Commit Graph
1780 Commits
Author SHA1 Message Date
haelyra b6e0261903 merge: preserve static MCP dependency review source 3239 2026-10-09 17:04:33 -04:00
haelyra a5432e84f7 merge: preserve tested stocktake discovery and save source 3220 2026-10-09 17:03:20 -04:00
haelyra b6416b07e8 merge: preserve role sample source 3219 and user model choices 2026-10-09 17:03:10 -04:00
haelyra d312d6f35c merge: preserve project and user Codex configuration source 3253 2026-10-09 17:02:47 -04:00
montjeffrey ad031b60fb Merge upstream/main into feat/gateguard-fewer-round-trips
Resolve the one conflict, skill-triggers@1.json: take upstream's
pretty-printed manifest and recompute registryDigest for the merged
registry so validate-context-profiles passes.
2026-10-09 16:58:12 -04:00
Eneko Ruiz 9f9ea5e35b fix(codex): fail closed when pre-commit cannot find ripgrep 2026-10-09 22:33:51 +02:00
haelyra eed806bf4a fix: restore unskipped installer refactor validation
Follow up PR #3187 at 38b8c07f while preserving the original contribution history and all current-main helper bodies. Remove both CI safety-suite exclusions, clean stale imports and the warning glyph, retain shipped test/coverage entrypoints, and keep unknown test totals honest. The tree matches the fully tested 6246-pass/325-file tree; disposable Claude/OpenCode lifecycle passes.
2026-10-09 16:32:47 -04:00
haelyra 67c89375c3 merge: preserve serialized store source 3252 with portable cache fixtures 2026-10-09 16:28:34 -04:00
haelyra 0aebb36af2 merge: preserve cache guidance source 3173 with measured cost boundaries 2026-10-09 16:27:29 -04:00
haelyra 206ad23125 merge: preserve payment source 2575 with tested origin and approval boundaries 2026-10-09 16:27:03 -04:00
haelyra d5abc5c8fc merge: preserve reviewed plan registry source 2914 2026-10-09 16:27:02 -04:00
haelyra 195301cb04 merge: preserve tested optional dependency carry-forward 3119 2026-10-09 16:21:29 -04:00
haelyra cc288b6e28 merge: reconcile tested OpenCode home carry-forward with Copilot transforms 2026-10-09 16:20:04 -04:00
haelyra 7265b989c4 merge: preserve tested bounded Hookify carry-forward candidate 3055 2026-10-09 16:17:57 -04:00
haelyra 46ec7aca9b merge: preserve tested SQL wrapper guard source 3050 2026-10-09 16:16:43 -04:00
haelyra a1e0f46c7c merge: preserve tested PowerShell prerequisite source 3042 2026-10-09 16:15:41 -04:00
montjeffrey aba3c241af test(carriers): pin exact import resolution, portable separators, and regex after a condition
Review on aec97150 found four ways the closure gate passes a carrier that
fails at run time. Each is reproduced here against the current head:

- import('./helper') with only helper.js planned is accepted, but Node's
  ESM resolver does no extension search.
- import('./data') with only data/index.json (or index.js) planned is
  accepted, but Node rejects directory imports even from CommonJS.
- require('./lib\helper.js') with lib/helper.js planned is accepted
  because backslashes were normalized, but Linux and macOS read the
  backslash as part of the filename.
- In `if (ok) /['"]/.test(text); require('./missing')` the regex after
  the condition's closing paren is read as division, its quote opens a
  fake string, and the require disappears.

