L4XB ce2b27664f fix(hooks): check the commands that an expanded here-document body runs ...

Bash expands a here-document body unless part of its delimiter is quoted, and runs the $(...) and backquoted substitutions in it, with quotes as plain text. Leaving the whole body out of the segments hid those commands, so npm --version <<EOF with '$(npm run dev)' in the body was allowed. The commands of these substitutions are now segments of their own. An escaped substitution, or a body whose delimiter is quoted (<<'EOF', <<\EOF), stays data.

2026-10-23 03:13:14 +02:00

..

ci

refactor(ci): share the catalog count replacer

2026-10-19 22:18:32 -04:00

codemaps

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

codex

fix(codex): ship named CLI profile files with ownership protection

2026-10-11 01:55:54 -04:00

codex-git-hooks

Merge PR #3478: fail closed on unavailable secret scanning

2026-10-10 17:41:38 -04:00

dev

test: preserve Windows GateGuard corpus denial policy

2026-10-11 06:15:49 -04:00

discord

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

dsh

fix: address CodeRabbit and Greptile review findings

2026-10-02 00:49:31 +07:00

hooks

refactor(hooks): split shell-scan into per-token helpers

2026-10-19 23:39:18 -04:00

lib

fix(hooks): check the commands that an expanded here-document body runs

2026-10-23 03:13:14 +02:00

agent-convert.js

fix(adapters): bound parsing and publish review artifacts safely

2026-10-10 18:38:26 -04:00

astra-review.js

feat(astra-review): let Astra apply fixes when Fable hits its usage limit

2026-10-08 11:44:07 +09:00

auto-update.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

build-opencode.js

fix: restore ci baseline for opencode packaging

2026-04-05 14:47:26 -07:00

build-pi-core.js

fix: reconcile reviewed sources and generated integration surfaces

2026-10-09 17:27:37 -04:00

catalog.js

feat: add install catalog and project config autodetection

2026-03-27 05:56:39 -04:00

claw.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

consult.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

control-pane.js

feat(profiles): add opt-in Lean/Full and hybrid Auto selection

2026-09-27 16:46:07 -04:00

coordination-inventory.js

Distinguish declared goals, open sessions and overlap risk in coordination inventory (#3028)

2026-09-10 14:11:51 +03:00

dashboard-web.js

fix: preserve activity errors, asset bytes and runner summaries

2026-10-09 19:33:37 -04:00

discussion-audit.js

chore: gate canonical ECC release identity (#1991)

2026-05-19 06:42:17 -04:00

doctor.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

ecc.js

feat(profiles): add opt-in Lean/Full and hybrid Auto selection

2026-09-27 16:46:07 -04:00

eval-harness.js

feat: group verified capsules into offline retrospective reports

2026-09-12 04:35:38 -04:00

feedback.js

feat: add retention feedback loop and honest support matrix (#2681)

2026-08-04 21:42:25 -04:00

gan-harness.sh

fix: deny Playwright tools in non-browser evaluator modes

2026-09-28 00:38:00 -04:00

gateguard-report.js

feat(gateguard): add metrics event schema and report script

2026-09-29 21:50:19 -04:00

gemini-adapt-agents.js

fix: use scalar Claude agent tools (#2583)

2026-07-26 03:20:15 -07:00

github-coordination.js

refactor: apply code-review findings to github-native coordination

2026-06-11 14:05:42 -04:00

harness-adapter-compliance.js

docs: add data-backed harness adapter scorecard (#1785)

2026-05-12 02:59:52 -04:00

harness-audit.js

merge: preserve tested Python audit source 3007

2026-10-09 16:11:22 -04:00

install-apply.js

Merge PR #3256: reconcile obsolete managed installer files safely

2026-10-10 17:49:10 -04:00

install-guided.js

fix: honor global preview in every guided install entry

2026-10-11 02:03:09 -04:00

install-plan.js

fix(install): ship ajv/sql.js with the plugin install bundle (#2822)

2026-09-07 16:26:10 -04:00

ito.js

fix(ito-compute): complete device auth lifecycle (#2706)

