feat: add everything-claude-code-conventions ECC bundle (.claude/commands/add-or-update-command.md)

.agents/skills/everything-claude-code/SKILL.md

@@ -48,13 +48,19 @@ Follow these commit message conventions based on 500 analyzed commits.
 *Commit message example*
 
 ```text
-feat: add everything-claude-code ECC bundle (.claude/commands/add-new-agent-or-skill.md)
+feat: add everything-claude-code ECC bundle (.claude/commands/add-or-update-command.md)
 ```
 
 *Commit message example*
 
 ```text
-docs: add Claude Code troubleshooting workarounds
+fix: update ecc2 ratatui dependency
+```
+
+*Commit message example*
+
+```text
+docs: tighten pr backlog classification
 ```
 
 *Commit message example*
@@ -72,13 +78,7 @@ chore: ignore local orchestration artifacts
 *Commit message example*
 
 ```text
-fix(security): remove evalview-agent-testing skill — external dependency
-```
-
-*Commit message example*
-
-```text
-feat: add everything-claude-code ECC bundle (.claude/commands/add-new-install-target.md)
+feat: add everything-claude-code ECC bundle (.claude/commands/add-new-agent-or-skill.md)
 ```
 
 *Commit message example*
@@ -196,32 +196,75 @@ Standard feature implementation workflow
 3. Update documentation
 
 **Files typically involved**:
-- `skills/remotion-video-creation/rules/assets/*`
 - `.opencode/*`
 - `.opencode/plugins/*`
+- `.opencode/plugins/lib/*`
 - `**/*.test.*`
 
 **Example commit sequence**:
 ```
-fix: CI fixes, security audit, remotion skill, lead-intelligence, npm audit (#1039)
-chore(deps-dev): bump globals in the minor-and-patch group (#1062)
-chore(deps): bump actions/github-script from 7.1.0 to 8.0.0 (#1059)
+feat(team-builder): use `claude agents` command for agent discovery (#1021)
+fix: extract inline SessionStart bootstrap to separate file (#1035)
+feat: add hexagonal architecture SKILL. (#1034)
 ```
 
-### Add New Install Target
+### Add New Skill Or Agent
 
-Adds support for a new install target (e.g., CodeBuddy, Gemini) to the system, including scripts, manifests, schemas, and tests.
+Adds a new agent or skill to the codebase, including documentation and configuration.
+
+**Frequency**: ~3 times per month
+
+**Steps**:
+1. Create a new SKILL.md or agent markdown file in the appropriate directory (skills/ or agents/).
+2. Optionally add supporting files such as YAML configs or example usage.
+3. Update relevant index or manifest files if needed.
+
+**Files typically involved**:
+- `skills/*/SKILL.md`
+- `agents/*.md`
+- `.agents/skills/*/SKILL.md`
+- `.claude/skills/*/SKILL.md`
+
+**Example commit sequence**:
+```
+Create a new SKILL.md or agent markdown file in the appropriate directory (skills/ or agents/).
+Optionally add supporting files such as YAML configs or example usage.
+Update relevant index or manifest files if needed.
+```
+
+### Add Or Update Command
+
+Adds or updates a command markdown file, defining new CLI commands or workflows.
 
 **Frequency**: ~2 times per month
 
 **Steps**:
-1. Create new install scripts (install.js, install.sh, uninstall.js, uninstall.sh) in a dedicated directory (e.g., .codebuddy/ or .gemini/).
-2. Add or update a README or documentation file for the new target.
-3. Update manifests/install-modules.json to register the new target.
-4. Update schemas/ecc-install-config.schema.json and schemas/install-modules.schema.json as needed.
-5. Update scripts/lib/install-manifests.js and scripts/lib/install-targets/<target>-project.js.
-6. Update or add tests in tests/lib/install-targets.test.js.
-7. Update registry or related files if necessary.
+1. Create or update a markdown file in the commands/ or .claude/commands/ directory.
+2. Document the command's usage, arguments, and output.
+3. Optionally update related documentation or index files.
+
+**Files typically involved**:
+- `commands/*.md`
+- `.claude/commands/*.md`
+
+**Example commit sequence**:
+```
+Create or update a markdown file in the commands/ or .claude/commands/ directory.
+Document the command's usage, arguments, and output.
+Optionally update related documentation or index files.
+```
+
+### Add Or Update Install Target
+
+Adds or updates an install target, including scripts, schemas, and manifest entries for new integrations.
+
+**Frequency**: ~2 times per month
+
+**Steps**:
+1. Add new install scripts (e.g., install.sh, install.js) in a dedicated directory.
+2. Update manifests/install-modules.json and relevant schema files.
+3. Update or add code in scripts/lib/install-manifests.js and install-targets/*.
+4. Add or update tests for install targets.
 
 **Files typically involved**:
 - `manifests/install-modules.json`
@@ -230,151 +273,57 @@ Adds support for a new install target (e.g., CodeBuddy, Gemini) to the system, i
 - `scripts/lib/install-manifests.js`
 - `scripts/lib/install-targets/*.js`
 - `tests/lib/install-targets.test.js`
-- `.*/README.md`
-- `.*/install.js`
-- `.*/install.sh`
-- `.*/uninstall.js`
-- `.*/uninstall.sh`
+- `.*/install.*`
 
 **Example commit sequence**:
 ```
-Create new install scripts (install.js, install.sh, uninstall.js, uninstall.sh) in a dedicated directory (e.g., .codebuddy/ or .gemini/).
-Add or update a README or documentation file for the new target.
-Update manifests/install-modules.json to register the new target.
-Update schemas/ecc-install-config.schema.json and schemas/install-modules.schema.json as needed.
-Update scripts/lib/install-manifests.js and scripts/lib/install-targets/<target>-project.js.
-Update or add tests in tests/lib/install-targets.test.js.
-Update registry or related files if necessary.
+Add new install scripts (e.g., install.sh, install.js) in a dedicated directory.
+Update manifests/install-modules.json and relevant schema files.
+Update or add code in scripts/lib/install-manifests.js and install-targets/*.
+Add or update tests for install targets.
 ```
 
-### Add New Skill Or Agent
+### Update Hooks Or Hook Scripts
 
-Adds a new skill or agent to the system, including documentation and registration in manifests.
+Updates hook configuration or scripts to change automation, formatting, or session management behaviors.
 
