feat: add everything-claude-code ECC bundle (.claude/commands/add-or-update-command.md)

feat: add everything-claude-code ECC bundle (.claude/commands/add-new-skill-or-agent.md)
feat: add everything-claude-code ECC bundle (.claude/commands/feature-development.md)
2026-04-01 14:43:28 +08:00 · 2026-04-01 04:45:06 +00:00 · 2026-04-01 04:45:05 +00:00 · 2026-04-01 04:45:04 +00:00 · 2026-04-01 04:45:03 +00:00 · 2026-04-01 04:45:02 +00:00
19 changed files with 1503 additions and 711 deletions
--- a/.agents/skills/everything-claude-code/SKILL.md
+++ b/.agents/skills/everything-claude-code/SKILL.md
@@ -5,169 +5,172 @@

 ## Overview

-This skill documents the core development patterns, coding conventions, and workflows used in the `everything-claude-code` JavaScript repository. It is designed to help contributors understand how to add new skills, agents, commands, install targets, and maintain the codebase according to established conventions. The repository is framework-agnostic, uses conventional commits, and supports modular extension via skills, agents, and command workflows.
+This skill teaches the core development patterns, coding conventions, and collaborative workflows used in the `everything-claude-code` repository. The codebase is written in JavaScript (no framework detected) and is organized for modularity, clarity, and extensibility. It emphasizes clear commit messages, structured documentation, and repeatable workflows for adding new skills, commands, integrations, and conventions.

 ## Coding Conventions

 - **File Naming:**  
-  Use `camelCase` for JavaScript files (e.g., `installManifests.js`), and descriptive names for markdown/config files (e.g., `SKILL.md`, `install-modules.json`).
+  Use `camelCase` for JavaScript files and directories.  
+  _Example:_  
+  ```
+  scripts/lib/installTargets.js
+  tests/hooks/formatCheck.test.js
+  ```

 - **Import Style:**  
-  Use relative imports for modules:
+  Use **relative imports** for modules within the codebase.  
+  _Example:_  
  ```js
-  const registry = require('../lib/install-targets/registry');
+  const installTarget = require('../../lib/installTargets');
  ```

 - **Export Style:**  
-  Both CommonJS (`module.exports = ...`) and ES module (`export default ...`) styles may be used, depending on file context.
+  Both CommonJS (`module.exports`) and ES module (`export`) styles are present.  
+  _Example (CommonJS):_  
+  ```js
+  module.exports = function runHook() { ... };
+  ```
+  _Example (ES Module):_  
+  ```js
+  export function addSkill() { ... }
+  ```

 - **Commit Messages:**  
-  Follow [Conventional Commits](https://www.conventionalcommits.org/) with prefixes such as `fix`, `feat`, `docs`, `chore`.  
-  Example:
-  ```
-  feat: add Gemini install target support
-  ```
+  Follow the **Conventional Commits** standard.  
+  - Prefixes: `fix`, `feat`, `docs`, `chore`
+  - _Example:_  
+    ```
+    feat: add install target for VSCode integration
+    fix: correct agent configuration parsing bug
+    ```

- **Test Files:**  
-  Test files follow the `*.test.js` pattern and are colocated with the code under test or in a `tests/` directory.
+- **Documentation:**  
+  Markdown files are used extensively for documenting skills, commands, agents, and conventions.

 ## Workflows

-### Add New Install Target
-**Trigger:** When supporting a new IDE, platform, or environment for ECC installation  
-**Command:** `/add-install-target`
-
-1. Create a new install target script, e.g., `scripts/lib/install-targets/{target}-project.js`, `.{target}/install.sh`, or `.{target}/install.js`.
-2. Add documentation for the new target, such as `.{target}/README.md`, `.{target}/README.zh-CN.md`, or `.{target}/GEMINI.md`.
-3. Update `manifests/install-modules.json` to register the new target.
-4. Update schemas:  
-   - `schemas/ecc-install-config.schema.json`  
-   - `schemas/install-modules.schema.json`
-5. Update logic in:  
-   - `scripts/lib/install-manifests.js`  
-   - `scripts/lib/install-targets/registry.js`
-6. Add or update tests in `tests/lib/install-targets.test.js`.
-7. Update `README.md` if public-facing install instructions change.
-
-**Example:**
-```js
-// scripts/lib/install-targets/gemini-project.js
-module.exports = function installGemini() {
-  // Installation logic for Gemini
-};
-```
-
---
-
 ### Add New Skill or Agent
-**Trigger:** When introducing a new capability, workflow, or agent persona  
+**Trigger:** When introducing a new skill or agent  
 **Command:** `/add-skill`

-1. Create a new `SKILL.md` in `skills/{skill-name}/` or `.agents/skills/{skill-name}/`.
-2. For agents, add definitions in `agents/{agent-name}.md` or `.codex/agents/{agent-name}.toml`.
-3. Update `manifests/install-modules.json` if the skill is installable.
-4. Update `AGENTS.md` and/or `README.md` to document the new skill/agent.
-5. Add supporting files as needed (e.g., `rules/`, `prompts/`, orchestration scripts).
-6. If orchestration is needed, add a shell or JS orchestrator (e.g., `scripts/{skill-name}.sh`).
+1. Create a new `SKILL.md` file under `skills/<skill-name>/` or `.agents/skills/<agent-name>/`.
+2. Optionally, add supporting agent definition files (e.g., `agents/<agent-name>.md` or `.codex/agents/<agent-name>.toml`).
+3. Update or create related documentation/configuration files (e.g., `AGENTS.md`, `.opencode/opencode.json`).

-**Example:**
-```markdown
-# skills/mySkill/SKILL.md
-
-## Overview
-Describes the "mySkill" capability for ECC.
-
-## Usage
-...
+_Example:_
+```
+skills/myNewSkill/SKILL.md
+.agents/skills/myAgent/SKILL.md
+agents/myAgent.md
+.codex/agents/myAgent.toml
 ```

 ---

-### Add or Update Command Workflow
-**Trigger:** When adding or improving CLI commands or workflows  
+### Add or Update Command
+**Trigger:** When introducing a new CLI command or workflow  
 **Command:** `/add-command`

-1. Create or modify a command markdown file in `commands/{command-name}.md` or `.claude/commands/{command-name}.md`.
-2. Add YAML frontmatter and sections for Purpose, Usage, and Output.
-3. Iterate based on review feedback (fix placeholders, add error handling, clarify protocol).
-4. Update related commands or documentation if part of a workflow.
-5. Document artifact storage locations if applicable.
+1. Create or update a markdown file in `commands/` (e.g., `commands/myCommand.md`).
+2. Document usage, purpose, and output in YAML frontmatter and markdown sections.
+3. Optionally update related documentation or test files.

-**Example:**
-```markdown
---
-name: install
-description: Install a new ECC module
---
-
-## Purpose
-...
-
-## Usage
-...
+_Example:_
+```
+commands/reviewFlow.md
 ```

 ---

-### Agent or Skill Bundle Import
-**Trigger:** When bulk importing conventions, agent definitions, or skill documentation  
-**Command:** `/import-bundle`
+### Add or Update Install Target
+**Trigger:** When supporting a new IDE, platform, or agent integration  
+**Command:** `/add-install-target`