Controls that must keep passing: an exact import() of a planned file, an
extensionless require through the CommonJS search, and division after a
method named `if` or a call nested inside a condition. extractReferences
gains an `imports` list so the resolver can tell the two forms apart.
2026-10-09 16:12:32 -04:00
haelyra 4cb9f29c06 merge: preserve tested Hermes hooks source 3019 2026-10-09 16:12:01 -04:00
haelyra 1d02fbfa51 merge: preserve tested agent-security source 3015 2026-10-09 16:11:53 -04:00
haelyra 34ba911ad3 merge: preserve tested Python audit source 3007 2026-10-09 16:11:22 -04:00
haelyra 899a12310e merge: preserve tested dashboard read-once source 3002 2026-10-09 16:11:12 -04:00
haelyra 83cd2ad91e merge: preserve tested commit-review source 2974 2026-10-09 16:10:04 -04:00
haelyra a6f6faed2a merge: preserve source 2983 with tested activity dashboard fixes 2026-10-09 16:09:59 -04:00
haelyra 2ad3bdbef4 merge: preserve tested Copilot install sources 2960 and 2963 2026-10-09 16:09:01 -04:00
haelyra 95bbd84106 merge: preserve tested tool-choice provider source 2950 2026-10-09 16:07:23 -04:00
haelyra 660a38ad24 merge: preserve tested documentation governance source 2943 2026-10-09 16:06:24 -04:00
haelyra 3ab06e8c6c merge: preserve reviewed routing wrapper source 2755 2026-10-09 16:05:14 -04:00
haelyra c4f419bea0 merge: refresh reviewed stewardship source 3280 on current main 2026-10-09 16:02:58 -04:00
wellkilo a50ee13cac feat: execute bounded local Hookify rules in lifecycle hooks
Carry forward PR #3055 at 92f53c4c onto ef648e01, preserving contributor attribution and current main. Focused maintainer fixes reuse shared input ceilings, preserve late root context through outer bootstrap, bound frontmatter before immutable parsing, and assert real oversized input in the limits workflow.
2026-10-09 15:59:20 -04:00
haelyra 846c450658 fix: keep activity dashboard executable and bound log reads 2026-10-09 15:57:34 -04:00
montjeffrey c6b2c55b87 fix(hooks): never run .sh hooks through the WSL bash launcher on Windows
plugin-hook-bootstrap (shell mode) and observe-runner probed a bare
`bash.exe`. On Windows that resolves to the first match on PATH, and
%SystemRoot%\System32 normally sits ahead of Git's bin directory, so the
pick was System32\bash.exe: the WSL launcher. The existing guard (require
a clean probe exit) only catches it when no distro is installed. With one
installed, the probe passes inside Linux, then the hook script is handed
over by a Windows path (C:\...) or a Git Bash path (/c/...), neither of
which exists in WSL. The hook exits 127 instead of running, and
observe-runner's continuous-learning observation fails on every call.

Resolve bash candidates on Windows to absolute paths from PATH, skipping
bash.exe in System32, SysWOW64, Sysnative, and the WindowsApps alias
directory, so a native bash later on PATH (Git's) is used. With none
available, the existing "no bash binary found" skip applies. An explicit
BASH override still wins, and other platforms keep bare names.

