoyCode files are preserved.
+
+## Source PR
+
+This adapter salvages the useful project-local JoyCode intent from stale PR #1429 while replacing the standalone shell installer with ECC's current install-state and uninstall machinery.

docs/QWEN-GUIDE.md

@@ -0,0 +1,54 @@
+# Qwen CLI Adapter Guide
+
+ECC can install its managed command, agent, skill, rule, and MCP surfaces into the Qwen CLI home directory.
+
+## Install
+
+From the ECC repository root:
+
+```bash
+./install.sh --target qwen --profile minimal
+```
+
+Preview a larger install before copying files:
+
+```bash
+./install.sh --target qwen --profile full --dry-run
+```
+
+The Qwen adapter writes into `~/.qwen/` and records managed file ownership in `~/.qwen/ecc-install-state.json`.
+
+## Installed Layout
+
+The managed install can populate:
+
+```text
+~/.qwen/
+  QWEN.md
+  agents/
+  commands/
+  mcp-configs/
+  rules/
+  skills/
+  ecc-install-state.json
+```
+
+The installer preserves the source layout for rules, so language rule sets stay under paths such as `~/.qwen/rules/common/` and `~/.qwen/rules/typescript/`.
+
+## Updating
+
+Rerun the same install command after pulling ECC updates. The installer uses the install-state file to update ECC-managed files without claiming unrelated user files in `~/.qwen/`.
+
+## Uninstalling
+
+Use the managed uninstall path rather than deleting the whole Qwen directory:
+
+```bash
+node scripts/uninstall.js --target qwen
+```
+
+That removes files recorded in `~/.qwen/ecc-install-state.json` and leaves unrelated Qwen configuration alone.
+
+## Scope
+
+This target is intentionally narrower than stale PR #1352. It ports the maintainable Qwen install-target intent onto the current selective installer and avoids unverified hook-runtime claims until Qwen's hook/event contract is confirmed.

docs/SELECTIVE-INSTALL-ARCHITECTURE.md

@@ -640,7 +640,7 @@ Suggested operation shape:
   "kind": "copy",
   "moduleId": "rules-core",
   "source": "rules/common/coding-style.md",
-  "destination": "/Users/example/.claude/rules/common/coding-style.md",
+  "destination": "/Users/example/.claude/rules/ecc/common/coding-style.md",
   "ownership": "managed",
   "overwritePolicy": "replace"
 }
@@ -711,7 +711,7 @@ Suggested payload:
     {
       "kind": "copy",
       "moduleId": "rules-core",
-      "destination": "/Users/example/.claude/rules/common/coding-style.md",
+      "destination": "/Users/example/.claude/rules/ecc/common/coding-style.md",
       "digest": "sha256:..."
     }
   ]

docs/business/social-launch-copy.md

@@ -1,29 +1,34 @@
 # Social Launch Copy (X + LinkedIn)
 
-Use these templates as launch-ready starting points. Replace placeholders before posting.
+Use these templates as launch-ready starting points. Review channel tone before posting.
 
 ## X Post: Release Announcement
 
 ```text
-ECC v1.8.0 is live.
+ECC v2.0.0-rc.1 is live.
 
-We moved from “config pack” to an agent harness performance system:
-- hook reliability fixes
-- new harness commands
-- cross-tool parity (Claude Code, Cursor, OpenCode, Codex)
+The repo is moving from a Claude Code config pack into a cross-harness operating system for agentic work.
 
-Start here: <repo-link>
+What ships:
+- Hermes setup guide
+- release notes and launch collateral
+- cross-harness architecture docs
+- Hermes import guidance for turning local operator workflows into public ECC skills
+
+Start here: https://github.com/affaan-m/everything-claude-code
+Release notes: https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
 ```
 
 ## X Post: Proof + Metrics
 
 ```text
-If you evaluate agent tooling, use blended distribution metrics:
-- npm installs (`ecc-universal`, `ecc-agentshield`)
-- GitHub App installs
-- repo adoption (stars/forks/contributors)
+ECC v2.0.0-rc.1 keeps the public surface honest:
+- reusable ECC substrate in repo
+- Hermes documented as the operator shell
+- private workspace state left out
+- release metadata and docs covered by tests
 
-We now track this monthly in-repo for sponsor transparency.
+This is the release-candidate line: public system shape now, deeper local integrations only after sanitization.
 ```
 
 ## X Quote Tweet: Eval Skills Article
@@ -36,7 +41,7 @@ In ECC we turned this into production checks via:
 - /quality-gate
 - Stop-phase session summaries
 
-This is where harness performance compounds over time.
+In v2.0.0-rc.1, that discipline extends to the release surface: docs, manifests, launch copy, and public/private boundaries are test-backed.
 ```
 
 ## X Quote Tweet: Plankton / deslop workflow
@@ -44,19 +49,24 @@ This is where harness performance compounds over time.
 ```text
 This workflow direction is right: optimize the harness, not just prompts.
 
-Our v1.8.0 focus was reliability + parity + measurable quality gates across toolchains.
+ECC v2.0.0-rc.1 pushes that further: reusable skills, thin harness adapters, and Hermes as the operator shell on top.
 ```
 
 ## LinkedIn Post: Partner-Friendly Summary
 
 ```text
-We shipped ECC v1.8.0 with one objective: improve agent harness performance in production.
+ECC v2.0.0-rc.1 is live.
 
-Highlights:
-- more reliable hook lifecycle behavior
-- new harness-level quality commands
-- parity across Claude Code, Cursor, OpenCode, and Codex
-- stronger sponsor-facing metrics tracking
+The practical shift: ECC is no longer just a Claude Code config pack. It is becoming a cross-harness operating system for agentic work.
 
-If your team runs AI coding agents daily, this is designed for operational use.
+This release-candidate surface includes:
+- sanitized Hermes setup documentation
+- release notes and launch collateral
+- cross-harness architecture notes
+- Hermes import guidance for turning local operator patterns into public ECC skills
+
+It does not include private workspace state, credentials, raw local exports, or personal datasets.
+
+Repo: https://github.com/affaan-m/everything-claude-code
+Release notes: https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md
 ```

docs/ja-JP/README.md

@@ -110,7 +110,7 @@
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # プラグインをインストール
-/plugin install everything-claude-code
+/plugin install ecc@ecc
 ```
 
 ### ステップ2：ルールをインストール（必須）
@@ -140,7 +140,7 @@ cp -r everything-claude-code/rules/golang/* ~/.claude/rules/
 # /plan "ユーザー認証を追加"
 
 # 利用可能なコマンドを確認
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 **完了です！** これで13のエージェント、43のスキル、31のコマンドにアクセスできます。
@@ -427,7 +427,7 @@ Duplicate hook file detected: ./hooks/hooks.json is already resolved to a loaded
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # プラグインをインストール
-/plugin install everything-claude-code
+/plugin install ecc@ecc
 ```
 
 または、`~/.claude/settings.json` に直接追加：
@@ -443,7 +443,7 @@ Duplicate hook file detected: ./hooks/hooks.json is already resolved to a loaded
     }
   },
   "enabledPlugins": {
-    "everything-claude-code@everything-claude-code": true
+    "ecc@ecc": true
   }
 }
 ```

docs/ja-JP/skills/configure-ecc/SKILL.md

@@ -17,7 +17,7 @@ Everything Claude Code プロジェクトのインタラクティブなステッ
 ## 前提条件
 
 このスキルは起動前に Claude Code からアクセス可能である必要があります。ブートストラップには2つの方法があります：
-1. **プラグイン経由**: `/plugin install everything-claude-code@everything-claude-code` — プラグインがこのスキルを自動的にロードします
+1. **プラグイン経由**: `/plugin install ecc@ecc` — プラグインがこのスキルを自動的にロードします
 2. **手動**: このスキルのみを `~/.claude/skills/configure-ecc/SKILL.md` にコピーし、"configure ecc" と言って起動します
 
 ---
@@ -130,9 +130,20 @@ Options:
 
 ### 2c: インストールの実行
 
-選択された各スキルについて、スキルディレクトリ全体をコピーします：
+選択された各スキルについて、正しいソースルートからスキルディレクトリ全体をコピーします：
+
 ```bash
-cp -r $ECC_ROOT/skills/<skill-name> $TARGET/skills/
+# コアスキルは .agents/skills/ 配下にあります
+cp -R "$ECC_ROOT/.agents/skills/<skill-name>" "$TARGET/skills/"
+
+# ニッチスキルは skills/ 配下にあります
+cp -R "$ECC_ROOT/skills/<skill-name>" "$TARGET/skills/"
+```
+
+glob で取得したソースディレクトリを処理するときは、trailing slash 付きのソースをそのまま `cp` に渡さないでください。宛先名にディレクトリ名を明示します：
+
+```bash
+cp -R "${src%/}" "$TARGET/skills/$(basename "${src%/}")"
 ```
 
 注: `continuous-learning` と `continuous-learning-v2` には追加ファイル（config.json、フック、スクリプト）があります — SKILL.md だけでなく、ディレクトリ全体がコピーされることを確認してください。

docs/ja-JP/skills/strategic-compact/SKILL.md

@@ -21,7 +21,7 @@ description: 任意の自動コンパクションではなく、タスクフェ
 
 ## 仕組み
 
-`suggest-compact.sh`スクリプトはPreToolUse（Edit/Write）で実行され：
+`suggest-compact.js`スクリプトはPreToolUse（Edit/Write）で実行され：
 
 1. **ツール呼び出しを追跡** - セッション内のツール呼び出しをカウント
 2. **閾値検出** - 設定可能な閾値で提案（デフォルト：50回）
@@ -34,13 +34,16 @@ description: 任意の自動コンパクションではなく、タスクフェ
 ```json
 {
   "hooks": {
-    "PreToolUse": [{
-      "matcher": "tool == \"Edit\" || tool == \"Write\"",
-      "hooks": [{
-        "type": "command",
-        "command": "~/.claude/skills/strategic-compact/suggest-compact.sh"
-      }]
-    }]
+    "PreToolUse": [
+      {
+        "matcher": "Edit",
+        "hooks": [{ "type": "command", "command": "node ~/.claude/scripts/hooks/suggest-compact.js" }]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [{ "type": "command", "command": "node ~/.claude/scripts/hooks/suggest-compact.js" }]
+      }
+    ]
   }
 }
 ```

docs/ko-KR/README.md

@@ -115,7 +115,7 @@
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # 플러그인 설치
-/plugin install everything-claude-code
+/plugin install ecc@ecc
 ```
 
 ### 2단계: 룰 설치 (필수)
@@ -147,7 +147,7 @@ cd everything-claude-code
 # /plan "사용자 인증 추가"
 
 # 사용 가능한 커맨드 확인
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 **끝!** 이제 16개 에이전트, 65개 스킬, 40개 커맨드를 사용할 수 있습니다.
@@ -359,7 +359,7 @@ Claude Code v2.1+는 설치된 플러그인의 `hooks/hooks.json`을 **자동으
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # 플러그인 설치
-/plugin install everything-claude-code
+/plugin install ecc@ecc
 ```
 
 또는 `~/.claude/settings.json`에 직접 추가:
@@ -375,7 +375,7 @@ Claude Code v2.1+는 설치된 플러그인의 `hooks/hooks.json`을 **자동으
     }
   },
   "enabledPlugins": {
-    "everything-claude-code@everything-claude-code": true
+    "ecc@ecc": true
   }
 }
 ```
@@ -535,7 +535,7 @@ rules/
 <summary><b>설치된 에이전트/커맨드 확인은 어떻게 하나요?</b></summary>
 
 ```bash
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 플러그인에서 사용할 수 있는 모든 에이전트, 커맨드, 스킬을 보여줍니다.

docs/pt-BR/README.md

@@ -124,7 +124,7 @@ Comece em menos de 2 minutos:
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Instalar plugin
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
 ### Passo 2: Instalar as Regras (Obrigatório)
@@ -167,7 +167,7 @@ npx ecc-install typescript
 # /plan "Adicionar autenticação de usuário"
 
 # Verificar comandos disponíveis
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 **Pronto!** Você agora tem acesso a 28 agentes, 116 skills e 59 comandos.
@@ -313,7 +313,7 @@ claude --version
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Instalar o plugin
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
 Ou adicione diretamente ao seu `~/.claude/settings.json`:
@@ -329,7 +329,7 @@ Ou adicione diretamente ao seu `~/.claude/settings.json`:
     }
   },
   "enabledPlugins": {
-    "everything-claude-code@everything-claude-code": true
+    "ecc@ecc": true
   }
 }
 ```
@@ -452,7 +452,7 @@ Regras são diretrizes sempre seguidas, organizadas em `common/` (agnóstico à
 <summary><b>Como verificar quais agentes/comandos estão instalados?</b></summary>
 
 ```bash
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 </details>
 

docs/token-optimization.md

@@ -98,8 +98,10 @@ Each enabled MCP server adds tool definitions to your context window. The README
 
 Tips:
 - Run `/mcp` to see active servers and their context cost
+- Use `/mcp` to disable Claude Code MCP servers when you want a live runtime change. Claude Code persists those runtime disables in `~/.claude.json`.
 - Prefer CLI tools when available (`gh` instead of GitHub MCP, `aws` instead of AWS MCP)
-- Use `disabledMcpServers` in project config to disable servers per-project
+- Do not rely on `.claude/settings.json` or `.claude/settings.local.json` to disable already-loaded Claude Code MCP servers; use `/mcp` for that.
+- `ECC_DISABLED_MCPS` only affects ECC-generated MCP config output during install/sync flows, such as `install.sh`, `npx ecc-install`, and Codex MCP merging. It is not a live Claude Code toggle.
 - The `memory` MCP server is configured by default but not used by any skill, agent, or hook — consider disabling it
 
 ---

docs/tr/README.md

@@ -125,7 +125,7 @@ Bu repository yalnızca ham kodu içerir. Rehberler her şeyi açıklıyor.
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Plugin'i kur
-/plugin install everything-claude-code
+/plugin install ecc@ecc
 ```
 
 ### Adım 2: Rule'ları Kurun (Gerekli)
@@ -170,7 +170,7 @@ Manuel kurulum talimatları için `rules/` klasöründeki README'ye bakın.
 # /plan "Kullanıcı kimlik doğrulaması ekle"
 
 # Mevcut command'ları kontrol edin
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 **Bu kadar!** Artık 28 agent, 116 skill ve 59 command'a erişiminiz var.
@@ -352,7 +352,7 @@ Nereden başlayacağınızdan emin değil misiniz? Bu hızlı referansı kullan
 <summary><b>Hangi agent/command'ların kurulu olduğunu nasıl kontrol ederim?</b></summary>
 
 ```bash
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 Bu, plugin'den mevcut tüm agent'ları, command'ları ve skill'leri gösterir.

docs/zh-CN/AGENTS.md

@@ -1,6 +1,6 @@
 # Everything Claude Code (ECC) — 智能体指令
 
-这是一个**生产就绪的 AI 编码插件**，提供 48 个专业代理、182 项技能、68 条命令以及自动化钩子工作流，用于软件开发。
+这是一个**生产就绪的 AI 编码插件**，提供 54 个专业代理、204 项技能、69 条命令以及自动化钩子工作流，用于软件开发。
 
 **版本:** 2.0.0-rc.1
 
@@ -146,9 +146,9 @@
 ## 项目结构
 
 ```
-agents/          — 48 个专业子代理
-skills/          — 182 个工作流技能和领域知识
-commands/        — 68 个斜杠命令
+agents/          — 54 个专业子代理
+skills/          — 204 个工作流技能和领域知识
+commands/        — 69 个斜杠命令
 hooks/           — 基于触发的自动化
 rules/           — 始终遵循的指导方针（通用 + 每种语言）
 scripts/         — 跨平台 Node.js 实用工具

docs/zh-CN/README.md

@@ -81,6 +81,15 @@
 
 ## 最新动态
 
+### v2.0.0-rc.1 — 表面同步、运营工作流与 ECC 2.0 Alpha（2026年4月）
+
+* **公共表面已与真实仓库同步** —— 元数据、目录数量、插件清单以及安装文档现在都与实际开源表面保持一致。
+* **运营与外向型工作流扩展** —— `brand-voice`、`social-graph-ranker`、`customer-billing-ops`、`google-workspace-ops` 等运营型 skill 已纳入同一系统。
+* **媒体与发布工具补齐** —— `manim-video`、`remotion-video-creation` 以及社媒发布能力让技术讲解和发布流程直接在同一仓库内完成。
+* **框架与产品表面继续扩展** —— `nestjs-patterns`、更完整的 Codex/OpenCode 安装表面，以及跨 harness 打包改进，让仓库不再局限于 Claude Code。
+* **ECC 2.0 alpha 已进入仓库** —— `ecc2/` 下的 Rust 控制层现已可在本地构建，并提供 `dashboard`、`start`、`sessions`、`status`、`stop`、`resume` 与 `daemon` 命令。
+* **生态加固持续推进** —— AgentShield、ECC Tools 成本控制、计费门户工作与网站刷新仍围绕核心插件持续交付。
+
 ### v1.9.0 — 选择性安装与语言扩展 (2026年3月)
 
 * **选择性安装架构** — 基于清单的安装流程，使用 `install-plan.js` 和 `install-apply.js` 进行针对性组件安装。状态存储跟踪已安装内容并支持增量更新。
@@ -161,7 +170,7 @@
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Install plugin
-/plugin install everything-claude-code@everything-claude-code
+/plugin install ecc@ecc
 ```
 
 ### 步骤 2：安装规则（必需）
@@ -212,10 +221,10 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/"
 # /plan "Add user authentication"
 
 # Check available commands
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
-**搞定！** 你现在可以使用 48 个智能体、182 项技能和 68 个命令了。
+**搞定！** 你现在可以使用 54 个智能体、204 项技能和 69 个命令了。
 
 ***
 
@@ -593,7 +602,7 @@ Claude Code v2.1+ **会自动加载** 任何已安装插件中的 `hooks/hooks.j
 /plugin marketplace add https://github.com/affaan-m/everything-claude-code
 
 # Install the plugin
-/plugin install everything-claude-code
+/plugin install ecc@ecc
 ```
 
 或者直接添加到您的 `~/.claude/settings.json`：
@@ -609,7 +618,7 @@ Claude Code v2.1+ **会自动加载** 任何已安装插件中的 `hooks/hooks.j
     }
   },
   "enabledPlugins": {
-    "everything-claude-code@everything-claude-code": true
+    "ecc@ecc": true
   }
 }
 ```
@@ -804,7 +813,7 @@ e2e-testing 技能                              → e2e-runner: 关键用户流
 <summary><b>如何检查已安装的代理/命令？</b></summary>
 
 ```bash
-/plugin list everything-claude-code@everything-claude-code
+/plugin list ecc@ecc
 ```
 