 **Frequency**: ~3 times per month
 
 **Steps**:
-1. Create SKILL.md in skills/<skill-name>/ or .claude/skills/<skill-name>/ or .agents/skills/<skill-name>/.
-2. Create agent definition(s) in agents/<agent-name>.md if needed.
-3. Update manifests/install-modules.json or other relevant manifest files.
-4. Add or update documentation (README.md, AGENTS.md, etc.).
-
-**Files typically involved**:
-- `skills/*/SKILL.md`
-- `.claude/skills/*/SKILL.md`
-- `.agents/skills/*/SKILL.md`
-- `agents/*.md`
-- `manifests/install-modules.json`
-- `README.md`
-- `AGENTS.md`
-
-**Example commit sequence**:
-```
-Create SKILL.md in skills/<skill-name>/ or .claude/skills/<skill-name>/ or .agents/skills/<skill-name>/.
-Create agent definition(s) in agents/<agent-name>.md if needed.
-Update manifests/install-modules.json or other relevant manifest files.
-Add or update documentation (README.md, AGENTS.md, etc.).
-```
-
-### Add Or Update Command Workflow
-
-Adds or extends user-facing commands (e.g., PRP, santa-loop, GAN harness), often with review/feedback cycles.
-
-**Frequency**: ~2 times per month
-
-**Steps**:
-1. Create or update command markdown files in commands/ or .claude/commands/.
-2. Add YAML frontmatter, usage, and output sections as per convention.
-3. Address review feedback with follow-up fixes (e.g., parameter quoting, API usage, documentation).
-4. If needed, update related files (e.g., hooks, tests, AGENTS.md).
-
-**Files typically involved**:
-- `commands/*.md`
-- `.claude/commands/*.md`
-
-**Example commit sequence**:
-```
-Create or update command markdown files in commands/ or .claude/commands/.
-Add YAML frontmatter, usage, and output sections as per convention.
-Address review feedback with follow-up fixes (e.g., parameter quoting, API usage, documentation).
-If needed, update related files (e.g., hooks, tests, AGENTS.md).
-```
-
-### Add Or Update Opencode Agent
-
-Adds new OpenCode agent prompt files and updates agent registration in opencode.json.
-
-**Frequency**: ~2 times per month
-
-**Steps**:
-1. Add new prompt files in .opencode/prompts/agents/*.txt.
-2. Update .opencode/opencode.json to register new agents.
-3. Update AGENTS.md to reflect new agent count or details.
-4. Address review feedback (e.g., remove agents, update documentation).
-
-**Files typically involved**:
-- `.opencode/prompts/agents/*.txt`
-- `.opencode/opencode.json`
-- `AGENTS.md`
-
-**Example commit sequence**:
-```
-Add new prompt files in .opencode/prompts/agents/*.txt.
-Update .opencode/opencode.json to register new agents.
-Update AGENTS.md to reflect new agent count or details.
-Address review feedback (e.g., remove agents, update documentation).
-```
-
-### Add Or Update Hook Orci Script
-
-Implements or fixes hooks and related scripts for formatting, typechecking, session management, or CI integration.
-
-**Frequency**: ~2 times per month
-
-**Steps**:
-1. Edit or add scripts in scripts/hooks/ or hooks/hooks.json.
-2. Update or add tests in tests/hooks/.
-3. Address review feedback (e.g., race conditions, timeouts, path normalization, security).
-4. If needed, update related files (e.g., .cursor/hooks/after-file-edit.js, .github/workflows/*).
+1. Edit hooks/hooks.json to add or modify hook definitions.
+2. Update or add scripts in scripts/hooks/ or tests/hooks/.
+3. Optionally update related shell scripts or adapters.
 
 **Files typically involved**:
+- `hooks/hooks.json`
 - `scripts/hooks/*.js`
 - `scripts/hooks/*.sh`
-- `hooks/hooks.json`
-- `tests/hooks/*.js`
-- `.cursor/hooks/*.js`
-- `.github/workflows/*.yml`
+- `tests/hooks/*.test.js`
 
 **Example commit sequence**:
 ```
-Edit or add scripts in scripts/hooks/ or hooks/hooks.json.
-Update or add tests in tests/hooks/.
-Address review feedback (e.g., race conditions, timeouts, path normalization, security).
-If needed, update related files (e.g., .cursor/hooks/after-file-edit.js, .github/workflows/*).
+Edit hooks/hooks.json to add or modify hook definitions.
+Update or add scripts in scripts/hooks/ or tests/hooks/.
+Optionally update related shell scripts or adapters.
 ```
 
-### Dependency Update Via Dependabot
+### Dependency Bump Github Actions
 
-Automated or manual update of dependencies (npm packages or GitHub Actions) across multiple workflow files.
+Automated or manual updates to GitHub Actions dependencies for CI/CD workflows.
 
 **Frequency**: ~4 times per month
 
 **Steps**:
-1. Update dependency version in package.json, yarn.lock, or relevant workflow YAML.
-2. Update .github/workflows/*.yml to use new action versions.
-3. Commit with standardized message referencing the dependency and version bump.
+1. Update version numbers in .github/workflows/*.yml files for specific actions.
+2. Commit with a standardized message indicating the dependency and new version.
 
 **Files typically involved**:
-- `package.json`
-- `yarn.lock`
-- `package-lock.json`
 - `.github/workflows/*.yml`
 
 **Example commit sequence**:
 ```
-Update dependency version in package.json, yarn.lock, or relevant workflow YAML.
-Update .github/workflows/*.yml to use new action versions.
-Commit with standardized message referencing the dependency and version bump.
+Update version numbers in .github/workflows/*.yml files for specific actions.
+Commit with a standardized message indicating the dependency and new version.
 ```
 
 

.claude/commands/add-new-install-target.md

@@ -1,42 +0,0 @@
----
-name: add-new-install-target
-description: Workflow command scaffold for add-new-install-target in everything-claude-code.
-allowed_tools: ["Bash", "Read", "Write", "Grep", "Glob"]
----
-
-# /add-new-install-target
-
-Use this workflow when working on **add-new-install-target** in `everything-claude-code`.
-
-## Goal
-
-Adds support for a new install target (e.g., CodeBuddy, Gemini) to the system, including scripts, manifests, schemas, and tests.
-
-## Common Files
-
-- `manifests/install-modules.json`
-- `schemas/ecc-install-config.schema.json`
-- `schemas/install-modules.schema.json`
-- `scripts/lib/install-manifests.js`
-- `scripts/lib/install-targets/*.js`
-- `tests/lib/install-targets.test.js`
-
-## Suggested Sequence
-
-1. Understand the current state and failure mode before editing.
-2. Make the smallest coherent change that satisfies the workflow goal.
-3. Run the most relevant verification for touched files.
-4. Summarize what changed and what still needs review.
-
-## Typical Commit Signals
-
-- Create new install scripts (install.js, install.sh, uninstall.js, uninstall.sh) in a dedicated directory (e.g., .codebuddy/ or .gemini/).
-- Add or update a README or documentation file for the new target.
-- Update manifests/install-modules.json to register the new target.
-- Update schemas/ecc-install-config.schema.json and schemas/install-modules.schema.json as needed.
-- Update scripts/lib/install-manifests.js and scripts/lib/install-targets/<target>-project.js.
-
-## Notes
-
-- Treat this as a scaffold, not a hard-coded script.
-- Update the command if the workflow evolves materially.