The shared resolver lives in scripts/lib/windows-bash.js with a
platform-independent test. A Windows integration test puts System32 ahead
of Git's bash and requires the .sh hook to actually run. Upstream's
bootstrap fails that scenario with exit 127 ("/bin/bash: C:Users...hook.sh:
No such file or directory"); this one prints the hook output.
2026-10-09 15:56:14 -04:00
haelyra 131c6186c3 feat: integrate native Copilot skill and agent distribution
Preserve contributor histories for PR #2960 and #2963. Resolve current-main conflicts without dropping OpenCode behavior. Reject traversal source paths, keep volatile inventory counts observational, and apply the shared ownership guard during every adapter repair while retaining adapter-derived roots. RED ownership and traversal regressions now pass, 73 lifecycle tests pass, and native Copilot observes 288 enabled project skills. Disposable install, missing-file repair, and uninstall preserve user-authored agents.
2026-10-09 15:53:38 -04:00
Darwin PardaveandCopilot App 5e3863e512 perf: avoid duplicate skill file reads
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-10-09 15:50:20 -04:00
haelyra 9e951e266d fix: normalize portable workspace path separators 2026-10-09 15:49:31 -04:00
Dante c29a724bcd fix: declare optional cross-target install dependencies
Carry forward the final scoped delta of PR #3119 at 60e82f95. Keep required dependency closure and select only modules reachable from successful requests; refresh the unchanged 293-skill registry binding.
2026-10-09 15:43:31 -04:00
Yusuf Efe 0f34fdcc14 fix: resolve installed OpenCode skill paths consistently
Carry forward PR #3115 ef475c79 and 780dfb78 onto current main. Preserve the newer hook-consent transforms during install and repair. Main already includes the source import fix from #3167.
2026-10-09 15:40:12 -04:00
montjeffrey 20cd70e06d test: stop Windows developer tooling from leaking into setup, tar, and audit tests
On a Windows machine with Claude Code installed natively, Git for Windows,
and the ECC plugin installed, `node tests/run-all.js` on main fails 44 tests
in 7 files. Linux CI never sees them. Three of the four causes are test
isolation gaps, fixed here (43 tests):

- claude-plugin-setup, claude-scope-migration, setup (38): fixtures put a
  fake claude.cmd first on PATH, but on Windows spawning a bare `claude`
  resolves only .com/.exe, so a native ~/.local/bin/claude.exe ran instead
  of the fake. Fixture PATHs now drop entries holding claude.exe/claude.com.
- ecc-universal-bin, eval-harness-package (4): tar received an absolute
  C:\ archive path, which Git Bash's GNU tar reads as a host:path remote
  spec ("Cannot connect to C: resolve failed"). Extract from inside the
  destination with a relative, forward-slash archive name, which both GNU
  tar and bsdtar accept.
- harness-audit (1): the cache-layout test overrode HOME only, while
  findPluginInstall also reads USERPROFILE and os.homedir(), so the real
  installed plugin won over the fixture. Override USERPROFILE too.

The two helpers live in tests/lib/helpers/windows-test-env.js with a
platform-independent test, so Linux CI holds both invariants too.

The 44th failure, plugin-hook-bootstrap's no-bash test, is a production
bug rather than a test leak: System32\bash.exe launches an installed WSL
distro, which passes the bash probe. It gets a separate fix.
2026-10-09 14:32:52 -04:00
Yann Roberto 39796acf2f perf(state-store): reuse unchanged read snapshots
Keep the operation lock while validating bigint file identity and reuse
only snapshots produced by successful trusted static SELECTs. Avoid
reloading and exporting unchanged databases on repeated public reads.

Retain conservative comparison for generic SQL, including RETURNING and
PRAGMA writes, and invalidate reuse after transactions, exports or errors.
Cover cache invalidation, cross-process visibility, Windows device IDs,
reentrant partial writes, lock contention and independent result objects.

Validate 188 focused tests per environment on WSL Node 22.22.3 and native
Windows Node 22.15.0/24.16.0, plus 38 related WSL tests. Paired warm-read
benchmarks show 7.6-18.1x point-query speedup on 160 KiB/1.28 MiB databases.
2026-10-09 17:04:56 +08:00
Yann Roberto a6ce6fbbdb fix(state-store): tolerate missing Windows lock device IDs
Handle Windows Node path stats that report dev=0 for the same file whose
open descriptor reports a volume serial. Keep bigint inode checks strict,
retain device comparisons whenever both are known, and leave POSIX strict.

Cover zero-device identity cases, high inode precision, replacement and
file-type safeguards. Verify 164 focused tests each on native Windows
Node 22.15.0 and 24.16.0, plus WSL Ubuntu Node 22.22.3.
2026-10-09 16:46:19 +08:00
Yann Roberto f76c469fa7 fix(state-store): persist writes from prepared result queries
Compare the completed snapshot after get/all queries so RETURNING and
prepared PRAGMA writes survive reloads and reopening. Export only after
the outer operation or transaction succeeds; unchanged read snapshots
still avoid disk writes. This adds one export/byte comparison per read
snapshot without relying on SQL parsing or private sql.js APIs.

