diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 437e8edde..09fc9f797 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ { "name": "ecc", "source": "./", - "description": "Harness-native ECC operator layer - 70 agents, 299 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses", + "description": "Harness-native ECC operator layer - 71 agents, 302 skills, 95 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses", "version": "2.2.3", "author": { "name": "Affaan Mustafa", diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 294432133..351ac68f1 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "ecc", "version": "2.2.3", - "description": "Harness-native ECC plugin for engineering teams - 70 agents, 299 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses", + "description": "Harness-native ECC plugin for engineering teams - 71 agents, 302 skills, 95 legacy command shims, reusable hooks, rules, MCP conventions, and operator workflows for Claude Code plus adjacent agent harnesses", "author": { "name": "Affaan Mustafa", "url": "https://x.com/affaanmustafa" diff --git a/.gemini/GEMINI.md b/.gemini/GEMINI.md index 9b86432d2..cb1112c84 100644 --- a/.gemini/GEMINI.md +++ b/.gemini/GEMINI.md @@ -4,7 +4,7 @@ This file provides Gemini CLI with the baseline ECC workflow, review standards, ## Overview -ECC is a cross-harness coding system with 70 specialized agents, 299 skills, and 95 commands. +ECC is a cross-harness coding system with 71 specialized agents, 302 skills, and 95 commands. Gemini support is currently focused on a strong project-local instruction layer via `.gemini/GEMINI.md`, plus the shared MCP catalog and package-manager setup assets shipped by the installer. diff --git a/AGENTS.md b/AGENTS.md index c4acc82cc..ab61e04c4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,6 +1,6 @@ # ECC — Agent Instructions -This is a **production-ready AI coding plugin** providing 70 specialized agents, 299 skills, 95 commands, and automated hook workflows for software development. +This is a **production-ready AI coding plugin** providing 71 specialized agents, 302 skills, 95 commands, and automated hook workflows for software development. **Version:** 2.2.3 @@ -201,8 +201,8 @@ Troubleshoot failures: check test isolation → verify mocks → fix implementat ## Project Structure ``` -agents/ — 70 specialized subagents -skills/ — 299 workflow skills and domain knowledge +agents/ — 71 specialized subagents +skills/ — 302 workflow skills and domain knowledge commands/ — 95 slash commands hooks/ — Trigger-based automations rules/ — Always-follow guidelines (common + per-language) diff --git a/README.md b/README.md index bc2421d1f..3c347d680 100644 --- a/README.md +++ b/README.md @@ -140,12 +140,12 @@ Instead of rebuilding that process in every prompt, you install it once and make ECC is MIT-licensed open source. It works best with Claude Code today, has a supported Codex sync path, and provides capability-limited adapters for Cursor, OpenCode, Gemini, Zed, GitHub Copilot, Antigravity, Qwen, and other harnesses. See the [support status matrix](#platform-support) before assuming feature parity. -Access to 70 agents, 299 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work. +Access to 71 agents, 302 skills, and 95 legacy command shims, plus hooks, rules, memory, continuous learning, and AgentShield security scanning. The agents are specialized for planning, review, build repair, security, architecture, and domain work. | Included | Count | What it gives you | | ---------------- | ----------: | ------------------------------------------------------------------------------------ | -| Agents | 70 agents | Planning, review, build repair, security, architecture, and domain work | -| Skills | 299 skills | TDD, research, security, docs, frontend, data, ML, operations, and more | +| Agents | 71 agents | Planning, review, build repair, security, architecture, and domain work | +| Skills | 302 skills | TDD, research, security, docs, frontend, data, ML, operations, and more | | Commands | 95 commands | Convenient entry points while ECC moves to a skills-first surface | | Hooks and memory | Runtime | Enforcement, session summaries, continuous learning, instincts, and context controls | | Rules | Selective | Always-loaded standards you choose by language or project | @@ -826,7 +826,7 @@ Stable graduation of the 2.0 line: control-pane substrate, worktree lifecycle se ```text ECC/ -|-- agents/ # 70 specialized subagents for delegation +|-- agents/ # 71 specialized subagents for delegation |-- skills/ # 293 reusable workflows loaded on demand |-- commands/ # 94 maintained slash-command shims |-- rules/ # opt-in common and language standards diff --git a/README.zh-CN.md b/README.zh-CN.md index d345f8501..321f17437 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -200,7 +200,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/" /plugin list ecc@ecc ``` -**完成！