.claude/commands/add-new-skill-or-agent.md

@@ -10,16 +10,14 @@ Use this workflow when working on **add-new-skill-or-agent** in `everything-clau
 
 ## Goal
 
-Adds a new skill or agent to the system, including documentation and registration in manifests.
+Adds a new agent or skill to the codebase, including documentation and configuration.
 
 ## Common Files
 
 - `skills/*/SKILL.md`
-- `.claude/skills/*/SKILL.md`
-- `.agents/skills/*/SKILL.md`
 - `agents/*.md`
-- `manifests/install-modules.json`
-- `README.md`
+- `.agents/skills/*/SKILL.md`
+- `.claude/skills/*/SKILL.md`
 
 ## Suggested Sequence
 
@@ -30,10 +28,9 @@ Adds a new skill or agent to the system, including documentation and registratio
 
 ## Typical Commit Signals
 
-- Create SKILL.md in skills/<skill-name>/ or .claude/skills/<skill-name>/ or .agents/skills/<skill-name>/.
-- Create agent definition(s) in agents/<agent-name>.md if needed.
-- Update manifests/install-modules.json or other relevant manifest files.
-- Add or update documentation (README.md, AGENTS.md, etc.).
+- Create a new SKILL.md or agent markdown file in the appropriate directory (skills/ or agents/).
+- Optionally add supporting files such as YAML configs or example usage.
+- Update relevant index or manifest files if needed.
 
 ## Notes
 

.claude/commands/add-or-update-command.md

@@ -0,0 +1,36 @@
+---
+name: add-or-update-command
+description: Workflow command scaffold for add-or-update-command in everything-claude-code.
+allowed_tools: ["Bash", "Read", "Write", "Grep", "Glob"]
+---
+
+# /add-or-update-command
+
+Use this workflow when working on **add-or-update-command** in `everything-claude-code`.
+
+## Goal
+
+Adds or updates a command markdown file, defining new CLI commands or workflows.
+
+## Common Files
+
+- `commands/*.md`
+- `.claude/commands/*.md`
+
+## Suggested Sequence
+
+1. Understand the current state and failure mode before editing.
+2. Make the smallest coherent change that satisfies the workflow goal.
+3. Run the most relevant verification for touched files.
+4. Summarize what changed and what still needs review.
+
+## Typical Commit Signals
+
+- Create or update a markdown file in the commands/ or .claude/commands/ directory.
+- Document the command's usage, arguments, and output.
+- Optionally update related documentation or index files.
+
+## Notes
+
+- Treat this as a scaffold, not a hard-coded script.
+- Update the command if the workflow evolves materially.

.claude/commands/feature-development.md

@@ -14,9 +14,9 @@ Standard feature implementation workflow
 
 ## Common Files
 
-- `skills/remotion-video-creation/rules/assets/*`
 - `.opencode/*`
 - `.opencode/plugins/*`
+- `.opencode/plugins/lib/*`
 - `**/*.test.*`
 
 ## Suggested Sequence

.claude/ecc-tools.json

@@ -2,7 +2,7 @@
   "version": "1.3",
   "schemaVersion": "1.0",
   "generatedBy": "ecc-tools",
-  "generatedAt": "2026-03-31T23:03:58.867Z",
+  "generatedAt": "2026-04-01T01:39:13.874Z",
   "repo": "https://github.com/affaan-m/everything-claude-code",
   "profiles": {
     "requested": "full",
@@ -149,8 +149,8 @@
     ".claude/team/everything-claude-code-team-config.json",
     ".claude/enterprise/controls.md",
     ".claude/commands/feature-development.md",
-    ".claude/commands/add-new-install-target.md",
-    ".claude/commands/add-new-skill-or-agent.md"
+    ".claude/commands/add-new-skill-or-agent.md",
+    ".claude/commands/add-or-update-command.md"
   ],
   "packageFiles": {
     "runtime-core": [
@@ -179,8 +179,8 @@
     ],
     "workflow-pack": [
       ".claude/commands/feature-development.md",
-      ".claude/commands/add-new-install-target.md",
-      ".claude/commands/add-new-skill-or-agent.md"
+      ".claude/commands/add-new-skill-or-agent.md",
+      ".claude/commands/add-or-update-command.md"
     ]
   },
   "moduleFiles": {
@@ -210,8 +210,8 @@
     ],
     "workflow-pack": [
       ".claude/commands/feature-development.md",
-      ".claude/commands/add-new-install-target.md",
-      ".claude/commands/add-new-skill-or-agent.md"
+      ".claude/commands/add-new-skill-or-agent.md",
+      ".claude/commands/add-or-update-command.md"
     ]
   },
   "files": [
@@ -292,13 +292,13 @@
     },
     {
       "moduleId": "workflow-pack",
-      "path": ".claude/commands/add-new-install-target.md",
-      "description": "Workflow command scaffold for add-new-install-target."
+      "path": ".claude/commands/add-new-skill-or-agent.md",
+      "description": "Workflow command scaffold for add-new-skill-or-agent."
     },
     {
       "moduleId": "workflow-pack",
-      "path": ".claude/commands/add-new-skill-or-agent.md",
-      "description": "Workflow command scaffold for add-new-skill-or-agent."
+      "path": ".claude/commands/add-or-update-command.md",
+      "description": "Workflow command scaffold for add-or-update-command."
     }
   ],
   "workflows": [
@@ -306,13 +306,13 @@
       "command": "feature-development",
       "path": ".claude/commands/feature-development.md"
     },
-    {
-      "command": "add-new-install-target",
-      "path": ".claude/commands/add-new-install-target.md"
-    },
     {
       "command": "add-new-skill-or-agent",
       "path": ".claude/commands/add-new-skill-or-agent.md"
+    },
+    {
+      "command": "add-or-update-command",
+      "path": ".claude/commands/add-or-update-command.md"
     }
   ],
   "adapters": {
@@ -321,8 +321,8 @@
       "identityPath": ".claude/identity.json",
       "commandPaths": [
         ".claude/commands/feature-development.md",
-        ".claude/commands/add-new-install-target.md",
-        ".claude/commands/add-new-skill-or-agent.md"
+        ".claude/commands/add-new-skill-or-agent.md",
+        ".claude/commands/add-or-update-command.md"
       ]
     },
     "codex": {

.claude/identity.json

@@ -10,5 +10,5 @@
     "javascript"
   ],
   "suggestedBy": "ecc-tools-repo-analysis",
-  "createdAt": "2026-04-01T00:55:29.418Z"
+  "createdAt": "2026-04-01T04:43:36.259Z"
 }

.claude/research/everything-claude-code-research-playbook.md

@@ -18,4 +18,4 @@ Use this when the task is documentation-heavy, source-sensitive, or requires bro
 
 - Primary language: JavaScript
 - Framework: Not detected
-- Workflows detected: 7
+- Workflows detected: 6

.claude/rules/everything-claude-code-guardrails.md

@@ -25,8 +25,8 @@ Generated by ECC Tools from repository history. Review before treating it as a h
 ## Detected Workflows
 
 - feature-development: Standard feature implementation workflow
-- add-new-install-target: Adds support for a new install target (e.g., CodeBuddy, Gemini) to the system, including scripts, manifests, schemas, and tests.
-- add-new-skill-or-agent: Adds a new skill or agent to the system, including documentation and registration in manifests.
+- add-new-skill-or-agent: Adds a new agent or skill to the codebase, including documentation and configuration.
+- add-or-update-command: Adds or updates a command markdown file, defining new CLI commands or workflows.
 