Add 18 regression cases covering multi-row INSERT/UPDATE/DELETE RETURNING,
standalone and transactional get/all, no-row PRAGMA writes, and rollback.
The unfixed adapter fails 16 of these cases. Strengthen read-only checks.

Validation: 148 focused tests pass on WSL Node 22 and Windows Node 24;
the general state-store suite passes 20/20 on WSL and 19/20 on Windows,
where the existing file-symlink fixture is denied by Windows permissions.
Scoped adapter coverage is 90.13% lines, 82.73% branches, 100% functions.
ESLint, Unicode safety, and git diff --check pass.
2026-10-09 16:28:30 +08:00
zakyirsyaad 93e6475420 fix(qwen): publish the adapter, handle CRLF, reject unknown flags
Three review findings, all verified before fixing.

1. Publish surface (blocking). package.json `files` lists
   scripts/gemini-adapt-agents.js but not this script, so the npm tarball
   omitted it and ecc-universal users hit MODULE_NOT_FOUND. Added to `files`
   and to the allowlist in tests/scripts/npm-publish-surface.test.js, which now
   passes 2/2.

2. CRLF agents were silently skipped. The frontmatter regex matched LF only, so
   a Windows-saved agent was reported as 'already compatible' while still
   carrying tools: Read, Bash and color: teal -- a success message with no
   adaptation. Normalize to LF, adapt, then restore the original ending style.
   Reproduced before and after: the same CRLF fixture went from 'Updated 0' with
   Read/teal intact to 'Updated 1' with read_file/cyan and CRLF preserved.

3. Unknown flags were discarded. Because the script rewrites files in place,
   `--dry-run` rewrote every installed agent and exited 0. parseArgs now throws
   on any unrecognized option before a directory is selected.

Tests: 12/12 (added CRLF preservation and no-mutation-on-unknown-flag),
gemini-adapt-agents 4/4 unaffected, npm-publish-surface 2/2. Re-run against all
68 canonical definitions: 68 updated, second run 0 updated, no Claude-shaped
frontmatter remaining, no spurious CRLF introduced.

Note: findings 2 and 3 apply equally to scripts/gemini-adapt-agents.js, which
has the same LF-only regex and the same flag filter. Left unchanged here to keep
this PR scoped to the Qwen adapter; worth a follow-up.
2026-10-09 13:46:34 +07:00
zakyirsyaad 7695b99348 fix(qwen): map WebSearch to web_search instead of dropping it
Review correction. The original version dropped WebSearch on the claim that Qwen
Code has no web search tool. That claim is wrong: Qwen Code exposes web_search as
a deferred tool, resolving through a DashScope search agent.

web_search is provider-dependent rather than universally present, but mapping is
still the better default than dropping. Where the provider supports it the agent
gains the capability; where it does not, Qwen Code ignores an unresolvable entry
in tools: without warning, so the outcome is the same as dropping. The reasoning
is recorded in a comment at the mapping so the choice is not silently reverted.

Across the 68 canonical definitions this changes two agents from losing a
declared capability to keeping it. Tests updated to assert the mapping; 10/10
pass and gemini-adapt-agents.test.js still passes 4/4.
2026-10-09 13:38:24 +07:00
zakyirsyaad 70940903cc test(commands): guard argument-hint against unquoted flow sequences
The existing frontmatter test only checks that a description is present, so all
three array-valued argument-hint declarations passed CI on main. Harnesses that
type-check the field reject the whole file, which is how the commands went
missing without anyone noticing.

Add an assertion scoped to argument-hint only. A blanket 'no flow sequences in
frontmatter' rule would be wrong: allowed-tools is a legitimate list in
marketing-campaign.md and skill-create.md.

