From 3c17f41a43b2744856f842a7a2d69de3b2be5e0c Mon Sep 17 00:00:00 2001 From: haelyra <49814733+haelyra@users.noreply.github.com> Date: Wed, 30 Sep 2026 18:58:26 -0400 Subject: [PATCH] docs: resolve integration review findings --- agents/bengali-reviewer.md | 2 +- docs/bn/README.md | 12 +++++++----- manifests/context-packs/skill-triggers@1.json | 2 +- pi/core/skills/bengali-nlp/SKILL.md | 13 ++++++++++--- pi/core/skills/mybatis-patterns/SKILL.md | 11 +++++++++-- scripts/hooks/gateguard-fact-force.js | 8 +++++--- skills/bengali-nlp/SKILL.md | 13 ++++++++++--- skills/mybatis-patterns/SKILL.md | 11 +++++++++-- 8 files changed, 52 insertions(+), 20 deletions(-) diff --git a/agents/bengali-reviewer.md b/agents/bengali-reviewer.md index a6682fcf2..bbe021750 100644 --- a/agents/bengali-reviewer.md +++ b/agents/bengali-reviewer.md @@ -24,7 +24,7 @@ When invoked: 2. **Check Unicode correctness** — Verify NFC normalization, correct handling of conjunct consonants (যুক্তবর্ণ), vowel signs (কার), and Hasanta (্). 3. **Validate text processing** — Check tokenization, search, sort, and comparison operations for Bengali-awareness. 4. **Review rendering and display** — Ensure proper font support, line breaking, and input handling for Bengali script. -5. **Check data layer** — Verify database columns use Unicode-capable encoding (utf8mb4 for MySQL, UTF-8 for PostgreSQL/SQLite), API responses include proper charset headers (`charset=utf-8`), and file I/O specifies encoding. +5. **Check data layer** — Verify database columns use Unicode-capable encoding (utf8mb4 for MySQL, UTF-8 for PostgreSQL/SQLite), API responses use the encoding required by their media type, and file I/O specifies encoding. Network JSON uses UTF-8; do not require a `charset` parameter for `application/json`. 6. **Report findings** — Use the output format below. Only report issues you are confident about (>80% sure it is a real problem). ## Confidence-Based Filtering diff --git a/docs/bn/README.md b/docs/bn/README.md index 254b227db..e18c14f56 100644 --- a/docs/bn/README.md +++ b/docs/bn/README.md @@ -70,9 +70,9 @@ ## নতুন কী আছে -### v2.2.1 — গাইডেড সেটআপ ও রিলিজ গেট (২০২৬ আগস্ট) +### v2.2.2 — গাইডেড সেটআপ ও রিলিজ গেট (২০২৬ সেপ্টেম্বর) -বর্তমান রিলিজ: **2.2.1** (২০২৬-০৮-৩১)। 2.2 ধারার প্রধান বৈশিষ্ট্য: +বর্তমান রিলিজ: **2.2.2** (২০২৬-০৯-২৯)। 2.2 ধারার প্রধান বৈশিষ্ট্য: - Claude Code, Codex ও Kimi Code জুড়ে ম্যানিফেস্ট-চালিত গাইডেড সেটআপ, সেই সঙ্গে ইনস্টল-স্টেট মালিকানা, `doctor`, `repair` ও `uninstall`। - নেটিভ Antigravity ইনস্টল, পাতলা Pi অ্যাডাপ্টার, এবং Linux, macOS ও Windows-এ পরীক্ষিত প্যাকড-আর্টিফ্যাক্ট রিলিজ গেট। @@ -116,7 +116,9 @@ ```bash git clone https://github.com/affaan-m/ECC.git cd ECC -./install.sh typescript # অথবা python, golang +mkdir -p ~/.claude/rules/ecc +cp -R rules/common ~/.claude/rules/ecc/ +cp -R rules/typescript ~/.claude/rules/ecc/ # অথবা python, golang ``` ### ৩য় ধাপ: ব্যবহার শুরু করুন @@ -126,7 +128,7 @@ cd ECC /plugin list ecc@ecc ``` -**হয়ে গেছে!** এখন আপনি 69 এজেন্ট, 293 স্কিল এবং 94 কমান্ড ব্যবহার করতে পারবেন। +**হয়ে গেছে!** এখন আপনি 69 এজেন্ট, 295 স্কিল এবং 94 কমান্ড ব্যবহার করতে পারবেন। --- @@ -158,7 +160,7 @@ ECC/ | |-- code-reviewer.md # মান ও নিরাপত্তা পর্যালোচনা | |-- bengali-reviewer.md # বাংলা টেক্সট হ্যান্ডলিং রিভিউ | -|-- skills/ # ওয়ার্কফ্লো ও ডোমেইন জ্ঞান (293) +|-- skills/ # ওয়ার্কফ্লো ও ডোমেইন জ্ঞান (295) | |-- bengali-nlp/ # বাংলা টেক্সট প্রসেসিং প্যাটার্ন | |-- tdd-workflow/ # TDD পদ্ধতি | |-- security-review/ # নিরাপত্তা চেকলিস্ট diff --git a/manifests/context-packs/skill-triggers@1.json b/manifests/context-packs/skill-triggers@1.json index 13edc2bce..f8b8618e0 100644 --- a/manifests/context-packs/skill-triggers@1.json +++ b/manifests/context-packs/skill-triggers@1.json @@ -1 +1 @@ -{"coverage":{"skills":295,"withTriggers":33},"generatedAt":"2026-09-30T17:25:13.581Z","id":"skill-triggers@1","model":{"effort":null,"id":"hand-seeded","source":"manual-curation-pending-regeneration"},"registryDigest":"e3e9092249045f681fa9e4cacc5d932c5abbec2e7491102e558a0e23a7eb5495","schemaVersion":1,"triggers":{"skill:api-connector-builder":["add api integration","new provider connector","match existing integration pattern"],"skill:api-design":["rest endpoint design","pagination api","status codes","api versioning","rate limiting api","resource naming","filtering api","api error responses","offset pagination","limit query parameter","pagination defaults"],"skill:backend-patterns":["express api","node backend architecture","nextjs api routes","server side patterns","data access layer","static file server","url path handling","file server"],"skill:browser-qa":["deployed feature test","visual regression screenshots","core web vitals check","axe accessibility audit","ship do not ship","staging verification"],"skill:canary-watch":["post deploy monitoring","smoke test url","production url check","console errors production","sse stream check","after deploy verification"],"skill:code-tour":["onboarding walkthrough","explain subsystem","architecture tour","pr walkthrough","rca tour"],"skill:coding-standards":["code review standards","naming conventions","readability review","immutability conventions","fix naming typo","export naming","consistent exports"],"skill:content-hash-cache-pattern":["cache file processing","content addressed cache","sha256 hash cache"],"skill:database-migrations":["zero downtime migration","schema change production","add column large table","backfill data","expand contract","concurrent index","migration rollback","prisma migration","django migration"],"skill:deployment-patterns":["ci cd setup","dockerize app","health checks","rollback strategy","production readiness","deploy pipeline","containerize application"],"skill:design-system":["design tokens","visual consistency audit","css custom properties","ui audit","design system bootstrap"],"skill:django-patterns":["django orm","drf api","django rest framework","django caching","django signals","django middleware"],"skill:django-security":["django authentication","csrf protection","sql injection prevention","xss prevention","django deployment security","role based access control","authorization middleware","permissions checks"],"skill:docker-patterns":["dockerfile review","docker compose setup","container security","multi service orchestration"],"skill:error-handling":["error types","retry logic","circuit breaker","user facing errors","exception handling patterns","typed errors","error boundaries","go error handling","custom error class","error codes","config validation"],"skill:evm-token-decimals":["token decimals","wei conversion","erc20 balance off","bridge token precision"],"skill:frontend-a11y":["aria attributes","screen reader support","focus management","semantic html","form labeling","keyboard navigation react","a11y lint errors"],"skill:git-workflow":["merge vs rebase","commit conventions","resolve merge conflict","branching strategy","clean up commits","pull request cleanup","git history tidy"],"skill:hexagonal-architecture":["ports and adapters","dependency injection boundaries","decouple domain from io"],"skill:kubernetes-patterns":["kubernetes manifests","kubectl debugging","pod probes","k8s rbac","autoscaling config","configmap secrets"],"skill:mybatis-patterns":["mybatis mapper xml","mybatis spring mapper","mybatis resultmap mapping","mybatis dynamic sql","mybatis parameter binding","mybatis sql injection","mybatis transaction boundary","mybatis batch insert","mybatis pagination","mybatis query performance","spring boot mybatis persistence","mybatis legacy dao"],"skill:orch-fix-defect":["fix a bug","broken behavior","regression fix","reproduce bug","defect repair"],"skill:postgres-patterns":["slow postgres