2026-08-07 14:53:13 -04:00

list-installed.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

loop-status.js

fix: handle dotted reserved snapshot names

2026-04-30 12:25:14 -04:00

mcp-inventory.js

feat: MCP inventory (ecc.mcp.v1) — unified cross-harness MCP config view (#2146)

2026-06-06 03:55:17 +08:00

memory-mcp.mjs

Merge pull request #3111 from Fibilisim-Tekno/fix/memory-initialized-metadata

2026-09-19 16:51:53 -04:00

memory.js

feat: add cross-harness memory vault (#2581)

2026-07-26 02:46:59 -07:00

nasiko.js

fix(release): stage ECC 2.2 launch safely

2026-08-25 17:19:45 -04:00

observability-readiness.js

security: add supply-chain IOC scanner (#1904)

2026-05-14 21:15:35 -04:00

operator-readiness-dashboard.js

refactor(scripts): table-drive the operator readiness dashboard

2026-10-19 22:18:32 -04:00

orchestrate-codex-worker.sh

fix(codex): canonicalize native Windows task paths before dispatch

2026-10-10 18:56:12 -04:00

orchestrate-worktrees.js

fix: preserve orchestration launcher compatibility

2026-03-12 15:40:25 -07:00

orchestration-status.js

feat: orchestration harness, selective install, observer improvements

2026-03-14 12:55:25 -07:00

plan-canvas.js

fix(plan-canvas): describe browser dispatch accurately

2026-09-28 01:38:53 -04:00

platform-audit.js

docs: sync selected-target announcement gate (#2020)

2026-05-19 22:09:45 -04:00

preview-pack-smoke.js

docs: sync selected-target announcement gate (#2020)

2026-05-19 22:09:45 -04:00

profile.js

feat(context): integrate generation-bound advisory suggestions (#3453)

2026-10-10 17:44:29 -04:00

proximity-tick.js

feat(layer4): live messages-table wiring for proximity triggers

2026-06-20 20:49:17 -04:00

qwen-adapt-agents.js

fix(qwen): normalize indentless lists and validate converted frontmatter

2026-10-10 18:47:48 -04:00

release-approval-gate.js

fix(release): derive approval gate paths from version (#2383)

2026-06-29 15:50:55 -07:00

release-video-suite.js

fix(release): derive video suite paths from version (#2384)

2026-06-29 15:50:57 -07:00

release.sh

feat: add native Qoder plugin support

2026-10-10 20:11:00 +08:00

repair.js

fix: installer slice from PR #3120 review (Haelyra)

2026-10-10 13:56:00 +05:30

session-inspect.js

feat: self-improving skills loop — observe, inspect, amend, evaluate

2026-03-14 23:21:18 -07:00

sessions-cli.js

fix(scripts): add os.homedir() fallback for Windows compatibility

2026-03-28 11:28:12 +08:00

setup-package-manager.js

fix: reject flags passed as package manager names in setup-package-manager CLI

2026-02-13 03:37:46 -08:00

setup.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

skill-create-output.js

chore: retire the Everything Claude Code name, ECC only (#3330)

2026-10-01 17:50:41 -05:00

skills-health.js

feat(design): skill health dashboard mockup (#518)

2026-03-16 14:01:41 -07:00

status.js

fix(opencode): isolate explicit home contexts

2026-08-25 12:17:21 -04:00

sync-ecc-to-codex.sh

fix(codex): ship named CLI profile files with ownership protection

2026-10-11 01:55:54 -04:00

uninstall.js

fix(install): preserve user files and honor uninstall previews

2026-09-07 16:40:47 -04:00

welcome.js

feat(install): add guided multi-harness installer (#2649)

2026-08-06 15:39:49 -04:00

work-items.js

fix(state): serialize work-item claims and preserve existing ownership

2026-10-11 02:08:19 -04:00

worktree-lifecycle.js

feat: worktree-lifecycle service (deterministic conflict prediction + safe GC) (#2164)

2026-06-07 13:00:08 +08:00