- Review a caller-supplied diff when given; otherwise collect committed
branch, staged, unstaged, and untracked Ruby changes. Plain `git diff`
missed staged-only and committed PR changes.
- Add update_all/delete_all/update_columns/insert_all/upsert_all on
user-reachable scopes to the HIGH tier, since they skip validations
and callbacks.
- Fix stale 67-agent catalog blocks in README.md and docs/ja-JP/README.md
and list ruby-reviewer there.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kimi.com/code serves mainland China (WeChat / +86 sign-in, Alipay and WeChat Pay), so ECC's international readers cannot sign up or pay there.
Point the Kimi Code link in the install-target tables at kimi.ai/code (Google sign-in, card payment) instead, keeping the same aff value.
Sync skills/tinystruct-patterns against tinystruct's own canonical copy of
this skill (.agents/skills/tinystruct-patterns/), which the framework repo
keeps up to date with each release:
- Document the bin/dispatcher / bin/dispatcher.cmd launcher generation
workflow (never hand-write or copy it; the framework generates it via
ApplicationManager.init()).
- Add native MCP server/tool integration (org.tinystruct.mcp.*), including
the prompt-injection warning for tool return values and overloaded-tool
schema merging.
- Add annotation-based DB mapping (@Table/@Id/@Column) alongside XML
mapping, the --mapping annotation generator flag, and table
auto-creation via database.autocreate.
- Add the programmatic logging/diagnostics subsystem (ANSI console colors,
StackWalker-based caller tracing, per-package level overrides).
- Update the architecture package map accordingly.
Also update the Japanese translation (docs/ja-JP/skills/tinystruct-patterns)
to match, which had drifted to an older, condensed version of this skill.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add a Ruby and Rails code reviewer agent covering Active Record query
safety, strong parameters, unsafe reflection and deserialization, XSS,
safe migrations, and RSpec/Minitest quality. It builds on the existing
rules/ruby/* and rails-patterns skill.
- Register it in .opencode/opencode.json with a matching prompt file
- Map ruby and rails to it in the orch-review workflow
- Bump the documented agent count from 68 to 69 across README, AGENTS.md,
plugin manifests, and translated docs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Resolve the 3 conflicts from 104 upstream commits (2.2.1 -> 2.2.2).
Merge resolution:
- .claude-plugin/plugin.json, .claude-plugin/marketplace.json: take the
upstream 2.2.2 version bump, keep the catalog counts at 69 agents /
293 skills. Upstream released 2.2.2 still describing 68/292, so neither
side could be taken whole.
- docs/ja-JP/README.md: upstream restructured the page, moving the hero
above the fold and replacing both markdown language selectors with a
single centered HTML block that also gained Español. Take that structure
and re-add বাংলা to the new selector.
- rules/common/agents.md: merged clean, but the roster line main added
reads "68 agents". Resync to 69 alongside the other catalog counts.
Verified: catalog.js reports 69 agents / 293 skills and confirms the
documentation counts match the repository catalog; the nine CI validators
and the command-registry check pass; bengali-language-surface.test.js is
7/7, including the selector and locale-parity assertions.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
The guides referenced a non-existent /ecc:tdd command; the TDD entry
point is the tdd-workflow skill (/ecc:tdd-workflow), optionally fed a
*.plan.md from /ecc:plan.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Step-by-step section in the English and Japanese guides: plugin refresh
and Codex login check, creating the project and starting Claude Code
there, running /ecc:astra-review, committing on PASS, and gating the push.
Notes that the project does not need to live under the ECC checkout and
gives the installed script path.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Full retranslation of README.md (structure preserved 1:1): 2.2 install
flows, Codex and Kimi support, platform tables, security, and
troubleshooting. Relative links rewritten for docs/ja-JP/ and in-page
anchors mapped to the Japanese headings.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Full manual for /astra-review: setup (Codex CLI, ChatGPT login, plugin
freshness), scopes, script options and exit codes, verdict format, the fix
loop, push gating, what leaves the machine, troubleshooting, and limits.
Linked from both READMEs, the Japanese quick reference, and the command docs.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Resolve the 19 conflicts from 314 upstream commits (all language-selector
and catalog-count lines), then fix the review threads still open on #2655.
Merge resolution:
- Keep both new locales: every language selector now lists Українська and বাংলা,
including the selectors that previously carried only one of them.
- Resync catalog counts to 69 agents / 293 skills across README.md, AGENTS.md,
README.zh-CN.md, docs/zh-CN/*, docs/tr/AGENTS.md, and the plugin manifests.
Review fixes:
- install-components.json: drop the explicit skill:bengali-nlp -> framework-language
mapping so the selector resolves to the generated single-skill component.
Selecting it installed 70 skill paths plus core modules; it now installs
skills/bengali-nlp only. (Greptile P1)
- docs/bn/README.md: point the Stars/Forks/Contributors badges at affaan-m/ECC
instead of affaan-m/everything-claude-code, align the header with the other
translations, add the 2.2.1 release section, and update 67+/281+ to 69/293.