query","query optimization","index design","rls policies","supabase schema","postgres indexing","database performance","schema design postgres","postgres driver","node postgres","query planner"],"skill:python-patterns":["pythonic code","pep 8","type hints python","python code review","idiomatic python"],"skill:python-testing":["pytest fixtures","mocking python","parametrized tests","coverage python","tdd python"],"skill:redis-patterns":["cache aside pattern","distributed lock","redis rate limiting","cache invalidation"],"skill:regex-vs-llm-structured-text":["parse invoice","extract receipt data","text extraction pipeline","parse form fields","cheap document parser","extract table data","parse log lines","parse access logs","common log format","log line parsing"],"skill:rust-patterns":["rust ownership","borrow checker","rust error handling","traits rust","rust concurrency","idiomatic rust"],"skill:search-first":["find existing library","npm package research","before writing custom code","evaluate existing tools","add dependency research"],"skill:security-review":["security audit","authentication review","sanitize user input","secrets handling","payment security checklist","prevent injection attacks","secure api endpoints","authn authz review","vulnerability checklist","input validation security","parameterized queries","sql injection"],"skill:security-scan":["audit claude config","claudemd security","mcp server audit","agentshield scan","hook configuration audit","settings json security"],"skill:tdd-workflow":["write test first","failing test","red green refactor","test driven development","regression test first","write a regression test"],"skill:verification-loop":["pre pr checks","verification report","quality gates","build lint test coverage","before creating a pr"]},"triggersDigest":"f4ef0aad185708bcf92caff2b280fbee09361a164273106ec33a7ab505018966"} +{"coverage":{"skills":295,"withTriggers":33},"generatedAt":"2026-09-30T17:25:13.581Z","id":"skill-triggers@1","model":{"effort":null,"id":"hand-seeded","source":"manual-curation-pending-regeneration"},"registryDigest":"9a18752f0b4bcb430b3b8d831e586a9d8c8485221b138f1851d27a21e40e41b5","schemaVersion":1,"triggers":{"skill:api-connector-builder":["add api integration","new provider connector","match existing integration pattern"],"skill:api-design":["rest endpoint design","pagination api","status codes","api versioning","rate limiting api","resource naming","filtering api","api error responses","offset pagination","limit query parameter","pagination defaults"],"skill:backend-patterns":["express api","node backend architecture","nextjs api routes","server side patterns","data access layer","static file server","url path handling","file server"],"skill:browser-qa":["deployed feature test","visual regression screenshots","core web vitals check","axe accessibility audit","ship do not ship","staging verification"],"skill:canary-watch":["post deploy monitoring","smoke test url","production url check","console errors production","sse stream check","after deploy verification"],"skill:code-tour":["onboarding walkthrough","explain subsystem","architecture tour","pr walkthrough","rca tour"],"skill:coding-standards":["code review standards","naming conventions","readability review","immutability conventions","fix naming typo","export naming","consistent exports"],"skill:content-hash-cache-pattern":["cache file processing","content addressed cache","sha256 hash cache"],"skill:database-migrations":["zero downtime migration","schema change production","add column large table","backfill data","expand contract","concurrent index","migration rollback","prisma migration","django migration"],"skill:deployment-patterns":["ci cd setup","dockerize app","health checks","rollback strategy","production readiness","deploy pipeline","containerize