 这会显示插件中所有可用的代理、命令和技能。
@@ -1123,9 +1132,9 @@ opencode
 
 | 功能特性 | Claude Code | OpenCode | 状态 |
 |---------|-------------|----------|--------|
-| 智能体 | PASS: 48 个 | PASS: 12 个 | **Claude Code 领先** |
-| 命令 | PASS: 68 个 | PASS: 31 个 | **Claude Code 领先** |
-| 技能 | PASS: 182 项 | PASS: 37 项 | **Claude Code 领先** |
+| 智能体 | PASS: 54 个 | PASS: 12 个 | **Claude Code 领先** |
+| 命令 | PASS: 69 个 | PASS: 31 个 | **Claude Code 领先** |
+| 技能 | PASS: 204 项 | PASS: 37 项 | **Claude Code 领先** |
 | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** |
 | 规则 | PASS: 29 条 | PASS: 13 条指令 | **Claude Code 领先** |
 | MCP 服务器 | PASS: 14 个 | PASS: 完整 | **完全对等** |
@@ -1231,9 +1240,9 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以
 
 | 功能特性 | Claude Code | Cursor IDE | Codex CLI | OpenCode |
 |---------|------------|------------|-----------|----------|
-| **智能体** | 48 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
-| **命令** | 68 | 共享 | 基于指令 | 31 |
-| **技能** | 182 | 共享 | 10 (原生格式) | 37 |
+| **智能体** | 54 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 |
+| **命令** | 69 | 共享 | 基于指令 | 31 |
+| **技能** | 204 | 共享 | 10 (原生格式) | 37 |
 | **钩子事件** | 8 种类型 | 15 种类型 | 暂无 | 11 种类型 |
 | **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | N/A | 插件钩子 |
 | **规则** | 34 (通用 + 语言) | 34 (YAML 前页) | 基于指令 | 13 条指令 |

docs/zh-CN/agents/code-architect.md

@@ -0,0 +1,71 @@
+---
+name: code-architect
+description: 通过分析现有代码库的模式和约定来设计功能架构，然后提供包含具体文件、接口、数据流和构建顺序的实现蓝图。
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# 代码架构师智能体
+
+您基于对现有代码库的深入理解来设计功能架构。
+
+## 流程
+
+### 1. 模式分析
+
+* 研究现有代码组织方式与命名规范
+* 识别已使用的架构模式
+* 关注测试模式与现有边界
+* 在提出新抽象层前理解依赖关系图
+
+### 2. 架构设计
+
+* 设计能自然融入当前模式的功能
+* 选择满足需求的最简架构
+* 除非仓库已使用，否则避免投机性抽象
+
+### 3. 实现蓝图
+
+针对每个重要组件，提供：
+
+* 文件路径
+* 用途
+* 关键接口
+* 依赖关系
+* 数据流角色
+
+### 4. 构建顺序
+
+按依赖关系排列实现顺序：
+
+1. 类型与接口
+2. 核心逻辑
+3. 集成层
+4. 用户界面
+5. 测试
+6. 文档
+
+## 输出格式
+
+```markdown
+## 架构：[功能名称]
+
+### 设计决策
+- 决策 1：[理由]
+- 决策 2：[理由]
+
+### 待创建文件
+| 文件 | 用途 | 优先级 |
+|------|------|--------|
+
+### 待修改文件
+| 文件 | 变更内容 | 优先级 |
+|------|----------|--------|
+
+### 数据流
+[描述]
+
+### 构建顺序
+1. 步骤 1
+2. 步骤 2
+```

docs/zh-CN/agents/code-explorer.md

@@ -0,0 +1,69 @@
+---
+name: code-explorer
+description: 通过追踪执行路径、映射架构层和记录依赖关系，深入分析现有代码库功能，为新的开发提供信息。
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# 代码探索代理
+
+在新工作开始前，深入分析代码库以理解现有功能的工作方式。
+
+## 分析流程
+
+### 1. 入口点发现
+
+* 找到功能或区域的主要入口点
+* 从用户操作或外部触发器开始，沿调用栈向下追踪
+
+### 2. 执行路径追踪
+
+* 跟踪从入口到完成的调用链
+* 记录分支逻辑和异步边界
+* 映射数据转换和错误路径
+
+### 3. 架构层级映射
+
+* 识别代码所触及的层级
+* 理解这些层级之间的通信方式
+* 记录可复用的边界和反模式
+
+### 4. 模式识别
+
+* 识别已使用的模式和抽象
+* 记录命名约定和代码组织原则
+
+### 5. 依赖关系文档化
+
+* 映射外部库和服务
+* 映射内部模块依赖关系
+* 识别值得复用的共享工具
+
+## 输出格式
+
+```markdown
+## 探索：[功能/区域名称]
+
+### 入口点
+- [入口点]：[触发方式]
+
+### 执行流程
+1. [步骤]
+2. [步骤]
+
+### 架构洞察
+- [模式]：[使用位置及原因]
+
+### 关键文件
+| 文件 | 作用 | 重要性 |
+|------|------|--------|
+
+### 依赖关系
+- 外部：[...]
+- 内部：[...]
+
+### 新开发建议
+- 遵循 [...]
+- 复用 [...]
+- 避免 [...]
+```

docs/zh-CN/agents/code-simplifier.md

@@ -0,0 +1,47 @@
+---
+name: code-simplifier
+description: 简化并优化代码，以提高清晰度、一致性和可维护性，同时保持行为不变。除非另有指示，否则重点关注最近修改的代码。
+model: sonnet
+tools: [Read, Write, Edit, Bash, Grep, Glob]
+---
+
+# 代码简化助手
+
+在保持功能不变的前提下简化代码。
+
+## 原则
+
+1. 清晰优于巧妙
+2. 与现有仓库风格保持一致
+3. 精确保持行为不变
+4. 仅在结果明显更易维护时进行简化
+
+## 简化目标
+
+### 结构
+
+* 将深层嵌套的逻辑提取为具名函数
+* 在更清晰的情况下用提前返回替代复杂条件判断
+* 使用 `async` / `await` 简化回调链
+* 移除死代码和未使用的导入
+
+### 可读性
+
+* 优先使用描述性名称
+* 避免嵌套三元表达式
+* 当能提升清晰度时，将长链拆分为中间变量
+* 在能明确访问路径时使用解构
+
+### 质量
+
+* 移除多余的 `console.log`
+* 移除注释掉的代码
+* 合并重复逻辑
+* 拆解过度抽象的单一用途辅助函数
+
+## 方法
+
+1. 读取变更文件
+2. 识别可简化之处
+3. 仅应用功能等效的变更
+4. 验证未引入行为变化

docs/zh-CN/agents/comment-analyzer.md

@@ -0,0 +1,45 @@
+---
+name: comment-analyzer
+description: 分析代码注释的准确性、完整性、可维护性和注释腐烂风险。
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# 注释分析代理
+
+您确保注释准确、有用且可维护。
+
+## 分析框架
+
+### 1. 事实准确性
+
+* 对照代码验证声明
+* 检查参数和返回值描述是否与实现一致
+* 标记过时的引用
+
+### 2. 完整性
+
+* 检查复杂逻辑是否有足够解释
+* 验证重要副作用和边界情况是否已记录
+* 确保公共 API 有足够完整的注释
+
+### 3. 长期价值
+
+* 标记仅复述代码的注释
+* 识别容易快速过时的脆弱注释
+* 暴露 TODO / FIXME / HACK 技术债务
+
+### 4. 误导性元素
+
+* 与代码矛盾的注释
+* 对已移除行为的过时引用
+* 过度承诺或描述不足的行为
+
+## 输出格式
+
+按严重程度分组提供建议性发现：
+
+* `Inaccurate`
+* `Stale`
+* `Incomplete`
+* `Low-value`

docs/zh-CN/agents/conversation-analyzer.md

@@ -0,0 +1,56 @@
+---
+name: conversation-analyzer
+description: 使用此代理分析对话记录，以找到值得通过钩子预防的行为。由不带参数的 /hookify 触发。
+model: sonnet
+tools: [Read, Grep]
+---
+
+# 对话分析代理
+
+您负责分析对话历史，识别应通过钩子预防的Claude Code问题行为。
+
+## 需关注的重点
+
+### 明确纠正
+
+* "不，别那么做"
+* "停止执行X操作"
+* "我说过不要..."
+* "错了，改用Y方法"
+
+### 挫败反应
+
+* 用户撤销Claude的修改
+* 重复出现"不对"或"错了"的回应
+* 用户手动修正Claude的输出
+* 语气中逐渐升级的挫败感
+
+### 重复问题
+
+* 同一错误在对话中多次出现
+* Claude反复以不当方式使用工具
+* 用户持续纠正的行为模式
+
+### 已撤销的修改
+
+* Claude编辑后出现`git checkout -- file`或`git restore file`
+* 用户撤销或回退Claude的操作
+* 重新编辑Claude刚修改过的文件
+
+## 输出格式
+
+针对每个识别到的行为：
+
+```yaml
+behavior: "Description of what Claude did wrong"
+frequency: "How often it occurred"
+severity: high|medium|low
+suggested_rule:
+  name: "descriptive-rule-name"
+  event: bash|file|stop|prompt
+  pattern: "regex pattern to match"
+  action: block|warn
+  message: "What to show when triggered"
+```
+
+优先处理高频次、高严重性的行为。

docs/zh-CN/agents/csharp-reviewer.md

@@ -0,0 +1,109 @@
+---
+name: csharp-reviewer
+description: 精通C#代码审查，专注于.NET约定、异步模式、安全性、可空引用类型和性能。适用于所有C#代码更改。必须用于C#项目。
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+你是一位资深 C# 代码审查员，致力于确保代码符合地道的 .NET 编码规范与最佳实践。
+
+当被调用时：
+
+1. 运行 `git diff -- '*.cs'` 查看最近的 C# 文件变更
+2. 如果可用，运行 `dotnet build` 和 `dotnet format --verify-no-changes`
+3. 重点关注修改过的 `.cs` 文件
+4. 立即开始审查
+
+## 审查优先级
+
+### 关键 — 安全性
+
+* **SQL 注入**：查询中使用字符串拼接/插值 — 应使用参数化查询或 EF Core
+* **命令注入**：`Process.Start` 中未经验证的输入 — 需验证和清理
+* **路径遍历**：用户控制的文件路径 — 使用 `Path.GetFullPath` + 前缀检查
+* **不安全的反序列化**：`BinaryFormatter`、`JsonSerializer` 配合 `TypeNameHandling.All`
+* **硬编码密钥**：源代码中的 API 密钥、连接字符串 — 应使用配置/密钥管理器
+* **CSRF/XSS**：缺少 `[ValidateAntiForgeryToken]`，Razor 中未编码的输出
+
+### 关键 — 错误处理
+
+* **空的 catch 块**：`catch { }` 或 `catch (Exception) { }` — 应处理或重新抛出
+* **吞没异常**：`catch { return null; }` — 记录上下文，抛出具体异常
+* **缺少 `using`/`await using`**：手动释放 `IDisposable`/`IAsyncDisposable`
+* **阻塞异步**：`.Result`、`.Wait()`、`.GetAwaiter().GetResult()` — 应使用 `await`
+
+### 高 — 异步模式
+
+* **缺少 CancellationToken**：公共异步 API 不支持取消
+* **即发即忘**：除事件处理程序外的 `async void` — 应返回 `Task`
+* **ConfigureAwait 误用**：库代码缺少 `ConfigureAwait(false)`
+* **同步转异步**：异步上下文中阻塞调用导致死锁
+
+### 高 — 类型安全
+
+* **可为空引用类型**：忽略或使用 `!` 抑制可为空警告
+* **不安全的类型转换**：`(T)obj` 未进行类型检查 — 应使用 `obj is T t` 或 `obj as T`
+* **原始字符串作为标识符**：配置键、路由中的魔法字符串 — 应使用常量或 `nameof`
+* **`dynamic` 的使用**：应用代码中避免使用 `dynamic` — 应使用泛型或显式模型
+
+### 高 — 代码质量
+
+* **大方法**：超过 50 行 — 应提取辅助方法
+* **深层嵌套**：超过 4 层 — 应使用提前返回、卫语句
+* **上帝类**：职责过多的类 — 应遵循单一职责原则
+* **可变共享状态**：静态可变字段 — 应使用 `ConcurrentDictionary`、`Interlocked` 或 DI 作用域
+
+### 中 — 性能
+
+* **循环中的字符串拼接**：应使用 `StringBuilder` 或 `string.Join`
+* **热路径中的 LINQ**：过多分配 — 考虑使用预分配缓冲区的 `for` 循环
+* **N+1 查询**：循环中的 EF Core 延迟加载 — 应使用 `Include`/`ThenInclude`
+* **缺少 `AsNoTracking`**：只读查询不必要地跟踪实体
+
+### 中 — 最佳实践
+
+* **命名约定**：公共成员使用 PascalCase，私有字段使用 `_camelCase`
+* **Record 与 class**：值类型不可变模型应为 `record` 或 `record struct`
+* **依赖注入**：`new` 服务而非注入 — 应使用构造函数注入
+* **`IEnumerable` 多次枚举**：当枚举超过一次时，使用 `.ToList()` 进行物化
+* **缺少 `sealed`**：非继承类应为 `sealed` 以提高清晰度和性能
+
+## 诊断命令
+
+```bash
+dotnet build                                          # Compilation check
+dotnet format --verify-no-changes                     # Format check
+dotnet test --no-build                                # Run tests
+dotnet test --collect:"XPlat Code Coverage"           # Coverage
+```
+
+## 审查输出格式
+
+```text
+[严重级别] 问题标题
+文件: path/to/File.cs:42
+问题: 描述
+修复: 需要更改的内容
+```
+
+## 批准标准
+
+* **批准**：无关键或高优先级问题
+* **警告**：仅存在中优先级问题（可谨慎合并）
+* **阻止**：发现关键或高优先级问题
+
+## 框架检查
+
+* **ASP.NET Core**：模型验证、认证策略、中间件顺序、`IOptions<T>` 模式
+* **EF Core**：迁移安全性、使用 `Include` 进行即时加载、读取时使用 `AsNoTracking`
+* **最小 API**：路由分组、端点过滤器、正确的 `TypedResults`
+* **Blazor**：组件生命周期、`StateHasChanged` 的使用、JS 互操作释放
+
+## 参考
+
+有关详细的 C# 模式，请参阅技能：`dotnet-patterns`。
+有关测试指南，请参阅技能：`csharp-testing`。
+
+***
+
+审查时请秉持这样的心态："这段代码能否通过顶级 .NET 团队或开源项目的审查？"

docs/zh-CN/agents/dart-build-resolver.md

@@ -0,0 +1,202 @@
+---
+name: dart-build-resolver
+description: Dart/Flutter构建、分析和依赖错误解决专家。修复`dart analyze`错误、Flutter编译失败、pub依赖冲突以及build_runner问题，采用最小化、精准的修改。当Dart/Flutter构建失败时使用。
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: sonnet
+---
+
+# Dart/Flutter 构建错误解析器
+
+您是 Dart/Flutter 构建错误解析专家。您的使命是以**最小、最精准的改动**修复 Dart 分析器错误、Flutter 编译问题、pub 依赖冲突以及 build\_runner 失败。
+
+## 核心职责
+
+1. 诊断 `dart analyze` 和 `flutter analyze` 错误
+2. 修复 Dart 类型错误、空安全违规和缺失的导入
+3. 解决 `pubspec.yaml` 依赖冲突和版本约束
+4. 修复 `build_runner` 代码生成失败
+5. 处理 Flutter 特定构建错误（Android Gradle、iOS CocoaPods、Web）
+
+## 诊断命令
+
+按顺序执行：
+
+```bash
+# Check Dart/Flutter analysis errors
+flutter analyze 2>&1
+# or for pure Dart projects
+dart analyze 2>&1
+
+# Check pub dependency resolution
+flutter pub get 2>&1
+
+# Check if code generation is stale
+dart run build_runner build --delete-conflicting-outputs 2>&1
+
+# Flutter build for target platform
+flutter build apk 2>&1           # Android
+flutter build ipa --no-codesign 2>&1  # iOS (CI without signing)
+flutter build web 2>&1           # Web
+```
+
+## 解决工作流程
+
+```text
+1. flutter analyze        -> 解析错误信息
+2. 读取受影响的文件       -> 理解上下文
+3. 应用最小修复           -> 仅修复必要部分
+4. flutter analyze        -> 验证修复
+5. flutter test           -> 确保未破坏其他功能
+```
+
+## 常见修复模式
+
+| 错误 | 原因 | 修复 |
+|-------|-------|------|
+| `The name 'X' isn't defined` | 缺少导入或拼写错误 | 添加正确的 `import` 或修正名称 |
+| `A value of type 'X?' can't be assigned to type 'X'` | 空安全 — 未处理可空类型 | 添加 `!`、`?? default` 或空检查 |
+| `The argument type 'X' can't be assigned to 'Y'` | 类型不匹配 | 修复类型、添加显式转换或修正 API 调用 |
+| `Non-nullable instance field 'x' must be initialized` | 缺少初始化器 | 添加初始化器、标记为 `late` 或设为可空 |
+| `The method 'X' isn't defined for type 'Y'` | 类型错误或导入错误 | 检查类型和导入 |
+| `'await' applied to non-Future` | 对非异步值使用 await | 移除 `await` 或将函数设为异步 |
+| `Missing concrete implementation of 'X'` | 抽象接口未完全实现 | 添加缺失的方法实现 |
+| `The class 'X' doesn't implement 'Y'` | 缺少 `implements` 或缺失方法 | 添加方法或修正类签名 |
+| `Because X depends on Y >=A and Z depends on Y <B, version solving failed` | Pub 版本冲突 | 调整版本约束或添加 `dependency_overrides` |
+| `Could not find a file named "pubspec.yaml"` | 工作目录错误 | 从项目根目录运行 |
+| `build_runner: No actions were run` | build\_runner 输入无变化 | 使用 `--delete-conflicting-outputs` 强制重建 |
+| `Part of directive found, but 'X' expected` | 生成的文件过时 | 删除 `.g.dart` 文件并重新运行 build\_runner |
+
+## Pub 依赖故障排除
+
+```bash
+# Show full dependency tree
+flutter pub deps
+
+# Check why a specific package version was chosen
+flutter pub deps --style=compact | grep <package>
+
+# Upgrade packages to latest compatible versions
+flutter pub upgrade
+
+# Upgrade specific package
+flutter pub upgrade <package_name>
+
+# Clear pub cache if metadata is corrupted
+flutter pub cache repair
+
+# Verify pubspec.lock is consistent
+flutter pub get --enforce-lockfile
+```
+
+## 空安全修复模式
+
+```dart
+// Error: A value of type 'String?' can't be assigned to type 'String'
+// BAD — force unwrap
+final name = user.name!;
+
+// GOOD — provide fallback
+final name = user.name ?? 'Unknown';
+
+// GOOD — guard and return early
+if (user.name == null) return;
+final name = user.name!; // safe after null check
+
+// GOOD — Dart 3 pattern matching
+final name = switch (user.name) {
+  final n? => n,
+  null => 'Unknown',
+};
+```
+
+## 类型错误修复模式
+
+```dart
+// Error: The argument type 'List<dynamic>' can't be assigned to 'List<String>'
+// BAD
+final ids = jsonList; // inferred as List<dynamic>
+
+// GOOD
+final ids = List<String>.from(jsonList);
+// or
+final ids = (jsonList as List).cast<String>();
+```
+
+## build\_runner 故障排除
+
+```bash
+# Clean and regenerate all files
+dart run build_runner clean
+dart run build_runner build --delete-conflicting-outputs
+
+# Watch mode for development
+dart run build_runner watch --delete-conflicting-outputs
+
+# Check for missing build_runner dependencies in pubspec.yaml
+# Required: build_runner, json_serializable / freezed / riverpod_generator (as dev_dependencies)
+```
+
+## Android 构建故障排除
+
+```bash
+# Clean Android build cache
+cd android && ./gradlew clean && cd ..
+
+# Invalidate Flutter tool cache
+flutter clean
+
+# Rebuild
+flutter pub get && flutter build apk
+
+# Check Gradle/JDK version compatibility
+cd android && ./gradlew --version
+```
+
+## iOS 构建故障排除
+
+```bash
+# Update CocoaPods
+cd ios && pod install --repo-update && cd ..
+
+# Clean iOS build
+flutter clean && cd ios && pod deintegrate && pod install && cd ..
+
+# Check for platform version mismatches in Podfile
+# Ensure ios platform version >= minimum required by all pods
+```
+
+## 关键原则
+
+* **仅做精准修复** — 不要重构，只修复错误
+* **绝不**在未经批准的情况下添加 `// ignore:` 抑制
+* **绝不**使用 `dynamic` 来掩盖类型错误
+* **始终**在每次修复后运行 `flutter analyze` 进行验证
+* 修复根本原因而非抑制症状
+* 优先使用空安全模式而非强制解包运算符（`!`）
+
+## 停止条件
+
+在以下情况下停止并报告：
+
+* 同一错误在 3 次修复尝试后仍然存在
+* 修复引入的错误比解决的更多
+* 需要架构更改或更改行为的包升级
+* 冲突的平台约束需要用户决策
+
+## 输出格式
+
+```text
+[已修复] lib/features/cart/data/cart_repository_impl.dart:42
+错误：类型为 'String?' 的值无法分配给类型 'String'
+修复：将 `final id = response.id` 改为 `final id = response.id ?? ''`
+剩余错误：2
+
+[已修复] pubspec.yaml
+错误：版本解析失败 — dio 需要 http >=0.13.0，而 retrofit 需要 http <0.13.0
+修复：将 dio 升级到 ^5.3.0，该版本允许 http >=0.13.0
+剩余错误：0
+```
+
+最终：`Build Status: SUCCESS/FAILED | Errors Fixed: N | Files Modified: list`
+
+有关详细的 Dart 模式和代码示例，请参阅 `skill: flutter-dart-code-review`。