-1. Add multiple files in `.claude/commands/`, `.claude/enterprise/`, `.claude/team/`, `.claude/research/`, `.claude/rules/`, `.codex/agents/`, `.claude/skills/`, `.agents/skills/`, etc.
-2. Include team config, identity, guardrails, research playbook, and skills documentation.
-3. No code/test changes—just documentation and config import.
+1. Add new install scripts and documentation under a tool-specific directory (e.g., `.codebuddy/`, `.gemini/`).
+2. Update `manifests/install-modules.json` and related schema files.
+3. Update or add scripts in `scripts/lib/install-targets/<target>.js`.
+4. Update or add tests for install targets.
+
+_Example:_
+```
+.codebuddy/install.sh
+manifests/install-modules.json
+scripts/lib/install-targets/codebuddy.js
+tests/lib/install-targets.test.js
+```

 ---

-### Dependency Update via Dependabot
-**Trigger:** When Dependabot creates a PR for a new dependency version  
-**Command:** `/update-dependencies`
+### Dependency Bump for GitHub Actions
+**Trigger:** When a new version of a GitHub Actions dependency is released  
+**Command:** `/bump-action`

-1. Update versions in `package.json`, `package-lock.json`, or `yarn.lock`.
-2. Update `.github/workflows/*.yml` for GitHub Actions if needed.
-3. Commit with a standard Dependabot message.
-4. Update `.github/dependabot.yml` for configuration if necessary.
+1. Update version numbers in `.github/workflows/*.yml` for specific actions.
+2. Commit with a standardized message indicating the dependency and new version.
+
+_Example:_
+```
+.github/workflows/ci.yml
+# Update:
+- uses: actions/checkout@v4
+```

 ---

-### Refactor or Fix Skill or Agent
-**Trigger:** When a skill/agent needs to be removed, merged, or reworked  
-**Command:** `/remove-skill`
+### Fix or Update Hook Scripts
+**Trigger:** When improving or repairing CLI/editor hooks  
+**Command:** `/fix-hook`

-1. Remove or modify `SKILL.md` in `skills/{skill-name}/` or `agents/{agent-name}.md`.
-2. Update `manifests/install-modules.json` and documentation.
-3. Restore or remove associated files as needed.
-4. Document the reason for the change (e.g., security, redundancy).
+1. Modify `hooks/hooks.json` to adjust hook configuration or add/remove hooks.
+2. Update or add scripts in `scripts/hooks/*.js` or `scripts/hooks/*.sh` for hook logic.
+3. Update or add tests in `tests/hooks/*.test.js`.
+
+_Example:_
+```
+hooks/hooks.json
+scripts/hooks/formatCheck.js
+tests/hooks/formatCheck.test.js
+```

 ---

+### Add or Update ECC Conventions Bundle
+**Trigger:** When formalizing or updating project conventions and team/process documentation  
+**Command:** `/add-convention`
+
+1. Add or update markdown or JSON files under `.claude/commands/`, `.claude/rules/`, `.claude/team/`, `.claude/research/`, or `.claude/skills/`.
+2. Document new or updated conventions, rules, or playbooks.
+
+_Example:_
+```
+.claude/commands/codeReview.md
+.claude/rules/commitMessage.md
+.claude/team/members.json
+.claude/skills/automation/SKILL.md
+```
+
 ## Testing Patterns

 - **Test Files:**  
-  All test files use the `*.test.js` pattern.
+  Test files follow the pattern `*.test.js` and are colocated with the code they test or in dedicated `tests/` directories.
+
 - **Framework:**  
  No specific testing framework detected; use standard Node.js assertions or your preferred test runner.
- **Location:**  
-  Tests are typically placed in a `tests/` directory or alongside the source files.

-**Example:**
-```js
-// tests/lib/install-targets.test.js
-const installGemini = require('../../scripts/lib/install-targets/gemini-project');
-
-test('Gemini install target works', () => {
-  expect(installGemini()).toBeDefined();
-});
+_Example:_
+```
+tests/lib/install-targets.test.js
+tests/hooks/formatCheck.test.js
 ```

 ## Commands

-| Command             | Purpose                                                      |
-|---------------------|--------------------------------------------------------------|
-| /add-install-target | Add support for a new install target (IDE/platform)          |
-| /add-skill          | Add a new skill or agent to the ECC system                   |
-| /add-command        | Add or update a CLI command or workflow                      |
-| /import-bundle      | Bulk import agent/skill bundles or conventions documentation |
-| /update-dependencies| Update dependencies via Dependabot                           |
-| /remove-skill       | Refactor, remove, or revert a skill or agent                 |
+| Command           | Purpose                                                        |
+|-------------------|----------------------------------------------------------------|
+| /add-skill        | Add a new skill or agent, including documentation and config   |
+| /add-command      | Add or update a CLI command or workflow                       |
+| /add-install-target | Add or update an install target for integrations            |
+| /bump-action      | Bump GitHub Actions workflow dependencies                     |
+| /fix-hook         | Fix, refactor, or enhance hook scripts and configuration      |
+| /add-convention   | Add or update ECC conventions, rules, or team configs         |
 ```
--- a/.claude/commands/add-new-install-target.md
+++ b/.claude/commands/add-new-install-target.md
@@ -1,42 +0,0 @@
---
-name: add-new-install-target
-description: Workflow command scaffold for add-new-install-target in everything-claude-code.
-allowed_tools: ["Bash", "Read", "Write", "Grep", "Glob"]
---
-
-# /add-new-install-target
-
-Use this workflow when working on **add-new-install-target** in `everything-claude-code`.
-
-## Goal
-
-Adds support for a new install target (e.g., Gemini, CodeBuddy) so ECC can be installed on a new platform or IDE.
-
-## Common Files
-
- `manifests/install-modules.json`
- `schemas/ecc-install-config.schema.json`
- `schemas/install-modules.schema.json`
- `scripts/lib/install-manifests.js`
- `scripts/lib/install-targets/{target}-project.js`
- `scripts/lib/install-targets/registry.js`
-
-## Suggested Sequence
-
-1. Understand the current state and failure mode before editing.
-2. Make the smallest coherent change that satisfies the workflow goal.
-3. Run the most relevant verification for touched files.
-4. Summarize what changed and what still needs review.
-
-## Typical Commit Signals
-
- Create a new install target script (e.g., scripts/lib/install-targets/{target}-project.js, .{target}/install.sh, .{target}/install.js)
- Add documentation for the new target (e.g., .{target}/README.md, .{target}/README.zh-CN.md, .{target}/GEMINI.md)
- Update manifests/install-modules.json to register the new target
- Update schemas/ecc-install-config.schema.json and schemas/install-modules.schema.json for schema validation
- Update scripts/lib/install-manifests.js and scripts/lib/install-targets/registry.js to handle the new target
-
-## Notes
-
- Treat this as a scaffold, not a hard-coded script.
- Update the command if the workflow evolves materially.
--- a/.claude/commands/add-new-skill-or-agent.md
+++ b/.claude/commands/add-new-skill-or-agent.md
@@ -10,16 +10,16 @@ Use this workflow when working on **add-new-skill-or-agent** in `everything-clau

 ## Goal

-Adds a new skill or agent to the ECC system, including documentation and registration.
+Adds a new skill or agent to the codebase, including documentation and configuration.