application"],"skill:design-system":["design tokens","visual consistency audit","css custom properties","ui audit","design system bootstrap"],"skill:django-patterns":["django orm","drf api","django rest framework","django caching","django signals","django middleware"],"skill:django-security":["django authentication","csrf protection","sql injection prevention","xss prevention","django deployment security","role based access control","authorization middleware","permissions checks"],"skill:docker-patterns":["dockerfile review","docker compose setup","container security","multi service orchestration"],"skill:error-handling":["error types","retry logic","circuit breaker","user facing errors","exception handling patterns","typed errors","error boundaries","go error handling","custom error class","error codes","config validation"],"skill:evm-token-decimals":["token decimals","wei conversion","erc20 balance off","bridge token precision"],"skill:frontend-a11y":["aria attributes","screen reader support","focus management","semantic html","form labeling","keyboard navigation react","a11y lint errors"],"skill:git-workflow":["merge vs rebase","commit conventions","resolve merge conflict","branching strategy","clean up commits","pull request cleanup","git history tidy"],"skill:hexagonal-architecture":["ports and adapters","dependency injection boundaries","decouple domain from io"],"skill:kubernetes-patterns":["kubernetes manifests","kubectl debugging","pod probes","k8s rbac","autoscaling config","configmap secrets"],"skill:mybatis-patterns":["mybatis mapper xml","mybatis spring mapper","mybatis resultmap mapping","mybatis dynamic sql","mybatis parameter binding","mybatis sql injection","mybatis transaction boundary","mybatis batch insert","mybatis pagination","mybatis query performance","spring boot mybatis persistence","mybatis legacy dao"],"skill:orch-fix-defect":["fix a bug","broken behavior","regression fix","reproduce bug","defect repair"],"skill:postgres-patterns":["slow postgres query","query optimization","index design","rls policies","supabase schema","postgres indexing","database performance","schema design postgres","postgres driver","node postgres","query planner"],"skill:python-patterns":["pythonic code","pep 8","type hints python","python code review","idiomatic python"],"skill:python-testing":["pytest fixtures","mocking python","parametrized tests","coverage python","tdd python"],"skill:redis-patterns":["cache aside pattern","distributed lock","redis rate limiting","cache invalidation"],"skill:regex-vs-llm-structured-text":["parse invoice","extract receipt data","text extraction pipeline","parse form fields","cheap document parser","extract table data","parse log lines","parse access logs","common log format","log line parsing"],"skill:rust-patterns":["rust ownership","borrow checker","rust error handling","traits rust","rust concurrency","idiomatic rust"],"skill:search-first":["find existing library","npm package research","before writing custom code","evaluate existing tools","add dependency research"],"skill:security-review":["security audit","authentication review","sanitize user input","secrets handling","payment security checklist","prevent injection attacks","secure api endpoints","authn authz review","vulnerability checklist","input validation security","parameterized queries","sql injection"],"skill:security-scan":["audit claude config","claudemd security","mcp server audit","agentshield scan","hook configuration audit","settings json security"],"skill:tdd-workflow":["write test first","failing test","red green refactor","test driven development","regression test first","write a regression test"],"skill:verification-loop":["pre pr checks","verification report","quality gates","build lint test coverage","before creating a pr"]},"triggersDigest":"f4ef0aad185708bcf92caff2b280fbee09361a164273106ec33a7ab505018966"} diff --git a/pi/core/skills/bengali-nlp/SKILL.md b/pi/core/skills/bengali-nlp/SKILL.md index 5e077565c..c16b41946 100644 --- a/pi/core/skills/bengali-nlp/SKILL.md +++ b/pi/core/skills/bengali-nlp/SKILL.md @@ -31,6 +31,7 @@ U+0985–U+0994 Independent vowels (অ আ ই ঈ উ ঊ ঋ ঌ এ ঐ ও U+0995–U+09B0 Consonants (ক–র) U+09B2 ল U+09B6–U+09B9 শ ষ স হ +U+09DC, U+09DD, U+09DF Additional consonants (ড়, ঢ়, য়) U+09BC Nukta U+09BE–U+09C8 Dependent vowel signs (কার): া ি ী ু ূ ৃ ে ৈ U+09CB–U+09CC Dependent vowel signs: ো ৌ @@ -56,9 +57,10 @@ def normalize_bangla(text: str) -> str: """Normalize Bengali text to NFC form.""" return unicodedata.normalize("NFC", text) -# NFC composes characters: base + combining mark -> precomposed -text_nfd = "বাংলা" # may be decomposed +# NFC composes characters: base + combining marks -> precomposed +text_nfd = "ক\u09C7\u09BE" # decomposed form of "কো" text_nfc = normalize_bangla(text_nfd) +assert text_nfc == "কো" assert text_nfc == normalize_bangla(text_nfc) # idempotent ``` @@ -130,7 +132,7 @@ import re def tokenize_bangla(text: str) -> list[str]: """Basic Bengali tokenizer — split on whitespace and punctuation.""" # Remove Bengali and ASCII punctuation - text = re.sub(r'[।,;:!?\-\'"()\[\]{}]', ' ', text) + text = re.sub(r'[।,;:!?.\-\'"()\[\]{}]', ' ', text) return [token for token in text.split() if token] # For production, use a trained tokenizer: @@ -221,6 +223,8 @@ const sortedWords = [...words].sort(collator.compare); ### Search with Normalization ```python +import unicodedata + def bangla_search(query: str, corpus: list[str]) -> list[str]: """Search Bengali text with normalization.""" query = unicodedata.normalize("NFC", query.strip().lower()) @@ -309,6 +313,9 @@ def detect_banglish(text: str) -> bool: ### Dataset Preparation ```python +import re +import unicodedata + def prepare_bangla_dataset(texts: list[str]) -> list[str]: """Clean and normalize Bengali text for ML training.""" cleaned = [] diff --git a/pi/core/skills/mybatis-patterns/SKILL.md b/pi/core/skills/mybatis-patterns/SKILL.md index 582d05f71..51cbbc256 100644 --- a/pi/core/skills/mybatis-patterns/SKILL.md +++ b/pi/core/skills/mybatis-patterns/SKILL.md @@ -14,7 +14,7 @@ Pair this skill with `springboot-patterns` for application structure, `mysql-patterns` for engine-specific SQL, and `security-review` for untrusted input and access-control concerns. -## When to Use +## When to Activate - Adding or reviewing MyBatis mapper interfaces or XML files - Choosing between XML mappers, annotation mappers, and generated SQL @@ -196,10 +196,17 @@ public List search(UserSearchRequest request) { if (request.ids() != null && request.ids().isEmpty()) { return Collections.emptyList(); } - return userMapper.search(request); + UserSearchRequest prepared = request.query() == null + ? request + : request.withQueryPattern(buildLikePattern(request.query())); + return userMapper.search(prepared); } ``` +Here `withQueryPattern` returns a copy of the request, and `buildLikePattern` +adds the intended wildcards while escaping literal `%` and `_` according to the +database dialect. Do not pass raw search text as `queryPattern`. + The mapper retains the `ids.size() > 0` guard as defense in depth. That guard omits the entire ID predicate for an empty list, which broadens the query. The service must short-circuit empty lists before calling the mapper, and any caller diff --git a/scripts/hooks/gateguard-fact-force.js b/scripts/hooks/gateguard-fact-force.js index 73843ccbb..4c032b5a6 100644 --- a/scripts/hooks/gateguard-fact-force.js +++ b/scripts/hooks/gateguard-fact-force.js @@ -1554,9 +1554,11 @@ function isChecked(key) { // --- Sanitize file path against injection --- -// Unicode policy for sanitizePath, mirroring the repo-wide dangerous set in -// scripts/ci/check-unicode-safety.js. Named so the ranges stay