** 你现在可以使用 70 个代理、299 个技能和 95 个命令。 +**完成！** 你现在可以使用 71 个代理、302 个技能和 95 个命令。 ### multi-* 命令需要额外配置 diff --git a/SOUL.md b/SOUL.md index 63b26d089..cdc9007ca 100644 --- a/SOUL.md +++ b/SOUL.md @@ -1,7 +1,7 @@ # Soul ## Core Identity -ECC is a production-ready AI coding plugin with 70 specialized agents, 299 skills, 95 commands, and automated hook workflows for software development. +ECC is a production-ready AI coding plugin with 71 specialized agents, 302 skills, 95 commands, and automated hook workflows for software development. ## Core Principles 1. **Agent-First** — route work to the right specialist as early as possible. diff --git a/docs/tr/AGENTS.md b/docs/tr/AGENTS.md index 4d12e5631..4ae6972ab 100644 --- a/docs/tr/AGENTS.md +++ b/docs/tr/AGENTS.md @@ -1,6 +1,6 @@ # ECC — Agent Talimatları -Bu, yazılım geliştirme için 69 özel agent, 295 skill, 94 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**. +Bu, yazılım geliştirme için 71 özel agent, 302 skill, 95 command ve otomatik hook iş akışları sağlayan **üretime hazır bir AI kodlama eklentisidir**. **Sürüm:** 2.2.3 @@ -141,9 +141,9 @@ Başarısızlık sorunlarını giderin: test izolasyonunu kontrol edin → mockl ## Proje Yapısı ``` -agents/ — 69 özel subagent -skills/ — 295 iş akışı skillleri ve alan bilgisi -commands/ — 94 slash command +agents/ — 71 özel subagent +skills/ — 302 iş akışı skillleri ve alan bilgisi +commands/ — 95 slash command hooks/ — Tetikleyici tabanlı otomasyonlar rules/ — Her zaman uyulması gereken kurallar (ortak + dile özel) scripts/ — Platformlar arası Node.js yardımcı programları diff --git a/docs/zh-CN/AGENTS.md b/docs/zh-CN/AGENTS.md index 0b45f5187..bb68114cf 100644 --- a/docs/zh-CN/AGENTS.md +++ b/docs/zh-CN/AGENTS.md @@ -1,6 +1,6 @@ # ECC — 智能体指令 -这是一个**生产就绪的 AI 编码插件**，提供 70 个专业代理、299 项技能、95 条命令以及自动化钩子工作流，用于软件开发。 +这是一个**生产就绪的 AI 编码插件**，提供 71 个专业代理、302 项技能、95 条命令以及自动化钩子工作流，用于软件开发。 **版本:** 2.2.3 @@ -146,8 +146,8 @@ ## 项目结构 ``` -agents/ — 70 个专业子代理 -skills/ — 299 个工作流技能和领域知识 +agents/ — 71 个专业子代理 +skills/ — 302 个工作流技能和领域知识 commands/ — 95 个斜杠命令 hooks/ — 基于触发的自动化 rules/ — 始终遵循的指导方针（通用 + 每种语言） diff --git a/docs/zh-CN/README.md b/docs/zh-CN/README.md index ab18a5af7..75bbedac9 100644 --- a/docs/zh-CN/README.md +++ b/docs/zh-CN/README.md @@ -264,7 +264,7 @@ Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/" /plugin list ecc@ecc ``` -**搞定！** 你现在可以使用 70 个智能体、299 项技能和 95 个命令了。 +**搞定！** 你现在可以使用 71 个智能体、302 项技能和 95 个命令了。 *** @@ -1176,9 +1176,9 @@ opencode | 功能特性 | Claude Code | OpenCode | 状态 | |---------|---------------|----------|--------| -| 智能体 | PASS: 70 个 | PASS: 12 个 | **Claude Code 领先** | +| 智能体 | PASS: 71 个 | PASS: 12 个 | **Claude Code 领先** | | 命令 | PASS: 95 个 | PASS: 35 个 | **Claude Code 领先** | -| 技能 | PASS: 299 项 | PASS: 37 项 | **Claude Code 领先** | +| 技能 | PASS: 302 项 | PASS: 37 项 | **Claude Code 领先** | | 钩子 | PASS: 8 种事件类型 | PASS: 11 种事件 | **OpenCode 更多！** | | 规则 | PASS: 29 条 | PASS: 13 条指令 | **Claude Code 领先** | | MCP 服务器 | PASS: 14 个 | PASS: 完整 | **完全对等** | @@ -1284,9 +1284,9 @@ ECC 是**第一个最大化利用每个主要 AI 编码工具的插件**。以 | 功能特性 | Claude Code | Cursor IDE | Codex CLI | OpenCode | |---------|-----------------------|------------|-----------|----------| -| **智能体** | 70 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 | +| **智能体** | 71 | 共享 (AGENTS.md) | 共享 (AGENTS.md) | 12 | | **命令** | 95 | 共享 | 基于指令 | 35 | -| **技能** | 299 | 共享 | 10 (原生格式) | 37 | +| **技能** | 302 | 共享 | 10 (原生格式) | 37 | | **钩子事件** | 8 种类型 | 15 种类型 | SessionStart（1 种类型） | 11 种类型 | | **钩子脚本** | 20+ 个脚本 | 16 个脚本 (DRY 适配器) | 1 个 SessionStart 引导脚本 | 插件钩子 | | **规则** | 34 (通用 + 语言) | 34 (YAML 前页) | 基于指令 | 13 条指令 | diff --git a/manifests/context-packs/skill-triggers@1.json b/manifests/context-packs/skill-triggers@1.json index a64c63fdb..940354ffa 100644 --- a/manifests/context-packs/skill-triggers@1.json +++ b/manifests/context-packs/skill-triggers@1.json @@ -1 +1 @@ -{"coverage":{"skills":295,"withTriggers":32},"generatedAt":"2026-09-24T23:51:22.784Z","id":"skill-triggers@1","model":{"effort":null,"id":"hand-seeded","source":"manual-curation-pending-regeneration"},"registryDigest":"98ade908c1be37c9583809ac45447bb65ed55638cae2696d9af5f4364e110867","schemaVersion":1,"triggers":{"skill:api-connector-builder":["add api integration","new provider connector","match existing integration pattern"],"skill:api-design":["rest endpoint design","pagination api","status codes","api versioning","rate limiting api","resource naming","filtering api","api error responses","offset pagination","limit query parameter","pagination defaults"],"skill:backend-patterns":["express api","node backend architecture","nextjs api routes","server side patterns","data access layer","static