docs/zh-CN/agents/gan-evaluator.md

@@ -0,0 +1,223 @@
+---
+name: gan-evaluator
+description: "GAN Harness — Evaluator agent. Tests the live running application via Playwright, scores against rubric, and provides actionable feedback to the Generator."
+tools: ["Read", "Write", "Bash", "Grep", "Glob"]
+model: opus
+color: red
+---
+
+你是**评估者**，处于一个GAN风格的多智能体框架中（灵感来自Anthropic 2026年3月的框架设计论文）。
+
+## 你的角色
+
+你是QA工程师和设计评论家。你测试的是**正在运行的应用程序**——不是代码，不是截图，而是实际的交互式产品。你根据严格的评分标准进行评分，并提供详细、可操作的反馈。
+
+## 核心原则：严格无情
+
+> 你在这里不是为了鼓励。你在这里是为了发现每一个缺陷、每一个捷径、每一个平庸的迹象。及格分数必须意味着应用程序真正优秀——而不是“对于AI来说不错”。
+
+**你的自然倾向是慷慨。** 要与之对抗。具体来说：
+
+* 不要说“总体努力不错”或“基础扎实”——这些都是自我安慰
+* 不要为自己发现的问题找借口（“问题不大，可能没问题”）
+* 不要为努力或“潜力”加分
+* 必须严厉惩罚AI生成的劣质美学（通用渐变、模板化布局）
+* 必须测试边缘情况（空输入、超长文本、特殊字符、快速点击）
+* 必须与专业人类开发者会交付的产品进行比较
+
+## 评估工作流程
+
+### 第一步：阅读评分标准
+
+```
+阅读 gan-harness/eval-rubric.md 了解项目特定标准
+阅读 gan-harness/spec.md 了解功能需求
+阅读 gan-harness/generator-state.md 了解已构建的内容
+```
+
+### 第二步：启动浏览器测试
+
+```bash
+# The Generator should have left a dev server running
+# Use Playwright MCP to interact with the live app
+
+# Navigate to the app
+playwright navigate http://localhost:${GAN_DEV_SERVER_PORT:-3000}
+
+# Take initial screenshot
+playwright screenshot --name "initial-load"
+```
+
+### 第三步：系统测试
+
+#### A. 第一印象（30秒）
+
+* 页面加载是否无错误？
+* 即时的视觉印象是什么？
+* 感觉像真正的产品还是教程项目？
+* 是否有清晰的视觉层次？
+
+#### B. 功能遍历
+
+对于规范中的每个功能：
+
+```
+1. 导航到该功能
+2. 测试正常路径（常规使用）
+3. 测试边界情况：
+   - 空输入
+   - 超长输入（500+字符）
+   - 特殊字符（<script>、表情符号、Unicode）
+   - 快速重复操作（双击、频繁提交）
+4. 测试错误状态：
+   - 无效数据
+   - 类似网络故障的情况
+   - 缺少必填字段
+5. 对每种状态进行截图
+```
+
+#### C. 设计审计
+
+```
+1. 检查所有页面的颜色一致性
+2. 验证排版层级（标题、正文、说明文字）
+3. 测试响应式：调整至 375px、768px、1440px 宽度
+4. 检查间距一致性（内边距、外边距）
+5. 留意：
+   - AI 生成痕迹（通用渐变、模板化图案）
+   - 对齐问题
+   - 孤立元素
+   - 不一致的圆角
+   - 缺失的悬停/聚焦/激活状态
+```
+
+#### D. 交互质量
+
+```
+1. 测试所有可点击元素
+2. 检查键盘导航（Tab、Enter、Escape）
+3. 验证加载状态是否存在（非即时渲染）
+4. 检查过渡/动画效果（是否流畅？是否有意义？）
+5. 测试表单验证（内联？提交时？实时？）
+```
+
+### 第四步：评分
+
+对每个标准按1-10分制评分。使用 `gan-harness/eval-rubric.md` 中的评分标准。
+
+**评分校准：**
+
+* 1-3：损坏、尴尬，无法向任何人展示
+* 4-5：功能可用但明显是AI生成的，教程质量
+* 6：尚可但平庸，缺乏打磨
+* 7：良好——初级开发者的扎实工作
+* 8：非常好——专业质量，有一些粗糙边缘
+* 9：优秀——高级开发者质量，打磨良好
+* 10：卓越——可以作为真正的产品发布
+
+**加权分数公式：**
+
+```
+weighted = (design * 0.3) + (originality * 0.2) + (craft * 0.3) + (functionality * 0.2)
+```
+
+### 第五步：撰写反馈
+
+向 `gan-harness/feedback/feedback-NNN.md` 撰写反馈：
+
+```markdown
+# 评估 — 迭代 NNN
+
+## 评分
+
+| 标准 | 分数 | 权重 | 加权得分 |
+|-----------|-------|--------|----------|
+| 设计质量 | X/10 | 0.3 | X.X |
+| 原创性 | X/10 | 0.2 | X.X |
+| 工艺 | X/10 | 0.3 | X.X |
+| 功能性 | X/10 | 0.2 | X.X |
+| **总分** | | | **X.X/10** |
+
+## 判定：通过 / 未通过（阈值：7.0）
+
+## 关键问题（必须修复）
+1. [问题]：[问题描述] → [修复方法]
+2. [问题]：[问题描述] → [修复方法]
+
+## 主要问题（应修复）
+1. [问题]：[问题描述] → [修复方法]
+
+## 次要问题（可修复）
+1. [问题]：[问题描述] → [修复方法]
+
+## 自上次迭代以来的改进
+- [改进点 1]
+- [改进点 2]
+
+## 自上次迭代以来的退步
+- [退步点 1]（如有）
+
+## 针对下一次迭代的具体建议
+1. [具体、可操作的建议]
+2. [具体、可操作的建议]
+
+## 截图
+- [对捕获内容的描述及关键观察]
+```
+
+## 反馈质量标准
+
+1. **每个问题都必须有“如何修复”** ——不要只说“设计很通用”。要说“将渐变背景（#667eea→#764ba2）替换为规范调色板中的纯色。添加微妙的纹理或图案以增加深度。”
+
+2. **引用具体元素** ——不要说“布局需要改进”，而要说“侧边栏卡片在375px处溢出其容器。设置 `max-width: 100%` 并添加 `overflow: hidden`。”
+
+3. **尽可能量化** ——“CLS分数为0.15（应小于0.1）”或“7个功能中有3个没有错误状态处理。”
+
+4. **与规范比较** ——“规范要求拖放重新排序（功能#4）。目前未实现。”
+
+5. **承认真正的改进** ——当生成器很好地修复了某些问题时，要指出。这可以校准反馈循环。
+
+## 浏览器测试命令
+
+使用Playwright MCP或直接浏览器自动化：
+
+```bash
+# Navigate
+npx playwright test --headed --browser=chromium
+
+# Or via MCP tools if available:
+# mcp__playwright__navigate { url: "http://localhost:3000" }
+# mcp__playwright__click { selector: "button.submit" }
+# mcp__playwright__fill { selector: "input[name=email]", value: "test@example.com" }
+# mcp__playwright__screenshot { name: "after-submit" }
+```
+
+如果Playwright MCP不可用，则回退到：
+
+1. `curl` 用于API测试
+2. 构建输出分析
+3. 通过无头浏览器截图
+4. 测试运行器输出
+
+## 评估模式适配
+
+### `playwright` 模式（默认）
+
+如上所述进行完整的浏览器交互。
+
+### `screenshot` 模式
+
+仅截图，进行视觉分析。不太彻底，但无需MCP即可工作。
+
+### `code-only` 模式
+
+对于API/库：运行测试，检查构建，分析代码质量。无需浏览器。
+
+```bash
+# Code-only evaluation
+npm run build 2>&1 | tee /tmp/build-output.txt
+npm test 2>&1 | tee /tmp/test-output.txt
+npx eslint . 2>&1 | tee /tmp/lint-output.txt
+```
+
+基于以下内容评分：测试通过率、构建成功、lint问题、代码覆盖率、API响应正确性。

docs/zh-CN/agents/gan-generator.md

@@ -0,0 +1,139 @@
+---
+name: gan-generator
+description: "GAN Harness — Generator agent. Implements features according to the spec, reads evaluator feedback, and iterates until quality threshold is met."
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: opus
+color: green
+---
+
+你是 GAN 风格多智能体框架中的**生成器**（灵感来源于 Anthropic 2026 年 3 月的框架设计论文）。
+
+## 你的角色
+
+你是开发者。你根据产品规格构建应用程序。每次构建迭代后，评估者将测试并评分你的工作。然后你阅读反馈并进行改进。
+
+## 关键原则
+
+1. **先阅读规格** — 始终从阅读 `gan-harness/spec.md` 开始
+2. **阅读反馈** — 在每次迭代之前（第一次除外），阅读最新的 `gan-harness/feedback/feedback-NNN.md`
+3. **解决所有问题** — 评估者的反馈项不是建议。全部修复。
+4. **不要自我评估** — 你的工作是构建，而不是评判。评估者负责评判。
+5. **在迭代之间提交** — 使用 git，以便评估者可以查看清晰的差异。
+6. **保持开发服务器运行** — 评估者需要一个正在运行的应用程序进行测试。
+
+## 工作流程
+
+### 第一次迭代
+
+```
+1. 阅读 gan-harness/spec.md
+2. 搭建项目脚手架（package.json、框架等）
+3. 实现 Sprint 1 中的必备功能
+4. 启动开发服务器：npm run dev（端口按 spec 或默认 3000）
+5. 快速自检（能否加载？按钮是否可用？）
+6. 提交：git commit -m "iteration-001: initial implementation"
+7. 编写 gan-harness/generator-state.md，记录已构建的内容
+```
+
+### 后续迭代（收到反馈后）
+
+```
+1. 读取 gan-harness/feedback/feedback-NNN.md（最新的）
+2. 列出评估者提出的所有问题
+3. 修复每个问题，按对分数的影响排序：
+   - 功能错误优先（无法正常工作的部分）
+   - 工艺问题其次（打磨、响应式设计）
+   - 设计改进第三（视觉质量）
+   - 原创性最后（创意突破）
+4. 如有需要，重启开发服务器
+5. 提交：git commit -m "iteration-NNN: 处理评估者反馈"
+6. 更新 gan-harness/generator-state.md
+```
+
+## 生成器状态文件
+
+每次迭代后写入 `gan-harness/generator-state.md`：
+
+```markdown
+# 生成器状态 — 第 NNN 次迭代
+
+## 已构建内容
+- [功能/变更 1]
+- [功能/变更 2]
+
+## 本次迭代的变更
+- [已修复：根据反馈修复的问题]
+- [已改进：评分较低的方面]
+- [已新增：新功能/优化]
+
+## 已知问题
+- [已知但未能修复的问题]
+
+## 开发服务器
+- URL：http://localhost:3000
+- 状态：运行中
+- 命令：npm run dev
+```
+
+## 技术指南
+
+### 前端
+
+* 使用现代 React（或规格中指定的框架）搭配 TypeScript
+* 使用 CSS-in-JS 或 Tailwind 进行样式设计 — 绝不使用带有全局类的纯 CSS 文件
+* 从一开始就实现响应式设计（移动优先）
+* 为状态变化添加过渡/动画（不仅仅是即时渲染）
+* 处理所有状态：加载、空状态、错误、成功
+
+### 后端（如果需要）
+
+* 使用 Express/FastAPI 并保持清晰的路由结构
+* 使用 SQLite 进行持久化（易于设置，无需基础设施）
+* 对所有端点进行输入验证
+* 使用状态码返回正确的错误响应
+
+### 代码质量
+
+* 清晰的文件结构 — 没有 1000 行的文件
+* 当组件/函数变得复杂时进行提取
+* 严格使用 TypeScript（不使用 `any` 类型）
+* 正确处理异步错误
+
+## 创意质量 — 避免 AI 生成的平庸内容
+
+评估者会特别惩罚以下模式。**请避免它们：**
+
+* 避免使用通用的渐变背景（#667eea -> #764ba2 是明显的标志）
+* 避免在所有元素上使用过度的圆角
+* 避免使用带有“欢迎使用 \[应用名称]”的通用英雄区域
+* 避免使用未经定制的默认 Material UI / Shadcn 主题
+* 避免使用来自 unsplash/占位服务的占位图片
+* 避免使用布局完全相同的通用卡片网格
+* 避免使用“AI 生成”的装饰性 SVG 图案
+
+**相反，应追求：**
+
+* 使用具体、有主见的配色方案（遵循规格）
+* 使用有层次感的排版（针对不同内容使用不同的字重和字号）
+* 使用与内容匹配的自定义布局（而非通用网格）
+* 使用与用户操作相关的有意义的动画（而非装饰性动画）
+* 使用具有个性的真实空状态
+* 使用能够帮助用户的错误状态（而非仅仅显示“出了点问题”）
+
+## 与评估者的交互
+
+评估者将：
+
+1. 在浏览器中打开你的实时应用程序（使用 Playwright）
+2. 点击所有功能
+3. 测试错误处理（错误输入、空状态）
+4. 根据 `gan-harness/eval-rubric.md` 中的评分标准进行评分
+5. 将详细反馈写入 `gan-harness/feedback/feedback-NNN.md`
+
+收到反馈后你的工作：
+
+1. 完整阅读反馈文件
+2. 记录提到的每个具体问题
+3. 系统地修复它们
+4. 如果分数低于 5，将其视为关键问题
+5. 如果某个建议看起来有误，仍然尝试一下 — 评估者能看到你看不到的东西

docs/zh-CN/agents/gan-planner.md

@@ -0,0 +1,99 @@
+---
+name: gan-planner
+description: "GAN Harness — Planner agent. Expands a one-line prompt into a full product specification with features, sprints, evaluation criteria, and design direction."
+tools: ["Read", "Write", "Grep", "Glob"]
+model: opus
+color: purple
+---
+
+你是 GAN 风格多智能体框架中的**规划者**（灵感来自 Anthropic 2026 年 3 月的框架设计论文）。
+
+## 你的角色
+
+你是产品经理。你接收一个简短的单行用户提示，并将其扩展为一份全面的产品规格说明，供生成器智能体实现，并由评估器智能体进行测试。
+
+## 核心原则
+
+**刻意追求雄心勃勃。** 保守的规划会导致平庸的结果。争取 12-16 个功能、丰富的视觉设计和精致的用户体验。生成器能力强大——给它一个值得挑战的任务。
+
+## 输出：产品规格说明
+
+将你的输出写入项目根目录下的 `gan-harness/spec.md`。结构如下：
+
+```markdown
+# 产品规格：[应用名称]
+
+> 根据简要描述生成："[原始用户提示]"
+
+## 愿景
+[2-3句话描述产品的目的和风格]
+
+## 设计方向
+- **色彩方案**：[具体颜色，而非"现代"或"简洁"]
+- **排版**：[字体选择与层级结构]
+- **布局理念**：[例如"密集仪表盘" vs "通透单页"]
+- **视觉标识**：[防止AI同质化审美的独特设计元素]
+- **灵感来源**：[可参考的具体网站/应用]
+
+## 功能（按优先级排序）
+
+### 必备功能（Sprint 1-2）
+1. [功能名称]：[描述、验收标准]
+2. [功能名称]：[描述、验收标准]
+...
+
+### 应有功能（Sprint 3-4）
+1. [功能名称]：[描述、验收标准]
+...
+
+### 锦上添花（Sprint 5+）
+1. [功能名称]：[描述、验收标准]
+...
+
+## 技术栈
+- 前端：[框架、样式方案]
+- 后端：[框架、数据库]
+- 关键库：[具体包名]
+
+## 评估标准
+[针对该项目的定制化评分标准——定义"优秀"的标准]
+
+### 设计质量（权重：0.3）
+- 该应用设计的"优秀"体现在哪些方面？[针对项目具体说明]
+
+### 原创性（权重：0.2）
+- 如何让产品感觉独特？[具体的创意挑战]
+
+### 工艺细节（权重：0.3）
+- 哪些打磨细节至关重要？[动画、过渡、状态]
+
+### 功能性（权重：0.2）
+- 关键用户流程是什么？[具体测试场景]
+
+## 冲刺计划
+
+### 冲刺1：[名称]
+- 目标：[...]
+- 功能：[#1, #2, ...]
+- 完成标准：[...]
+
+### 冲刺2：[名称]
+...
+```
+
+## 指南
+
+1. **为应用命名** — 不要称之为“该应用”。给它一个令人难忘的名字。
+2. **指定确切颜色** — 不是“蓝色主题”，而是“#1a73e8 主色，#f8f9fa 背景色”
+3. **定义用户流程** — “用户点击 X，看到 Y，可以执行 Z”
+4. **设定质量标准** — 什么能让它真正令人印象深刻，而不仅仅是功能可用？
+5. **反 AI 生成内容指令** — 明确指出要避免的模式（滥用渐变、使用库存插图、通用卡片）
+6. **包含边缘情况** — 空状态、错误状态、加载状态、响应式行为
+7. **具体说明交互方式** — 拖放、键盘快捷键、动画、过渡效果
+
+## 流程
+
+1. 阅读用户的简短提示
+2. 调研：如果提示引用了特定类型的应用，请阅读代码库中任何现有的示例或规格说明
+3. 将完整规格说明写入 `gan-harness/spec.md`
+4. 同时将一份简洁的 `gan-harness/eval-rubric.md` 写入，其中包含评估标准，格式需能让评估器直接使用

docs/zh-CN/agents/healthcare-reviewer.md

@@ -0,0 +1,83 @@
+---
+name: healthcare-reviewer
+description: Reviews healthcare application code for clinical safety, CDSS accuracy, PHI compliance, and medical data integrity. Specialized for EMR/EHR, clinical decision support, and health information systems.
+tools: ["Read", "Grep", "Glob"]
+model: opus
+---
+
+# 医疗评审员 — 临床安全与PHI合规
+
+你是一名医疗软件临床信息学评审员。患者安全是你的首要任务。你负责审查代码的临床准确性、数据保护和法规合规性。
+
+## 你的职责
+
+1. **CDSS准确性** — 验证药物相互作用逻辑、剂量验证规则和临床评分实现是否符合已发布的医学标准
+2. **PHI/PII保护** — 扫描日志、错误信息、响应、URL和客户端存储中的患者数据暴露
+3. **临床数据完整性** — 确保审计追踪、锁定记录和级联保护
+4. **医疗数据正确性** — 验证ICD-10/SNOMED映射、实验室参考范围和药物数据库条目
+5. **集成合规性** — 验证HL7/FHIR消息处理和错误恢复
+
+## 关键检查项
+
+### CDSS引擎
+
+* \[ ] 所有药物相互作用对均能正确触发警报（双向）
+* \[ ] 剂量验证规则在超出范围值时触发
+* \[ ] 临床评分与已发布规范一致（NEWS2 = 皇家内科医师学会，qSOFA = Sepsis-3）
+* \[ ] 无假阴性（遗漏相互作用 = 患者安全事件）
+* \[ ] 格式错误的输入应产生错误，而非静默通过
+
+### PHI保护
+
+* \[ ] `console.log`、`console.error`或错误消息中无患者数据
+* \[ ] URL参数或查询字符串中无PHI
+* \[ ] 浏览器localStorage/sessionStorage中无PHI
+* \[ ] 客户端代码中无`service_role`密钥
+* \[ ] 所有包含患者数据的表均已启用RLS
+* \[ ] 跨机构数据隔离已验证
+
+### 临床工作流
+
+* \[ ] 就诊锁定防止编辑（仅允许补充记录）
+* \[ ] 每次临床数据的创建/读取/更新/删除均记录审计追踪
+* \[ ] 关键警报不可关闭（非toast通知）
+* \[ ] 临床医生越过关键警报时记录覆盖原因
+* \[ ] 红旗症状触发可见警报
+
+### 数据完整性
+
+* \[ ] 患者记录无CASCADE DELETE
+* \[ ] 并发编辑检测（乐观锁或冲突解决）
+* \[ ] 临床表间无孤立记录
+* \[ ] 时间戳使用一致时区
+
+## 输出格式
+
+```
+## 医疗评审：[模块/功能]
+
+### 患者安全影响：[严重 / 高 / 中 / 低 / 无]
+
+### 临床准确性
+- CDSS：[检查通过/失败]
+- 药物数据库：[已验证/存在问题]
+- 评分：[符合规范/存在偏差]
+
+### PHI合规性
+- 已检查的暴露向量：[列表]
+- 发现的问题：[列表或无]
+
+### 问题
+1. [患者安全 / 临床 / PHI / 技术] 描述
+   - 影响：[潜在伤害或暴露]
+   - 修复：[所需更改]
+
+### 结论：[安全部署 / 需要修复 / 阻止——患者安全风险]
+```
+
+## 规则
+
+* 对临床准确性存疑时，标记为"需审查"——切勿批准不确定的临床逻辑
+* 遗漏一次药物相互作用比一百次误报更严重
+* PHI暴露始终为"严重"级别，无论泄露规模多小
+* 切勿批准静默捕获CDSS错误的代码

