The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)
Perl::Critic has no InputOutput::RequireThreeArgOpen or
Modules::RequireTaintChecking policy. perlcritic warns that they are
not installed and ignores them. Two-arg open is already covered by
InputOutput::ProhibitTwoArgOpen in the same profile. Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d70726d79c)
sanitize_html is not a built-in Laravel rule and the skill never
registers it, so the validator throws BadMethodCallException. The same
FormRequest already strips tags in validated(). Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit 453c0651f7)
The users router uses Depends() for OAuth2PasswordRequestForm but the
import line omits it, so the module raises NameError on import.
Regenerated pi/core with scripts/build-pi-core.js.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d383fb57e9)
RED: seven Unicode regressions reproduced under Windows cp1252 and Linux ASCII with UTF-8 mode disabled. GREEN: Windows 91 passed with 5 platform skips; Linux ASCII 96 passed. Nine offline Unicode cases cover file, temporary YAML, prompt and all four CLI capture boundaries without model calls. Changed functions have 84.7% line coverage, each exceeds 80%; all 13 changed IO sites execute. Pi/catalog parity checks pass.
(cherry picked from commit 642cb0d512)
RED: 6 failures proved booleans and fractional indices could invent evidence. GREEN: 49 targeted tests; full skill-comply suites pass on Windows (88 passed, 5 platform skips) and Linux (93 passed). Parser coverage 100%; exact integer floats and numeric strings remain supported. Pi/catalog checks pass.
(cherry picked from commit 6dde588860)
Line 13 still said 'Verify that 2.2.0 is readable' after the install
command was updated to @2.2.3. Align prose with the pin to remove the
version mismatch within the Quick Start section.
(cherry picked from commit b0b955541f)
The Quick Start section pinned ecc-universal@2.2.0 while every other
reference in the repo (README.md, and all other docs) uses @2.2.3.
This caused Antigravity users to install an outdated version.
Update the pin to @2.2.3 to match the rest of the codebase.
(cherry picked from commit a052b208e5)
The compiled OpenCode tools import `tool` from `@opencode-ai/plugin/tool`
at module top level, and the hooks plugin imports those tools statically.
The package was only a devDependency, so production installs (OpenCode's
npm plugin cache, `npm install --omit=dev`) could not resolve it and the
whole plugin failed to load.
Move it to `dependencies` and add a build-opencode regression test that
fails when the built bundle imports a package not declared as a runtime
dependency.
Fixes#3543
(cherry picked from commit 106024070e)
* docs: correct MODULE_NOT_FOUND plugin cache path
Point the install command at cache/ecc/ecc/<version>.
The cache/ecc directory itself has no package.json.
* docs: explain the MODULE_NOT_FOUND version placeholder
Tell readers to replace <version> with the version from claude plugin list
before running the install command.
* docs: quote plugin cache version placeholder
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
The platform-configs module lists `.pi`, but PLATFORM_SOURCE_PATH_OWNERS
had no entry for it, so isForeignPlatformPath() returned false and every
install-apply target (e.g. `--target opencode`) copied the Pi harness
adapter (.pi/README.md, .pi/extensions/*) into its config root and
recorded it as ECC-managed.
Pi consumes ECC through `pi install`, not install-apply, so map `.pi` to
the `pi` owner. No install target has that id, so the directory is now
filtered out everywhere, like `.codex`, `.cursor`, and `.zed`.
Add regression tests for the opencode plan and for every registered
target.
Fixes#3558
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
The test job ran the entire suite on 3 OSes x 3 Node lines x 4 package
managers, 33 full runs per push. Windows lanes took 28 to 39 minutes and
macOS 14 to 19, so one push queued about 1.5 hours of wall clock behind
runner concurrency, and timing-sensitive tests got 33 chances to flake.
The package-manager axis only ever changed one environment variable that
nine suites read.
Now there are 13 lanes. Five run the full suite: Linux on Node 18, 20
and 22, plus Windows and macOS on Node 22. Eight are package-manager
lanes on Node 22 that run only the suites which read
CLAUDE_CODE_PACKAGE_MANAGER or CLAUDE_PACKAGE_MANAGER; the file list is
grepped at run time so it cannot drift as tests are added. Full lanes
use the runner's 4-process pool on Linux and macOS; Windows stays serial
because its process spawn and temp-dir cleanup are the flaky part.
The runner executed 422 files one process at a time, which is most of
the 12 to 40 minutes a CI lane spends in "Run tests". ECC_TEST_JOBS
above 1 now runs files through a pool of that many processes; output is
still buffered and printed per file, so logs read the same. The default
stays 1 and that path is the original synchronous spawnSync loop, so the
VM-driven runner test and the piped-output tests are unchanged.
ECC_TEST_ONLY is the mirror of ECC_TEST_SKIP: a comma-separated list of
path substrings, and only matching files run. CI uses it to give the
package-manager lanes just the suites that read the package-manager
variable instead of the whole suite.
Two real-process tests cover the pool (grouped output, counted failure,
summary last) and the ONLY filter.
Wen