file server","url path handling","file server"],"skill:browser-qa":["deployed feature test","visual regression screenshots","core web vitals check","axe accessibility audit","ship do not ship","staging verification"],"skill:canary-watch":["post deploy monitoring","smoke test url","production url check","console errors production","sse stream check","after deploy verification"],"skill:code-tour":["onboarding walkthrough","explain subsystem","architecture tour","pr walkthrough","rca tour"],"skill:coding-standards":["code review standards","naming conventions","readability review","immutability conventions","fix naming typo","export naming","consistent exports"],"skill:content-hash-cache-pattern":["cache file processing","content addressed cache","sha256 hash cache"],"skill:database-migrations":["zero downtime migration","schema change production","add column large table","backfill data","expand contract","concurrent index","migration rollback","prisma migration","django migration"],"skill:deployment-patterns":["ci cd setup","dockerize app","health checks","rollback strategy","production readiness","deploy pipeline","containerize application"],"skill:design-system":["design tokens","visual consistency audit","css custom properties","ui audit","design system bootstrap"],"skill:django-patterns":["django orm","drf api","django rest framework","django caching","django signals","django middleware"],"skill:django-security":["django authentication","csrf protection","sql injection prevention","xss prevention","django deployment security","role based access control","authorization middleware","permissions checks"],"skill:docker-patterns":["dockerfile review","docker compose setup","container security","multi service orchestration"],"skill:error-handling":["error types","retry logic","circuit breaker","user facing errors","exception handling patterns","typed errors","error boundaries","go error handling","custom error class","error codes","config validation"],"skill:evm-token-decimals":["token decimals","wei conversion","erc20 balance off","bridge token precision"],"skill:frontend-a11y":["aria attributes","screen reader support","focus management","semantic html","form labeling","keyboard navigation react","a11y lint errors"],"skill:git-workflow":["merge vs rebase","commit conventions","resolve merge conflict","branching strategy","clean up commits","pull request cleanup","git history tidy"],"skill:hexagonal-architecture":["ports and adapters","dependency injection boundaries","decouple domain from io"],"skill:kubernetes-patterns":["kubernetes manifests","kubectl debugging","pod probes","k8s rbac","autoscaling config","configmap secrets"],"skill:orch-fix-defect":["fix a bug","broken behavior","regression fix","reproduce bug","defect repair"],"skill:postgres-patterns":["slow postgres query","query optimization","index design","rls policies","supabase schema","postgres indexing","database performance","schema design postgres","postgres driver","node postgres","query planner"],"skill:python-patterns":["pythonic code","pep 8","type hints python","python code review","idiomatic python"],"skill:python-testing":["pytest fixtures","mocking python","parametrized tests","coverage python","tdd python"],"skill:redis-patterns":["cache aside pattern","distributed lock","redis rate limiting","cache invalidation"],"skill:regex-vs-llm-structured-text":["parse invoice","extract receipt data","text extraction pipeline","parse form fields","cheap document parser","extract table data","parse log lines","parse access logs","common log format","log line parsing"],"skill:rust-patterns":["rust ownership","borrow checker","rust error handling","traits rust","rust concurrency","idiomatic rust"],"skill:search-first":["find existing library","npm package research","before writing custom code","evaluate existing tools","add dependency research"],"skill:security-review":["security audit","authentication review","sanitize user input","secrets handling","payment security checklist","prevent injection attacks","secure api endpoints","authn authz review","vulnerability checklist","input validation security","parameterized queries","sql injection"],"skill:security-scan":["audit claude config","claudemd security","mcp server audit","agentshield scan","hook configuration audit","settings json security"],"skill:tdd-workflow":["write test first","failing test","red green refactor","test driven development","regression test first","write a regression test"],"skill:verification-loop":["pre pr checks","verification report","quality gates","build lint test coverage","before creating a