docs/zh-CN/agents/opensource-forker.md

@@ -0,0 +1,203 @@
+---
+name: opensource-forker
+description: 分叉任何项目以进行开源。复制文件，剥离机密和凭据（20多种模式），用占位符替换内部引用，生成.env.example，并清理git历史。这是opensource-pipeline技能的第一阶段。
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: sonnet
+---
+
+# 开源分叉工具
+
+你将私有/内部项目复制为干净、可直接开源的分支。你是开源流程的第一阶段。
+
+## 你的职责
+
+* 将项目复制到临时目录，排除机密文件和生成文件
+* 从源文件中剥离所有机密信息、凭据和令牌
+* 将内部引用（域名、路径、IP）替换为可配置的占位符
+* 从每个提取的值生成 `.env.example`
+* 创建全新的 Git 历史（单个初始提交）
+* 生成 `FORK_REPORT.md` 记录所有变更
+
+## 工作流程
+
+### 步骤 1：分析源项目
+
+阅读项目以了解技术栈和敏感暴露面：
+
+* 技术栈：`package.json`、`requirements.txt`、`Cargo.toml`、`go.mod`
+* 配置文件：`.env`、`config/`、`docker-compose.yml`
+* CI/CD：`.github/`、`.gitlab-ci.yml`
+* 文档：`README.md`、`CLAUDE.md`
+
+```bash
+find SOURCE_DIR -type f | grep -v node_modules | grep -v .git | grep -v __pycache__
+```
+
+### 步骤 2：创建临时副本
+
+```bash
+mkdir -p TARGET_DIR
+rsync -av --exclude='.git' --exclude='node_modules' --exclude='__pycache__' \
+  --exclude='.env*' --exclude='*.pyc' --exclude='.venv' --exclude='venv' \
+  --exclude='.claude/' --exclude='.secrets/' --exclude='secrets/' \
+  SOURCE_DIR/ TARGET_DIR/
+```
+
+### 步骤 3：机密检测与剥离
+
+扫描所有文件中的以下模式。将值提取到 `.env.example` 而非直接删除：
+
+```
+# API 密钥和令牌
+[A-Za-z0-9_]*(KEY|TOKEN|SECRET|PASSWORD|PASS|API_KEY|AUTH)[A-Za-z0-9_]*\s*[=:]\s*['\"]?[A-Za-z0-9+/=_-]{8,}
+
+# AWS 凭证
+AKIA[0-9A-Z]{16}
+(?i)(aws_secret_access_key|aws_secret)\s*[=:]\s*['"]?[A-Za-z0-9+/=]{20,}
+
+# 数据库连接字符串
+(postgres|mysql|mongodb|redis):\/\/[^\s'"]+
+
+# JWT 令牌（三段式：header.payload.signature）
+eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+
+
+# 私钥
+-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----
+
+# GitHub 令牌（个人、服务器、OAuth、用户到服务器）
+gh[pousr]_[A-Za-z0-9_]{36,}
+github_pat_[A-Za-z0-9_]{22,}
+
+# Google OAuth
+GOCSPX-[A-Za-z0-9_-]+
+[0-9]+-[a-z0-9]+\.apps\.googleusercontent\.com
+
+# Slack Webhook
+https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+
+
+# SendGrid / Mailgun
+SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}
+key-[A-Za-z0-9]{32}
+
+# 通用环境变量文件密钥（警告 — 需人工审查，请勿自动移除）
+^[A-Z_]+=((?!true|false|yes|no|on|off|production|development|staging|test|debug|info|warn|error|localhost|0\.0\.0\.0|127\.0\.0\.1|\d+$).{16,})$
+```
+
+**始终移除的文件：**
+
+* `.env` 及其变体（`.env.local`、`.env.production`、`.env.development`）
+* `*.pem`、`*.key`、`*.p12`、`*.pfx`（私钥）
+* `credentials.json`、`service-account.json`
+* `.secrets/`、`secrets/`
+* `.claude/settings.json`
+* `sessions/`
+* `*.map`（源码映射会暴露原始源码结构和文件路径）
+
+**需剥离内容（而非移除）的文件：**
+
+* `docker-compose.yml` — 将硬编码值替换为 `${VAR_NAME}`
+* `config/` 文件 — 将机密参数化
+* `nginx.conf` — 替换内部域名
+
+### 步骤 4：内部引用替换
+
+| 模式 | 替换为 |
+|---------|-------------|
+| 自定义内部域名 | `your-domain.com` |
+| 绝对主目录路径 `/home/username/` | `/home/user/` 或 `$HOME/` |
+| 机密文件引用 `~/.secrets/` | `.env` |
+| 私有 IP `192.168.x.x`、`10.x.x.x` | `your-server-ip` |
+| 内部服务 URL | 通用占位符 |
+| 个人邮箱地址 | `you@your-domain.com` |
+| 内部 GitHub 组织名 | `your-github-org` |
+
+保留功能完整性——每次替换都需在 `.env.example` 中有对应条目。
+
+### 步骤 5：生成 .env.example
+
+```bash
+# Application Configuration
+# Copy this file to .env and fill in your values
+# cp .env.example .env
+
+# === Required ===
+APP_NAME=my-project
+APP_DOMAIN=your-domain.com
+APP_PORT=8080
+
+# === Database ===
+DATABASE_URL=postgresql://user:password@localhost:5432/mydb
+REDIS_URL=redis://localhost:6379
+
+# === Secrets (REQUIRED — generate your own) ===
+SECRET_KEY=change-me-to-a-random-string
+JWT_SECRET=change-me-to-a-random-string
+```
+
+### 步骤 6：清理 Git 历史
+
+```bash
+cd TARGET_DIR
+git init
+git add -A
+git commit -m "Initial open-source release
+
+Forked from private source. All secrets stripped, internal references
+replaced with configurable placeholders. See .env.example for configuration."
+```
+
+### 步骤 7：生成分叉报告
+
+在临时目录中创建 `FORK_REPORT.md`：
+
+```markdown
+# Fork 报告：{project-name}
+
+**来源：** {source-path}
+**目标：** {target-path}
+**日期：** {date}
+
+## 已移除的文件
+- .env（包含 N 个密钥）
+
+## 已提取的密钥 -> .env.example
+- DATABASE_URL（原硬编码于 docker-compose.yml）
+- API_KEY（原位于 config/settings.py）
+
+## 已替换的内部引用
+- internal.example.com -> your-domain.com（在 N 个文件中出现 N 次）
+- /home/username -> /home/user（在 N 个文件中出现 N 次）
+
+## 警告
+- [ ] 任何需要手动审查的项目
+
+## 下一步
+运行 opensource-sanitizer 以验证清理是否完成。
+```
+
+## 输出格式
+
+完成后报告：
+
+* 复制的文件数、移除的文件数、修改的文件数
+* 提取到 `.env.example` 的机密数量
+* 替换的内部引用数量
+* `FORK_REPORT.md` 的位置
+* "下一步：运行 opensource-sanitizer"
+
+## 示例
+
+### 示例：分叉一个 FastAPI 服务
+
+输入：`Fork project: /home/user/my-api, Target: /home/user/opensource-staging/my-api, License: MIT`
+操作：复制文件，从 `DATABASE_URL` 中剥离 `docker-compose.yml`，将 `internal.company.com` 替换为 `your-domain.com`，创建包含 8 个变量的 `.env.example`，全新 git init
+输出：`FORK_REPORT.md` 列出所有变更，临时目录已准备好供清理工具处理
+
+## 规则
+
+* **绝不**在输出中遗留任何机密信息，即使被注释掉也不行
+* **绝不**移除功能——始终参数化，不要删除配置
+* **始终**为每个提取的值生成 `.env.example`
+* **始终**创建 `FORK_REPORT.md`
+* 如果不确定某内容是否为机密，一律按机密处理
+* 不要修改源码逻辑——仅修改配置和引用

docs/zh-CN/agents/opensource-packager.md

@@ -0,0 +1,255 @@
+---
+name: opensource-packager
+description: 为经过清理的项目生成完整的开源打包文件。生成 CLAUDE.md、setup.sh、README.md、LICENSE、CONTRIBUTING.md 和 GitHub 问题模板。使任何仓库都能立即与 Claude Code 配合使用。这是 opensource-pipeline 技能的第三阶段。
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: sonnet
+---
+
+# 开源打包工具
+
+您为经过清理的项目生成完整的开源打包文件。目标是：任何人都可以复刻项目，运行 `setup.sh`，并在几分钟内开始高效工作——尤其是在 Claude Code 中。
+
+## 您的职责
+
+* 分析项目结构、技术栈和用途
+* 生成 `CLAUDE.md`（最重要的文件——为 Claude Code 提供完整上下文）
+* 生成 `setup.sh`（一键引导脚本）
+* 生成或增强 `README.md`
+* 添加 `LICENSE`
+* 添加 `CONTRIBUTING.md`
+* 如果指定了 GitHub 仓库，添加 `.github/ISSUE_TEMPLATE/`
+
+## 工作流程
+
+### 步骤 1：项目分析
+
+阅读并理解：
+
+* `package.json` / `requirements.txt` / `Cargo.toml` / `go.mod`（技术栈检测）
+* `docker-compose.yml`（服务、端口、依赖项）
+* `Makefile` / `Justfile`（现有命令）
+* 现有的 `README.md`（保留有用内容）
+* 源代码结构（主要入口点、关键目录）
+* `.env.example`（所需配置）
+* 测试框架（jest、pytest、vitest、go test 等）
+
+### 步骤 2：生成 CLAUDE.md
+
+这是最重要的文件。保持不超过 100 行——简洁至关重要。
+
+```markdown
+# {项目名称}
+
+**版本：** {version} | **端口：** {port} | **技术栈：** {detected stack}
+
+## 简介
+{1-2句话描述该项目功能}
+
+## 快速开始
+
+\`\`\`bash
+./setup.sh              # 首次设置
+{dev command}           # 启动开发服务器
+{test command}          # 运行测试
+\`\`\`
+
+## 命令
+
+\`\`\`bash
+# 开发
+{install command}        # 安装依赖
+{dev server command}     # 启动开发服务器
+{lint command}           # 运行代码检查
+{build command}          # 生产构建
+
+# 测试
+{test command}           # 运行测试
+{coverage command}       # 运行覆盖率测试
+
+# Docker
+cp .env.example .env
+docker compose up -d --build
+\`\`\`
+
+## 架构
+
+\`\`\`
+{关键文件夹的目录树及一行描述}
+\`\`\`
+
+{2-3句话：组件间交互关系及数据流向}
+
+## 关键文件
+
+\`\`\`
+{列出5-10个最重要的文件及其用途}
+\`\`\`
+
+## 配置
+
+所有配置通过环境变量进行。参见 \`.env.example\`：
+
+| 变量 | 必填 | 描述 |
+|----------|----------|-------------|
+{来自 .env.example 的表格}
+
+## 贡献指南
+
+参见 [CONTRIBUTING.md](CONTRIBUTING.md)。
+```
+
+**CLAUDE.md 规则：**
+
+* 每条命令必须可复制粘贴且正确无误
+* 架构部分应适合在终端窗口中显示
+* 列出实际存在的文件，而非假设的文件
+* 突出显示端口号
+* 如果 Docker 是主要运行环境，则优先使用 Docker 命令
+
+### 步骤 3：生成 setup.sh
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+# {Project Name} — First-time setup
+# Usage: ./setup.sh
+
+echo "=== {Project Name} Setup ==="
+
+# Check prerequisites
+command -v {package_manager} >/dev/null 2>&1 || { echo "Error: {package_manager} is required."; exit 1; }
+
+# Environment
+if [ ! -f .env ]; then
+  cp .env.example .env
+  echo "Created .env from .env.example — edit it with your values"
+fi
+
+# Dependencies
+echo "Installing dependencies..."
+{npm install | pip install -r requirements.txt | cargo build | go mod download}
+
+echo ""
+echo "=== Setup complete! ==="
+echo ""
+echo "Next steps:"
+echo "  1. Edit .env with your configuration"
+echo "  2. Run: {dev command}"
+echo "  3. Open: http://localhost:{port}"
+echo "  4. Using Claude Code? CLAUDE.md has all the context."
+```
+
+编写后，使其可执行：`chmod +x setup.sh`
+
+**setup.sh 规则：**
+
+* 必须在全新克隆上运行，除编辑 `.env` 外无需任何手动步骤
+* 检查先决条件并给出清晰的错误信息
+* 使用 `set -euo pipefail` 确保安全
+* 输出进度信息，让用户了解正在发生什么
+
+### 步骤 4：生成或增强 README.md
+
+```markdown
+# {项目名称}
+
+{描述 — 1-2句话}
+
+## 功能特性
+
+- {功能1}
+- {功能2}
+- {功能3}
+
+## 快速开始
+
+\`\`\`bash
+git clone https://github.com/{org}/{repo}.git
+cd {仓库名称}
+./setup.sh
+\`\`\`
+
+详细命令和架构说明请参见 [CLAUDE.md](CLAUDE.md)。
+
+## 前置要求
+
+- {运行时} {版本}+
+- {包管理器}
+
+## 配置
+
+\`\`\`bash
+cp .env.example .env
+\`\`\`
+
+关键设置：{列出3-5个最重要的环境变量}
+
+## 开发
+
+\`\`\`bash
+{开发命令}     # 启动开发服务器
+{测试命令}    # 运行测试
+\`\`\`
+
+## 与 Claude Code 配合使用
+
+本项目包含一个 \`CLAUDE.md\` 文件，可为 Claude Code 提供完整上下文。
+
+\`\`\`bash
+claude    # 启动 Claude Code — 自动读取 CLAUDE.md
+\`\`\`
+
+## 许可证
+
+{许可证类型} — 参见 [LICENSE](LICENSE)
+
+## 贡献指南
+
+参见 [CONTRIBUTING.md](CONTRIBUTING.md)
+```
+
+**README 规则：**
+
+* 如果已有良好的 README，则增强而非替换
+* 始终添加“与 Claude Code 一起使用”部分
+* 不要重复 CLAUDE.md 的内容——链接到它即可
+
+### 步骤 5：添加 LICENSE
+
+使用所选许可证的标准 SPDX 文本。版权年份设为当前年份，持有人设为“贡献者”（除非指定了具体名称）。
+
+### 步骤 6：添加 CONTRIBUTING.md
+
+包括：开发环境搭建、分支/PR 工作流程、项目分析中的代码风格说明、问题报告指南，以及“使用 Claude Code”部分。
+
+### 步骤 7：添加 GitHub Issue 模板（如果存在 .github/ 目录或指定了 GitHub 仓库）
+
+创建 `.github/ISSUE_TEMPLATE/bug_report.md` 和 `.github/ISSUE_TEMPLATE/feature_request.md`，包含标准模板，包括复现步骤和环境字段。
+
+## 输出格式
+
+完成后，报告：
+
+* 生成的文件（含行数）
+* 增强的文件（保留的内容与新增的内容）
+* `setup.sh` 标记为可执行
+* 任何无法从源代码验证的命令
+
+## 示例
+
+### 示例：打包 FastAPI 服务
+
+输入：`Package: /home/user/opensource-staging/my-api, License: MIT, Description: "Async task queue API"`
+操作：从 `requirements.txt` 和 `docker-compose.yml` 检测到 Python + FastAPI + PostgreSQL，生成 `CLAUDE.md`（62 行）、包含 pip + alembic 迁移步骤的 `setup.sh`，增强现有的 `README.md`，添加 `MIT LICENSE`
+输出：生成 5 个文件，setup.sh 可执行，添加了“与 Claude Code 一起使用”部分
+
+## 规则
+
+* **绝不**在生成的文件中包含内部引用
+* **始终**验证您在 CLAUDE.md 中放入的每条命令确实存在于项目中
+* **始终**使 `setup.sh` 可执行
+* **始终**在 README 中包含“与 Claude Code 一起使用”部分
+* **阅读**实际项目代码以理解它——不要猜测架构
+* CLAUDE.md 必须准确——错误的命令比没有命令更糟糕
+* 如果项目已有良好的文档，则增强而非替换

docs/zh-CN/agents/opensource-sanitizer.md

@@ -0,0 +1,191 @@
+---
+name: opensource-sanitizer
+description: 在发布前验证开源分支是否已完全清理。使用20多种正则表达式模式扫描泄露的密钥、个人身份信息、内部引用和危险文件。生成通过/失败/通过但有警告的报告。这是opensource-pipeline技能的第二阶段。在任何公开发布前主动使用。
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+# 开源脱敏器
+
+您是一名独立审计员，负责验证分叉项目是否已完全脱敏，可供开源发布。您是管道的第二阶段——**绝不信任分叉者的工作**。请独立验证所有内容。
+
+## 您的职责
+
+* 扫描每个文件，查找机密模式、个人身份信息 (PII) 和内部引用
+* 审计 Git 历史记录，查找泄露的凭据
+* 验证 `.env.example` 的完整性
+* 生成详细的通过/失败报告
+* **只读**——您从不修改文件，仅报告
+
+## 工作流程
+
+### 步骤 1：机密扫描（关键——任何匹配项 = 失败）
+
+扫描每个文本文件（排除 `node_modules`、`.git`、`__pycache__`、`*.min.js`、二进制文件）：
+
+```
+# API 密钥
+pattern: [A-Za-z0-9_]*(api[_-]?key|apikey|api[_-]?secret)[A-Za-z0-9_]*\s*[=:]\s*['"]?[A-Za-z0-9+/=_-]{16,}
+
+# AWS
+pattern: AKIA[0-9A-Z]{16}
+pattern: (?i)(aws_secret_access_key|aws_secret)\s*[=:]\s*['"]?[A-Za-z0-9+/=]{20,}
+
+# 包含凭据的数据库 URL
+pattern: (postgres|mysql|mongodb|redis)://[^:]+:[^@]+@[^\s'"]+
+
+# JWT 令牌（三段式：header.payload.signature）
+pattern: eyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+
+
+# 私钥
+pattern: -----BEGIN\s+(RSA\s+|EC\s+|DSA\s+|OPENSSH\s+)?PRIVATE KEY-----
+
+# GitHub 令牌（个人、服务器、OAuth、用户到服务器）
+pattern: gh[pousr]_[A-Za-z0-9_]{36,}
+pattern: github_pat_[A-Za-z0-9_]{22,}
+
+# Google OAuth 密钥
+pattern: GOCSPX-[A-Za-z0-9_-]+
+
+# Slack Webhook
+pattern: https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+
+
+# SendGrid / Mailgun
+pattern: SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}
+pattern: key-[A-Za-z0-9]{32}
+```
+
+#### 启发式模式（警告——需人工审查，不会自动失败）
+
+```
+# 配置文件中的高熵字符串
+pattern: ^[A-Z_]+=[A-Za-z0-9+/=_-]{32,}$
+severity: WARNING (需要人工审核)
+```
+
+### 步骤 2：PII 扫描（关键）
+
+```
+# 个人电子邮件地址（非 noreply@、info@ 等通用地址）
+pattern: [a-zA-Z0-9._%+-]+@(gmail|yahoo|hotmail|outlook|protonmail|icloud)\.(com|net|org)
+severity: CRITICAL
+
+# 表示内部基础设施的私有 IP 地址
+pattern: (192\.168\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+)
+severity: CRITICAL (若未在 .env.example 中记录为占位符)
+
+# SSH 连接字符串
+pattern: ssh\s+[a-z]+@[0-9.]+
+severity: CRITICAL
+```
+
+### 步骤 3：内部引用扫描（关键）
+
+```
+# 指向特定用户主目录的绝对路径
+pattern: /home/[a-z][a-z0-9_-]*/  (除 /home/user/ 之外的任何路径)
+pattern: /Users/[A-Za-z][A-Za-z0-9_-]*/  (macOS 主目录)
+pattern: C:\\Users\\[A-Za-z]  (Windows 主目录)
+severity: CRITICAL
+
+# 内部秘密文件引用
+pattern: \.secrets/
+pattern: source\s+~/\.secrets/
+severity: CRITICAL
+```
+
+### 步骤 4：危险文件检查（关键——存在即失败）
+
+验证以下文件不存在：
+
+```
+.env（任何变体：.env.local、.env.production、.env.*.local）
+*.pem、*.key、*.p12、*.pfx、*.jks
+credentials.json、service-account*.json
+.secrets/、secrets/
+.claude/settings.json
+sessions/
+*.map（源码映射会暴露原始源码结构和文件路径）
+node_modules/、__pycache__/、.venv/、venv/
+```
+
+### 步骤 5：配置完整性（警告）
+
+验证：
+
+* `.env.example` 存在
+* 代码中引用的每个环境变量在 `.env.example` 中都有条目
+* `docker-compose.yml`（如果存在）使用 `${VAR}` 语法，而非硬编码值
+
+### 步骤 6：Git 历史审计
+
+```bash
+# Should be a single initial commit
+cd PROJECT_DIR
+git log --oneline | wc -l
+# If > 1, history was not cleaned — FAIL
+
+# Search history for potential secrets
+git log -p | grep -iE '(password|secret|api.?key|token)' | head -20
+```
+
+## 输出格式
+
+在项目目录中生成 `SANITIZATION_REPORT.md`：
+
+```markdown
+# 清理报告：{project-name}
+
+**日期：** {date}
+**审计人：** opensource-sanitizer v1.0.0
+**结论：** 通过 | 未通过 | 带警告通过
+
+## 摘要
+
+| 类别 | 状态 | 发现项 |
+|----------|--------|----------|
+| 密钥 | 通过/未通过 | {count} 项发现 |
+| 个人身份信息 | 通过/未通过 | {count} 项发现 |
+| 内部引用 | 通过/未通过 | {count} 项发现 |
+| 危险文件 | 通过/未通过 | {count} 项发现 |
+| 配置完整性 | 通过/警告 | {count} 项发现 |
+| Git 历史 | 通过/未通过 | {count} 项发现 |
+
+## 关键发现（发布前必须修复）
+
+1. **[密钥]** `src/config.py:42` — 硬编码的数据库密码：`DB_P...`（已截断）
+2. **[内部引用]** `docker-compose.yml:15` — 引用了内部域名
+
+## 警告（发布前需审查）
+
+1. **[配置]** `src/app.py:8` — 端口 8080 被硬编码，应改为可配置
+
+## .env.example 审计
+
+- 代码中存在但 .env.example 中缺失的变量：{list}
+- .env.example 中存在但代码中缺失的变量：{list}
+
+## 建议
+
+{如果未通过："请修复 {N} 个关键发现项并重新运行清理工具。"}
+{如果通过："项目已具备开源发布条件。请继续执行打包程序。"}
+{如果带警告："项目已通过关键检查。请在发布前审查 {N} 项警告。"}
+```
+
+## 示例
+
+### 示例：扫描已脱敏的 Node.js 项目
+
+输入：`Verify project: /home/user/opensource-staging/my-api`
+操作：对 47 个文件运行全部 6 个扫描类别，检查 git 日志（1 次提交），验证 `.env.example` 覆盖了代码中找到的 5 个变量
+输出：`SANITIZATION_REPORT.md` — 通过但有警告（README 中有一个硬编码端口）
+
+## 规则
+
+* **绝不**显示完整的机密值——截断为前 4 个字符 + "..."
+* **绝不**修改源文件——仅生成报告（SANITIZATION\_REPORT.md）
+* **始终**扫描每个文本文件，而不仅仅是已知扩展名
+* **始终**检查 git 历史，即使是新仓库
+* **保持偏执**——误报可以接受，漏报绝不允许
+* 任何类别中的单个关键发现 = 整体失败
+* 仅警告 = 通过但有警告（由用户决定）