 ## Common Files

- `skills/{skill-name}/SKILL.md`
- `.agents/skills/{skill-name}/SKILL.md`
- `agents/{agent-name}.md`
- `.codex/agents/{agent-name}.toml`
- `manifests/install-modules.json`
+- `skills/*/SKILL.md`
+- `.agents/skills/*/SKILL.md`
+- `agents/*.md`
+- `.codex/agents/*.toml`
 - `AGENTS.md`
+- `.opencode/opencode.json`

 ## Suggested Sequence

@@ -30,11 +30,9 @@ Adds a new skill or agent to the ECC system, including documentation and registr

 ## Typical Commit Signals

- Create a new SKILL.md in skills/{skill-name}/ or .agents/skills/{skill-name}/
- If agent-based, add agent definition(s) in agents/{agent-name}.md or .codex/agents/{agent-name}.toml
- Update manifests/install-modules.json if the skill is installable
- Update AGENTS.md and/or README.md to reflect the new skill/agent
- If applicable, add supporting files (e.g., rules/, prompts/, or orchestration scripts)
+- Create a new SKILL.md file under skills/<skill-name>/ or .agents/skills/<agent-name>/
+- Optionally add supporting agent definition files (e.g., agents/<agent-name>.md or .codex/agents/<agent-name>.toml)
+- Update or create related documentation or configuration files (e.g., AGENTS.md, opencode.json)

 ## Notes

--- a/.claude/commands/add-or-update-command.md
+++ b/.claude/commands/add-or-update-command.md
@@ -0,0 +1,35 @@
+---
+name: add-or-update-command
+description: Workflow command scaffold for add-or-update-command in everything-claude-code.
+allowed_tools: ["Bash", "Read", "Write", "Grep", "Glob"]
+---
+
+# /add-or-update-command
+
+Use this workflow when working on **add-or-update-command** in `everything-claude-code`.
+
+## Goal
+
+Adds or updates a command file, often for new workflows, review flows, or agent orchestration.
+
+## Common Files
+
+- `commands/*.md`
+
+## Suggested Sequence
+
+1. Understand the current state and failure mode before editing.
+2. Make the smallest coherent change that satisfies the workflow goal.
+3. Run the most relevant verification for touched files.
+4. Summarize what changed and what still needs review.
+
+## Typical Commit Signals
+
+- Create or update a markdown file in commands/ (e.g., commands/<command>.md)
+- Document usage, purpose, and output in YAML frontmatter and markdown sections
+- Optionally update related documentation or test files
+
+## Notes
+
+- Treat this as a scaffold, not a hard-coded script.
+- Update the command if the workflow evolves materially.
--- a/.claude/commands/feature-development.md
+++ b/.claude/commands/feature-development.md
@@ -14,9 +14,9 @@ Standard feature implementation workflow

 ## Common Files

- `skills/remotion-video-creation/rules/assets/*`
 - `.opencode/*`
 - `.opencode/plugins/*`
+- `.opencode/plugins/lib/*`
 - `**/*.test.*`

 ## Suggested Sequence
--- a/.claude/ecc-tools.json
+++ b/.claude/ecc-tools.json
@@ -2,7 +2,7 @@
  "version": "1.3",
  "schemaVersion": "1.0",
  "generatedBy": "ecc-tools",
-  "generatedAt": "2026-04-01T00:56:01.731Z",
+  "generatedAt": "2026-04-01T04:44:14.185Z",
  "repo": "https://github.com/affaan-m/everything-claude-code",
  "profiles": {
    "requested": "full",
@@ -149,8 +149,8 @@
    ".claude/team/everything-claude-code-team-config.json",
    ".claude/enterprise/controls.md",
    ".claude/commands/feature-development.md",
-    ".claude/commands/add-new-install-target.md",
-    ".claude/commands/add-new-skill-or-agent.md"
+    ".claude/commands/add-new-skill-or-agent.md",
+    ".claude/commands/add-or-update-command.md"
  ],
  "packageFiles": {
    "runtime-core": [
@@ -179,8 +179,8 @@
    ],
    "workflow-pack": [
      ".claude/commands/feature-development.md",
-      ".claude/commands/add-new-install-target.md",
-      ".claude/commands/add-new-skill-or-agent.md"
+      ".claude/commands/add-new-skill-or-agent.md",
+      ".claude/commands/add-or-update-command.md"
    ]
  },
  "moduleFiles": {
@@ -210,8 +210,8 @@
    ],
    "workflow-pack": [
      ".claude/commands/feature-development.md",
-      ".claude/commands/add-new-install-target.md",
-      ".claude/commands/add-new-skill-or-agent.md"
+      ".claude/commands/add-new-skill-or-agent.md",
+      ".claude/commands/add-or-update-command.md"
    ]
  },
  "files": [
@@ -292,13 +292,13 @@
    },
    {
      "moduleId": "workflow-pack",
-      "path": ".claude/commands/add-new-install-target.md",
-      "description": "Workflow command scaffold for add-new-install-target."
+      "path": ".claude/commands/add-new-skill-or-agent.md",
+      "description": "Workflow command scaffold for add-new-skill-or-agent."
    },
    {
      "moduleId": "workflow-pack",
-      "path": ".claude/commands/add-new-skill-or-agent.md",
-      "description": "Workflow command scaffold for add-new-skill-or-agent."
+      "path": ".claude/commands/add-or-update-command.md",
+      "description": "Workflow command scaffold for add-or-update-command."
    }
  ],
  "workflows": [
@@ -306,13 +306,13 @@
      "command": "feature-development",
      "path": ".claude/commands/feature-development.md"
    },
-    {
-      "command": "add-new-install-target",
-      "path": ".claude/commands/add-new-install-target.md"
-    },
    {
      "command": "add-new-skill-or-agent",
      "path": ".claude/commands/add-new-skill-or-agent.md"
+    },
+    {
+      "command": "add-or-update-command",
+      "path": ".claude/commands/add-or-update-command.md"
    }
  ],
  "adapters": {
@@ -321,8 +321,8 @@
      "identityPath": ".claude/identity.json",
      "commandPaths": [
        ".claude/commands/feature-development.md",
-        ".claude/commands/add-new-install-target.md",
-        ".claude/commands/add-new-skill-or-agent.md"
+        ".claude/commands/add-new-skill-or-agent.md",
+        ".claude/commands/add-or-update-command.md"
      ]
    },
    "codex": {
--- a/.claude/identity.json
+++ b/.claude/identity.json
@@ -10,5 +10,5 @@
    "javascript"
  ],
  "suggestedBy": "ecc-tools-repo-analysis",
-  "createdAt": "2026-04-01T00:56:53.890Z"
+  "createdAt": "2026-04-01T04:44:50.680Z"
 }
--- a/.claude/rules/everything-claude-code-guardrails.md
+++ b/.claude/rules/everything-claude-code-guardrails.md
@@ -25,8 +25,8 @@ Generated by ECC Tools from repository history. Review before treating it as a h
 ## Detected Workflows

 - feature-development: Standard feature implementation workflow
- add-new-install-target: Adds support for a new install target (e.g., Gemini, CodeBuddy) so ECC can be installed on a new platform or IDE.
- add-new-skill-or-agent: Adds a new skill or agent to the ECC system, including documentation and registration.
+- add-new-skill-or-agent: Adds a new skill or agent to the codebase, including documentation and configuration.
+- add-or-update-command: Adds or updates a command file, often for new workflows, review flows, or agent orchestration.

 ## Review Reminder

--- a/.claude/skills/everything-claude-code/SKILL.md
+++ b/.claude/skills/everything-claude-code/SKILL.md
@@ -5,169 +5,172 @@

 ## Overview

-This skill documents the core development patterns, coding conventions, and workflows used in the `everything-claude-code` JavaScript repository. It is designed to help contributors understand how to add new skills, agents, commands, install targets, and maintain the codebase according to established conventions. The repository is framework-agnostic, uses conventional commits, and supports modular extension via skills, agents, and command workflows.
+This skill teaches the core development patterns, coding conventions, and collaborative workflows used in the `everything-claude-code` repository. The codebase is written in JavaScript (no framework detected) and is organized for modularity, clarity, and extensibility. It emphasizes clear commit messages, structured documentation, and repeatable workflows for adding new skills, commands, integrations, and conventions.