pr"]},"triggersDigest":"25b97a9e06fc336c7cf95ab854ed1a41033a54bcd6e1fb1cf69dc906332462aa"} +{"coverage":{"skills":302,"withTriggers":32},"generatedAt":"2026-09-24T23:51:22.784Z","id":"skill-triggers@1","model":{"effort":null,"id":"hand-seeded","source":"manual-curation-pending-regeneration"},"registryDigest":"0b80675288b6c632e54a2938fc314ea72e3a553cb3339b6a32f4d7dcd753d5f5","schemaVersion":1,"triggers":{"skill:api-connector-builder":["add api integration","new provider connector","match existing integration pattern"],"skill:api-design":["rest endpoint design","pagination api","status codes","api versioning","rate limiting api","resource naming","filtering api","api error responses","offset pagination","limit query parameter","pagination defaults"],"skill:backend-patterns":["express api","node backend architecture","nextjs api routes","server side patterns","data access layer","static file server","url path handling","file server"],"skill:browser-qa":["deployed feature test","visual regression screenshots","core web vitals check","axe accessibility audit","ship do not ship","staging verification"],"skill:canary-watch":["post deploy monitoring","smoke test url","production url check","console errors production","sse stream check","after deploy verification"],"skill:code-tour":["onboarding walkthrough","explain subsystem","architecture tour","pr walkthrough","rca tour"],"skill:coding-standards":["code review standards","naming conventions","readability review","immutability conventions","fix naming typo","export naming","consistent exports"],"skill:content-hash-cache-pattern":["cache file processing","content addressed cache","sha256 hash cache"],"skill:database-migrations":["zero downtime migration","schema change production","add column large table","backfill data","expand contract","concurrent index","migration rollback","prisma migration","django migration"],"skill:deployment-patterns":["ci cd setup","dockerize app","health checks","rollback strategy","production readiness","deploy pipeline","containerize application"],"skill:design-system":["design tokens","visual consistency audit","css custom properties","ui audit","design system bootstrap"],"skill:django-patterns":["django orm","drf api","django rest framework","django caching","django signals","django middleware"],"skill:django-security":["django authentication","csrf protection","sql injection prevention","xss prevention","django deployment security","role based access control","authorization middleware","permissions checks"],"skill:docker-patterns":["dockerfile review","docker compose setup","container security","multi service orchestration"],"skill:error-handling":["error types","retry logic","circuit breaker","user facing errors","exception handling patterns","typed errors","error boundaries","go error handling","custom error class","error codes","config validation"],"skill:evm-token-decimals":["token decimals","wei conversion","erc20 balance off","bridge token precision"],"skill:frontend-a11y":["aria attributes","screen reader support","focus management","semantic html","form labeling","keyboard navigation react","a11y lint errors"],"skill:git-workflow":["merge vs rebase","commit conventions","resolve merge conflict","branching strategy","clean up commits","pull request cleanup","git history tidy"],"skill:hexagonal-architecture":["ports and adapters","dependency injection boundaries","decouple domain from io"],"skill:kubernetes-patterns":["kubernetes manifests","kubectl debugging","pod probes","k8s rbac","autoscaling config","configmap secrets"],"skill:orch-fix-defect":["fix a bug","broken behavior","regression fix","reproduce bug","defect repair"],"skill:postgres-patterns":["slow postgres query","query optimization","index design","rls policies","supabase schema","postgres indexing","database performance","schema design postgres","postgres driver","node postgres","query planner"],"skill:python-patterns":["pythonic code","pep 8","type hints python","python code review","idiomatic python"],"skill:python-testing":["pytest fixtures","mocking python","parametrized tests","coverage python","tdd python"],"skill:redis-patterns":["cache aside pattern","distributed lock","redis rate limiting","cache invalidation"],"skill:regex-vs-llm-structured-text":["parse invoice","extract receipt data","text extraction pipeline","parse form fields","cheap document parser","extract table data","parse log lines","parse access logs","common log format","log line parsing"],"skill:rust-patterns":["rust ownership","borrow checker","rust error handling","traits rust","rust concurrency","idiomatic rust"],"skill:search-first":["find existing library","npm package research","before writing custom code","evaluate existing tools","add dependency research"],"skill:security-review":["security audit","authentication review","sanitize user input","secrets handling","payment security checklist","prevent injection attacks","secure api endpoints","authn authz review","vulnerability