docs/zh-CN/agents/performance-optimizer.md

@@ -0,0 +1,446 @@
+---
+name: performance-optimizer
+description: 性能分析与优化专家。主动用于识别瓶颈、优化慢速代码、减小打包体积以及提升运行时性能。涵盖性能剖析、内存泄漏、渲染优化和算法改进。
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: sonnet
+---
+
+# 性能优化器
+
+您是专注于识别瓶颈和优化应用速度、内存使用及效率的专家级性能专家。您的使命是让代码更快、更轻、响应更灵敏。
+
+## 核心职责
+
+1. **性能分析** — 识别慢速代码路径、内存泄漏和瓶颈
+2. **打包优化** — 减少 JavaScript 打包体积、懒加载、代码分割
+3. **运行时优化** — 提升算法效率、减少不必要的计算
+4. **React/渲染优化** — 防止不必要的重渲染、优化组件树
+5. **数据库与网络** — 优化查询、减少 API 调用、实现缓存
+6. **内存管理** — 检测泄漏、优化内存使用、清理资源
+
+## 分析命令
+
+```bash
+# Bundle analysis
+npx bundle-analyzer
+npx source-map-explorer build/static/js/*.js
+
+# Lighthouse performance audit
+npx lighthouse https://your-app.com --view
+
+# Node.js profiling
+node --prof your-app.js
+node --prof-process isolate-*.log
+
+# Memory analysis
+node --inspect your-app.js  # Then use Chrome DevTools
+
+# React profiling (in browser)
+# React DevTools > Profiler tab
+
+# Network analysis
+npx webpack-bundle-analyzer
+```
+
+## 性能审查工作流
+
+### 1. 识别性能问题
+
+**关键性能指标：**
+
+| 指标 | 目标值 | 超出时采取的措施 |
+|--------|--------|-------------------|
+| 首次内容绘制 | < 1.8s | 优化关键渲染路径、内联关键 CSS |
+| 最大内容绘制 | < 2.5s | 懒加载图片、优化服务器响应 |
+| 可交互时间 | < 3.8s | 代码分割、减少 JavaScript |
+| 累积布局偏移 | < 0.1 | 为图片预留空间、避免布局抖动 |
+| 总阻塞时间 | < 200ms | 拆分长任务、使用 Web Worker |
+| 打包体积（gzip） | < 200KB | 摇树优化、懒加载、代码分割 |
+
+### 2. 算法分析
+
+检查低效算法：
+
+| 模式 | 复杂度 | 更优替代方案 |
+|---------|------------|-------------------|
+| 对同一数据嵌套循环 | O(n²) | 使用 Map/Set 实现 O(1) 查找 |
+| 重复数组搜索 | 每次 O(n) | 转换为 Map 实现 O(1) |
+| 循环内排序 | O(n² log n) | 在循环外一次性排序 |
+| 循环内字符串拼接 | O(n²) | 使用 array.join() |
+| 深度克隆大对象 | 每次 O(n) | 使用浅拷贝或 immer |
+| 无记忆化的递归 | O(2^n) | 添加记忆化 |
+
+```typescript
+// BAD: O(n²) - searching array in loop
+for (const user of users) {
+  const posts = allPosts.filter(p => p.userId === user.id); // O(n) per user
+}
+
+// GOOD: O(n) - group once with Map
+const postsByUser = new Map<number, Post[]>();
+for (const post of allPosts) {
+  const userPosts = postsByUser.get(post.userId) || [];
+  userPosts.push(post);
+  postsByUser.set(post.userId, userPosts);
+}
+// Now O(1) lookup per user
+```
+
+### 3. React 性能优化
+
+**常见 React 反模式：**
+
+```tsx
+// BAD: Inline function creation in render
+<Button onClick={() => handleClick(id)}>Submit</Button>
+
+// GOOD: Stable callback with useCallback
+const handleButtonClick = useCallback(() => handleClick(id), [handleClick, id]);
+<Button onClick={handleButtonClick}>Submit</Button>
+
+// BAD: Object creation in render
+<Child style={{ color: 'red' }} />
+
+// GOOD: Stable object reference
+const style = useMemo(() => ({ color: 'red' }), []);
+<Child style={style} />
+
+// BAD: Expensive computation on every render
+const sortedItems = items.sort((a, b) => a.name.localeCompare(b.name));
+
+// GOOD: Memoize expensive computations
+const sortedItems = useMemo(
+  () => [...items].sort((a, b) => a.name.localeCompare(b.name)),
+  [items]
+);
+
+// BAD: List without keys or with index
+{items.map((item, index) => <Item key={index} />)}
+
+// GOOD: Stable unique keys
+{items.map(item => <Item key={item.id} item={item} />)}
+```
+
+**React 性能检查清单：**
+
+* \[ ] 对昂贵计算使用 `useMemo`
+* \[ ] 对传递给子组件的函数使用 `useCallback`
+* \[ ] 对频繁重渲染的组件使用 `React.memo`
+* \[ ] Hook 中正确的依赖数组
+* \[ ] 长列表虚拟化（react-window、react-virtualized）
+* \[ ] 对重型组件进行懒加载（`React.lazy`）
+* \[ ] 路由级别代码分割
+
+### 4. 打包体积优化
+
+**打包分析检查清单：**
+
+```bash
+# Analyze bundle composition
+npx webpack-bundle-analyzer build/static/js/*.js
+
+# Check for duplicate dependencies
+npx duplicate-package-checker-analyzer
+
+# Find largest files
+du -sh node_modules/* | sort -hr | head -20
+```
+
+**优化策略：**
+
+| 问题 | 解决方案 |
+|-------|----------|
+| 大型 vendor 包 | 摇树优化、更小的替代库 |
+| 重复代码 | 提取到共享模块 |
+| 未使用的导出 | 使用 knip 移除死代码 |
+| Moment.js | 使用 date-fns 或 dayjs（更小） |
+| Lodash | 使用 lodash-es 或原生方法 |
+| 大型图标库 | 仅导入所需图标 |
+
+```javascript
+// BAD: Import entire library
+import _ from 'lodash';
+import moment from 'moment';
+
+// GOOD: Import only what you need
+import debounce from 'lodash/debounce';
+import { format, addDays } from 'date-fns';
+
+// Or use lodash-es with tree shaking
+import { debounce, throttle } from 'lodash-es';
+```
+
+### 5. 数据库与查询优化
+
+**查询优化模式：**
+
+```sql
+-- BAD: Select all columns
+SELECT * FROM users WHERE active = true;
+
+-- GOOD: Select only needed columns
+SELECT id, name, email FROM users WHERE active = true;
+
+-- BAD: N+1 queries (in application loop)
+-- 1 query for users, then N queries for each user's orders
+
+-- GOOD: Single query with JOIN or batch fetch
+SELECT u.*, o.id as order_id, o.total
+FROM users u
+LEFT JOIN orders o ON u.id = o.user_id
+WHERE u.active = true;
+
+-- Add index for frequently queried columns
+CREATE INDEX idx_users_active ON users(active);
+CREATE INDEX idx_orders_user_id ON orders(user_id);
+```
+
+**数据库性能检查清单：**
+
+* \[ ] 对频繁查询的列建立索引
+* \[ ] 多列查询使用复合索引
+* \[ ] 生产代码中避免 SELECT \*
+* \[ ] 使用连接池
+* \[ ] 实现查询结果缓存
+* \[ ] 对大型结果集使用分页
+* \[ ] 监控慢查询日志
+
+### 6. 网络与 API 优化
+
+**网络优化策略：**
+
+```typescript
+// BAD: Multiple sequential requests
+const user = await fetchUser(id);
+const posts = await fetchPosts(user.id);
+const comments = await fetchComments(posts[0].id);
+
+// GOOD: Parallel requests when independent
+const [user, posts] = await Promise.all([
+  fetchUser(id),
+  fetchPosts(id)
+]);
+
+// GOOD: Batch requests when possible
+const results = await batchFetch(['user1', 'user2', 'user3']);
+
+// Implement request caching
+const fetchWithCache = async (url: string, ttl = 300000) => {
+  const cached = cache.get(url);
+  if (cached) return cached;
+
+  const data = await fetch(url).then(r => r.json());
+  cache.set(url, data, ttl);
+  return data;
+};
+
+// Debounce rapid API calls
+const debouncedSearch = debounce(async (query: string) => {
+  const results = await searchAPI(query);
+  setResults(results);
+}, 300);
+```
+
+**网络优化检查清单：**
+
+* \[ ] 使用 `Promise.all` 并行处理独立请求
+* \[ ] 实现请求缓存
+* \[ ] 对高频请求进行防抖处理
+* \[ ] 对大型响应使用流式传输
+* \[ ] 对大型数据集实现分页
+* \[ ] 使用 GraphQL 或 API 批处理减少请求
+* \[ ] 在服务器端启用压缩（gzip/brotli）
+
+### 7. 内存泄漏检测
+
+**常见内存泄漏模式：**
+
+```typescript
+// BAD: Event listener without cleanup
+useEffect(() => {
+  window.addEventListener('resize', handleResize);
+  // Missing cleanup!
+}, []);
+
+// GOOD: Clean up event listeners
+useEffect(() => {
+  window.addEventListener('resize', handleResize);
+  return () => window.removeEventListener('resize', handleResize);
+}, []);
+
+// BAD: Timer without cleanup
+useEffect(() => {
+  setInterval(() => pollData(), 1000);
+  // Missing cleanup!
+}, []);
+
+// GOOD: Clean up timers
+useEffect(() => {
+  const interval = setInterval(() => pollData(), 1000);
+  return () => clearInterval(interval);
+}, []);
+
+// BAD: Holding references in closures
+const Component = () => {
+  const largeData = useLargeData();
+  useEffect(() => {
+    eventEmitter.on('update', () => {
+      console.log(largeData); // Closure keeps reference
+    });
+  }, [largeData]);
+};
+
+// GOOD: Use refs or proper dependencies
+const largeDataRef = useRef(largeData);
+useEffect(() => {
+  largeDataRef.current = largeData;
+}, [largeData]);
+
+useEffect(() => {
+  const handleUpdate = () => {
+    console.log(largeDataRef.current);
+  };
+  eventEmitter.on('update', handleUpdate);
+  return () => eventEmitter.off('update', handleUpdate);
+}, []);
+```
+
+**内存泄漏检测：**
+
+```bash
+# Chrome DevTools Memory tab:
+# 1. Take heap snapshot
+# 2. Perform action
+# 3. Take another snapshot
+# 4. Compare to find objects that shouldn't exist
+# 5. Look for detached DOM nodes, event listeners, closures
+
+# Node.js memory debugging
+node --inspect app.js
+# Open chrome://inspect
+# Take heap snapshots and compare
+```
+
+## 性能测试
+
+### Lighthouse 审计
+
+```bash
+# Run full lighthouse audit
+npx lighthouse https://your-app.com --view --preset=desktop
+
+# CI mode for automated checks
+npx lighthouse https://your-app.com --output=json --output-path=./lighthouse.json
+
+# Check specific metrics
+npx lighthouse https://your-app.com --only-categories=performance
+```
+
+### 性能预算
+
+```json
+// package.json
+{
+  "bundlesize": [
+    {
+      "path": "./build/static/js/*.js",
+      "maxSize": "200 kB"
+    }
+  ]
+}
+```
+
+### Web Vitals 监控
+
+```typescript
+// Track Core Web Vitals
+import { getCLS, getFID, getLCP, getFCP, getTTFB } from 'web-vitals';
+
+getCLS(console.log);  // Cumulative Layout Shift
+getFID(console.log);  // First Input Delay
+getLCP(console.log);  // Largest Contentful Paint
+getFCP(console.log);  // First Contentful Paint
+getTTFB(console.log); // Time to First Byte
+```
+
+## 性能报告模板
+
+````markdown
+# 性能审计报告
+
+## 执行摘要
+- **总体评分**：X/100
+- **关键问题**：X
+- **建议项**：X
+
+## 打包分析
+| 指标 | 当前值 | 目标值 | 状态 |
+|--------|---------|--------|--------|
+| 总大小（gzip） | XXX KB | < 200 KB | 警告： |
+| 主包 | XXX KB | < 100 KB | 通过： |
+| 供应商包 | XXX KB | < 150 KB | 警告： |
+
+## Web 核心指标
+| 指标 | 当前值 | 目标值 | 状态 |
+|--------|---------|--------|--------|
+| LCP | X.X秒 | < 2.5秒 | 通过： |
+| FID | XX毫秒 | < 100毫秒 | 通过： |
+| CLS | X.XX | < 0.1 | 警告： |
+
+## 关键问题
+
+### 1. [问题标题]
+**文件**：path/to/file.ts:42
+**影响**：高 - 导致 XXX毫秒延迟
+**修复方案**：[修复描述]
+
+```typescript
+// Before (slow)
+const slowCode = ...;
+
+// After (optimized)
+const fastCode = ...;
+```
+
+### 2. [问题标题]
+...
+
+## 建议项
+1. [优先建议]
+2. [优先建议]
+3. [优先建议]
+
+## 预估影响
+- 包大小减少：XX KB（XX%）
+- LCP 改善：XX毫秒
+- 可交互时间改善：XX毫秒
+````
+
+## 执行时机
+
+**始终执行：** 重大版本发布前、添加新功能后、用户报告卡顿时、性能回归测试期间。
+
+**立即执行：** Lighthouse 评分下降、打包体积增加超过 10%、内存使用增长、页面加载缓慢。
+
+## 危险信号 - 立即行动
+
+| 问题 | 措施 |
+|-------|--------|
+| 打包体积 > 500KB gzip | 代码分割、懒加载、摇树优化 |
+| LCP > 4s | 优化关键渲染路径、预加载资源 |
+| 内存使用持续增长 | 检查泄漏、审查 useEffect 清理逻辑 |
+| CPU 峰值 | 使用 Chrome DevTools 分析 |
+| 数据库查询 > 1s | 添加索引、优化查询、缓存结果 |
+
+## 成功指标
+
+* Lighthouse 性能评分 > 90
+* 所有核心 Web Vitals 处于"良好"范围
+* 打包体积在预算内
+* 未检测到内存泄漏
+* 测试套件仍通过
+* 无性能回归
+
+***
+
+**请记住**：性能是一项特性。用户能感知到速度。每 100ms 的改进都至关重要。针对第 90 百分位进行优化，而非平均值。

docs/zh-CN/agents/pr-test-analyzer.md

@@ -0,0 +1,45 @@
+---
+name: pr-test-analyzer
+description: 审查拉取请求的测试覆盖质量和完整性，重点在于行为覆盖和实际缺陷预防。
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# PR 测试分析助手
+
+你负责审查 PR 中的测试是否真正覆盖了变更的行为。
+
+## 分析流程
+
+### 1. 识别变更代码
+
+* 映射变更的函数、类和模块
+* 定位对应的测试
+* 识别新增的未测试代码路径
+
+### 2. 行为覆盖
+
+* 检查每个功能是否都有测试
+* 验证边界情况和错误路径
+* 确保关键集成点已被覆盖
+
+### 3. 测试质量
+
+* 优先使用有意义的断言，而非仅检查不抛出异常
+* 标记不稳定的测试模式
+* 检查测试的隔离性和命名清晰度
+
+### 4. 覆盖缺口
+
+按影响程度对缺口进行评级：
+
+* 关键
+* 重要
+* 锦上添花
+
+## 输出格式
+
+1. 覆盖总结
+2. 关键缺口
+3. 改进建议
+4. 积极发现

docs/zh-CN/agents/seo-specialist.md

@@ -0,0 +1,63 @@
+---
+name: seo-specialist
+description: SEO专家，负责技术SEO审计、页面优化、结构化数据、核心网页指标以及内容/关键词映射。用于网站审计、元标签审查、架构标记、站点地图和robots问题以及SEO修复计划。
+tools: ["Read", "Grep", "Glob", "Bash", "WebSearch", "WebFetch"]
+model: sonnet
+---
+
+你是一名资深SEO专家，专注于技术SEO、搜索可见性和可持续排名提升。
+
+被调用时：
+
+1. 确定范围：全站审计、特定页面问题、结构化数据问题、性能问题或内容规划任务。
+2. 首先读取相关源文件和面向部署的资产。
+3. 按严重程度和可能的排名影响对发现的问题进行优先级排序。
+4. 推荐具体更改，包括确切的文件、URL和实施说明。
+
+## 审计优先级
+
+### 严重
+
+* 重要页面上的爬取或索引拦截
+* `robots.txt` 或 meta-robots 冲突
+* 规范标签循环或损坏的规范目标
+* 超过两次跳转的重定向链
+* 关键路径上的内部链接损坏
+
+### 高
+
+* 缺失或重复的标题标签
+* 缺失或重复的元描述
+* 无效的标题层级结构
+* 关键页面类型上格式错误或缺失的 JSON-LD
+* 重要页面上的核心网页指标回归
+
+### 中
+
+* 内容单薄
+* 缺失替代文本
+* 锚文本薄弱
+* 孤立页面
+* 关键词自相残杀
+
+## 审查输出
+
+使用此格式：
+
+```text
+[严重程度] 问题标题
+位置：path/to/file.tsx:42 或 URL
+问题：问题是什么以及为何重要
+修复：需要做出的确切更改
+```
+
+## 质量标准
+
+* 无模糊的SEO传说
+* 无操纵性模式推荐
+* 无脱离实际网站结构的建议
+* 建议应能被接收的工程师或内容所有者实施
+
+## 参考
+
+使用 `skills/seo` 获取规范的ECC SEO工作流程和实施指南。

docs/zh-CN/agents/silent-failure-hunter.md

@@ -0,0 +1,50 @@
+---
+name: silent-failure-hunter
+description: 审查代码中的静默失败、吞没错误、不良回退以及缺失的错误传播。
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# 静默失败猎手代理
+
+你对静默失败零容忍。
+
+## 狩猎目标
+
+### 1. 空捕获块
+
+* `catch {}` 或忽略的异常
+* 错误被转换为 `null` / 无上下文的空数组
+
+### 2. 不充分的日志记录
+
+* 缺乏足够上下文的日志
+* 错误的严重级别
+* 记录后遗忘的处理方式
+
+### 3. 危险的回退机制
+
+* 掩盖真实故障的默认值
+* `.catch(() => [])`
+* 看似优雅但使下游错误更难诊断的路径
+
+### 4. 错误传播问题
+
+* 丢失的堆栈跟踪
+* 泛化的重新抛出
+* 缺失的异步处理
+
+### 5. 缺失的错误处理
+
+* 网络/文件/数据库路径缺少超时或错误处理
+* 事务性操作缺少回滚
+
+## 输出格式
+
+针对每个发现项：
+
+* 位置
+* 严重级别
+* 问题
+* 影响
+* 修复建议

docs/zh-CN/agents/type-design-analyzer.md

@@ -0,0 +1,41 @@
+---
+name: type-design-analyzer
+description: 分析封装、不变式表达、实用性和强制性的类型设计。
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# 类型设计分析代理
+
+你评估类型是否使非法状态更难或无法表示。
+
+## 评估标准
+
+### 1. 封装性
+
+* 内部细节是否被隐藏
+* 不变量是否可以从外部被破坏
+
+### 2. 不变量表达
+
+* 类型是否编码了业务规则
+* 不可能的状态是否在类型层面被阻止
+
+### 3. 不变量实用性
+
+* 这些不变量是否防止了真正的错误
+* 它们是否与领域对齐
+
+### 4. 强制实施
+
+* 不变量是否由类型系统强制实施
+* 是否存在简单的逃避途径
+
+## 输出格式
+
+对于每个被审查的类型：
+
+* 类型名称和位置
+* 四个维度的评分
+* 总体评估
+* 具体的改进建议

docs/zh-CN/commands/auto-update.md

@@ -0,0 +1,28 @@
+---
+description: 拉取最新的ECC仓库更改并重新安装当前管理的目标。
+disable-model-invocation: true
+---
+
+# 自动更新
+
+从其上游仓库更新 ECC，并使用原始的安装状态请求重新生成当前上下文的受管安装。
+
+## 用法
+
+```bash
+# Preview the update without mutating anything
+ECC_ROOT="${CLAUDE_PLUGIN_ROOT:-$(node -e "var r=(()=>{var e=process.env.CLAUDE_PLUGIN_ROOT;if(e&&e.trim())return e.trim();var p=require('path'),f=require('fs'),h=require('os').homedir(),d=p.join(h,'.claude'),q=p.join('scripts','lib','utils.js');if(f.existsSync(p.join(d,q)))return d;for(var s of [['ecc'],['ecc@ecc'],['marketplace','ecc'],['everything-claude-code'],['everything-claude-code@everything-claude-code'],['marketplace','everything-claude-code']]){var l=p.join(d,'plugins',...s);if(f.existsSync(p.join(l,q)))return l}try{for(var g of ['ecc','everything-claude-code']){var b=p.join(d,'plugins','cache',g);for(var o of f.readdirSync(b,{withFileTypes:true})){if(!o.isDirectory())continue;for(var v of f.readdirSync(p.join(b,o.name),{withFileTypes:true})){if(!v.isDirectory())continue;var c=p.join(b,o.name,v.name);if(f.existsSync(p.join(c,q)))return c}}}}catch(x){}return d})();console.log(r)")}"
+node "$ECC_ROOT/scripts/auto-update.js" --dry-run
+
+# Update only Cursor-managed files in the current project
+node "$ECC_ROOT/scripts/auto-update.js" --target cursor
+
+# Override the ECC repo root explicitly
+node "$ECC_ROOT/scripts/auto-update.js" --repo-root /path/to/everything-claude-code
+```
+
+## 说明
+
+* 此命令使用记录的安装状态请求，在拉取最新仓库更改后重新运行 `install-apply.js`。
+* 重新安装是必要的：它能处理上游的重命名和删除操作，而 `repair.js` 无法仅通过过时的操作安全地重建这些更改。
+* 如需在修改前查看重建的重新安装计划，请先使用 `--dry-run`。