- skills/bengali-nlp/SKILL.md: split the U+09F0-U+09FA row by character type;
reject empty search queries; replace the delimiter-only prompt boundary with
structured messages; require provider and locale checks before relying on the
bn-BD ICU collation; rewrite the isdigit() anti-pattern, which claimed the
method misses Bengali digits when it accepts them; add Best Practices and
Related Skills per the CONTRIBUTING template.
- agents/bengali-reviewer.md: HIGH findings now need a fix or a written waiver
with an owner and expiry, otherwise the verdict is BLOCK.
- tests/ci/bengali-language-surface.test.js: parse fences so an unclosed
```python block fails, track a missing interpreter as skipped rather than
passed, assert the single-skill install plan, and check every language
selector instead of only the root README.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
- rules/common/agents.md: Fix incorrect location (was ~/.claude/agents/, now explains plugin ships with ecc@ecc)
- Add ecc: prefix to all agent names in tables and orchestration sections
- Update all 4 translated copies (es, ja-JP, zh-CN, tr) with same fixes
- Update root AGENTS.md with ecc: prefix for consistency
Fixes#3143
Keep the contributor's corrected Haiku and Fable/Mythos tiers, update the live Sonnet and Opus rows against the current official pricing contract, and mirror the same numeric changes in the Japanese and Chinese tables.
Keep the duplicate estimator and its tests deleted as landed through #2866, while carrying the contributor's pricing-table correction forward and refreshing the documented live model rows against the current official pricing contract.
`scripts/ci/validate-agents.js` reads only `agents/`, so the translated copies
under `docs/<locale>/agents/` were never validated against the agent they
describe — and drifted.
Two kinds of drift, both machine-checkable and both wrong in the same
direction (the translations were made from an older revision and never
re-synced):
- **Model tier, 39 files.** Every one names a costlier tier than ships:
haiku -> sonnet, sonnet -> opus. `security-reviewer` reads `opus` in ja-JP
and zh-TW; it ships `sonnet`.
- **Tool set, 15 files.** `security-reviewer` and `database-reviewer` list
`Write` and `Edit` in **all seven locales** — both agents ship read-only
(`Read, Grep, Glob, Bash`). `seo-specialist` in zh-CN adds a `Bash` the
canonical agent does not have. Documenting a reviewer as able to write is
the kind of inaccuracy someone auditing what these agents can touch would
act on.
Sync `model` and the `tools` set to canonical, preserving each locale's
existing list style so the diff is only the values that were wrong. The
`["a", "b"]` vs `a, b` formatting difference is left alone: it is consistent
per locale and carries no meaning.
Add `tests/ci/locale-agent-frontmatter.test.js` so this cannot drift back.
`tools` is compared as a set, not a string, so the style difference stays
legal; prose is not compared at all. The last case pins the specific failure:
a canonical read-only agent may never be documented with Write or Edit.
`.kiro/agents/` is deliberately excluded — it uses a different schema
(`allowedTools: [read, shell]`, no `model`), not a translation of this one.
Nine command files spell the key with an underscore while six other files in
this repository already use `allowed-tools`. Claude Code reads the hyphenated
form, so the underscored key is unrecognized and the tool pre-approval it is
meant to grant never applies.
The design rationale cited "Opus 4.6+" as the class of models capable of
holistic checklist judgment. That reference predates the Claude 5 families
(Opus 5, Sonnet 5, Fable 5), so readers on current models can't tell whether
the guidance still applies to them.
Widens the parenthetical to name the Claude 5 families explicitly. Applied
across all four locale copies (en, ja-JP, tr, zh-CN) to keep translations in
sync. Documentation wording only; no behavioral change.
Two findings from the bot review.
The reusable payment client had no authorization boundary. The policy
validates one challenge at a time, so it cannot see a session total and
cannot ask a human anything — a long-lived wrapped client could pay
repeatedly, to any recipient, past any intended budget. This also
contradicted the skill's own Spending Controls section, which promises
per-session budgets and allowlisted recipients.
Adds an allowlist of recipients to the policy, and routes every paid call
through a boundary that asks for confirmation once and holds a session
ledger. Settlement responses carry no amount, so the ledger reserves the
per-call cap — a deliberate over-estimate that can stop early, never late.
The payment-enabled client stays private behind it.
The Solana recipient check was too loose. Scanning an owner's token
accounts proves only that some account exists for the mint; the exact-SVM
client targets the canonical ATA specifically, so an auxiliary account
would pass while settlement still fails. Now derives the ATA with
findAssociatedTokenPda and checks that exact address. Also corrects the
provisioning advice: a bare transfer does not create the account, only one
that includes the create instruction does.
Mirrored across en, ja-JP, and zh-CN.
- Rename the Ukrainian locale identifier from ua-UA/ua to uk-UA,
with uk kept as a short alias
- Update directory (docs/ua-UA -> docs/uk-UA), README links, and
all component/module IDs accordingly
- Add locale:uk-ua entry to install-components.json, replacing the
orphaned locale:ua entry that had no matching component
- Add docs-uk-ua entry to install-modules.json, pointing to
docs/uk-UA
Fixes "Unknown install component" error triggered by the previous
locale:ua entry.