 ## Coding Conventions

 - **File Naming:**  
-  Use `camelCase` for JavaScript files (e.g., `installManifests.js`), and descriptive names for markdown/config files (e.g., `SKILL.md`, `install-modules.json`).
+  Use `camelCase` for JavaScript files and directories.  
+  _Example:_  
+  ```
+  scripts/lib/installTargets.js
+  tests/hooks/formatCheck.test.js
+  ```

 - **Import Style:**  
-  Use relative imports for modules:
+  Use **relative imports** for modules within the codebase.  
+  _Example:_  
  ```js
-  const registry = require('../lib/install-targets/registry');
+  const installTarget = require('../../lib/installTargets');
  ```

 - **Export Style:**  
-  Both CommonJS (`module.exports = ...`) and ES module (`export default ...`) styles may be used, depending on file context.
+  Both CommonJS (`module.exports`) and ES module (`export`) styles are present.  
+  _Example (CommonJS):_  
+  ```js
+  module.exports = function runHook() { ... };
+  ```
+  _Example (ES Module):_  
+  ```js
+  export function addSkill() { ... }
+  ```

 - **Commit Messages:**  
-  Follow [Conventional Commits](https://www.conventionalcommits.org/) with prefixes such as `fix`, `feat`, `docs`, `chore`.  
-  Example:
-  ```
-  feat: add Gemini install target support
-  ```
+  Follow the **Conventional Commits** standard.  
+  - Prefixes: `fix`, `feat`, `docs`, `chore`
+  - _Example:_  
+    ```
+    feat: add install target for VSCode integration
+    fix: correct agent configuration parsing bug
+    ```

- **Test Files:**  
-  Test files follow the `*.test.js` pattern and are colocated with the code under test or in a `tests/` directory.
+- **Documentation:**  
+  Markdown files are used extensively for documenting skills, commands, agents, and conventions.

 ## Workflows

-### Add New Install Target
-**Trigger:** When supporting a new IDE, platform, or environment for ECC installation  
-**Command:** `/add-install-target`
-
-1. Create a new install target script, e.g., `scripts/lib/install-targets/{target}-project.js`, `.{target}/install.sh`, or `.{target}/install.js`.
-2. Add documentation for the new target, such as `.{target}/README.md`, `.{target}/README.zh-CN.md`, or `.{target}/GEMINI.md`.
-3. Update `manifests/install-modules.json` to register the new target.
-4. Update schemas:  
-   - `schemas/ecc-install-config.schema.json`  
-   - `schemas/install-modules.schema.json`
-5. Update logic in:  
-   - `scripts/lib/install-manifests.js`  
-   - `scripts/lib/install-targets/registry.js`
-6. Add or update tests in `tests/lib/install-targets.test.js`.
-7. Update `README.md` if public-facing install instructions change.
-
-**Example:**
-```js
-// scripts/lib/install-targets/gemini-project.js
-module.exports = function installGemini() {
-  // Installation logic for Gemini
-};
-```
-
---
-
 ### Add New Skill or Agent
-**Trigger:** When introducing a new capability, workflow, or agent persona  
+**Trigger:** When introducing a new skill or agent  
 **Command:** `/add-skill`

-1. Create a new `SKILL.md` in `skills/{skill-name}/` or `.agents/skills/{skill-name}/`.
-2. For agents, add definitions in `agents/{agent-name}.md` or `.codex/agents/{agent-name}.toml`.
-3. Update `manifests/install-modules.json` if the skill is installable.
-4. Update `AGENTS.md` and/or `README.md` to document the new skill/agent.
-5. Add supporting files as needed (e.g., `rules/`, `prompts/`, orchestration scripts).
-6. If orchestration is needed, add a shell or JS orchestrator (e.g., `scripts/{skill-name}.sh`).
+1. Create a new `SKILL.md` file under `skills/<skill-name>/` or `.agents/skills/<agent-name>/`.
+2. Optionally, add supporting agent definition files (e.g., `agents/<agent-name>.md` or `.codex/agents/<agent-name>.toml`).
+3. Update or create related documentation/configuration files (e.g., `AGENTS.md`, `.opencode/opencode.json`).

-**Example:**
-```markdown
-# skills/mySkill/SKILL.md
-
-## Overview
-Describes the "mySkill" capability for ECC.
-
-## Usage
-...
+_Example:_
+```
+skills/myNewSkill/SKILL.md
+.agents/skills/myAgent/SKILL.md
+agents/myAgent.md
+.codex/agents/myAgent.toml
 ```

 ---

-### Add or Update Command Workflow
-**Trigger:** When adding or improving CLI commands or workflows  
+### Add or Update Command
+**Trigger:** When introducing a new CLI command or workflow  
 **Command:** `/add-command`

-1. Create or modify a command markdown file in `commands/{command-name}.md` or `.claude/commands/{command-name}.md`.
-2. Add YAML frontmatter and sections for Purpose, Usage, and Output.
-3. Iterate based on review feedback (fix placeholders, add error handling, clarify protocol).
-4. Update related commands or documentation if part of a workflow.
-5. Document artifact storage locations if applicable.
+1. Create or update a markdown file in `commands/` (e.g., `commands/myCommand.md`).
+2. Document usage, purpose, and output in YAML frontmatter and markdown sections.
+3. Optionally update related documentation or test files.

-**Example:**
-```markdown
---
-name: install
-description: Install a new ECC module
---
-
-## Purpose
-...
-
-## Usage
-...
+_Example:_
+```
+commands/reviewFlow.md
 ```

 ---

-### Agent or Skill Bundle Import
-**Trigger:** When bulk importing conventions, agent definitions, or skill documentation  
-**Command:** `/import-bundle`
+### Add or Update Install Target
+**Trigger:** When supporting a new IDE, platform, or agent integration  
+**Command:** `/add-install-target`

-1. Add multiple files in `.claude/commands/`, `.claude/enterprise/`, `.claude/team/`, `.claude/research/`, `.claude/rules/`, `.codex/agents/`, `.claude/skills/`, `.agents/skills/`, etc.
-2. Include team config, identity, guardrails, research playbook, and skills documentation.
-3. No code/test changes—just documentation and config import.
+1. Add new install scripts and documentation under a tool-specific directory (e.g., `.codebuddy/`, `.gemini/`).
+2. Update `manifests/install-modules.json` and related schema files.
+3. Update or add scripts in `scripts/lib/install-targets/<target>.js`.
+4. Update or add tests for install targets.
+
+_Example:_
+```
+.codebuddy/install.sh
+manifests/install-modules.json
+scripts/lib/install-targets/codebuddy.js
+tests/lib/install-targets.test.js
+```

 ---

-### Dependency Update via Dependabot
-**Trigger:** When Dependabot creates a PR for a new dependency version  
-**Command:** `/update-dependencies`
+### Dependency Bump for GitHub Actions
+**Trigger:** When a new version of a GitHub Actions dependency is released  
+**Command:** `/bump-action`

-1. Update versions in `package.json`, `package-lock.json`, or `yarn.lock`.
-2. Update `.github/workflows/*.yml` for GitHub Actions if needed.
-3. Commit with a standard Dependabot message.
-4. Update `.github/dependabot.yml` for configuration if necessary.
+1. Update version numbers in `.github/workflows/*.yml` for specific actions.
+2. Commit with a standardized message indicating the dependency and new version.
+
+_Example:_
+```
+.github/workflows/ci.yml
+# Update:
+- uses: actions/checkout@v4
+```

 ---

-### Refactor or Fix Skill or Agent
-**Trigger:** When a skill/agent needs to be removed, merged, or reworked  
-**Command:** `/remove-skill`
+### Fix or Update Hook Scripts
+**Trigger:** When improving or repairing CLI/editor hooks  
+**Command:** `/fix-hook`