checklist","input validation security","parameterized queries","sql injection"],"skill:security-scan":["audit claude config","claudemd security","mcp server audit","agentshield scan","hook configuration audit","settings json security"],"skill:tdd-workflow":["write test first","failing test","red green refactor","test driven development","regression test first","write a regression test"],"skill:verification-loop":["pre pr checks","verification report","quality gates","build lint test coverage","before creating a pr"]},"triggersDigest":"25b97a9e06fc336c7cf95ab854ed1a41033a54bcd6e1fb1cf69dc906332462aa"} diff --git a/manifests/pi-core.json b/manifests/pi-core.json index bdcfe2df7..bce3b50c7 100644 --- a/manifests/pi-core.json +++ b/manifests/pi-core.json @@ -37,6 +37,7 @@ "agent-eval", "agent-harness-construction", "agent-introspection-debugging", + "agent-security-hardening", "agent-self-evaluation", "agentic-engineering", "ai-first-engineering", @@ -46,9 +47,9 @@ "api-design", "architecture-decision-records", "backend-patterns", - "bengali-nlp", "benchmark", "benchmark-optimization-loop", + "bengali-nlp", "blueprint", "bun-runtime", "click-path-audit", @@ -59,6 +60,7 @@ "compose-multiplatform-patterns", "content-hash-cache-pattern", "contract-first", + "conventional-commit-review", "cost-aware-llm-pipeline", "council", "cpp-coding-standards", @@ -332,7 +334,11 @@ "visa-doc-translate": "visa/legal docs niche; OCR network calls", "windows-desktop-e2e": "niche Windows desktop automation; pip installs at runtime", "workspace-surface-audit": "ECC harness surface audit", - "x-api": "wraps X/Twitter SaaS API" + "x-api": "wraps X/Twitter SaaS API", + "prompt-caching-strategy": "Provider-specific cache economics and runtime measurement are outside the curated Pi core.", + "osint-investigation": "External source investigation and evidence collection are outside the curated offline Pi core.", + "mcp-dependency-review": "MCP server configuration and selector review are outside the curated Pi core.", + "token-card": "Requires a downloaded tokenchit CLI and reads provider session logs." } }, "commands": { @@ -432,7 +438,8 @@ "setup-pm.md": "runs an ECC repo script (scripts/setup-package-manager.js)", "skill-create.md": "Claude Code skill authoring plus instincts", "skill-health.md": "ECC skill analytics dashboard", - "vue-review.md": "invokes ECC agent roster (vue-reviewer)" + "vue-review.md": "invokes ECC agent roster (vue-reviewer)", + "token-card.md": "Requires the tokenchit CLI and provider session logs via the token-card skill." } }, "safety": { @@ -442,11 +449,12 @@ "angular.dev", "aws.amazon.com", "bloclibrary.dev", + "bun.com", "cli.github.com", + "dart.dev", "developer.android.com", "developer.apple.com", "developers.cloudflare.com", - "dart.dev", "docs.flutter.dev", "docs.spring.io", "external-secrets.io", @@ -461,6 +469,7 @@ "pub.dev", "riverpod.dev", "supabase.com", + "vercel.com", "vite.dev", "www.cisecurity.org", "www.speedscope.app", diff --git a/package.json b/package.json index 75da588d2..84b78a10f 100644 --- a/package.json +++ b/package.json @@ -83,6 +83,7 @@ "docs/de-DE/", "docs/CODEX-NAVIGATION-GUIDE.md", "docs/COMMAND-AGENT-MAP.md", + "docs/HERMES-HOOKS.md", "docs/ROADMAP.md", "docs/design/ecc-memory-vault.md", "docs/design/context-profiles.md", diff --git a/pi/core/CURATION.md b/pi/core/CURATION.md index 3f7d9e197..1a38f5c69 100644 --- a/pi/core/CURATION.md +++ b/pi/core/CURATION.md @@ -1,6 +1,6 @@ # Curation -pi/core includes 125 of 295 skills and 24 of 94 commands from the root of ECC. +pi/core includes 128 of 302 skills and 24 of 95 commands from the root of ECC. Everything excluded is listed here with its reason. ## Rules @@ -189,6 +189,10 @@ Exclude anything that: | `windows-desktop-e2e` | niche Windows desktop automation; pip installs at runtime | | `workspace-surface-audit` | ECC harness surface audit | | `x-api` | wraps X/Twitter SaaS API | +| `prompt-caching-strategy` | Provider-specific cache economics and runtime measurement are outside the curated Pi core. | +| `osint-investigation` | External source investigation and evidence collection are outside the curated offline Pi core. | +| `mcp-dependency-review` | MCP server configuration and selector review are outside the curated Pi core. | +| `token-card` | Requires a downloaded tokenchit CLI and reads provider session logs. | ## Excluded commands @@ -264,6 +268,7 @@ Exclude anything that: | `skill-create` | Claude Code skill authoring plus instincts | | `skill-health` | ECC skill analytics dashboard | | `vue-review` | invokes ECC agent roster (vue-reviewer) | +| `token-card` | Requires the tokenchit CLI and provider session logs via the token-card skill. | ## Renames diff --git a/pi/core/README.md b/pi/core/README.md index 6a09e4432..c943e6199 100644 --- a/pi/core/README.md +++ b/pi/core/README.md @@ -1,6 +1,6 @@ # ecc-pi-core -A curated, Pi-native profile of ECC: 125 portable +A curated, Pi-native profile of ECC: 128 portable engineering skills and 24 pure prompt-workflow commands, with no extensions, no hooks, no runtime downloads, and no network or SaaS dependencies. diff --git a/pi/core/skills/agent-security-hardening/SKILL.md b/pi/core/skills/agent-security-hardening/SKILL.md new file mode 100644 index 000000000..726cd3e2e --- /dev/null +++ b/pi/core/skills/agent-security-hardening/SKILL.md @@ -0,0 +1,177 @@ +--- +name: agent-security-hardening +description: Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building or reviewing an agent runtime, autonomous worker, tool gateway, memory service, or multi-tenant agent deployment. Do not use for general web application security or offensive testing. +metadata: + origin: ECC +--- + +# Agent Security Hardening + +Harden the boundaries where an agent turns untrusted data into filesystem, network, memory, or tool actions. Produce concrete controls and tests for the framework being reviewed; a checklist without enforcement evidence is incomplete. + +## Important + +- Treat model output, retrieved content, tool output, memory, and cross-agent messages as untrusted input. +- Default external integrations to read-only and grant each write capability separately. +- Validate at the action boundary even when an upstream prompt or schema already validated the value. +- Fail closed before a side effect when identity, destination, ownership, or containment cannot be proven. +- Before a delete, publish, credential rotation, or other irreversible action, the real tool entry point must authorize the authenticated principal for that exact operation and resource scope, then require explicit confirmation or a valid scoped pre-approval. Missing or invalid evidence blocks the action. +- Use hard bounds defined by the governing requirement and stricter values verified from deployment configuration. When neither defines a value, mark it as a required decision and test that the implementation rejects an unbounded configuration; do not invent a plausible value. + +## When to Activate + +- Building an autonomous agent, tool gateway, memory service, or agent-to-agent protocol +- Reviewing code that maps model output into commands, paths, URLs, credentials, or API mutations +- Isolating tenants, projects, sessions, or workspaces in a long-running agent process +- Hardening temporary files, logs, tool responses, or external-content ingestion + +## Hardening Workflow + +### 1. Map Trust Boundaries + +List every boundary as `source -> parser -> validator -> side effect`. Include direct user input, model output, retrieved documents, memory, environment variables, tool results, and messages from other agents. + +For each side effect, record: + +- the identity and scope authorizing it; +- the exact validator that runs immediately before it; +- the maximum input and output size; +- the audit evidence produced; +- the recovery path if the operation is interrupted. + +This step is complete when every write, command, network mutation, and credential use has one named authorization boundary. + +### 2. Validate Identifiers, Environment Values, and URLs + +Use an allowlist for identifiers that become filenames, keys, selectors, or command arguments. Agent IDs have the issue-defined hard maximum of 64 characters; deployment configuration may choose a stricter positive limit but cannot raise that boundary: + +```python +import re + +SAFE_AGENT_ID_CHARS = re.compile(r"^[A-Za-z0-9_][A-Za-z0-9_-]*$") +HARD_MAX_AGENT_ID_LENGTH = 64 + +def require_agent_id(value: object, *, max_length: int) -> str: + if ( + isinstance(max_length, bool) + or not isinstance(max_length, int) + or not 1 <= max_length <= HARD_MAX_AGENT_ID_LENGTH + ): + raise RuntimeError("configured agent ID limit must be between 1 and 64") + if ( + not isinstance(value, str) + or len(value) > max_length + or not SAFE_AGENT_ID_CHARS.fullmatch(value) + ): + raise ValueError("invalid agent identifier") + return value +``` + +When an identifier becomes a CLI argument, pass it through an argv API and place it after the command's end-of-options marker where supported. Character validation is not a substitute for argument separation. + +Reject missing and whitespace-only environment values before constructing a client: + +```python +def require_env(name: str, environ: dict[str, str]) -> str: + value = environ.get(name) + if value is None or not value.strip(): + raise RuntimeError(f"{name} is required") + return value +``` + +Parse URLs, allow only schemes required by the deployment, require a host, reject embedded credentials, and block private-network destinations when the URL is attacker-controlled. For