 ## Review Reminder
 

.claude/skills/everything-claude-code/SKILL.md

@@ -48,13 +48,19 @@ Follow these commit message conventions based on 500 analyzed commits.
 *Commit message example*
 
 ```text
-feat: add everything-claude-code ECC bundle (.claude/commands/add-new-agent-or-skill.md)
+feat: add everything-claude-code ECC bundle (.claude/commands/add-or-update-command.md)
 ```
 
 *Commit message example*
 
 ```text
-docs: add Claude Code troubleshooting workarounds
+fix: update ecc2 ratatui dependency
+```
+
+*Commit message example*
+
+```text
+docs: tighten pr backlog classification
 ```
 
 *Commit message example*
@@ -72,13 +78,7 @@ chore: ignore local orchestration artifacts
 *Commit message example*
 
 ```text
-fix(security): remove evalview-agent-testing skill — external dependency
-```
-
-*Commit message example*
-
-```text
-feat: add everything-claude-code ECC bundle (.claude/commands/add-new-install-target.md)
+feat: add everything-claude-code ECC bundle (.claude/commands/add-new-agent-or-skill.md)
 ```
 
 *Commit message example*
@@ -196,32 +196,75 @@ Standard feature implementation workflow
 3. Update documentation
 
 **Files typically involved**:
-- `skills/remotion-video-creation/rules/assets/*`
 - `.opencode/*`
 - `.opencode/plugins/*`
+- `.opencode/plugins/lib/*`
 - `**/*.test.*`
 
 **Example commit sequence**:
 ```
-fix: CI fixes, security audit, remotion skill, lead-intelligence, npm audit (#1039)
-chore(deps-dev): bump globals in the minor-and-patch group (#1062)
-chore(deps): bump actions/github-script from 7.1.0 to 8.0.0 (#1059)
+feat(team-builder): use `claude agents` command for agent discovery (#1021)
+fix: extract inline SessionStart bootstrap to separate file (#1035)
+feat: add hexagonal architecture SKILL. (#1034)
 ```
 
-### Add New Install Target
+### Add New Skill Or Agent
 
-Adds support for a new install target (e.g., CodeBuddy, Gemini) to the system, including scripts, manifests, schemas, and tests.
+Adds a new agent or skill to the codebase, including documentation and configuration.
+
+**Frequency**: ~3 times per month
+
+**Steps**:
+1. Create a new SKILL.md or agent markdown file in the appropriate directory (skills/ or agents/).
+2. Optionally add supporting files such as YAML configs or example usage.
+3. Update relevant index or manifest files if needed.
+
+**Files typically involved**:
+- `skills/*/SKILL.md`
+- `agents/*.md`
+- `.agents/skills/*/SKILL.md`
+- `.claude/skills/*/SKILL.md`
+
+**Example commit sequence**:
+```
+Create a new SKILL.md or agent markdown file in the appropriate directory (skills/ or agents/).
+Optionally add supporting files such as YAML configs or example usage.
+Update relevant index or manifest files if needed.
+```
+
+### Add Or Update Command
+
+Adds or updates a command markdown file, defining new CLI commands or workflows.
 
 **Frequency**: ~2 times per month
 
 **Steps**:
-1. Create new install scripts (install.js, install.sh, uninstall.js, uninstall.sh) in a dedicated directory (e.g., .codebuddy/ or .gemini/).
-2. Add or update a README or documentation file for the new target.
-3. Update manifests/install-modules.json to register the new target.
-4. Update schemas/ecc-install-config.schema.json and schemas/install-modules.schema.json as needed.
-5. Update scripts/lib/install-manifests.js and scripts/lib/install-targets/<target>-project.js.
-6. Update or add tests in tests/lib/install-targets.test.js.
-7. Update registry or related files if necessary.
+1. Create or update a markdown file in the commands/ or .claude/commands/ directory.
+2. Document the command's usage, arguments, and output.
+3. Optionally update related documentation or index files.
+
+**Files typically involved**:
+- `commands/*.md`
+- `.claude/commands/*.md`
+
+**Example commit sequence**:
+```
+Create or update a markdown file in the commands/ or .claude/commands/ directory.
+Document the command's usage, arguments, and output.
+Optionally update related documentation or index files.
+```
+
+### Add Or Update Install Target
+
+Adds or updates an install target, including scripts, schemas, and manifest entries for new integrations.
+
+**Frequency**: ~2 times per month
+
+**Steps**:
+1. Add new install scripts (e.g., install.sh, install.js) in a dedicated directory.
+2. Update manifests/install-modules.json and relevant schema files.
+3. Update or add code in scripts/lib/install-manifests.js and install-targets/*.
+4. Add or update tests for install targets.
 
 **Files typically involved**:
 - `manifests/install-modules.json`
@@ -230,151 +273,57 @@ Adds support for a new install target (e.g., CodeBuddy, Gemini) to the system, i
 - `scripts/lib/install-manifests.js`
 - `scripts/lib/install-targets/*.js`
 - `tests/lib/install-targets.test.js`
-- `.*/README.md`
-- `.*/install.js`
-- `.*/install.sh`
-- `.*/uninstall.js`
-- `.*/uninstall.sh`
+- `.*/install.*`
 
 **Example commit sequence**:
 ```
-Create new install scripts (install.js, install.sh, uninstall.js, uninstall.sh) in a dedicated directory (e.g., .codebuddy/ or .gemini/).
-Add or update a README or documentation file for the new target.
-Update manifests/install-modules.json to register the new target.
-Update schemas/ecc-install-config.schema.json and schemas/install-modules.schema.json as needed.
-Update scripts/lib/install-manifests.js and scripts/lib/install-targets/<target>-project.js.
-Update or add tests in tests/lib/install-targets.test.js.
-Update registry or related files if necessary.
+Add new install scripts (e.g., install.sh, install.js) in a dedicated directory.
+Update manifests/install-modules.json and relevant schema files.
+Update or add code in scripts/lib/install-manifests.js and install-targets/*.
+Add or update tests for install targets.
 ```
 
-### Add New Skill Or Agent
+### Update Hooks Or Hook Scripts
 
-Adds a new skill or agent to the system, including documentation and registration in manifests.
+Updates hook configuration or scripts to change automation, formatting, or session management behaviors.
 