-1. Remove or modify `SKILL.md` in `skills/{skill-name}/` or `agents/{agent-name}.md`.
-2. Update `manifests/install-modules.json` and documentation.
-3. Restore or remove associated files as needed.
-4. Document the reason for the change (e.g., security, redundancy).
+1. Modify `hooks/hooks.json` to adjust hook configuration or add/remove hooks.
+2. Update or add scripts in `scripts/hooks/*.js` or `scripts/hooks/*.sh` for hook logic.
+3. Update or add tests in `tests/hooks/*.test.js`.
+
+_Example:_
+```
+hooks/hooks.json
+scripts/hooks/formatCheck.js
+tests/hooks/formatCheck.test.js
+```

 ---

+### Add or Update ECC Conventions Bundle
+**Trigger:** When formalizing or updating project conventions and team/process documentation  
+**Command:** `/add-convention`
+
+1. Add or update markdown or JSON files under `.claude/commands/`, `.claude/rules/`, `.claude/team/`, `.claude/research/`, or `.claude/skills/`.
+2. Document new or updated conventions, rules, or playbooks.
+
+_Example:_
+```
+.claude/commands/codeReview.md
+.claude/rules/commitMessage.md
+.claude/team/members.json
+.claude/skills/automation/SKILL.md
+```
+
 ## Testing Patterns

 - **Test Files:**  
-  All test files use the `*.test.js` pattern.
+  Test files follow the pattern `*.test.js` and are colocated with the code they test or in dedicated `tests/` directories.
+
 - **Framework:**  
  No specific testing framework detected; use standard Node.js assertions or your preferred test runner.
- **Location:**  
-  Tests are typically placed in a `tests/` directory or alongside the source files.

-**Example:**
-```js
-// tests/lib/install-targets.test.js
-const installGemini = require('../../scripts/lib/install-targets/gemini-project');
-
-test('Gemini install target works', () => {
-  expect(installGemini()).toBeDefined();
-});
+_Example:_
+```
+tests/lib/install-targets.test.js
+tests/hooks/formatCheck.test.js
 ```

 ## Commands

-| Command             | Purpose                                                      |
-|---------------------|--------------------------------------------------------------|
-| /add-install-target | Add support for a new install target (IDE/platform)          |
-| /add-skill          | Add a new skill or agent to the ECC system                   |
-| /add-command        | Add or update a CLI command or workflow                      |
-| /import-bundle      | Bulk import agent/skill bundles or conventions documentation |
-| /update-dependencies| Update dependencies via Dependabot                           |
-| /remove-skill       | Refactor, remove, or revert a skill or agent                 |
+| Command           | Purpose                                                        |
+|-------------------|----------------------------------------------------------------|
+| /add-skill        | Add a new skill or agent, including documentation and config   |
+| /add-command      | Add or update a CLI command or workflow                       |
+| /add-install-target | Add or update an install target for integrations            |
+| /bump-action      | Bump GitHub Actions workflow dependencies                     |
+| /fix-hook         | Fix, refactor, or enhance hook scripts and configuration      |
+| /add-convention   | Add or update ECC conventions, rules, or team configs         |
 ```
--- a/.claude/team/everything-claude-code-team-config.json
+++ b/.claude/team/everything-claude-code-team-config.json
@@ -8,8 +8,8 @@
  ],
  "commandFiles": [
    ".claude/commands/feature-development.md",
-    ".claude/commands/add-new-install-target.md",
-    ".claude/commands/add-new-skill-or-agent.md"
+    ".claude/commands/add-new-skill-or-agent.md",
+    ".claude/commands/add-or-update-command.md"
  ],
-  "updatedAt": "2026-04-01T00:56:01.731Z"
+  "updatedAt": "2026-04-01T04:44:14.185Z"
 }
--- a/WORKING-CONTEXT.md
+++ b/WORKING-CONTEXT.md
@@ -0,0 +1,77 @@
+# Working Context
+
+Last updated: 2026-04-01
+
+## Purpose
+
+Public ECC plugin repo for agents, skills, commands, hooks, rules, install surfaces, and ECC 2.0 platform buildout.
+
+## Current Truth
+
+- Default branch: `main`
+- Immediate blocker addressed: CI lockfile drift and hook validation breakage fixed in `a273c62`
+- Local full suite status after fix: `1723/1723` passing
+- Main active operational work:
+  - keep default branch green
+  - audit and classify remaining open PR backlog by full diff
+  - continue ECC 2.0 control-plane and operator-surface buildout
+
+## Current Constraints
+
+- No merge by title or commit summary alone.
+- No arbitrary external runtime installs in shipped ECC surfaces.
+- Overlapping skills, hooks, or agents should be consolidated when overlap is material and runtime separation is not required.
+
+## Active Queues
+
+- PR backlog: audit and classify remaining open PRs into merge, port/rebuild, close, or park
+- Product:
+  - selective install cleanup
+  - control plane primitives
+  - operator surface
+  - self-improving skills
+- Security:
+  - keep dependency posture clean
+  - preserve self-contained hook and MCP behavior
+
+## Open PR Classification
+
+- Closed on 2026-04-01 under backlog hygiene / merge policy:
+  - `#1069` `feat: add everything-claude-code ECC bundle`
+  - `#1068` `feat: add everything-claude-code-conventions ECC bundle`
+  - `#1064` `chore(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1`
+  - `#1063` `chore(deps-dev): bump eslint from 9.39.2 to 10.1.0`
+- Closed on 2026-04-01 because the content is sourced from external ecosystems and should only land via manual ECC-native re-port:
+  - `#852` openclaw-user-profiler
+  - `#851` openclaw-soul-forge
+  - `#640` harper skills
+- Native-support candidates to fully diff-audit next:
+  - `#1055` Dart / Flutter support
+  - `#1043` C# reviewer and .NET skills
+  - `#834` localized catalog sync and antigravity target filtering
+- Port or rebuild inside ECC after full audit:
+  - `#894` Jira integration
+  - `#844` ui-demo skill
+  - `#814` + `#808` rebuild as a single consolidated notifications lane for Opencode and cross-harness surfaces
+
+## Interfaces
+
+- Public truth: GitHub issues and PRs
+- Internal execution truth: linked Linear work items under the ECC program
+- Current linked Linear items:
+  - `ECC-206` ecosystem CI baseline
+  - `ECC-207` PR backlog audit and merge-policy enforcement
+  - `ECC-208` context hygiene
+
+## Update Rule
+
+Keep this file detailed for only the current sprint, blockers, and next actions. Summarize completed work into archive or repo docs once it is no longer actively shaping execution.
+
+## Latest Execution Notes
+
+- 2026-04-01: `main` CI was restored locally with `1723/1723` tests passing after lockfile and hook validation fixes.
+- 2026-04-01: Auto-generated ECC bundle PRs `#1068` and `#1069` were closed instead of merged; useful ideas must be ported manually after explicit diff audit.
+- 2026-04-01: Major-version ESLint bump PRs `#1063` and `#1064` were closed; revisit only inside a planned ESLint 10 migration lane.
+- 2026-04-01: Notification PRs `#808` and `#814` were identified as overlapping and should be rebuilt as one unified feature instead of landing as parallel branches.
+- 2026-04-01: External-source skill PRs `#640`, `#851`, and `#852` were closed under the new ingestion policy; copy ideas from audited source later rather than merging branded/source-import PRs directly.
+- 2026-04-01: The remaining low GitHub advisory on `ecc2/Cargo.lock` was addressed by moving `ratatui` to `0.30` with `crossterm_0_28`, which updated transitive `lru` from `0.12.5` to `0.16.3`. `cargo build --manifest-path ecc2/Cargo.toml` still passes.
--- a/ecc2/Cargo.lock
+++ b/ecc2/Cargo.lock
--- a/ecc2/Cargo.toml
+++ b/ecc2/Cargo.toml
@@ -9,7 +9,7 @@ repository = "https://github.com/affaan-m/everything-claude-code"