every outbound connection and redirect hop, pin the connection to a validated public address or verify the connected peer address at connection time so DNS rebinding cannot cross the boundary. A credential-bearing request must use HTTPS with certificate verification before credentials are attached. Disable automatic cross-origin credential forwarding; when the scheme or origin changes, strip the credentials and reauthorize the new destination or reject the redirect. Re-run destination, connected-address, and transport validation on every hop. + +This step is complete when tests reject empty, oversized, malformed, traversal-shaped, credential-bearing, and unauthorized-destination values before any side effect, and prove that DNS rebinding and cross-origin redirects cannot carry credentials to an unapproved peer. + +### 3. Contain Filesystem Access + +Reject absolute user-controlled paths and traversal components before joining. Reject Windows-unsafe components on every platform so behavior stays portable: reserved device names (`CON`, `NUL`, `COM1`, `LPT1`, including with an extension such as `nul.txt`), names ending in a dot or space (Win32 strips them), and `:` (drive-relative or NTFS alternate data stream syntax such as `report.txt:ads`). Resolve both the workspace and candidate path, then prove containment: + +```python +import re +from pathlib import Path + +WINDOWS_RESERVED_NAME = re.compile( + r"(CON|PRN|AUX|NUL|COM[1-9¹²³]|LPT[1-9¹²³])(\..*)?", + re.IGNORECASE, +) + +def workspace_path(workspace: Path, requested: str) -> Path: + # Treat both platform separators consistently before checking components. + relative = Path(requested.replace("\\", "/")) + if relative.is_absolute() or ".." in relative.parts: + raise ValueError("path must be workspace-relative") + for part in relative.parts: + if ":" in part or part.endswith((".", " ")) or WINDOWS_RESERVED_NAME.fullmatch(part): + raise ValueError("path component is not portable") + + root = workspace.resolve(strict=True) + candidate = (root / relative).resolve(strict=False) + if not candidate.is_relative_to(root): + raise ValueError("path escapes workspace") + return candidate +``` + +Containment checks do not eliminate symlink races. For sensitive writes, open relative to a trusted directory handle where the platform supports it, reject symlink targets, create files exclusively, and verify ownership and permissions after opening. + +This step is complete when tests cover sibling-prefix paths, nested `..`, absolute paths, symlink escapes, reserved device names, trailing dots or spaces, alternate data stream syntax, and a valid nested workspace path. + +### 4. Protect Temporary Data and Credentials + +- Create sensitive files with owner-only permissions such as `0o600`; create private directories with `0o700`. +- Prefer a user-private runtime directory over a shared temporary directory for credentials or tenant data. +- Create unpredictable names atomically; do not check-then-create. +- Remove temporary data in `finally`, while preserving a redacted error record when cleanup fails. +- Keep secrets out of command arguments, model context, logs, traces, exception text, and tool responses. +- Pass secrets through the platform's secret store or scoped environment injection and rotate exposed credentials. +- Treat zeroization as best effort: mutable byte buffers can be overwritten, but immutable language strings cannot be reliably erased. + +This step is complete when file-mode checks, forced-error cleanup tests, and log-capture tests show that secret values never persist outside the approved boundary. + +### 5. Bound and Sanitize Tool Output + +Read tool output with a byte limit rather than collecting an unbounded stream. Preserve structured fields, remove disallowed control characters, and append an explicit truncation marker with the original byte count. Keep a content hash when later forensic comparison matters. + +Do not silently turn malformed output into an empty success value. Return a typed failure that names the producing tool, boundary, and validation reason without echoing sensitive content. + +This step is complete when oversized output, invalid encoding, terminal-control sequences, malformed structured data, and a normal response all have deterministic tests. + +## Verification Gate + +Before calling the framework hardened, verify all of these behaviors through its real entry point: + +1. Untrusted instructions remain data and cannot trigger a tool or write. +2. An irreversible action without operation-and-resource authorization plus confirmation or scoped pre-approval leaves no side effect. +3. Cross-tenant and cross-workspace identifiers are rejected at the action boundary. +4. Traversal and symlink escape attempts leave the filesystem unchanged. +5. Forced