 **Frequency**: ~3 times per month
 
 **Steps**:
-1. Create SKILL.md in skills/<skill-name>/ or .claude/skills/<skill-name>/ or .agents/skills/<skill-name>/.
-2. Create agent definition(s) in agents/<agent-name>.md if needed.
-3. Update manifests/install-modules.json or other relevant manifest files.
-4. Add or update documentation (README.md, AGENTS.md, etc.).
-
-**Files typically involved**:
-- `skills/*/SKILL.md`
-- `.claude/skills/*/SKILL.md`
-- `.agents/skills/*/SKILL.md`
-- `agents/*.md`
-- `manifests/install-modules.json`
-- `README.md`
-- `AGENTS.md`
-
-**Example commit sequence**:
-```
-Create SKILL.md in skills/<skill-name>/ or .claude/skills/<skill-name>/ or .agents/skills/<skill-name>/.
-Create agent definition(s) in agents/<agent-name>.md if needed.
-Update manifests/install-modules.json or other relevant manifest files.
-Add or update documentation (README.md, AGENTS.md, etc.).
-```
-
-### Add Or Update Command Workflow
-
-Adds or extends user-facing commands (e.g., PRP, santa-loop, GAN harness), often with review/feedback cycles.
-
-**Frequency**: ~2 times per month
-
-**Steps**:
-1. Create or update command markdown files in commands/ or .claude/commands/.
-2. Add YAML frontmatter, usage, and output sections as per convention.
-3. Address review feedback with follow-up fixes (e.g., parameter quoting, API usage, documentation).
-4. If needed, update related files (e.g., hooks, tests, AGENTS.md).
-
-**Files typically involved**:
-- `commands/*.md`
-- `.claude/commands/*.md`
-
-**Example commit sequence**:
-```
-Create or update command markdown files in commands/ or .claude/commands/.
-Add YAML frontmatter, usage, and output sections as per convention.
-Address review feedback with follow-up fixes (e.g., parameter quoting, API usage, documentation).
-If needed, update related files (e.g., hooks, tests, AGENTS.md).
-```
-
-### Add Or Update Opencode Agent
-
-Adds new OpenCode agent prompt files and updates agent registration in opencode.json.
-
-**Frequency**: ~2 times per month
-
-**Steps**:
-1. Add new prompt files in .opencode/prompts/agents/*.txt.
-2. Update .opencode/opencode.json to register new agents.
-3. Update AGENTS.md to reflect new agent count or details.
-4. Address review feedback (e.g., remove agents, update documentation).
-
-**Files typically involved**:
-- `.opencode/prompts/agents/*.txt`
-- `.opencode/opencode.json`
-- `AGENTS.md`
-
-**Example commit sequence**:
-```
-Add new prompt files in .opencode/prompts/agents/*.txt.
-Update .opencode/opencode.json to register new agents.
-Update AGENTS.md to reflect new agent count or details.
-Address review feedback (e.g., remove agents, update documentation).
-```
-
-### Add Or Update Hook Orci Script
-
-Implements or fixes hooks and related scripts for formatting, typechecking, session management, or CI integration.
-
-**Frequency**: ~2 times per month
-
-**Steps**:
-1. Edit or add scripts in scripts/hooks/ or hooks/hooks.json.
-2. Update or add tests in tests/hooks/.
-3. Address review feedback (e.g., race conditions, timeouts, path normalization, security).
-4. If needed, update related files (e.g., .cursor/hooks/after-file-edit.js, .github/workflows/*).
+1. Edit hooks/hooks.json to add or modify hook definitions.
+2. Update or add scripts in scripts/hooks/ or tests/hooks/.
+3. Optionally update related shell scripts or adapters.
 
 **Files typically involved**:
+- `hooks/hooks.json`
 - `scripts/hooks/*.js`
 - `scripts/hooks/*.sh`
-- `hooks/hooks.json`
-- `tests/hooks/*.js`
-- `.cursor/hooks/*.js`
-- `.github/workflows/*.yml`
+- `tests/hooks/*.test.js`
 
 **Example commit sequence**:
 ```
-Edit or add scripts in scripts/hooks/ or hooks/hooks.json.
-Update or add tests in tests/hooks/.
-Address review feedback (e.g., race conditions, timeouts, path normalization, security).
-If needed, update related files (e.g., .cursor/hooks/after-file-edit.js, .github/workflows/*).
+Edit hooks/hooks.json to add or modify hook definitions.
+Update or add scripts in scripts/hooks/ or tests/hooks/.
+Optionally update related shell scripts or adapters.
 ```
 
-### Dependency Update Via Dependabot
+### Dependency Bump Github Actions
 
-Automated or manual update of dependencies (npm packages or GitHub Actions) across multiple workflow files.
+Automated or manual updates to GitHub Actions dependencies for CI/CD workflows.
 
 **Frequency**: ~4 times per month
 
 **Steps**:
-1. Update dependency version in package.json, yarn.lock, or relevant workflow YAML.
-2. Update .github/workflows/*.yml to use new action versions.
-3. Commit with standardized message referencing the dependency and version bump.
+1. Update version numbers in .github/workflows/*.yml files for specific actions.
+2. Commit with a standardized message indicating the dependency and new version.
 
 **Files typically involved**:
-- `package.json`
-- `yarn.lock`
-- `package-lock.json`
 - `.github/workflows/*.yml`
 
 **Example commit sequence**:
 ```
-Update dependency version in package.json, yarn.lock, or relevant workflow YAML.
-Update .github/workflows/*.yml to use new action versions.
-Commit with standardized message referencing the dependency and version bump.
+Update version numbers in .github/workflows/*.yml files for specific actions.
+Commit with a standardized message indicating the dependency and new version.
 ```
 
 

.claude/team/everything-claude-code-team-config.json

@@ -8,8 +8,8 @@
   ],
   "commandFiles": [
     ".claude/commands/feature-development.md",
-    ".claude/commands/add-new-install-target.md",
-    ".claude/commands/add-new-skill-or-agent.md"
+    ".claude/commands/add-new-skill-or-agent.md",
+    ".claude/commands/add-or-update-command.md"
   ],
-  "updatedAt": "2026-03-31T23:03:58.867Z"
+  "updatedAt": "2026-04-01T01:39:13.874Z"
 }