 [dependencies]
 # TUI
-ratatui = "0.29"
+ratatui = { version = "0.30", features = ["crossterm_0_28"] }
 crossterm = "0.28"

 # Async runtime
--- a/hooks/hooks.json
+++ b/hooks/hooks.json
@@ -158,7 +158,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "#!/bin/bash\nmkdir -p ~/.claude; INPUT=$(cat);\necho \"$INPUT\" | jq -r '\"[\" + (now | todate) + \"] \" + ((.tool_input.command // \"?\") | gsub(\"\n\"; \" \") | gsub(\"--token[= ][^ ]*\"; \"--token=<REDACTED>\") | gsub(\"Authorization:[: ]*[^ ]*[: ]*[^ ]*\"; \"Authorization:<REDACTED>\") | gsub(\"AKIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"ASIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"password[= ][^ ]*\"; \"password=<REDACTED>\") | gsub(\"ghp_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"gho_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"ghs_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"github_pat_[A-Za-z0-9_]+\"; \"<REDACTED>\"))' >> ~/.claude/bash-commands.log 2>/dev/null || true;\nprintf '%s\n' \"$INPUT\""
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/post-bash-command-log.js\" audit"
          }
        ],
        "description": "Audit log all bash commands to ~/.claude/bash-commands.log"
@@ -168,7 +168,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "#!/bin/bash\nmkdir -p ~/.claude; INPUT=$(cat);\necho \"$INPUT\" | jq -r '\"[\" + (now | todate) + \"] tool=Bash command=\" + ((.tool_input.command // \"?\") | gsub(\"\n\"; \" \") | gsub(\"--token[= ][^ ]*\"; \"--token=<REDACTED>\") | gsub(\"Authorization:[: ]*[^ ]*[: ]*[^ ]*\"; \"Authorization:<REDACTED>\") | gsub(\"AKIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"ASIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"password[= ][^ ]*\"; \"password=<REDACTED>\") | gsub(\"ghp_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"gho_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"ghs_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"github_pat_[A-Za-z0-9_]+\"; \"<REDACTED>\"))' >> ~/.claude/cost-tracker.log 2>/dev/null || true;\nprintf '%s\n' \"$INPUT\""
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/post-bash-command-log.js\" cost"
          }
        ],
        "description": "Cost tracker - log bash tool usage with timestamps"
@@ -269,7 +269,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/run-with-flags.js\" \"stop:format-typecheck\" \"scripts/hooks/stop-format-typecheck.js\" \"standard,strict\"",
+            "command": "node -e \"const fs=require('fs');const path=require('path');const {spawnSync}=require('child_process');const raw=fs.readFileSync(0,'utf8');const rel=path.join('scripts','hooks','run-with-flags.js');const hasRunnerRoot=candidate=>{const value=typeof candidate==='string'?candidate.trim():'';return value.length>0&&fs.existsSync(path.join(path.resolve(value),rel));};const root=(()=>{const envRoot=process.env.CLAUDE_PLUGIN_ROOT||'';if(hasRunnerRoot(envRoot))return path.resolve(envRoot.trim());const home=require('os').homedir();const claudeDir=path.join(home,'.claude');if(hasRunnerRoot(claudeDir))return claudeDir;for(const candidate of [path.join(claudeDir,'plugins','everything-claude-code'),path.join(claudeDir,'plugins','everything-claude-code@everything-claude-code'),path.join(claudeDir,'plugins','marketplace','everything-claude-code')]){if(hasRunnerRoot(candidate))return candidate;}try{const cacheBase=path.join(claudeDir,'plugins','cache','everything-claude-code');for(const org of fs.readdirSync(cacheBase,{withFileTypes:true})){if(!org.isDirectory())continue;for(const version of fs.readdirSync(path.join(cacheBase,org.name),{withFileTypes:true})){if(!version.isDirectory())continue;const candidate=path.join(cacheBase,org.name,version.name);if(hasRunnerRoot(candidate))return candidate;}}}catch{}return claudeDir;})();const script=path.join(root,rel);if(fs.existsSync(script)){const result=spawnSync(process.execPath,[script,'stop:format-typecheck','scripts/hooks/stop-format-typecheck.js','standard,strict'],{input:raw,encoding:'utf8',env:process.env,cwd:process.cwd(),timeout:300000});const stdout=typeof result.stdout==='string'?result.stdout:'';if(stdout)process.stdout.write(stdout);else process.stdout.write(raw);if(result.stderr)process.stderr.write(result.stderr);if(result.error||result.status===null||result.signal){const reason=result.error?result.error.message:(result.signal?'signal '+result.signal:'missing exit status');process.stderr.write('[Stop] ERROR: hook runner failed: '+reason+String.fromCharCode(10));process.exit(1);}process.exit(Number.isInteger(result.status)?result.status:0);}process.stderr.write('[Stop] WARNING: could not resolve ECC plugin root; skipping hook'+String.fromCharCode(10));process.stdout.write(raw);\"",
            "timeout": 300
          }
        ],
--- a/package-lock.json
+++ b/package-lock.json
@@ -20,7 +20,7 @@
      },
      "devDependencies": {
        "@eslint/js": "^9.39.2",
-        "c8": "^10.1.2",
+        "c8": "^11.0.0",
        "eslint": "^9.39.2",
        "globals": "^17.1.0",
        "markdownlint-cli": "^0.48.0"
@@ -278,49 +278,6 @@
      "integrity": "sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==",
      "license": "ISC"
    },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@isaacs/cliui/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
    "node_modules/@istanbuljs/schema": {
      "version": "0.1.3",
      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
@@ -359,17 +316,6 @@
        "@jridgewell/sourcemap-codec": "^1.4.14"
      }
    },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=14"
-      }
-    },
    "node_modules/@types/debug": {
      "version": "4.1.12",
      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
@@ -516,9 +462,9 @@
      }
    },
    "node_modules/c8": {
-      "version": "10.1.3",
-      "resolved": "https://registry.npmjs.org/c8/-/c8-10.1.3.tgz",
-      "integrity": "sha512-LvcyrOAaOnrrlMpW22n690PUvxiq4Uf9WMhQwNJ9vgagkL/ph1+D4uvjvDA5XCbykrc0sx+ay6pVi9YZ1GnhyA==",
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/c8/-/c8-11.0.0.tgz",
+      "integrity": "sha512-e/uRViGHSVIJv7zsaDKM7VRn2390TgHXqUSvYwPHBQaU6L7E9L0n9JbdkwdYPvshDT0KymBmmlwSpms3yBaMNg==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
@@ -529,7 +475,7 @@
        "istanbul-lib-coverage": "^3.2.0",
        "istanbul-lib-report": "^3.0.1",
        "istanbul-reports": "^3.1.6",
-        "test-exclude": "^7.0.1",
+        "test-exclude": "^8.0.0",
        "v8-to-istanbul": "^9.0.0",
        "yargs": "^17.7.2",
        "yargs-parser": "^21.1.1"
@@ -538,7 +484,7 @@
        "c8": "bin/c8.js"
      },
      "engines": {
-        "node": ">=18"
+        "node": "20 || >=22"
      },
      "peerDependencies": {
        "monocart-coverage-reports": "^2"
@@ -811,13 +757,6 @@
        "url": "https://github.com/sponsors/wooorm"
      }
    },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
-      "dev": true,
-      "license": "MIT"
-    },
    "node_modules/emoji-regex": {
      "version": "8.0.0",
      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
@@ -1184,22 +1123,18 @@
      }
    },
    "node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
      "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^3.1.2",
-        "minimatch": "^9.0.4",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^1.11.1"
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
+      "engines": {
+        "node": "18 || 20 || >=22"
      },
      "funding": {
        "url": "https://github.com/sponsors/isaacs"
@@ -1218,27 +1153,40 @@
        "node": ">=10.13.0"
      }
    },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
      }
    },
    "node_modules/glob/node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
      "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "brace-expansion": "^5.0.5"
      },
      "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
      },
      "funding": {
        "url": "https://github.com/sponsors/isaacs"
@@ -1448,22 +1396,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/jackspeak": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
-      }
-    },
    "node_modules/js-yaml": {
      "version": "4.1.1",
      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
@@ -1598,11 +1530,14 @@
      "license": "MIT"
    },
    "node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "version": "11.2.7",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.7.tgz",