auditable and -// drift against the CI policy is visible in one place. +// Unicode policy for sanitizePath starts with the repo-wide dangerous set in +// scripts/ci/check-unicode-safety.js and adds display-ambiguity characters such +// as soft hyphen. Source text may use those legitimately, but denial paths must +// remain visually unambiguous. Named constants keep that stricter boundary +// auditable. const ASCII_CONTROL_MAX = 0x1f; const ASCII_DELETE = 0x7f; const C1_CONTROLS = [0x80, 0x9f]; // Unicode C1 control block (U+0080..U+009F) diff --git a/skills/bengali-nlp/SKILL.md b/skills/bengali-nlp/SKILL.md index 5e077565c..c16b41946 100644 --- a/skills/bengali-nlp/SKILL.md +++ b/skills/bengali-nlp/SKILL.md @@ -31,6 +31,7 @@ U+0985–U+0994 Independent vowels (অ আ ই ঈ উ ঊ ঋ ঌ এ ঐ ও U+0995–U+09B0 Consonants (ক–র) U+09B2 ল U+09B6–U+09B9 শ ষ স হ +U+09DC, U+09DD, U+09DF Additional consonants (ড়, ঢ়, য়) U+09BC Nukta U+09BE–U+09C8 Dependent vowel signs (কার): া ি ী ু ূ ৃ ে ৈ U+09CB–U+09CC Dependent vowel signs: ো ৌ @@ -56,9 +57,10 @@ def normalize_bangla(text: str) -> str: """Normalize Bengali text to NFC form.""" return unicodedata.normalize("NFC", text) -# NFC composes characters: base + combining mark -> precomposed -text_nfd = "বাংলা" # may be decomposed +# NFC composes characters: base + combining marks -> precomposed +text_nfd = "ক\u09C7\u09BE" # decomposed form of "কো" text_nfc = normalize_bangla(text_nfd) +assert text_nfc == "কো" assert text_nfc == normalize_bangla(text_nfc) # idempotent ``` @@ -130,7 +132,7 @@ import re def tokenize_bangla(text: str) -> list[str]: """Basic Bengali tokenizer — split on whitespace and punctuation.""" # Remove Bengali and ASCII punctuation - text = re.sub(r'[।,;:!?\-\'"()\[\]{}]', ' ', text) + text = re.sub(r'[।,;:!?.\-\'"()\[\]{}]', ' ', text) return [token for token in text.split() if token] # For production, use a trained tokenizer: @@ -221,6 +223,8 @@ const sortedWords = [...words].sort(collator.compare); ### Search with Normalization ```python +import unicodedata + def bangla_search(query: str, corpus: list[str]) -> list[str]: """Search Bengali text with normalization.""" query = unicodedata.normalize("NFC", query.strip().lower()) @@ -309,6 +313,9 @@ def detect_banglish(text: str) -> bool: ### Dataset Preparation ```python +import re +import unicodedata + def prepare_bangla_dataset(texts: list[str]) -> list[str]: """Clean and normalize Bengali text for ML training.""" cleaned = [] diff --git a/skills/mybatis-patterns/SKILL.md b/skills/mybatis-patterns/SKILL.md index 582d05f71..51cbbc256 100644 --- a/skills/mybatis-patterns/SKILL.md +++ b/skills/mybatis-patterns/SKILL.md @@ -14,7 +14,7 @@ Pair this skill with `springboot-patterns` for application structure, `mysql-patterns` for engine-specific SQL, and `security-review` for untrusted input and access-control concerns. -## When to Use +## When to Activate - Adding or reviewing MyBatis mapper interfaces or XML files - Choosing between XML mappers, annotation mappers, and generated SQL @@ -196,10 +196,17 @@ public List search(UserSearchRequest request) { if (request.ids() != null && request.ids().isEmpty()) { return Collections.emptyList(); } - return userMapper.search(request); + UserSearchRequest prepared = request.query() == null + ? request + : request.withQueryPattern(buildLikePattern(request.query())); + return userMapper.search(prepared); } ``` +Here `withQueryPattern` returns a copy of the request, and `buildLikePattern` +adds the intended wildcards while escaping literal `%` and `_` according to the +database dialect. Do not pass raw search text as `queryPattern`. + The mapper retains the `ids.size() > 0` guard as defense in depth. That guard omits the entire ID predicate for an empty list, which broadens the query. The service must short-circuit empty lists before calling the mapper, and any caller