WORKING-CONTEXT.md

@@ -0,0 +1,77 @@
+# Working Context
+
+Last updated: 2026-04-01
+
+## Purpose
+
+Public ECC plugin repo for agents, skills, commands, hooks, rules, install surfaces, and ECC 2.0 platform buildout.
+
+## Current Truth
+
+- Default branch: `main`
+- Immediate blocker addressed: CI lockfile drift and hook validation breakage fixed in `a273c62`
+- Local full suite status after fix: `1723/1723` passing
+- Main active operational work:
+  - keep default branch green
+  - audit and classify remaining open PR backlog by full diff
+  - continue ECC 2.0 control-plane and operator-surface buildout
+
+## Current Constraints
+
+- No merge by title or commit summary alone.
+- No arbitrary external runtime installs in shipped ECC surfaces.
+- Overlapping skills, hooks, or agents should be consolidated when overlap is material and runtime separation is not required.
+
+## Active Queues
+
+- PR backlog: audit and classify remaining open PRs into merge, port/rebuild, close, or park
+- Product:
+  - selective install cleanup
+  - control plane primitives
+  - operator surface
+  - self-improving skills
+- Security:
+  - keep dependency posture clean
+  - preserve self-contained hook and MCP behavior
+
+## Open PR Classification
+
+- Closed on 2026-04-01 under backlog hygiene / merge policy:
+  - `#1069` `feat: add everything-claude-code ECC bundle`
+  - `#1068` `feat: add everything-claude-code-conventions ECC bundle`
+  - `#1064` `chore(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1`
+  - `#1063` `chore(deps-dev): bump eslint from 9.39.2 to 10.1.0`
+- Closed on 2026-04-01 because the content is sourced from external ecosystems and should only land via manual ECC-native re-port:
+  - `#852` openclaw-user-profiler
+  - `#851` openclaw-soul-forge
+  - `#640` harper skills
+- Native-support candidates to fully diff-audit next:
+  - `#1055` Dart / Flutter support
+  - `#1043` C# reviewer and .NET skills
+  - `#834` localized catalog sync and antigravity target filtering
+- Port or rebuild inside ECC after full audit:
+  - `#894` Jira integration
+  - `#844` ui-demo skill
+  - `#814` + `#808` rebuild as a single consolidated notifications lane for Opencode and cross-harness surfaces
+
+## Interfaces
+
+- Public truth: GitHub issues and PRs
+- Internal execution truth: linked Linear work items under the ECC program
+- Current linked Linear items:
+  - `ECC-206` ecosystem CI baseline
+  - `ECC-207` PR backlog audit and merge-policy enforcement
+  - `ECC-208` context hygiene
+
+## Update Rule
+
+Keep this file detailed for only the current sprint, blockers, and next actions. Summarize completed work into archive or repo docs once it is no longer actively shaping execution.
+
+## Latest Execution Notes
+
+- 2026-04-01: `main` CI was restored locally with `1723/1723` tests passing after lockfile and hook validation fixes.
+- 2026-04-01: Auto-generated ECC bundle PRs `#1068` and `#1069` were closed instead of merged; useful ideas must be ported manually after explicit diff audit.
+- 2026-04-01: Major-version ESLint bump PRs `#1063` and `#1064` were closed; revisit only inside a planned ESLint 10 migration lane.
+- 2026-04-01: Notification PRs `#808` and `#814` were identified as overlapping and should be rebuilt as one unified feature instead of landing as parallel branches.
+- 2026-04-01: External-source skill PRs `#640`, `#851`, and `#852` were closed under the new ingestion policy; copy ideas from audited source later rather than merging branded/source-import PRs directly.
+- 2026-04-01: The remaining low GitHub advisory on `ecc2/Cargo.lock` was addressed by moving `ratatui` to `0.30` with `crossterm_0_28`, which updated transitive `lru` from `0.12.5` to `0.16.3`. `cargo build --manifest-path ecc2/Cargo.toml` still passes.

ecc2/Cargo.toml

@@ -9,7 +9,7 @@ repository = "https://github.com/affaan-m/everything-claude-code"
 
 [dependencies]
 # TUI
-ratatui = "0.29"
+ratatui = { version = "0.30", features = ["crossterm_0_28"] }
 crossterm = "0.28"
 
 # Async runtime

hooks/hooks.json

@@ -158,7 +158,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\nmkdir -p ~/.claude; INPUT=$(cat);\necho \"$INPUT\" | jq -r '\"[\" + (now | todate) + \"] \" + ((.tool_input.command // \"?\") | gsub(\"\n\"; \" \") | gsub(\"--token[= ][^ ]*\"; \"--token=<REDACTED>\") | gsub(\"Authorization:[: ]*[^ ]*[: ]*[^ ]*\"; \"Authorization:<REDACTED>\") | gsub(\"AKIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"ASIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"password[= ][^ ]*\"; \"password=<REDACTED>\") | gsub(\"ghp_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"gho_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"ghs_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"github_pat_[A-Za-z0-9_]+\"; \"<REDACTED>\"))' >> ~/.claude/bash-commands.log 2>/dev/null || true;\nprintf '%s\n' \"$INPUT\""
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/post-bash-command-log.js\" audit"
           }
         ],
         "description": "Audit log all bash commands to ~/.claude/bash-commands.log"
@@ -168,7 +168,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "#!/bin/bash\nmkdir -p ~/.claude; INPUT=$(cat);\necho \"$INPUT\" | jq -r '\"[\" + (now | todate) + \"] tool=Bash command=\" + ((.tool_input.command // \"?\") | gsub(\"\n\"; \" \") | gsub(\"--token[= ][^ ]*\"; \"--token=<REDACTED>\") | gsub(\"Authorization:[: ]*[^ ]*[: ]*[^ ]*\"; \"Authorization:<REDACTED>\") | gsub(\"AKIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"ASIA[A-Z0-9]{16}\"; \"<REDACTED>\") | gsub(\"password[= ][^ ]*\"; \"password=<REDACTED>\") | gsub(\"ghp_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"gho_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"ghs_[A-Za-z0-9_]+\"; \"<REDACTED>\") | gsub(\"github_pat_[A-Za-z0-9_]+\"; \"<REDACTED>\"))' >> ~/.claude/cost-tracker.log 2>/dev/null || true;\nprintf '%s\n' \"$INPUT\""
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/post-bash-command-log.js\" cost"
           }
         ],
         "description": "Cost tracker - log bash tool usage with timestamps"
@@ -269,7 +269,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/run-with-flags.js\" \"stop:format-typecheck\" \"scripts/hooks/stop-format-typecheck.js\" \"standard,strict\"",
+            "command": "node -e \"const fs=require('fs');const path=require('path');const {spawnSync}=require('child_process');const raw=fs.readFileSync(0,'utf8');const rel=path.join('scripts','hooks','run-with-flags.js');const hasRunnerRoot=candidate=>{const value=typeof candidate==='string'?candidate.trim():'';return value.length>0&&fs.existsSync(path.join(path.resolve(value),rel));};const root=(()=>{const envRoot=process.env.CLAUDE_PLUGIN_ROOT||'';if(hasRunnerRoot(envRoot))return path.resolve(envRoot.trim());const home=require('os').homedir();const claudeDir=path.join(home,'.claude');if(hasRunnerRoot(claudeDir))return claudeDir;for(const candidate of [path.join(claudeDir,'plugins','everything-claude-code'),path.join(claudeDir,'plugins','everything-claude-code@everything-claude-code'),path.join(claudeDir,'plugins','marketplace','everything-claude-code')]){if(hasRunnerRoot(candidate))return candidate;}try{const cacheBase=path.join(claudeDir,'plugins','cache','everything-claude-code');for(const org of fs.readdirSync(cacheBase,{withFileTypes:true})){if(!org.isDirectory())continue;for(const version of fs.readdirSync(path.join(cacheBase,org.name),{withFileTypes:true})){if(!version.isDirectory())continue;const candidate=path.join(cacheBase,org.name,version.name);if(hasRunnerRoot(candidate))return candidate;}}}catch{}return claudeDir;})();const script=path.join(root,rel);if(fs.existsSync(script)){const result=spawnSync(process.execPath,[script,'stop:format-typecheck','scripts/hooks/stop-format-typecheck.js','standard,strict'],{input:raw,encoding:'utf8',env:process.env,cwd:process.cwd(),timeout:300000});const stdout=typeof result.stdout==='string'?result.stdout:'';if(stdout)process.stdout.write(stdout);else process.stdout.write(raw);if(result.stderr)process.stderr.write(result.stderr);if(result.error||result.status===null||result.signal){const reason=result.error?result.error.message:(result.signal?'signal '+result.signal:'missing exit status');process.stderr.write('[Stop] ERROR: hook runner failed: '+reason+String.fromCharCode(10));process.exit(1);}process.exit(Number.isInteger(result.status)?result.status:0);}process.stderr.write('[Stop] WARNING: could not resolve ECC plugin root; skipping hook'+String.fromCharCode(10));process.stdout.write(raw);\"",
             "timeout": 300
           }
         ],