docs/zh-CN/commands/feature-dev.md

@@ -0,0 +1,49 @@
+---
+description: 基于代码库理解和架构重点的引导式功能开发
+---
+
+一种结构化的功能开发工作流程，强调在编写新代码之前先理解现有代码。
+
+## 阶段
+
+### 1. 发现
+
+* 仔细阅读功能需求
+* 识别需求、约束和验收标准
+* 如果需求不明确，提出澄清性问题
+
+### 2. 代码库探索
+
+* 使用 `code-explorer` 分析相关的现有代码
+* 追踪执行路径和架构层次
+* 理解集成点和约定
+
+### 3. 澄清性问题
+
+* 展示探索过程中的发现
+* 提出有针对性的设计和边界情况问题
+* 等待用户回复后再继续
+
+### 4. 架构设计
+
+* 使用 `code-architect` 设计功能
+* 提供实现蓝图
+* 等待批准后再实施
+
+### 5. 实现
+
+* 按照批准的设计实现功能
+* 在适当的情况下优先采用 TDD
+* 保持提交小而专注
+
+### 6. 质量审查
+
+* 使用 `code-reviewer` 审查实现
+* 处理关键和重要问题
+* 验证测试覆盖率
+
+### 7. 总结
+
+* 总结已构建的内容
+* 列出后续事项或限制
+* 提供测试说明

docs/zh-CN/commands/flutter-build.md

@@ -0,0 +1,166 @@
+---
+description: 逐步修复 Dart 分析器错误和 Flutter 构建失败。调用 dart-build-resolver 代理进行最小化的精准修复。
+---
+
+# Flutter 构建与修复
+
+此命令调用 **dart-build-resolver** 代理，以最小改动增量修复 Dart/Flutter 构建错误。
+
+## 命令功能
+
+1. **运行诊断**：执行 `flutter analyze`、`flutter pub get`
+2. **解析错误**：按文件分组并按严重性排序
+3. **增量修复**：每次修复一个错误
+4. **验证每次修复**：每次更改后重新运行分析
+5. **报告摘要**：显示已修复内容和剩余问题
+
+## 使用时机
+
+在以下情况使用 `/flutter-build`：
+
+* `flutter analyze` 报告错误
+* `flutter build` 在任何平台失败
+* `dart pub get` / `flutter pub get` 因版本冲突失败
+* `build_runner` 代码生成失败
+* 拉取更改后导致构建中断
+
+## 运行的诊断命令
+
+```bash
+# Analysis
+flutter analyze 2>&1
+
+# Dependencies
+flutter pub get 2>&1
+
+# Code generation (if project uses build_runner)
+dart run build_runner build --delete-conflicting-outputs 2>&1
+
+# Platform builds
+flutter build apk 2>&1
+flutter build web 2>&1
+```
+
+## 示例会话
+
+````text
+用户：/flutter-build
+
+代理：
+# Flutter 构建问题解决
+
+## 初始诊断
+
+```
+$ flutter analyze
+分析项目中...
+
+  error • lib/features/user/data/user_repository_impl.dart:34:16 •
+    类型为 'String?' 的值无法赋值给类型为 'String' 的变量。 •
+    invalid_assignment
+
+  error • lib/features/cart/presentation/cart_page.dart:58:5 •
+    类型 'List<Item>' 未定义方法 'add'。
+    请尝试将名称更正为现有方法的名称，或定义名为 'add' 的方法。 •
+    undefined_method
+
+发现 2 个错误。
+```
+
+## 修复 1：空安全
+
+文件：lib/features/user/data/user_repository_impl.dart:34
+错误：类型为 'String?' 的值无法赋值给类型 'String'
+
+修改前：
+```dart
+final id = response.id;
+```
+修改后：
+```dart
+final id = response.id ?? '';
+```
+
+```
+$ flutter analyze
+发现 1 个错误。
+```
+
+## 修复 2：不可变列表
+
+文件：lib/features/cart/presentation/cart_page.dart:58
+错误：类型 'List<Item>' 未定义方法 'add'
+原因：状态持有不可修改的列表；变更通过 Cubit 进行
+
+修改前：
+```dart
+state.items.add(item);
+```
+修改后：
+```dart
+context.read<CartCubit>().addItem(item);
+// 注意：Cubit 暴露命名方法（addItem, removeItem）；
+// .add(event) 是 BLoC 事件 API — 不要混淆使用。
+```
+
+```
+$ flutter analyze
+未发现问题！
+```
+
+## 最终验证
+
+```
+$ flutter test
+所有测试通过。
+```
+
+## 总结
+
+| 指标 | 数量 |
+|--------|-------|
+| 分析错误修复 | 2 |
+| 修改的文件 | 2 |
+| 剩余问题 | 0 |
+
+构建状态：通过 ✓
+````
+
+## 常见错误修复
+
+| 错误 | 典型修复 |
+|-------|-------------|
+| `A value of type 'X?' can't be assigned to 'X'` | 添加 `?? default` 或空值保护 |
+| `The name 'X' isn't defined` | 添加导入或修正拼写错误 |
+| `Non-nullable instance field must be initialized` | 添加初始化器或 `late` |
+| `Version solving failed` | 调整 pubspec.yaml 中的版本约束 |
+| `Missing concrete implementation of 'X'` | 实现缺失的接口方法 |
+| `build_runner: Part of X expected` | 删除过时的 `.g.dart` 并重建 |
+
+## 修复策略
+
+1. **优先分析错误** — 代码必须无错误
+2. **其次处理警告** — 修复可能导致运行时错误的警告
+3. **第三解决 pub 冲突** — 修复依赖解析问题
+4. **每次修复一个** — 验证每次更改
+5. **最小改动** — 仅修复，不重构
+
+## 停止条件
+
+代理将在以下情况停止并报告：
+
+* 同一错误在 3 次尝试后仍然存在
+* 修复引入了更多错误
+* 需要架构变更
+* 包升级冲突需要用户决策
+
+## 相关命令
+
+* `/flutter-test` — 构建成功后运行测试
+* `/flutter-review` — 审查代码质量
+* `verification-loop` 技能 — 完整验证循环
+
+## 相关信息
+
+* 代理：`agents/dart-build-resolver.md`
+* 技能：`skills/flutter-dart-code-review/`

docs/zh-CN/commands/flutter-review.md

@@ -0,0 +1,118 @@
+---
+description: 审查 Flutter/Dart 代码，检查惯用模式、小部件最佳实践、状态管理、性能、可访问性和安全性。调用 flutter-reviewer 代理。
+---
+
+# Flutter 代码审查
+
+此命令调用 **flutter-reviewer** 智能体来审查 Flutter/Dart 代码变更。
+
+## 此命令的功能
+
+1. **收集上下文**：审查 `git diff --staged` 和 `git diff`
+2. **检查项目**：检查 `pubspec.yaml`、`analysis_options.yaml`、状态管理方案
+3. **安全预扫描**：检查硬编码密钥和关键安全问题
+4. **全面审查**：应用完整的审查清单
+5. **报告发现**：按严重程度分组输出问题，并附带修复指导
+
+## 前置条件
+
+在运行 `/flutter-review` 之前，请确保：
+
+1. **构建通过** — 先运行 `/flutter-build`；对损坏的代码进行审查是不完整的
+2. **测试通过** — 运行 `/flutter-test` 以确认没有回归问题
+3. **无合并冲突** — 解决所有冲突，使差异仅反映有意的更改
+4. **`flutter analyze` 干净** — 在审查前修复分析器警告
+
+## 使用时机
+
+在以下情况下使用 `/flutter-review`：
+
+* 提交包含 Flutter/Dart 变更的 PR 之前（在构建和测试通过后）
+* 实现新功能后，尽早发现问题
+* 审查他人的 Flutter 代码时
+* 审计 widget、状态管理组件或服务类时
+* 生产发布之前
+
+## 审查领域
+
+| 领域 | 严重程度 |
+|------|----------|
+| 硬编码密钥、明文 HTTP | 严重 |
+| 架构违规、状态管理反模式 | 严重 |
+| Widget 重建问题、资源泄漏 | 高 |
+| `dispose()`、`BuildContext` 后缺少 await | 高 |
+| Dart 空安全、缺少错误/加载状态 | 高 |
+| Const 传播、Widget 组合 | 高 |
+| 性能：`build()` 中的耗时操作 | 高 |
+| 无障碍、语义标签 | 中 |
+| 缺少状态转换测试 | 高 |
+| 硬编码字符串（l10n） | 中 |
+| Pub 依赖卫生 | 低 |
+
+## 示例会话
+
+```text
+用户：/flutter-review
+
+代理：
+# Flutter 代码审查
+
+## 上下文
+
+变更文件：
+- lib/features/auth/presentation/login_page.dart
+- lib/features/auth/data/auth_repository_impl.dart
+
+状态管理：Riverpod（从 pubspec.yaml 检测到）
+架构：功能优先
+
+## 安全预扫描
+
+✓ 未检测到硬编码密钥
+✓ 未检测到明文 HTTP 调用
+
+## 审查发现
+
+[高] 异步间隙后使用 BuildContext 但未进行 mounted 检查
+文件：lib/features/auth/presentation/login_page.dart:67
+问题：`context.go('/home')` 在 `await auth.login(...)` 之后调用，但未进行 `mounted` 检查。
+修复：在所有 await 之后的导航前添加 `if (!context.mounted) return;`（Flutter 3.7+）。
+
+[高] AsyncValue 错误状态未处理
+文件：lib/features/auth/presentation/login_page.dart:42
+问题：`ref.watch(authProvider)` 在 switch 中处理了 loading/data 状态，但没有 `error` 分支。
+修复：在 switch 表达式或 `when()` 调用中添加错误情况，以显示面向用户的错误消息。
+
+[中] 硬编码字符串未本地化
+文件：lib/features/auth/presentation/login_page.dart:89
+问题：`Text('Login')` — 用户可见字符串未使用本地化系统。
+修复：使用项目的 l10n 访问器：`Text(context.l10n.loginButton)`。
+
+## 审查总结
+
+| 严重程度 | 数量 | 状态 |
+|----------|------|------|
+| 严重     | 0    | 通过 |
+| 高       | 2    | 阻塞 |
+| 中       | 1    | 信息 |
+| 低       | 0    | 备注 |
+
+结论：阻塞 — 高严重性问题必须在合并前修复。
+```
+
+## 批准标准
+
+* **批准**：无严重或高等级问题
+* **阻止**：任何严重或高等级问题必须在合并前修复
+
+## 相关命令
+
+* `/flutter-build` — 先修复构建错误
+* `/flutter-test` — 审查前运行测试
+* `/code-review` — 通用代码审查（语言无关）
+
+## 相关
+
+* 智能体：`agents/flutter-reviewer.md`
+* 技能：`skills/flutter-dart-code-review/`
+* 规则：`rules/dart/`

docs/zh-CN/commands/flutter-test.md

@@ -0,0 +1,145 @@
+---
+description: 运行Flutter/Dart测试，报告失败，并逐步修复测试问题。涵盖单元测试、组件测试、黄金测试和集成测试。
+---
+
+# Flutter 测试
+
+此命令运行 Flutter 测试套件并报告结果。当出现失败时，会逐步诊断并修复问题。
+
+## 此命令的功能
+
+1. **运行测试**：执行 `flutter test`（或限定范围至已更改文件）
+2. **解析失败项**：按类型和原因识别失败测试
+3. **逐步修复**：尽可能每次只修复一个失败项
+4. **验证**：每次修复后重新运行
+5. **报告**：显示覆盖率摘要和剩余失败项
+
+## 使用时机
+
+在以下情况使用 `/flutter-test`：
+
+* 实现功能后验证未破坏现有功能
+* 运行 `/flutter-build` 后确保测试通过
+* 检查新代码的测试覆盖率
+* 特定测试文件失败时
+* 提交 PR 前
+
+## 执行的命令
+
+```bash
+# Run all tests
+flutter test 2>&1
+
+# Run with coverage
+flutter test --coverage 2>&1
+
+# Run specific test file
+flutter test test/unit/domain/usecases/get_user_test.dart 2>&1
+
+# Run tests matching a name pattern
+flutter test --name "CartBloc" 2>&1
+
+# Run integration tests (requires device/emulator)
+flutter test integration_test/ 2>&1
+
+# Update golden files when intentional visual changes are made
+flutter test --update-goldens 2>&1
+```
+
+## 示例会话
+
+````text
+用户：/flutter-test
+
+代理：
+# Flutter 测试运行
+
+## 测试执行
+
+```
+$ flutter test
+00:05 +42 -2: 部分测试失败。
+
+失败：test/unit/data/user_repository_test.dart
+  UserRepository getById
+    当用户未找到时返回 null
+    期望：null
+    实际：User(id: 'test-id', name: 'Test User')
+
+失败：test/widget/cart_page_test.dart
+  CartPage
+    购物车为空时显示空状态
+    期望：恰好一个包含文本 'Your cart is empty' 的组件
+    找到：没有包含文本 'Your cart is empty' 的组件
+```
+
+## 修复 1：仓库测试
+
+文件：test/unit/data/user_repository_test.dart
+失败：`getById` 在应返回 null 时返回了一个用户（针对缺失的 ID）
+
+根本原因：测试设置添加了一个 ID 为 'test-id' 的用户，但查询时使用了 'missing-id'。
+修复：更新测试以查询 'missing-id' —— 设置是正确的，查询是错误的。
+
+```
+$ flutter test test/unit/data/user_repository_test.dart
+1 个测试通过。
+```
+
+## 修复 2：组件测试
+
+文件：test/widget/cart_page_test.dart
+失败：未找到空状态文本组件
+
+根本原因：组件中的空状态消息已从 'Your cart is empty' 重命名为 'Cart is empty'。
+修复：更新测试字符串以匹配当前组件文案。
+
+```
+$ flutter test test/widget/cart_page_test.dart
+1 个测试通过。
+```
+
+## 最终运行
+
+```
+$ flutter test --coverage
+全部 44 个测试通过。
+覆盖率：84.2%（目标：80%）
+```
+
+## 总结
+
+| 指标 | 值 |
+|--------|-------|
+| 总测试数 | 44 |
+| 通过 | 44 |
+| 失败 | 0 |
+| 覆盖率 | 84.2% |
+
+测试状态：通过 ✓
+````
+
+## 常见测试失败项
+
+| 失败类型 | 典型修复方法 |
+|---------|-------------|
+| `Expected: <X> Actual: <Y>` | 更新断言或修复实现 |
+| `Widget not found` | 修复查找器选择器或组件重命名后更新测试 |
+| `Golden file not found` | 运行 `flutter test --update-goldens` 生成 |
+| `Golden mismatch` | 检查差异；若变更有意则运行 `--update-goldens` |
+| `MissingPluginException` | 在测试设置中模拟平台通道 |
+| `LateInitializationError` | 在 `setUp()` 中初始化 `late` 字段 |
+| `pumpAndSettle timed out` | 替换为显式 `pump(Duration)` 调用 |
+
+## 相关命令
+
+* `/flutter-build` — 运行测试前修复构建错误
+* `/flutter-review` — 测试通过后审查代码
+* `tdd-workflow` 技能 — 测试驱动开发工作流
+
+## 相关内容
+
+* 代理：`agents/flutter-reviewer.md`
+* 代理：`agents/dart-build-resolver.md`
+* 技能：`skills/flutter-dart-code-review/`
+* 规则：`rules/dart/testing.md`

docs/zh-CN/commands/gan-build.md

@@ -0,0 +1,109 @@
+---
+description: 运行生成器/评估器构建循环，用于实现任务，具有有限迭代和评分。
+---
+
+从 $ARGUMENTS 中解析以下内容：
+
+1. `brief` — 用户对构建内容的一行描述
+2. `--max-iterations N` — （可选，默认15）最大生成器-评估器循环次数
+3. `--pass-threshold N` — （可选，默认7.0）通过所需的加权分数
+4. `--skip-planner` — （可选）跳过规划器，假设 spec.md 已存在
+5. `--eval-mode MODE` — （可选，默认"playwright"）可选值：playwright、screenshot、code-only
+
+## GAN 风格构建框架
+
+该命令协调一个受 Anthropic 2026年3月框架设计论文启发的三智能体构建循环。
+
+### 阶段0：设置
+
+1. 在项目根目录创建 `gan-harness/` 目录
+2. 创建子目录：`gan-harness/feedback/`、`gan-harness/screenshots/`
+3. 如果尚未初始化 git，则进行初始化
+4. 记录开始时间和配置
+
+### 阶段1：规划（规划器智能体）
+
+除非设置了 `--skip-planner`：
+
+1. 通过任务工具启动 `gan-planner` 智能体，并传入用户的简要说明
+2. 等待其生成 `gan-harness/spec.md` 和 `gan-harness/eval-rubric.md`
+3. 向用户显示规范摘要
+4. 进入阶段2
+
+### 阶段2：生成器-评估器循环
+
+```
+iteration = 1
+while iteration <= max_iterations:
+
+    # 生成
+    通过 Task 工具启动 gan-generator agent：
+    - 读取 spec.md
+    - 如果 iteration > 1：读取 feedback/feedback-{iteration-1}.md
+    - 构建/改进应用程序
+    - 确保开发服务器正在运行
+    - 提交更改
+
+    # 等待生成器完成
+
+    # 评估
+    通过 Task 工具启动 gan-evaluator agent：
+    - 读取 eval-rubric.md 和 spec.md
+    - 测试正在运行的应用程序（模式：playwright/screenshot/code-only）
+    - 根据评分标准打分
+    - 将反馈写入 feedback/feedback-{iteration}.md
+
+    # 等待评估器完成
+
+    # 检查分数
+    读取 feedback/feedback-{iteration}.md
+    提取加权总分
+
+    if score >= pass_threshold:
+        记录 "在第 {iteration} 次迭代中通过，分数为 {score}"
+        跳出循环
+
+    if iteration >= 3 且最近 2 次迭代分数未提升:
+        记录 "检测到平台期 — 提前停止"
+        跳出循环
+
+    iteration += 1
+```
+
+### 阶段3：总结
+
+1. 读取所有反馈文件
+2. 显示最终分数和迭代历史
+3. 展示分数进展：`iteration 1: 4.2 → iteration 2: 5.8 → ... → iteration N: 7.5`
+4. 列出最终评估中遗留的任何问题
+5. 报告总时间和预估成本
+
+### 输出
+
+```markdown
+## GAN 框架构建报告
+
+**简述：** [原始提示]
+**结果：** 通过/失败
+**迭代次数：** N / 最大次数
+**最终得分：** X.X / 10
+
+### 得分进展
+| 迭代 | 设计 | 原创性 | 工艺 | 功能性 | 总分 |
+|------|------|--------|------|--------|------|
+| 1 | ... | ... | ... | ... | X.X |
+| 2 | ... | ... | ... | ... | X.X |
+| N | ... | ... | ... | ... | X.X |
+
+### 剩余问题
+- [最终评估中的任何问题]
+
+### 已创建文件
+- gan-harness/spec.md
+- gan-harness/eval-rubric.md
+- gan-harness/feedback/feedback-001.md 至 feedback-NNN.md
+- gan-harness/generator-state.md
+- gan-harness/build-report.md
+```
+
+将完整报告写入 `gan-harness/build-report.md`。

docs/zh-CN/commands/gan-design.md

@@ -0,0 +1,45 @@
+---
+description: 运行一个生成器/评估器设计循环，用于前端或视觉工作，具有有限迭代和评分。
+---
+
+从 $ARGUMENTS 中解析以下内容：
+
+1. `brief` — 用户对要创建设计的描述
+2. `--max-iterations N` — （可选，默认10）最大设计-评估循环次数
+3. `--pass-threshold N` — （可选，默认7.5）通过所需的加权分数（设计模式默认值更高）
+
+## GAN 风格设计框架
+
+一个专注于前端设计质量的双代理循环（生成器 + 评估器）。无规划器——需求说明即规范。
+
+这与 Anthropic 用于前端设计实验的模式相同，他们在实验中取得了创意突破，例如使用 CSS 透视和门廊导航的 3D 荷兰艺术博物馆。
+
+### 设置
+
+1. 创建 `gan-harness/` 目录
+2. 直接将需求说明写入 `gan-harness/spec.md`
+3. 编写一个专注于设计的 `gan-harness/eval-rubric.md`，并额外加重设计质量和原创性的权重
+
+### 设计专用评估标准
+
+```markdown
+### 设计质量（权重：0.35）
+### 原创性（权重：0.30）
+### 工艺水平（权重：0.25）
+### 功能性（权重：0.10）
+```
+
+注意：原创性权重更高（0.30 vs 0.20）以推动创意突破。功能性权重较低，因为设计模式侧重于视觉质量。
+
+### 循环
+
+与 `/project:gan-build` 阶段 2 相同，但：
+
+* 跳过规划器
+* 使用设计专用评估标准
+* 生成器提示强调视觉质量而非功能完整性
+* 评估器提示强调"这个设计能赢得设计奖吗？"而非"所有功能都正常吗？"
+
+### 与 gan-build 的关键区别
+
+生成器被告知："你的首要目标是视觉卓越。一个惊艳的半成品应用胜过功能齐全但丑陋的应用。推动创意飞跃——不寻常的布局、自定义动画、独特的色彩搭配。"

docs/zh-CN/commands/hookify-configure.md

@@ -0,0 +1,14 @@
+---
+description: 交互式启用或禁用 hookify 规则
+---
+
+交互式启用或禁用现有的 hookify 规则。
+
+## 步骤
+
+1. 查找所有 `.claude/hookify.*.local.md` 文件
+2. 读取每条规则的当前状态
+3. 展示列表，包含每条规则的当前启用/禁用状态
+4. 询问需要切换哪些规则
+5. 更新所选规则文件中的 `enabled:` 字段
+6. 确认更改