+      "integrity": "sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA==",
      "dev": true,
-      "license": "ISC"
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
    },
    "node_modules/make-dir": {
      "version": "4.0.0",
@@ -2375,13 +2310,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0"
-    },
    "node_modules/parent-module": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -2436,17 +2364,17 @@
      }
    },
    "node_modules/path-scurry": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
      "dev": true,
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "lru-cache": "^10.2.0",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
      },
      "engines": {
-        "node": ">=16 || 14 >=14.18"
+        "node": "18 || 20 || >=22"
      },
      "funding": {
        "url": "https://github.com/sponsors/isaacs"
@@ -2624,45 +2552,6 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width-cjs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
    "node_modules/strip-ansi": {
      "version": "7.1.2",
      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
@@ -2679,30 +2568,6 @@
        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
      }
    },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
    "node_modules/strip-json-comments": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
@@ -2730,18 +2595,18 @@
      }
    },
    "node_modules/test-exclude": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.2.tgz",
-      "integrity": "sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-8.0.0.tgz",
+      "integrity": "sha512-ZOffsNrXYggvU1mDGHk54I96r26P8SyMjO5slMKSc7+IWmtB/MQKnEC2fP51imB3/pT6YK5cT5E8f+Dd9KdyOQ==",
      "dev": true,
      "license": "ISC",
      "dependencies": {
        "@istanbuljs/schema": "^0.1.2",
-        "glob": "^10.4.1",
+        "glob": "^13.0.6",
        "minimatch": "^10.2.2"
      },
      "engines": {
-        "node": ">=18"
+        "node": "20 || >=22"
      }
    },
    "node_modules/test-exclude/node_modules/balanced-match": {
@@ -2768,13 +2633,13 @@
      }
    },
    "node_modules/test-exclude/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
      "dev": true,
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
      },
      "engines": {
        "node": "18 || 20 || >=22"
@@ -2870,119 +2735,6 @@
        "node": ">=0.10.0"
      }
    },
-    "node_modules/wrap-ansi": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.1.0",
-        "string-width": "^5.0.1",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/wrap-ansi-cjs": {
-      "name": "wrap-ansi",
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/wrap-ansi/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
    "node_modules/y18n": {
      "version": "5.0.8",
      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
--- a/schemas/install-modules.schema.json
+++ b/schemas/install-modules.schema.json
@@ -51,6 +51,7 @@
                "cursor",
                "antigravity",
                "codex",
+                "gemini",
                "opencode",
                "codebuddy"
              ]
--- a/scripts/hooks/post-bash-command-log.js
+++ b/scripts/hooks/post-bash-command-log.js
@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const MAX_STDIN = 1024 * 1024;
+let raw = '';
+
+const MODE_CONFIG = {
+  audit: {
+    fileName: 'bash-commands.log',
+    format: command => `[${new Date().toISOString()}] ${command}`,
+  },
+  cost: {
+    fileName: 'cost-tracker.log',
+    format: command => `[${new Date().toISOString()}] tool=Bash command=${command}`,
+  },
+};
+
+function sanitizeCommand(command) {
+  return String(command || '')
+    .replace(/\n/g, ' ')
+    .replace(/--token[= ][^ ]*/g, '--token=<REDACTED>')
+    .replace(/Authorization:[: ]*[^ ]*[: ]*[^ ]*/gi, 'Authorization:<REDACTED>')
+    .replace(/\bAKIA[A-Z0-9]{16}\b/g, '<REDACTED>')
+    .replace(/\bASIA[A-Z0-9]{16}\b/g, '<REDACTED>')
+    .replace(/password[= ][^ ]*/gi, 'password=<REDACTED>')
+    .replace(/\bghp_[A-Za-z0-9_]+\b/g, '<REDACTED>')
+    .replace(/\bgho_[A-Za-z0-9_]+\b/g, '<REDACTED>')
+    .replace(/\bghs_[A-Za-z0-9_]+\b/g, '<REDACTED>')
+    .replace(/\bgithub_pat_[A-Za-z0-9_]+\b/g, '<REDACTED>');
+}
+
+function appendLine(filePath, line) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.appendFileSync(filePath, `${line}\n`, 'utf8');
+}
+
+function main() {
+  const config = MODE_CONFIG[process.argv[2]];
+
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => {
+    if (raw.length < MAX_STDIN) {
+      const remaining = MAX_STDIN - raw.length;
+      raw += chunk.substring(0, remaining);
+    }
+  });
+
+  process.stdin.on('end', () => {
+    try {
+      if (config) {
+        const input = raw.trim() ? JSON.parse(raw) : {};
+        const command = sanitizeCommand(input.tool_input?.command || '?');
+        appendLine(path.join(os.homedir(), '.claude', config.fileName), config.format(command));
+      }
+    } catch {
+      // Logging must never block the calling hook.
+    }
+
+    process.stdout.write(raw);
+  });
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  sanitizeCommand,
+};
--- a/tests/scripts/post-bash-command-log.test.js
+++ b/tests/scripts/post-bash-command-log.test.js
@@ -0,0 +1,104 @@
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const scriptPath = path.join(__dirname, '..', '..', 'scripts', 'hooks', 'post-bash-command-log.js');
+const { sanitizeCommand } = require(scriptPath);
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`PASS: ${name}`);
+    return true;
+  } catch (error) {
+    console.log(`FAIL: ${name}`);
+    console.log(`  ${error.message}`);
+    return false;
+  }
+}
+
+function runHook(mode, payload, homeDir) {
+  return spawnSync('node', [scriptPath, mode], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      HOME: homeDir,
+    },
+  });
+}
+
+let passed = 0;
+let failed = 0;
+
+if (
+  test('sanitizeCommand redacts common secret formats', () => {
+    const input = 'gh pr create --token abc123 Authorization: Bearer hello password=swordfish ghp_abc github_pat_xyz';
+    const sanitized = sanitizeCommand(input);
+    assert.ok(!sanitized.includes('abc123'));
+    assert.ok(!sanitized.includes('swordfish'));
+    assert.ok(!sanitized.includes('ghp_abc'));
+    assert.ok(!sanitized.includes('github_pat_xyz'));
+    assert.ok(sanitized.includes('--token=<REDACTED>'));
+    assert.ok(sanitized.includes('Authorization:<REDACTED>'));
+    assert.ok(sanitized.includes('password=<REDACTED>'));
+  })
+)
+  passed++;
+else failed++;
+
+if (
+  test('audit mode logs sanitized bash commands and preserves stdout', () => {
+    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-bash-log-'));
+    const payload = {
+      tool_input: {
+        command: 'git push --token abc123',
+      },
+    };
+
+    try {
+      const result = runHook('audit', payload, homeDir);
+      assert.strictEqual(result.status, 0, result.stdout + result.stderr);
+      assert.strictEqual(result.stdout, JSON.stringify(payload));
+
+      const logFile = path.join(homeDir, '.claude', 'bash-commands.log');
+      const logContent = fs.readFileSync(logFile, 'utf8');
+      assert.ok(logContent.includes('--token=<REDACTED>'));
+      assert.ok(!logContent.includes('abc123'));
+    } finally {
+      fs.rmSync(homeDir, { recursive: true, force: true });
+    }
+  })
+)
+  passed++;
+else failed++;
+
+if (
+  test('cost mode writes command metrics log', () => {
+    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-cost-log-'));
+    const payload = {
+      tool_input: {
+        command: 'npm publish',
+      },
+    };
+
+    try {
+      const result = runHook('cost', payload, homeDir);
+      assert.strictEqual(result.status, 0, result.stdout + result.stderr);
+
+      const logFile = path.join(homeDir, '.claude', 'cost-tracker.log');
+      const logContent = fs.readFileSync(logFile, 'utf8');
+      assert.match(logContent, /tool=Bash command=npm publish/);
+    } finally {
+      fs.rmSync(homeDir, { recursive: true, force: true });
+    }
+  })
+)
+  passed++;
+else failed++;
+
+console.log(`\nPassed: ${passed}`);
+console.log(`Failed: ${failed}`);
+process.exit(failed > 0 ? 1 : 0);
--- a/yarn.lock
+++ b/yarn.lock
@@ -316,7 +316,7 @@ __metadata:
  languageName: node
  linkType: hard