package-lock.json

@@ -20,7 +20,7 @@
       },
       "devDependencies": {
         "@eslint/js": "^9.39.2",
-        "c8": "^10.1.2",
+        "c8": "^11.0.0",
         "eslint": "^9.39.2",
         "globals": "^17.1.0",
         "markdownlint-cli": "^0.48.0"
@@ -278,49 +278,6 @@
       "integrity": "sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==",
       "license": "ISC"
     },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@isaacs/cliui/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.3",
       "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
@@ -359,17 +316,6 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/@types/debug": {
       "version": "4.1.12",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
@@ -516,9 +462,9 @@
       }
     },
     "node_modules/c8": {
-      "version": "10.1.3",
-      "resolved": "https://registry.npmjs.org/c8/-/c8-10.1.3.tgz",
-      "integrity": "sha512-LvcyrOAaOnrrlMpW22n690PUvxiq4Uf9WMhQwNJ9vgagkL/ph1+D4uvjvDA5XCbykrc0sx+ay6pVi9YZ1GnhyA==",
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/c8/-/c8-11.0.0.tgz",
+      "integrity": "sha512-e/uRViGHSVIJv7zsaDKM7VRn2390TgHXqUSvYwPHBQaU6L7E9L0n9JbdkwdYPvshDT0KymBmmlwSpms3yBaMNg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -529,7 +475,7 @@
         "istanbul-lib-coverage": "^3.2.0",
         "istanbul-lib-report": "^3.0.1",
         "istanbul-reports": "^3.1.6",
-        "test-exclude": "^7.0.1",
+        "test-exclude": "^8.0.0",
         "v8-to-istanbul": "^9.0.0",
         "yargs": "^17.7.2",
         "yargs-parser": "^21.1.1"
@@ -538,7 +484,7 @@
         "c8": "bin/c8.js"
       },
       "engines": {
-        "node": ">=18"
+        "node": "20 || >=22"
       },
       "peerDependencies": {
         "monocart-coverage-reports": "^2"
@@ -811,13 +757,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
@@ -1184,22 +1123,18 @@
       }
     },
     "node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^3.1.2",
-        "minimatch": "^9.0.4",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^1.11.1"
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
       },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
+      "engines": {
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -1218,27 +1153,40 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -1448,22 +1396,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/jackspeak": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
-      }
-    },
     "node_modules/js-yaml": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
@@ -1598,11 +1530,14 @@
       "license": "MIT"
     },
     "node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "version": "11.2.7",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.7.tgz",
+      "integrity": "sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA==",
       "dev": true,
-      "license": "ISC"
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
     },
     "node_modules/make-dir": {
       "version": "4.0.0",
@@ -2375,13 +2310,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0"
-    },
     "node_modules/parent-module": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -2436,17 +2364,17 @@
       }
     },
     "node_modules/path-scurry": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "lru-cache": "^10.2.0",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.18"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -2624,45 +2552,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width-cjs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/strip-ansi": {
       "version": "7.1.2",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
@@ -2679,30 +2568,6 @@
         "url": "https://github.com/chalk/strip-ansi?sponsor=1"
       }
     },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
@@ -2730,18 +2595,18 @@
       }
     },
     "node_modules/test-exclude": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.2.tgz",
-      "integrity": "sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-8.0.0.tgz",
+      "integrity": "sha512-ZOffsNrXYggvU1mDGHk54I96r26P8SyMjO5slMKSc7+IWmtB/MQKnEC2fP51imB3/pT6YK5cT5E8f+Dd9KdyOQ==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "@istanbuljs/schema": "^0.1.2",
-        "glob": "^10.4.1",
+        "glob": "^13.0.6",
         "minimatch": "^10.2.2"
       },
       "engines": {
-        "node": ">=18"
+        "node": "20 || >=22"
       }
     },
     "node_modules/test-exclude/node_modules/balanced-match": {
@@ -2768,13 +2633,13 @@
       }
     },
     "node_modules/test-exclude/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -2870,119 +2735,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/wrap-ansi": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.1.0",
-        "string-width": "^5.0.1",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/wrap-ansi-cjs": {
-      "name": "wrap-ansi",
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/wrap-ansi/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/wrap-ansi/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",

schemas/install-modules.schema.json

@@ -51,6 +51,7 @@
                 "cursor",
                 "antigravity",
                 "codex",
+                "gemini",
                 "opencode",
                 "codebuddy"
               ]

scripts/hooks/post-bash-command-log.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const MAX_STDIN = 1024 * 1024;
+let raw = '';
+
+const MODE_CONFIG = {
+  audit: {
+    fileName: 'bash-commands.log',
+    format: command => `[${new Date().toISOString()}] ${command}`,
+  },
+  cost: {
+    fileName: 'cost-tracker.log',
+    format: command => `[${new Date().toISOString()}] tool=Bash command=${command}`,
+  },
+};
+
+function sanitizeCommand(command) {
+  return String(command || '')
+    .replace(/\n/g, ' ')
+    .replace(/--token[= ][^ ]*/g, '--token=<REDACTED>')
+    .replace(/Authorization:[: ]*[^ ]*[: ]*[^ ]*/gi, 'Authorization:<REDACTED>')
+    .replace(/\bAKIA[A-Z0-9]{16}\b/g, '<REDACTED>')
+    .replace(/\bASIA[A-Z0-9]{16}\b/g, '<REDACTED>')
+    .replace(/password[= ][^ ]*/gi, 'password=<REDACTED>')
+    .replace(/\bghp_[A-Za-z0-9_]+\b/g, '<REDACTED>')
+    .replace(/\bgho_[A-Za-z0-9_]+\b/g, '<REDACTED>')
+    .replace(/\bghs_[A-Za-z0-9_]+\b/g, '<REDACTED>')
+    .replace(/\bgithub_pat_[A-Za-z0-9_]+\b/g, '<REDACTED>');
+}
+
+function appendLine(filePath, line) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.appendFileSync(filePath, `${line}\n`, 'utf8');
+}
+
+function main() {
+  const config = MODE_CONFIG[process.argv[2]];
+
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => {
+    if (raw.length < MAX_STDIN) {
+      const remaining = MAX_STDIN - raw.length;
+      raw += chunk.substring(0, remaining);
+    }
+  });
+
+  process.stdin.on('end', () => {
+    try {
+      if (config) {
+        const input = raw.trim() ? JSON.parse(raw) : {};
+        const command = sanitizeCommand(input.tool_input?.command || '?');
+        appendLine(path.join(os.homedir(), '.claude', config.fileName), config.format(command));
+      }
+    } catch {
+      // Logging must never block the calling hook.
+    }
+
+    process.stdout.write(raw);
+  });
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  sanitizeCommand,
+};