Verified both directions -- on main the new test fails and names exactly
code-review.md, cost-report.md, and orch-review.md; on this branch the suite
passes 96/96.
2026-10-09 12:59:53 +07:00
zakyirsyaad 64eaa7d124 feat(qwen): add qwen-adapt-agents.js to normalize agent frontmatter
--target qwen installs all 68 agent definitions verbatim, so they carry Claude
Code tool names (Read, Write, Edit, Bash, Grep, Glob, WebSearch) and color: teal.
Qwen Code uses different tool ids, and its palette is red/blue/green/yellow/
purple/orange/pink/cyan/auto, so an unlisted value is dropped at load time with a
SUBAGENT_MANAGER warning.

ECC already solves this for Gemini via scripts/gemini-adapt-agents.js; this adds
the Qwen counterpart plus a test mirroring the Gemini one. The canonical agents/
directory is untouched -- each harness adapts its own installed copy.

Deliberate differences from the Gemini adapter, each a real Qwen behaviour:

  Edit              -> edit          (Gemini maps to replace)
  WebSearch         -> dropped       (Qwen has web_fetch only, no web search)
  mcp__server__tool -> unchanged     (Gemini lowercases to mcp_server_tool)
  color:            -> remapped      (Gemini removes it; teal becomes cyan)
  tools: output     -> comma scalar  (the form Qwen's own examples use)

model: is left alone, matching the Gemini adapter. 58 files say sonnet, 6 haiku,
4 opus and none are Qwen model ids, but Qwen logs no warning for them, so whether
they are ignored or resolved at dispatch time is unverified and changing 68 files
on an assumption seemed worse than flagging it as a follow-up.

Tested: 10/10 new cases pass and gemini-adapt-agents.test.js still passes 4/4.
Run against a copy of all 68 real definitions: 68 updated, 0 bodies changed,
0 invalid frontmatters, second run reports 0 updated. The result was installed
into ~/.qwen/agents and a headless Qwen session loaded all 68 with no errors and
no color warnings.
2026-10-09 12:55:36 +07:00
Beksultan Pirmatov 11a970e11e fix: detect Dart/Flutter projects in project-detect.js
LANGUAGE_RULES had no entry for Dart, and FRAMEWORK_RULES had no way to
detect Flutter, so any Flutter app (pubspec.yaml, lib/*.dart, android/,
ios/) was reported as primary: "unknown" by the SessionStart project-type
banner, despite ECC shipping a dart-flutter-patterns skill and a
dart-build-resolver agent for this exact stack.

Adds a 'dart' language rule (pubspec.yaml/pubspec.lock markers, .dart
extension) and a 'flutter' framework rule that checks pubspec.yaml for
the standard `flutter: / sdk: flutter` dependency shape, via a new
customCheck hook on FRAMEWORK_RULES entries. This distinguishes Flutter
apps from plain Dart packages, which don't depend on the Flutter SDK.

Closes #3469
2026-10-09 11:16:44 +06:00
Eneko Ruiz 684c971173 fix(hooks): resolve session IDs from hook payloads 2026-10-08 23:46:56 +02:00
taljeri 6d15a1272e docs(i18n): add Arabic localization scout
Add Arabic (ar) localization guide and glossary, register the locale:ar component and docs-ar module across install manifests, and wire test coverage.

Contributed-by: @taljeri (taljeri)
Signed-off-by: taljeri <318237806+taljeri@users.noreply.github.com>
2026-10-08 21:50:04 +03:00
montjeffrey f4c9b05e54 test(context): pin routing index recovery, entry validation, bounds and mode-aware advice 2026-10-08 16:56:09 +00:00
montjeffrey e85c529eaf test(carriers): an interpolated from identifier is not an import 2026-10-08 16:48:47 +00:00
montjeffrey 333e755f50 test(carriers): cover spaced calls, escaped specifiers, Windows paths and index.json 2026-10-08 16:47:54 +00:00