-"brace-expansion@npm:^5.0.2, brace-expansion@npm:^5.0.5":
+"brace-expansion@npm:^5.0.5":
  version: 5.0.5
  resolution: "brace-expansion@npm:5.0.5"
  dependencies:
@@ -796,9 +796,9 @@ __metadata:
  linkType: hard

 "globals@npm:^17.1.0":
-  version: 17.4.0
-  resolution: "globals@npm:17.4.0"
-  checksum: 10c0/2be9e8c2b9035836f13d420b22f0247a328db82967d3bebfc01126d888ed609305f06c05895914e969653af5c6ba35fd7a0920f3e6c869afa60666c810630feb
+  version: 17.1.0
+  resolution: "globals@npm:17.1.0"
+  checksum: 10c0/4a4a17847676a09f164b8bdce7df105a4f484d6d44586e374087ba9ec7089cbf4c578b8648838dee9917074199c542ce157ea3c07b266f708dfb1652010900c8
  languageName: node
  linkType: hard

@@ -1424,12 +1424,12 @@ __metadata:
  languageName: node
  linkType: hard

-"minimatch@npm:^10.2.2":
-  version: 10.2.4
-  resolution: "minimatch@npm:10.2.4"
+"minimatch@npm:^10.2.2, minimatch@npm:~10.2.4":
+  version: 10.2.5
+  resolution: "minimatch@npm:10.2.5"
  dependencies:
-    brace-expansion: "npm:^5.0.2"
-  checksum: 10c0/35f3dfb7b99b51efd46afd378486889f590e7efb10e0f6a10ba6800428cf65c9a8dedb74427d0570b318d749b543dc4e85f06d46d2858bc8cac7e1eb49a95945
+    brace-expansion: "npm:^5.0.5"
+  checksum: 10c0/6bb058bd6324104b9ec2f763476a35386d05079c1f5fe4fbf1f324a25237cd4534d6813ecd71f48208f4e635c1221899bef94c3c89f7df55698fe373aaae20fd
  languageName: node
  linkType: hard

@@ -1442,15 +1442,6 @@ __metadata:
  languageName: node
  linkType: hard

-"minimatch@npm:~10.2.4":
-  version: 10.2.5
-  resolution: "minimatch@npm:10.2.5"
-  dependencies:
-    brace-expansion: "npm:^5.0.5"
-  checksum: 10c0/6bb058bd6324104b9ec2f763476a35386d05079c1f5fe4fbf1f324a25237cd4534d6813ecd71f48208f4e635c1221899bef94c3c89f7df55698fe373aaae20fd
-  languageName: node
-  linkType: hard
-
 "minimist@npm:^1.2.8":
  version: 1.2.8
  resolution: "minimist@npm:1.2.8"
Author	SHA1	Message	Date
ecc-tools[bot]	732751dabf	feat: add everything-claude-code ECC bundle (.claude/commands/add-or-update-command.md)	2026-04-01 04:45:06 +00:00
ecc-tools[bot]	a81cffbd59	feat: add everything-claude-code ECC bundle (.claude/commands/add-new-skill-or-agent.md)	2026-04-01 04:45:05 +00:00
ecc-tools[bot]	736f1e5b0b	feat: add everything-claude-code ECC bundle (.claude/commands/feature-development.md)	2026-04-01 04:45:04 +00:00
ecc-tools[bot]	b71334ea36	feat: add everything-claude-code ECC bundle (.claude/enterprise/controls.md)	2026-04-01 04:45:03 +00:00
ecc-tools[bot]	02442ee94c	feat: add everything-claude-code ECC bundle (.claude/team/everything-claude-code-team-config.json)	2026-04-01 04:45:02 +00:00
ecc-tools[bot]	b474d639fc	feat: add everything-claude-code ECC bundle (.claude/research/everything-claude-code-research-playbook.md)	2026-04-01 04:45:01 +00:00
ecc-tools[bot]	823c99d5f2	feat: add everything-claude-code ECC bundle (.claude/rules/everything-claude-code-guardrails.md)	2026-04-01 04:45:01 +00:00
ecc-tools[bot]	2e0709732d	feat: add everything-claude-code ECC bundle (.codex/agents/docs-researcher.toml)	2026-04-01 04:45:00 +00:00
ecc-tools[bot]	32fbbd68a4	feat: add everything-claude-code ECC bundle (.codex/agents/reviewer.toml)	2026-04-01 04:44:59 +00:00
ecc-tools[bot]	ef92a3742a	feat: add everything-claude-code ECC bundle (.codex/agents/explorer.toml)	2026-04-01 04:44:58 +00:00
ecc-tools[bot]	4749ddc854	feat: add everything-claude-code ECC bundle (.claude/identity.json)	2026-04-01 04:44:57 +00:00
ecc-tools[bot]	af761f1fd8	feat: add everything-claude-code ECC bundle (.agents/skills/everything-claude-code/agents/openai.yaml)	2026-04-01 04:44:56 +00:00
ecc-tools[bot]	86a85b2904	feat: add everything-claude-code ECC bundle (.agents/skills/everything-claude-code/SKILL.md)	2026-04-01 04:44:55 +00:00
ecc-tools[bot]	f0c418e793	feat: add everything-claude-code ECC bundle (.claude/skills/everything-claude-code/SKILL.md)	2026-04-01 04:44:54 +00:00
ecc-tools[bot]	f488f59b2a	feat: add everything-claude-code ECC bundle (.claude/ecc-tools.json)	2026-04-01 04:44:53 +00:00
Affaan Mustafa	03c4a90ffa	fix: update ecc2 ratatui dependency	2026-03-31 18:23:29 -07:00
Affaan Mustafa	d4b5ca7483	docs: tighten pr backlog classification	2026-03-31 18:21:05 -07:00
Affaan Mustafa	51a87d86d9	docs: add working context file	2026-03-31 18:08:59 -07:00
Affaan Mustafa	a273c62f35	fix: restore ci lockfile and hook validation	2026-03-31 18:00:07 -07:00