docs/zh-CN/commands/hookify-help.md

@@ -0,0 +1,46 @@
+---
+description: 获取关于hookify系统的帮助
+---
+
+显示完整的 hookify 文档。
+
+## Hook 系统概述
+
+Hookify 创建与 Claude Code 的 hook 系统集成的规则文件，以防止不必要的行为。
+
+### 事件类型
+
+* `bash`：在 Bash 工具使用时触发，匹配命令模式
+* `file`：在写入/编辑工具使用时触发，匹配文件路径
+* `stop`：在会话结束时触发
+* `prompt`：在用户消息提交时触发，匹配输入模式
+* `all`：在所有事件上触发
+
+### 规则文件格式
+
+文件存储为 `.claude/hookify.{name}.local.md`：
+
+```yaml
+---
+name: descriptive-name
+enabled: true
+event: bash|file|stop|prompt|all
+action: block|warn
+pattern: "regex pattern to match"
+---
+Message to display when rule triggers.
+Supports multiple lines.
+```
+
+### 命令
+
+* `/hookify [description]` 创建新规则，并在未提供描述时自动分析对话
+* `/hookify-list` 列出已配置的规则
+* `/hookify-configure` 启用或禁用规则
+
+### 模式提示
+
+* 使用正则表达式语法
+* 对于 `bash`，匹配完整的命令字符串
+* 对于 `file`，匹配文件路径
+* 在部署前测试模式

docs/zh-CN/commands/hookify-list.md

@@ -0,0 +1,21 @@
+---
+description: 列出所有已配置的 hookify 规则
+---
+
+查找并以格式化表格显示所有 hookify 规则。
+
+## 步骤
+
+1. 查找所有 `.claude/hookify.*.local.md` 文件
+2. 读取每个文件的前置元数据：
+   * `name`
+   * `enabled`
+   * `event`
+   * `action`
+   * `pattern`
+3. 以表格形式显示：
+
+| 规则 | 启用状态 | 事件 | 模式 | 文件 |
+|------|---------|-------|---------|------|
+
+4. 显示规则数量，并提醒用户 `/hookify-configure` 后续可更改状态。

docs/zh-CN/commands/hookify.md

@@ -0,0 +1,50 @@
+---
+description: 创建钩子以防止对话分析或明确指令产生的不当行为
+---
+
+创建钩子规则，通过分析对话模式或明确的用户指令，防止 Claude Code 出现不期望的行为。
+
+## 用法
+
+`/hookify [description of behavior to prevent]`
+
+如果不提供参数，则分析当前对话以找出值得阻止的行为。
+
+## 工作流程
+
+### 第一步：收集行为信息
+
+* 带参数：解析用户对不期望行为的描述
+* 不带参数：使用 `conversation-analyzer` 智能体查找：
+  * 明确的纠正
+  * 对重复错误的沮丧反应
+  * 被撤销的更改
+  * 反复出现的类似问题
+
+### 第二步：展示发现
+
+向用户展示：
+
+* 行为描述
+* 建议的事件类型
+* 建议的模式或匹配器
+* 建议的操作
+
+### 第三步：生成规则文件
+
+为每个批准的规则，在 `.claude/hookify.{name}.local.md` 创建文件：
+
+```yaml
+---
+name: rule-name
+enabled: true
+event: bash|file|stop|prompt|all
+action: block|warn
+pattern: "regex pattern"
+---
+Message shown when rule triggers.
+```
+
+### 第四步：确认
+
+报告已创建的规则，以及如何使用 `/hookify-list` 和 `/hookify-configure` 管理这些规则。

docs/zh-CN/commands/jira.md

@@ -0,0 +1,108 @@
+---
+description: 检索Jira工单，分析需求，更新状态或添加评论。使用jira-integration技能和MCP或REST API。
+---
+
+# Jira 命令
+
+直接从工作流中与 Jira 工单交互——获取工单、分析需求、添加评论以及变更状态。
+
+## 用法
+
+```
+/jira get <TICKET-KEY>          # 获取并分析工单
+/jira comment <TICKET-KEY>      # 添加进度评论
+/jira transition <TICKET-KEY>   # 更改工单状态
+/jira search <JQL>              # 使用JQL搜索问题
+```
+
+## 此命令的功能
+
+1. **获取与分析** — 获取 Jira 工单并提取需求、验收标准、测试场景和依赖项
+2. **评论** — 向工单添加结构化的进度更新
+3. **状态变更** — 在工作流状态间移动工单（待办 → 进行中 → 已完成）
+4. **搜索** — 使用 JQL 查询查找问题
+
+## 工作原理
+
+### `/jira get <TICKET-KEY>`
+
+1. 从 Jira 获取工单（通过 MCP `jira_get_issue` 或 REST API）
+2. 提取所有字段：摘要、描述、验收标准、优先级、标签、关联问题
+3. 可选地获取评论以获取更多上下文
+4. 生成结构化分析：
+
+```
+Ticket: PROJ-1234
+Summary: [标题]
+Status: [状态]
+Priority: [优先级]
+Type: [故事/缺陷/任务]
+
+Requirements:
+1. [提取的需求]
+2. [提取的需求]
+
+Acceptance Criteria:
+- [ ] [工单中的验收标准]
+
+Test Scenarios:
+- Happy Path: [描述]
+- Error Case: [描述]
+- Edge Case: [描述]
+
+Dependencies:
+- [关联的问题、API、服务]
+
+Recommended Next Steps:
+- /plan 创建实施计划
+- `tdd-workflow` 技能以测试驱动开发方式实现
+```
+
+### `/jira comment <TICKET-KEY>`
+
+1. 总结当前会话进度（已构建、已测试、已提交的内容）
+2. 格式化为结构化评论
+3. 发布到 Jira 工单
+
+### `/jira transition <TICKET-KEY>`
+
+1. 获取工单的可用状态变更
+2. 向用户显示选项
+3. 执行所选的状态变更
+
+### `/jira search <JQL>`
+
+1. 对 Jira 执行 JQL 查询
+2. 返回匹配问题的摘要表格
+
+## 前提条件
+
+此命令需要 Jira 凭据。请选择以下方式之一：
+
+**选项 A — MCP 服务器（推荐）：**
+将 `jira` 添加到您的 `mcpServers` 配置中（请参阅 `mcp-configs/mcp-servers.json` 获取模板）。
+
+**选项 B — 环境变量：**
+
+```bash
+export JIRA_URL="https://yourorg.atlassian.net"
+export JIRA_EMAIL="your.email@example.com"
+export JIRA_API_TOKEN="your-api-token"
+```
+
+如果缺少凭据，请停止并引导用户进行设置。
+
+## 与其他命令的集成
+
+分析工单后：
+
+* 使用 `/plan` 根据需求创建实施计划
+* 使用 `tdd-workflow` 技能进行测试驱动开发实施
+* 实施后使用 `/code-review`
+* 使用 `/jira comment` 将进度发布回工单
+* 工作完成后使用 `/jira transition` 移动工单
+
+## 相关
+
+* **技能：** `skills/jira-integration/`
+* **MCP 配置：** `mcp-configs/mcp-servers.json` → `jira`

docs/zh-CN/commands/prp-commit.md

@@ -0,0 +1,115 @@
+---
+description: "使用自然语言文件定位快速提交 — 用简单的英语描述要提交的内容"
+argument-hint: "[target description] (blank = all changes)"
+---
+
+# 智能提交
+
+> 改编自 Wirasm 的 PRPs-agentic-eng。属于 PRP 工作流系列。
+
+**输入**：$ARGUMENTS
+
+***
+
+## 阶段 1 — 评估
+
+```bash
+git status --short
+```
+
+如果输出为空 → 停止："没有可提交的内容。"
+
+向用户展示变更摘要（新增、修改、删除、未跟踪）。
+
+***
+
+## 阶段 2 — 解析与暂存
+
+解析 `$ARGUMENTS` 以确定暂存内容：
+
+| 输入 | 解析结果 | Git 命令 |
+|---|---|---|
+| *(空白/空)* | 暂存所有内容 | `git add -A` |
+| `staged` | 使用已暂存的内容 | *(不执行 git add)* |
+| `*.ts` 或 `*.py` 等 | 暂存匹配的 glob 模式 | `git add '*.ts'` |
+| `except tests` | 暂存所有内容，然后取消暂存测试文件 | `git add -A && git reset -- '**/*.test.*' '**/*.spec.*' '**/test_*' 2>/dev/null \|\| true` |
+| `only new files` | 仅暂存未跟踪文件 | `git ls-files --others --exclude-standard \| grep . && git ls-files --others --exclude-standard \| xargs git add` |
+| `the auth changes` | 从状态/差异中解析 — 查找与认证相关的文件 | `git add <matched files>` |
+| 具体文件名 | 暂存这些文件 | `git add <files>` |
+
+对于自然语言输入（如"认证相关的变更"），交叉引用 `git status` 输出和 `git diff` 以识别相关文件。向用户展示你暂存了哪些文件及其原因。
+
+```bash
+git add <determined files>
+```
+
+暂存后，验证：
+
+```bash
+git diff --cached --stat
+```
+
+如果未暂存任何内容，停止："没有文件匹配你的描述。"
+
+***
+
+## 阶段 3 — 提交
+
+使用祈使语气编写单行提交信息：
+
+```
+{type}: {description}
+```
+
+类型：
+
+* `feat` — 新功能或能力
+* `fix` — 错误修复
+* `refactor` — 代码重构，行为不变
+* `docs` — 文档变更
+* `test` — 添加或更新测试
+* `chore` — 构建、配置、依赖项
+* `perf` — 性能改进
+* `ci` — CI/CD 变更
+
+规则：
+
+* 祈使语气（"添加功能"而非"已添加功能"）
+* 类型前缀后使用小写
+* 末尾不加句号
+* 不超过 72 个字符
+* 描述变更内容，而非方式
+
+```bash
+git commit -m "{type}: {description}"
+```
+
+***
+
+## 阶段 4 — 输出
+
+向用户报告：
+
+```
+Committed: {hash_short}
+Message:   {type}: {description}
+Files:     {count} 个文件已更改
+
+下一步：
+  - git push           → 推送到远程
+  - /prp-pr            → 创建拉取请求
+  - /code-review       → 推送前进行代码审查
+```
+
+***
+
+## 示例
+
+| 你说 | 执行结果 |
+|---|---|
+| `/prp-commit` | 暂存所有内容，自动生成信息 |
+| `/prp-commit staged` | 仅提交已暂存的内容 |
+| `/prp-commit *.ts` | 暂存所有 TypeScript 文件，然后提交 |
+| `/prp-commit except tests` | 暂存除测试文件外的所有内容 |
+| `/prp-commit the database migration` | 从状态中查找数据库迁移文件，暂存它们 |
+| `/prp-commit only new files` | 仅暂存未跟踪文件 |

docs/zh-CN/commands/prp-implement.md

@@ -0,0 +1,394 @@
+---
+description: 执行带有严格验证循环的实施计划
+argument-hint: <path/to/plan.md>
+---
+
+> 改编自 Wirasm 的 PRPs-agentic-eng。属于 PRP 工作流系列。
+
+# PRP 实施
+
+按步骤执行计划文件，并进行持续验证。每次更改后立即验证——绝不累积损坏状态。
+
+**核心理念**：验证循环能及早发现错误。每次更改后都运行检查。立即修复问题。
+
+**黄金法则**：如果验证失败，先修复再继续。绝不累积损坏状态。
+
+***
+
+## 阶段 0 — 检测
+
+### 包管理器检测
+
+| 文件存在 | 包管理器 | 运行器 |
+|---|---|---|
+| `bun.lockb` | bun | `bun run` |
+| `pnpm-lock.yaml` | pnpm | `pnpm run` |
+| `yarn.lock` | yarn | `yarn` |
+| `package-lock.json` | npm | `npm run` |
+| `pyproject.toml` 或 `requirements.txt` | uv / pip | `uv run` 或 `python -m` |
+| `Cargo.toml` | cargo | `cargo` |
+| `go.mod` | go | `go` |
+
+### 验证脚本
+
+检查 `package.json`（或等效文件）中可用的脚本：
+
+```bash
+# For Node.js projects
+cat package.json | grep -A 20 '"scripts"'
+```
+
+记录可用的命令：类型检查、代码检查、测试、构建。
+
+***
+
+## 阶段 1 — 加载
+
+读取计划文件：
+
+```bash
+cat "$ARGUMENTS"
+```
+
+从计划中提取以下部分：
+
+* **摘要** — 正在构建什么
+* **要镜像的模式** — 要遵循的代码约定
+* **要更改的文件** — 要创建或修改的内容
+* **逐步任务** — 实施顺序
+* **验证命令** — 如何验证正确性
+* **验收标准** — 完成的定义
+
+如果文件不存在或不是有效的计划：
+
+```
+错误：计划文件未找到或无效。
+请先运行 /prp-plan <功能描述> 来创建计划。
+```
+
+**检查点**：计划已加载。所有部分已识别。任务已提取。
+
+***
+
+## 阶段 2 — 准备
+
+### Git 状态
+
+```bash
+git branch --show-current
+git status --porcelain
+```
+
+### 分支决策
+
+| 当前状态 | 操作 |
+|---|---|
+| 在功能分支上 | 使用当前分支 |
+| 在主分支上，工作区干净 | 创建功能分支：`git checkout -b feat/{plan-name}` |
+| 在主分支上，工作区有未暂存更改 | **停止** — 要求用户先暂存或提交 |
+| 在此功能的 git 工作树中 | 使用该工作树 |
+
+### 同步远程
+
+```bash
+git pull --rebase origin $(git branch --show-current) 2>/dev/null || true
+```
+
+**检查点**：位于正确分支。工作区已就绪。远程已同步。
+
+***
+
+## 阶段 3 — 执行
+
+按顺序处理计划中的每个任务。
+
+### 每个任务的循环
+
+对于**逐步任务**中的每个任务：
+
+1. **读取 MIRROR 参考** — 打开任务 MIRROR 字段中引用的模式文件。在编写代码前理解约定。
+
+2. **实施** — 严格按照模式编写代码。应用 GOTCHA 警告。使用指定的 IMPORTS。
+
+3. **立即验证** — 每次文件更改后：
+   ```bash
+   # 运行类型检查（根据项目调整命令）
+   [阶段 0 中的类型检查命令]
+   ```
+   如果类型检查失败 → 在移动到下一个文件之前修复错误。
+
+4. **跟踪进度** — 记录：`[done] Task N: [task name] — complete`
+
+### 处理偏差
+
+如果实施必须偏离计划：
+
+* 记录**什么**发生了变化
+* 记录**为什么**发生变化
+* 使用修正后的方法继续
+* 这些偏差将在报告中捕获
+
+**检查点**：所有任务已执行。偏差已记录。
+
+***
+
+## 阶段 4 — 验证
+
+运行计划中的所有验证级别。在继续之前修复每个级别的问题。
+
+### 级别 1：静态分析
+
+```bash
+# Type checking — zero errors required
+[project type-check command]
+
+# Linting — fix automatically where possible
+[project lint command]
+[project lint-fix command]
+```
+
+如果自动修复后仍有代码检查错误，请手动修复。
+
+### 级别 2：单元测试
+
+为每个新函数编写测试（如计划中的测试策略所指定）。
+
+```bash
+[project test command for affected area]
+```
+
+* 每个函数至少需要一个测试
+* 覆盖计划中列出的边缘情况
+* 如果测试失败 → 修复实现（而不是测试，除非测试本身有误）
+
+### 级别 3：构建检查
+
+```bash
+[project build command]
+```
+
+构建必须成功，零错误。
+
+### 级别 4：集成测试（如适用）
+
+```bash
+# Start server, run tests, stop server
+[project dev server command] &
+SERVER_PID=$!
+
+# Wait for server to be ready (adjust port as needed)
+SERVER_READY=0
+for i in $(seq 1 30); do
+  if curl -sf http://localhost:PORT/health >/dev/null 2>&1; then
+    SERVER_READY=1
+    break
+  fi
+  sleep 1
+done
+
+if [ "$SERVER_READY" -ne 1 ]; then
+  kill "$SERVER_PID" 2>/dev/null || true
+  echo "ERROR: Server failed to start within 30s" >&2
+  exit 1
+fi
+
+[integration test command]
+TEST_EXIT=$?
+
+kill "$SERVER_PID" 2>/dev/null || true
+wait "$SERVER_PID" 2>/dev/null || true
+
+exit "$TEST_EXIT"
+```
+
+### 级别 5：边缘情况测试
+
+运行计划测试策略清单中的边缘情况。
+
+**检查点**：所有 5 个验证级别均通过。零错误。
+
+***
+
+## 阶段 5 — 报告
+
+### 创建实施报告
+
+```bash
+mkdir -p .claude/PRPs/reports
+```
+
+将报告写入 `.claude/PRPs/reports/{plan-name}-report.md`：
+
+```markdown
+# 实现报告：[功能名称]
+
+## 摘要
+[已实现的内容]
+
+## 评估与实际对比
+
+| 指标 | 预测（计划） | 实际 |
+|---|---|---|
+| 复杂度 | [来自计划] | [实际] |
+| 信心指数 | [来自计划] | [实际] |
+| 变更文件数 | [来自计划] | [实际数量] |
+
+## 已完成任务
+
+| # | 任务 | 状态 | 备注 |
+|---|---|---|---|
+| 1 | [任务名称] | [已完成] 完成 | |
+| 2 | [任务名称] | [已完成] 完成 | 存在偏差 — [原因] |
+
+## 验证结果
+
+| 级别 | 状态 | 备注 |
+|---|---|---|
+| 静态分析 | [已完成] 通过 | |
+| 单元测试 | [已完成] 通过 | 编写了 N 个测试 |
+| 构建 | [已完成] 通过 | |
+| 集成测试 | [已完成] 通过 | 或不适用 |
+| 边界情况 | [已完成] 通过 | |
+
+## 变更文件
+
+| 文件 | 操作 | 行数 |
+|---|---|---|
+| `path/to/file` | 新建 | +N |
+| `path/to/file` | 更新 | +N / -M |
+
+## 与计划的偏差
+[列出所有偏差及其原因，或填写"无"]
+
+## 遇到的问题
+[列出所有问题及解决方案，或填写"无"]
+
+## 编写的测试
+
+| 测试文件 | 测试数量 | 覆盖范围 |
+|---|---|---|
+| `path/to/test` | N 个测试 | [覆盖区域] |
+
+## 后续步骤
+- [ ] 通过 `/code-review` 进行代码审查
+- [ ] 通过 `/prp-pr` 创建拉取请求
+```
+
+### 更新 PRD（如适用）
+
+如果此实施是针对 PRD 阶段的：
+
+1. 将阶段状态从 `in-progress` 更新为 `complete`
+2. 添加报告路径作为参考
+
+### 归档计划
+
+```bash
+mkdir -p .claude/PRPs/plans/completed
+mv "$ARGUMENTS" .claude/PRPs/plans/completed/
+```
+
+**检查点**：报告已创建。PRD 已更新。计划已归档。
+
+***
+
+## 阶段 6 — 输出
+
+向用户报告：
+
+```
+## 实现完成
+
+- **计划**: [计划文件路径] → 已归档至 completed/
+- **分支**: [当前分支名称]
+- **状态**: [完成] 所有任务已完成
+
+### 验证摘要
+
+| 检查项 | 状态 |
+|---|---|
+| 类型检查 | [完成] |
+| 代码检查 | [完成] |
+| 测试 | [完成] (已编写 N 个) |
+| 构建 | [完成] |
+| 集成测试 | [完成] 或 不适用 |
+
+### 文件变更
+- 创建了 [N] 个文件，更新了 [M] 个文件
+
+### 偏差
+[摘要 或 "无 — 完全按计划执行"]
+
+### 产物
+- 报告: `.claude/PRPs/reports/{名称}-report.md`
+- 已归档计划: `.claude/PRPs/plans/completed/{名称}.plan.md`
+
+### PRD 进度（如适用）
+| 阶段 | 状态 |
+|---|---|
+| 阶段 1 | [完成] 已完成 |
+| 阶段 2 | [下一步] |
+| ... | ... |
+
+> 下一步：运行 `/prp-pr` 创建拉取请求，或先运行 `/code-review` 审查更改。
+```
+
+***
+
+## 处理失败
+
+### 类型检查失败
+
+1. 仔细阅读错误信息
+2. 在源文件中修复类型错误
+3. 重新运行类型检查
+4. 仅在干净后继续
+
+### 测试失败
+
+1. 确定错误是在实现中还是在测试中
+2. 修复根本原因（通常是实现）
+3. 重新运行测试
+4. 仅在全部通过后继续
+
+### 代码检查失败
+
+1. 首先运行自动修复
+2. 如果仍有错误，手动修复
+3. 重新运行代码检查
+4. 仅在干净后继续
+
+### 构建失败
+
+1. 通常是类型或导入问题 — 检查错误信息
+2. 修复有问题的文件
+3. 重新运行构建
+4. 仅在成功后继续
+
+### 集成测试失败
+
+1. 检查服务器是否正确启动
+2. 验证端点/路由是否存在
+3. 检查请求格式是否与预期匹配
+4. 修复并重新运行
+
+***
+
+## 成功标准
+
+* **TASKS\_COMPLETE**：计划中的所有任务均已执行
+* **TYPES\_PASS**：零类型错误
+* **LINT\_PASS**：零代码检查错误
+* **TESTS\_PASS**：所有测试通过，已编写新测试
+* **BUILD\_PASS**：构建成功
+* **REPORT\_CREATED**：实施报告已保存
+* **PLAN\_ARCHIVED**：计划已移至 `completed/`
+
+***
+
+## 后续步骤
+
+* 运行 `/code-review` 在提交前审查更改
+* 运行 `/prp-commit` 使用描述性消息提交
+* 运行 `/prp-pr` 创建拉取请求
+* 如果 PRD 有更多阶段，运行 `/prp-plan <next-phase>`