tests/scripts/post-bash-command-log.test.js

@@ -0,0 +1,104 @@
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const scriptPath = path.join(__dirname, '..', '..', 'scripts', 'hooks', 'post-bash-command-log.js');
+const { sanitizeCommand } = require(scriptPath);
+
+function test(name, fn) {
+  try {
+    fn();
+    console.log(`PASS: ${name}`);
+    return true;
+  } catch (error) {
+    console.log(`FAIL: ${name}`);
+    console.log(`  ${error.message}`);
+    return false;
+  }
+}
+
+function runHook(mode, payload, homeDir) {
+  return spawnSync('node', [scriptPath, mode], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      HOME: homeDir,
+    },
+  });
+}
+
+let passed = 0;
+let failed = 0;
+
+if (
+  test('sanitizeCommand redacts common secret formats', () => {
+    const input = 'gh pr create --token abc123 Authorization: Bearer hello password=swordfish ghp_abc github_pat_xyz';
+    const sanitized = sanitizeCommand(input);
+    assert.ok(!sanitized.includes('abc123'));
+    assert.ok(!sanitized.includes('swordfish'));
+    assert.ok(!sanitized.includes('ghp_abc'));
+    assert.ok(!sanitized.includes('github_pat_xyz'));
+    assert.ok(sanitized.includes('--token=<REDACTED>'));
+    assert.ok(sanitized.includes('Authorization:<REDACTED>'));
+    assert.ok(sanitized.includes('password=<REDACTED>'));
+  })
+)
+  passed++;
+else failed++;
+
+if (
+  test('audit mode logs sanitized bash commands and preserves stdout', () => {
+    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-bash-log-'));
+    const payload = {
+      tool_input: {
+        command: 'git push --token abc123',
+      },
+    };
+
+    try {
+      const result = runHook('audit', payload, homeDir);
+      assert.strictEqual(result.status, 0, result.stdout + result.stderr);
+      assert.strictEqual(result.stdout, JSON.stringify(payload));
+
+      const logFile = path.join(homeDir, '.claude', 'bash-commands.log');
+      const logContent = fs.readFileSync(logFile, 'utf8');
+      assert.ok(logContent.includes('--token=<REDACTED>'));
+      assert.ok(!logContent.includes('abc123'));
+    } finally {
+      fs.rmSync(homeDir, { recursive: true, force: true });
+    }
+  })
+)
+  passed++;
+else failed++;
+
+if (
+  test('cost mode writes command metrics log', () => {
+    const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-cost-log-'));
+    const payload = {
+      tool_input: {
+        command: 'npm publish',
+      },
+    };
+
+    try {
+      const result = runHook('cost', payload, homeDir);
+      assert.strictEqual(result.status, 0, result.stdout + result.stderr);
+
+      const logFile = path.join(homeDir, '.claude', 'cost-tracker.log');
+      const logContent = fs.readFileSync(logFile, 'utf8');
+      assert.match(logContent, /tool=Bash command=npm publish/);
+    } finally {
+      fs.rmSync(homeDir, { recursive: true, force: true });
+    }
+  })
+)
+  passed++;
+else failed++;
+
+console.log(`\nPassed: ${passed}`);
+console.log(`Failed: ${failed}`);
+process.exit(failed > 0 ? 1 : 0);

yarn.lock

@@ -316,7 +316,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"brace-expansion@npm:^5.0.2, brace-expansion@npm:^5.0.5":
+"brace-expansion@npm:^5.0.5":
   version: 5.0.5
   resolution: "brace-expansion@npm:5.0.5"
   dependencies:
@@ -796,9 +796,9 @@ __metadata:
   linkType: hard
 
 "globals@npm:^17.1.0":
-  version: 17.4.0
-  resolution: "globals@npm:17.4.0"
-  checksum: 10c0/2be9e8c2b9035836f13d420b22f0247a328db82967d3bebfc01126d888ed609305f06c05895914e969653af5c6ba35fd7a0920f3e6c869afa60666c810630feb
+  version: 17.1.0
+  resolution: "globals@npm:17.1.0"
+  checksum: 10c0/4a4a17847676a09f164b8bdce7df105a4f484d6d44586e374087ba9ec7089cbf4c578b8648838dee9917074199c542ce157ea3c07b266f708dfb1652010900c8
   languageName: node
   linkType: hard
 
@@ -1424,12 +1424,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimatch@npm:^10.2.2":
-  version: 10.2.4
-  resolution: "minimatch@npm:10.2.4"
+"minimatch@npm:^10.2.2, minimatch@npm:~10.2.4":
+  version: 10.2.5
+  resolution: "minimatch@npm:10.2.5"
   dependencies:
-    brace-expansion: "npm:^5.0.2"
-  checksum: 10c0/35f3dfb7b99b51efd46afd378486889f590e7efb10e0f6a10ba6800428cf65c9a8dedb74427d0570b318d749b543dc4e85f06d46d2858bc8cac7e1eb49a95945
+    brace-expansion: "npm:^5.0.5"
+  checksum: 10c0/6bb058bd6324104b9ec2f763476a35386d05079c1f5fe4fbf1f324a25237cd4534d6813ecd71f48208f4e635c1221899bef94c3c89f7df55698fe373aaae20fd
   languageName: node
   linkType: hard
 
@@ -1442,15 +1442,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimatch@npm:~10.2.4":
-  version: 10.2.5
-  resolution: "minimatch@npm:10.2.5"
-  dependencies:
-    brace-expansion: "npm:^5.0.5"
-  checksum: 10c0/6bb058bd6324104b9ec2f763476a35386d05079c1f5fe4fbf1f324a25237cd4534d6813ecd71f48208f4e635c1221899bef94c3c89f7df55698fe373aaae20fd
-  languageName: node
-  linkType: hard
-
 "minimist@npm:^1.2.8":
   version: 1.2.8
   resolution: "minimist@npm:1.2.8"