* fix: disable Claude co-author attribution by default
* fix: harden default co-author opt-out and correct the docs
Follow-up on the co-author default in this PR.
- Remove the existsSync/writeFileSync race in the installer settings write
(CodeQL js/file-system-race, high). A single guarded read now covers the
fresh-install case, and unreadable or non-object settings are left untouched.
- Respect `attribution` as an explicit user choice. It supersedes
`includeCoAuthoredBy` in Claude Code 2.1.x, so a user who configured it would
otherwise have had a dead key written into their settings.
- Share one opt-out rule via scripts/lib/claude-commit-attribution.js instead of
duplicating it across the installer and plugin setup.
- Update the git-workflow rule and its nine mirrors and translations, which
still told users ECC does not ship this setting.
We keep writing the deprecated `includeCoAuthoredBy` key rather than
`attribution`: unknown keys fail Claude Code settings validation, so writing
`attribution` would break users on older versions.
Addresses the security review on #2575.
Enforce policy against the actual challenge. The previous example compared
a budget against a number the caller passed in, so a server quoting any
amount could still be paid. Replaces it with a PaymentPolicy registered on
the client, which filters the server-provided requirements before a
signature exists and validates all three fields — amount, asset, network.
Filtering everything out makes createPaymentPayload throw rather than fall
back to paying.
Testing this adversarially surfaced a bug in the guard itself: EVM
addresses are case-insensitive, so a server quoting lowercase USDC — the
same token — was dropped. Assets are now normalised before comparison,
lowercasing only 0x addresses, since Solana base58 is case-sensitive and
must not be folded. Also rejects negative amounts.
Verified against 12 cases: over-budget, wrong mint, wrong network,
case-flipped Solana mint, non-numeric and negative amounts all refuse;
checksummed, lowercase and uppercase EVM forms and the cap boundary all
pass.
Refresh the supported contract. Pins move 2.19.0 -> 2.22.0 (upstream
shipped 2.20, 2.21 and 2.22 since this branch opened). The documented
server and client APIs are unchanged across that range — re-ran the
seller middleware on 2.22.0 and it still returns a multi-network 402.
Keep facilitator guidance vendor-neutral. Self-facilitation and running
your own facilitator are now listed first, ahead of the testnet default
and hosted options, and the hosted paragraph points at the upstream
maintained list rather than naming a default. Adds an explicit disclosure
of the author's affiliation with one listed facilitator.
Mirrored across en, ja-JP, and zh-CN.
Model-routing guidance across the rules, skills, and harness-steering docs
still recommends Sonnet 4.6 / Opus 4.5-4.6 by name. Readers on the current
generation have to map those onto Sonnet 5 / Opus 5 themselves, and the
recommendation reads as pinned to a superseded generation.
Renames the recommended models in guidance tables and updates two pinned
model IDs in code samples:
- rules/steering guidance: .cursor, .kiro, and the seven translated
performance.md copies (ja-JP, zh-CN, zh-TW, ko-KR, pt-BR, es, tr)
- skills/prompt-optimizer complexity-routing table (+ zh-CN copy)
- skills/cost-aware-llm-pipeline MODEL_SONNET constant (+ zh-CN, ja-JP)
- docs/examples project-guidelines template, which pinned the invalid ID
claude-sonnet-4-5-20250514 (+ zh-TW, ja-JP copies)
Deliberately left alone:
- The "Pricing Reference (2025-2026)" table in cost-aware-llm-pipeline.
Renaming those rows while keeping the existing per-token figures would
assert Claude 5 pricing this change has not verified.
- Executable model config (.opencode/opencode.json, agent.yaml). Those pins
change real agent behavior and belong in their own reviewed change.
- Historical and illustrative references: the-shortform-guide session
transcripts, the ECC-PRO roadmap log entry, gan-style-harness's
"Opus 4.5-class"/"Opus 4.6-class" capability tiers, and
strategic-compact's deliberately generic "400k Opus 4.x" example.
- docs/ATLAS-CLOUD-GUIDE.md, which lists a third-party provider's catalog.
Documentation wording only; no behavioral change.
Co-authored-by: Phumchai Tanonsi <274848436+phumchai1515-prog@users.noreply.github.com>
* fix(quarkus-verification): use current ghcr.io/zaproxy/zaproxy:stable image
The owasp/zap2docker-* images are deprecated (ZAP left the OWASP org). The
current canonical image published by the ZAP project is
ghcr.io/zaproxy/zaproxy:stable; the packaged scan scripts (zap-api-scan.py)
are unchanged.
Applies to the source skill and the ja-JP, tr translated copies.
Refs: https://www.zaproxy.org/docs/docker/about/
* chore(quarkus-verification): bump GitHub Actions v3 -> v4
actions/checkout, actions/setup-java, actions/cache and codecov/codecov-action
were pinned at v3 (which runs on the deprecated Node 16 runtime). Bump to v4.
Applies to the source skill and the ja-JP, tr translated copies.
* docs(quarkus): finish current CI example refresh
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
Notorious D.E.V