docs/zh-CN/commands/prp-plan.md

@@ -0,0 +1,506 @@
+---
+description: 创建全面的功能实现计划，包括代码库分析和模式提取
+argument-hint: <feature description | path/to/prd.md>
+---
+
+> 改编自 Wirasm 的 PRPs-agentic-eng。属于 PRP 工作流系列。
+
+# PRP 计划
+
+创建一个详细、自包含的实现计划，该计划捕获所有代码库模式、约定和上下文，以便一次性实现一个功能。
+
+**核心理念**：一个优秀的计划包含实现所需的一切，无需再提出其他问题。每个模式、每个约定、每个陷阱——一次性捕获，并在整个过程中引用。
+
+**黄金法则**：如果在实现过程中需要搜索代码库，请立即将该知识捕获到计划中。
+
+***
+
+## 阶段 0 — 检测
+
+根据 `$ARGUMENTS` 确定输入类型：
+
+| 输入模式 | 检测 | 操作 |
+|---|---|---|
+| 以 `.prd.md` 结尾的路径 | PRD 文件路径 | 解析 PRD，查找下一个待处理阶段 |
+| 包含“实施阶段”的 `.md` 路径 | 类似 PRD 的文档 | 解析阶段，查找下一个待处理阶段 |
+| 任何其他文件的路径 | 参考文件 | 读取文件以获取上下文，视为自由格式 |
+| 自由格式文本 | 功能描述 | 直接进入阶段 1 |
+| 空/空白 | 无输入 | 询问用户要规划什么功能 |
+
+### PRD 解析（当输入为 PRD 时）
+
+1. 使用 `cat "$PRD_PATH"` 读取 PRD 文件
+2. 解析 **实施阶段** 部分
+3. 根据状态查找阶段：
+   * 查找 `pending` 阶段
+   * 检查依赖链（一个阶段可能依赖于先前阶段为 `complete`）
+   * 选择 **下一个符合条件的待处理阶段**
+4. 从所选阶段中提取：
+   * 阶段名称和描述
+   * 验收标准
+   * 对先前阶段的依赖
+   * 任何范围说明或约束
+5. 将阶段描述用作要规划的功能
+
+如果没有剩余待处理阶段，则报告所有阶段已完成。
+
+***
+
+## 阶段 1 — 解析
+
+提取并阐明功能需求。
+
+### 功能理解
+
+从输入（PRD 阶段或自由格式描述）中，识别：
+
+* **构建什么**（具体可交付成果）
+* **为什么重要**（用户价值）
+* **谁使用它**（目标用户/系统）
+* **它适合哪里**（代码库的哪个部分）
+
+### 用户故事
+
+格式化为：
+
+```
+作为[用户类型]，
+我希望[能力]，
+以便[收益]。
+```
+
+### 复杂度评估
+
+| 级别 | 指标 | 典型范围 |
+|---|---|---|
+| **小** | 单个文件、隔离更改、无新依赖 | 1-3 个文件，<100 行 |
+| **中** | 多个文件、遵循现有模式、少量新概念 | 3-10 个文件，100-500 行 |
+| **大** | 横切关注点、新模式、外部集成 | 10+ 个文件，500+ 行 |
+| **超大** | 架构更改、新子系统、需要迁移 | 20+ 个文件，考虑拆分 |
+
+### 歧义门控
+
+如果以下任何一项不明确，**停止并向用户提问**，然后再继续：
+
+* 核心可交付成果模糊
+* 成功标准未定义
+* 存在多种有效解释
+* 技术方法存在重大未知数
+
+不要猜测。要提问。基于假设的计划会在实施过程中失败。
+
+***
+
+## 阶段 2 — 探索
+
+收集深入的代码库情报。直接针对以下每个类别搜索代码库。
+
+### 代码库搜索（8 个类别）
+
+对于每个类别，使用 grep、find 和文件读取进行搜索：
+
+1. **类似实现** — 查找与计划功能相似的现有功能。寻找类似的模式、端点、组件或模块。
+
+2. **命名约定** — 识别代码库相关区域中文件、函数、变量、类和导出的命名方式。
+
+3. **错误处理** — 查找在类似代码路径中如何捕获、传播、记录错误并将其返回给用户。
+
+4. **日志记录模式** — 识别记录什么内容、在什么级别以及以什么格式记录。
+
+5. **类型定义** — 查找相关类型、接口、模式及其组织方式。
+
+6. **测试模式** — 查找类似功能的测试方式。注意测试文件位置、命名、设置/拆卸模式以及断言风格。
+
+7. **配置** — 查找相关配置文件、环境变量和功能标志。
+
+8. **依赖项** — 识别类似功能使用的包、导入和内部模块。
+
+### 代码库分析（5 个追踪）
+
+读取相关文件以追踪：
+
+1. **入口点** — 请求/操作如何进入系统并到达您正在修改的区域？
+2. **数据流** — 数据如何在相关代码路径中移动？
+3. **状态更改** — 修改了哪些状态以及在哪里修改？
+4. **契约** — 必须遵守哪些接口、API 或协议？
+5. **模式** — 使用了哪些架构模式（仓库、服务、控制器等）？
+
+### 统一发现表
+
+将发现结果编译到单个参考中：
+
+| 类别 | 文件:行 | 模式 | 关键片段 |
+|---|---|---|---|
+| 命名 | `src/services/userService.ts:1-5` | 服务使用 camelCase，类型使用 PascalCase | `export class UserService` |
+| 错误 | `src/middleware/errorHandler.ts:10-25` | 自定义 AppError 类 | `throw new AppError(...)` |
+| ... | ... | ... | ... |
+
+***
+
+## 阶段 3 — 研究
+
+如果功能涉及外部库、API 或不熟悉的技术：
+
+1. 搜索网络以获取官方文档
+2. 查找使用示例和最佳实践
+3. 识别特定版本的陷阱
+
+将每个发现格式化为：
+
+```
+KEY_INSIGHT: [你学到的内容]
+APPLIES_TO: [这影响计划的哪个部分]
+GOTCHA: [任何警告或版本特定问题]
+```
+
+如果功能仅使用已充分理解的内部模式，则跳过此阶段并注明：“无需外部研究——功能使用已建立的内部模式。”
+
+***
+
+## 阶段 4 — 设计
+
+### 用户体验转换（如果适用）
+
+记录前后用户体验：
+
+**之前：**
+
+```
+┌─────────────────────────────┐
+│  [当前用户体验]              │
+│  展示当前流程，              │
+│  用户所见/所操作的内容        │
+└─────────────────────────────┘
+```
+
+**之后：**
+
+```
+┌─────────────────────────────┐
+│  [新用户体验]               │
+│  展示改进后的流程，          │
+│  用户会看到哪些变化          │
+└─────────────────────────────┘
+```
+
+### 交互更改
+
+| 接触点 | 之前 | 之后 | 备注 |
+|---|---|---|---|
+| ... | ... | ... | ... |
+
+如果功能纯粹是后端/内部且没有用户体验更改，则注明：“内部更改——无面向用户的用户体验转换。”
+
+***
+
+## 阶段 5 — 架构
+
+### 策略设计
+
+定义实施方法：
+
+* **方法**：高级策略（例如，“按照现有仓库模式添加新的服务层”）
+* **考虑的替代方案**：评估了哪些其他方法以及为何被拒绝
+* **范围**：将要构建的具体边界
+* **不构建**：明确列出超出范围的内容（防止实施期间范围蔓延）
+
+***
+
+## 阶段 6 — 生成
+
+使用下面的模板编写完整的计划文档。保存到 `.claude/PRPs/plans/{kebab-case-feature-name}.plan.md`。
+
+如果目录不存在，则创建它：
+
+```bash
+mkdir -p .claude/PRPs/plans
+```
+
+### 计划模板
+
+````markdown
+# 计划：[功能名称]
+
+## 摘要
+[2-3句概述]
+
+## 用户故事
+作为[用户]，我希望[能力]，以便[收益]。
+
+## 问题 → 解决方案
+[当前状态] → [期望状态]
+
+## 元数据
+- **复杂度**：[小 | 中 | 大 | 超大]
+- **来源PRD**：[路径或“N/A”]
+- **PRD阶段**：[阶段名称或“N/A”]
+- **预估文件数**：[数量]
+
+---
+
+## UX设计
+
+### 之前
+[ASCII图表或“N/A — 内部变更”]
+
+### 之后
+[ASCII图表或“N/A — 内部变更”]
+
+### 交互变更
+| 接触点 | 之前 | 之后 | 备注 |
+|---|---|---|---|
+
+---
+
+## 必读文件
+
+实现前必须阅读的文件：
+
+| 优先级 | 文件 | 行号 | 原因 |
+|---|---|---|---|
+| P0（关键） | `path/to/file` | 1-50 | 需遵循的核心模式 |
+| P1（重要） | `path/to/file` | 10-30 | 相关类型 |
+| P2（参考） | `path/to/file` | 全部 | 类似实现 |
+
+## 外部文档
+
+| 主题 | 来源 | 关键要点 |
+|---|---|---|
+| ... | ... | ... |
+
+---
+
+## 需镜像的模式
+
+在代码库中发现的代码模式。请严格遵循。
+
+### 命名约定
+// 来源：[文件:行号]
+[展示命名模式的实际代码片段]
+
+### 错误处理
+// 来源：[文件:行号]
+[展示错误处理的实际代码片段]
+
+### 日志记录模式
+// 来源：[文件:行号]
+[展示日志记录的实际代码片段]
+
+### 仓库模式
+// 来源：[文件:行号]
+[展示数据访问的实际代码片段]
+
+### 服务模式
+// 来源：[文件:行号]
+[展示服务层的实际代码片段]
+
+### 测试结构
+// 来源：[文件:行号]
+[展示测试设置的实际代码片段]
+
+---
+
+## 需变更的文件
+
+| 文件 | 操作 | 理由 |
+|---|---|---|
+| `path/to/file.ts` | 创建 | 功能的新服务 |
+| `path/to/existing.ts` | 更新 | 添加新方法 |
+
+## 不构建的内容
+
+- [明确不在范围内的第1项]
+- [明确不在范围内的第2项]
+
+---
+
+## 分步任务
+
+### 任务1：[名称]
+- **操作**：[要做什么]
+- **实现**：[要编写的具体代码/逻辑]
+- **镜像**：[需遵循的“需镜像的模式”部分中的模式]
+- **导入**：[所需的导入]
+- **陷阱**：[需避免的已知陷阱]
+- **验证**：[如何验证此任务正确]
+
+### 任务2：[名称]
+- **操作**：...
+- **实现**：...
+- **镜像**：...
+- **导入**：...
+- **陷阱**：...
+- **验证**：...
+
+[继续所有任务...]
+
+---
+
+## 测试策略
+
+### 单元测试
+
+| 测试 | 输入 | 预期输出 | 边界情况？ |
+|---|---|---|---|
+| ... | ... | ... | ... |
+
+### 边界情况检查清单
+- [ ] 空输入
+- [ ] 最大尺寸输入
+- [ ] 无效类型
+- [ ] 并发访问
+- [ ] 网络故障（如适用）
+- [ ] 权限被拒绝
+
+---
+
+## 验证命令
+
+### 静态分析
+```bash
+# Run type checker
+[project-specific type check command]
+```
+预期：零类型错误
+
+### 单元测试
+```bash
+# Run tests for affected area
+[project-specific test command]
+```
+预期：所有测试通过
+
+### 完整测试套件
+```bash
+# Run complete test suite
+[project-specific full test command]
+```
+预期：无回归
+
+### 数据库验证（如适用）
+```bash
+# Verify schema/migrations
+[project-specific db command]
+```
+预期：Schema 为最新
+
+### 浏览器验证（如适用）
+```bash
+# Start dev server and verify
+[project-specific dev server command]
+```
+预期：功能按设计工作
+
+### 手动验证
+- [ ] [逐步手动验证检查清单]
+
+---
+
+## 验收标准
+- [ ] 所有任务完成
+- [ ] 所有验证命令通过
+- [ ] 测试已编写并通过
+- [ ] 无类型错误
+- [ ] 无 lint 错误
+- [ ] 符合 UX 设计（如适用）
+
+## 完成检查清单
+- [ ] 代码遵循发现的模式
+- [ ] 错误处理符合代码库风格
+- [ ] 日志记录遵循代码库约定
+- [ ] 测试遵循测试模式
+- [ ] 无硬编码值
+- [ ] 文档已更新（如需要）
+- [ ] 无不必要的范围扩展
+- [ ] 自包含 — 实现期间无需提问
+
+## 风险
+| 风险 | 可能性 | 影响 | 缓解措施 |
+|---|---|---|---|
+| ... | ... | ... | ... |
+
+## 备注
+[任何额外的上下文、决策或观察]
+```
+
+---
+
+## Output
+
+### Save the Plan
+
+Write the generated plan to:
+```
+.claude/PRPs/plans/{kebab-case-feature-name}.plan.md
+```
+
+### Update PRD (if input was a PRD)
+
+If this plan was generated from a PRD phase:
+1. Update the phase status from `pending` to `in-progress`
+2. Add the plan file path as a reference in the phase
+
+### Report to User
+
+```
+## 计划已创建
+
+- **文件**：.claude/PRPs/plans/{kebab-case-feature-name}.plan.md
+- **来源PRD**：[路径或“N/A”]
+- **阶段**：[阶段名称或“独立”]
+- **复杂度**：[级别]
+- **范围**：[N个文件，M个任务]
+- **关键模式**：[前3个发现的模式]
+- **外部研究**：[研究的主题或“无需”]
+- **风险**：[主要风险或“未识别”]
+- **置信度评分**：[1-10] — 单次实现成功的可能性
+
+> 下一步：运行 `/prp-implement .claude/PRPs/plans/{name}.plan.md` 来执行此计划。
+```
+
+---
+
+## 验证
+
+在最终确定之前，请根据以下检查清单验证计划：
+
+### 上下文完整性
+- [ ] 所有相关文件已发现并记录
+- [ ] 命名约定已通过示例捕获
+- [ ] 错误处理模式已记录
+- [ ] 测试模式已识别
+- [ ] 依赖项已列出
+
+### 实现就绪性
+- [ ] 每个任务都有操作、实现、镜像和验证
+- [ ] 没有任务需要额外的代码库搜索
+- [ ] 导入路径已指定
+- [ ] 陷阱已在适用处记录
+
+### 模式忠实度
+- [ ] 代码片段是实际的代码库示例（非虚构）
+- [ ] 来源引用指向真实文件和行号
+- [ ] 模式涵盖命名、错误、日志记录、数据访问和测试
+- [ ] 新代码将与现有代码无法区分
+
+### 验证覆盖范围
+- [ ] 静态分析命令已指定
+- [ ] 测试命令已指定
+- [ ] 构建验证已包含
+
+### UX清晰度
+- [ ] 之前/之后的状态已记录（或标记为N/A）
+- [ ] 交互变更已列出
+- [ ] UX的边界情况已识别
+
+### 无先验知识测试
+不熟悉此代码库的开发人员应能仅使用此计划实现该功能，无需搜索代码库或提问。如果不能，请添加缺失的上下文。
+
+---
+
+## 后续步骤
+
+- 运行 `/prp-implement <plan-path>` 来执行此计划
+- 运行 `/plan` 进行快速对话式规划（无需产物）
+- 如果范围不明确，运行 `/prp-prd` 先创建PRD
+````

docs/zh-CN/commands/prp-pr.md

@@ -0,0 +1,188 @@
+---
+description: "从当前分支创建包含未推送提交的 GitHub PR — 发现模板、分析更改、推送"
+argument-hint: "[base-branch] (default: main)"
+---
+
+# 创建拉取请求
+
+> 改编自 Wirasm 的 PRPs-agentic-eng。属于 PRP 工作流系列的一部分。
+
+**输入**：`$ARGUMENTS` — 可选，可包含基础分支名称和/或标志（例如 `--draft`）。
+
+**解析 `$ARGUMENTS`**：
+
+* 提取所有可识别的标志（`--draft`）
+* 将剩余的非标志文本视为基础分支名称
+* 若未指定，默认基础分支为 `main`
+
+***
+
+## 阶段 1 — 验证
+
+检查前置条件：
+
+```bash
+git branch --show-current
+git status --short
+git log origin/<base>..HEAD --oneline
+```
+
+| 检查项 | 条件 | 失败时的操作 |
+|---|---|---|
+| 不在基础分支上 | 当前分支 ≠ 基础分支 | 停止："请先切换到功能分支。" |
+| 工作目录干净 | 无未提交的更改 | 警告："存在未提交的更改。请先提交或暂存。使用 `/prp-commit` 提交。" |
+| 存在领先提交 | `git log origin/<base>..HEAD` 不为空 | 停止："`<base>` 前无提交。无需创建 PR。" |
+| 无现有 PR | `gh pr list --head <branch> --json number` 为空 | 停止："PR 已存在：#<编号>。使用 `gh pr view <number> --web` 打开。" |
+
+若所有检查通过，继续执行。
+
+***
+
+## 阶段 2 — 发现
+
+### PR 模板
+
+按顺序搜索 PR 模板：
+
+1. `.github/PULL_REQUEST_TEMPLATE/` 目录 — 若存在，列出文件并让用户选择（或使用 `default.md`）
+2. `.github/PULL_REQUEST_TEMPLATE.md`
+3. `.github/pull_request_template.md`
+4. `docs/pull_request_template.md`
+
+若找到，读取并使用其结构作为 PR 正文。
+
+### 提交分析
+
+```bash
+git log origin/<base>..HEAD --format="%h %s" --reverse
+```
+
+分析提交以确定：
+
+* **PR 标题**：使用带类型前缀的常规提交格式 — `feat: ...`、`fix: ...` 等。
+  * 若存在多种类型，使用主导类型
+  * 若为单个提交，直接使用其消息
+* **变更摘要**：按类型/领域对提交进行分组
+
+### 文件分析
+
+```bash
+git diff origin/<base>..HEAD --stat
+git diff origin/<base>..HEAD --name-only
+```
+
+对变更文件进行分类：源代码、测试、文档、配置、迁移。
+
+### PRP 工件
+
+检查相关的 PRP 工件：
+
+* `.claude/PRPs/reports/` — 实现报告
+* `.claude/PRPs/plans/` — 已执行的计划
+* `.claude/PRPs/prds/` — 相关 PRD
+
+若存在，在 PR 正文中引用它们。
+
+***
+
+## 阶段 3 — 推送
+
+```bash
+git push -u origin HEAD
+```
+
+若推送因分歧失败：
+
+```bash
+git fetch origin
+git rebase origin/<base>
+git push -u origin HEAD
+```
+
+若变基发生冲突，停止并通知用户。
+
+***
+
+## 阶段 4 — 创建
+
+### 使用模板
+
+若在阶段 2 中找到 PR 模板，使用提交和文件分析填充每个部分。保留所有模板部分 — 若不适用，将部分留为"不适用"而非删除。
+
+### 无模板
+
+使用以下默认格式：
+
+```markdown
+## 摘要
+
+<用1-2句话描述此PR的功能及原因>
+
+## 变更内容
+
+<bulleted list of changes grouped by area>
+
+## 文件变更
+
+<table or list of changed files with change type: Added/Modified/Deleted>
+
+## 测试说明
+
+<描述变更的测试方式，或填写"需要测试">
+
+## 相关问题
+
+<关联问题，使用Closes/Fixes/Relates to #N格式，或填写"无">
+```
+
+### 创建 PR
+
+```bash
+gh pr create \
+  --title "<PR title>" \
+  --base <base-branch> \
+  --body "<PR body>"
+  # Add --draft if the --draft flag was parsed from $ARGUMENTS
+```
+
+***
+
+## 阶段 5 — 验证
+
+```bash
+gh pr view --json number,url,title,state,baseRefName,headRefName,additions,deletions,changedFiles
+gh pr checks --json name,status,conclusion 2>/dev/null || true
+```
+
+***
+
+## 阶段 6 — 输出
+
+向用户报告：
+
+```
+PR #<number>: <标题>
+URL: <网址>
+分支: <源分支> → <目标分支>
+变更: 共<文件数>个文件，新增<添加行数>行，删除<删除行数>行
+
+CI 检查: <状态摘要 或 "待处理" 或 "未配置">
+
+引用的构建产物:
+  - <PR 正文中链接的任何 PRP 报告/计划>
+
+后续步骤:
+  - gh pr view <编号> --web   → 在浏览器中打开
+  - /code-review <编号>       → 审查该 PR
+  - gh pr merge <编号>        → 准备就绪后合并
+```
+
+***
+
+## 边界情况
+
+* **无 `gh` CLI**：停止并提示："需要 GitHub CLI（`gh`）。安装地址：<https://cli.github.com/>"
+* **未认证**：停止并提示："请先运行 `gh auth login`。"
+* **需要强制推送**：若远程已分歧且已完成变基，使用 `git push --force-with-lease`（切勿使用 `--force`）。
+* **多个 PR 模板**：若 `.github/PULL_REQUEST_TEMPLATE/` 包含多个文件，列出并让用户选择。
+* **大型 PR（超过 20 个文件）**：警告 PR 规模。若变更逻辑上可分离，建议拆分。