failures leave no credential-bearing temp files or logs. +6. Oversized or malformed tool output returns an explicit bounded error. + +Report the command used, exit status, rejected input, and observed absence of the side effect. Mock-only tests do not prove operating-system permissions, symlink handling, subprocess isolation, or network egress controls. + +## Common Issues + +### Validation exists only in the prompt + +Prompt instructions are advisory. Move the same invariant into deterministic code immediately before the side effect and test a model response that violates it. + +### A normalized path still escapes + +String prefix checks confuse sibling paths such as `/work/app` and `/work/application`. Resolve paths and use component-aware containment, then test symlinks separately. + +### Redaction happens after logging + +Redact before values enter the logger, tracer, exception, or model context. Add a capture test using a sentinel secret and assert the sentinel is absent from every emitted channel. + +## When NOT to Use + +- Use `security-review` for ordinary application authentication, authorization, SQL injection, XSS, CSRF, and API security. +- Use `security-scan` for repository-wide automated vulnerability scanning. +- Use infrastructure-specific guidance for host, container, firewall, or cloud hardening. +- Do not use this skill for penetration testing, exploit development, or unauthorized access. + +## Related Skills + +- `agent-harness-construction` +- `security-review` +- `security-scan` diff --git a/pi/core/skills/bun-runtime/SKILL.md b/pi/core/skills/bun-runtime/SKILL.md index ce07c99b9..999f71dfe 100644 --- a/pi/core/skills/bun-runtime/SKILL.md +++ b/pi/core/skills/bun-runtime/SKILL.md @@ -18,21 +18,28 @@ Use when: adopting Bun, migrating from Node, writing or debugging Bun scripts/te ## How It Works -- **Runtime**: Drop-in Node-compatible runtime (built on JavaScriptCore, implemented in Zig). -- **Package manager**: `bun install` is significantly faster than npm/yarn. Lockfile is `bun.lock` (text) by default in current Bun; older versions used `bun.lockb` (binary). +- **Version baseline**: guidance below targets Bun 1.4.x. Check the actual version with `bun --version` before relying on flag names, since CLI flags can change between releases. +- **Runtime**: Drop-in Node-compatible runtime, built on JavaScriptCore. As of Bun 1.4 the runtime itself is implemented in Rust (migrated from Zig). Not 100% Node-compatible — some native addons, less-common `node:` internal APIs, and packages that depend on Node-specific internals can still fail; verify before depending on it in production. +- **Package manager**: Bun includes a package manager; installation performance depends on the project, network conditions, and cache state. Lockfile is `bun.lock` (text) by default in current Bun; older versions used `bun.lockb` (binary) — Bun still reads that format for migration, but new projects should use `bun.lock`. - **Bundler**: Built-in bundler and transpiler for apps and libraries. -- **Test runner**: Built-in `bun test` with Jest-like API. +- **Test runner**: Built-in `bun test` with a Jest-like API. **Migration from Node**: Replace `node script.js` with `bun run script.js` or `bun script.js`. Run `bun install` in place of `npm install`; most packages work. Use `bun run` for npm scripts; `bun x` for npx-style one-off runs. Node built-ins are supported; prefer Bun APIs where they exist for better performance. -**Vercel**: Set runtime to Bun in project settings. Build: `bun run build` or `bun build ./src/index.ts --outdir=dist`. Install: `bun install --frozen-lockfile` for reproducible deploys. +**Package and workspace commands**: `bun add ` / `bun remove ` / `bun update [pkg]` manage dependencies; `bun outdated` lists stale deps. `bun pm ls` lists project dependencies and resolved versions using the lockfile; `--all` includes transitive dependencies. It is not an integrity check of installed file contents. [`bun audit`](https://bun.com/docs/pm/cli/audit) queries registry advisories using package names and versions from `bun.lock`; it does not modify `package.json`, `bun.lock`, or `node_modules`. Review approved destinations before sending private package metadata. Packages whose scoped registry lacks an advisory endpoint are skipped and do not affect the exit code. `bun audit fix` upgrades and installs dependencies, changing the lockfile and installed packages and sometimes direct version pins; review it as a modifying install operation, including applicable lifecycle scripts. `bun dedupe` collapses duplicate installs, and `bun prune` removes packages no longer referenced. Monorepos use a root `workspaces` array in `package.json` (same convention as npm/yarn); run a script in one workspace with `bun run --filter