claudecode-omc 5.9.1 → 5.12.0

package/bundled/upstream/ecc/skills/continuous-learning-v2/hooks/observe.sh

@@ -155,7 +155,7 @@ fi
 # Non-interactive SDK automation is still filtered by Layers 2-5 below
 # (ECC_HOOK_PROFILE=minimal, ECC_SKIP_OBSERVE=1, agent_id, path exclusions).
 case "${CLAUDE_CODE_ENTRYPOINT:-cli}" in
-  cli|sdk-ts|claude-desktop) ;;
+  cli|sdk-ts|claude-desktop|claude-vscode) ;;
   *) exit 0 ;;
 esac
 
@@ -268,13 +268,25 @@ if [ "$PARSED_OK" != "True" ]; then
   echo "$INPUT_JSON" | "$PYTHON_CMD" -c '
 import json, sys, os, re
 
+# Linear-time secret matcher. Bounded quantifiers and a fixed set of auth
+# schemes (instead of a generic [A-Za-z]+\s+ that overlapped the value class)
+# prevent the catastrophic backtracking that pegged python at 100% CPU (#2278).
 _SECRET_RE = re.compile(
     r"(?i)(api[_-]?key|token|secret|password|authorization|credentials?|auth)"
-    r"""(["'"'"'\s:=]+)"""
-    r"([A-Za-z]+\s+)?"
-    r"([A-Za-z0-9_\-/.+=]{8,})"
+    r"""(["'"'"'\s:=]{1,8})"""
+    r"((?:bearer|basic|token|bot)\s+)?"
+    r"([A-Za-z0-9_\-/.+=]{8,256})"
 )
 
+import signal
+def _ecc_bail(*_):
+    sys.exit(0)
+try:
+    signal.signal(signal.SIGALRM, _ecc_bail)
+    signal.alarm(8)  # self-terminate before the async hook 10s timeout can orphan us (#2278)
+except Exception:
+    pass
+
 raw = sys.stdin.read()[:2000]
 raw = _SECRET_RE.sub(lambda m: m.group(1) + m.group(2) + (m.group(3) or "") + "[REDACTED]", raw)
 print(json.dumps({"timestamp": os.environ["TIMESTAMP"], "event": "parse_error", "raw": raw}))
@@ -302,6 +314,15 @@ export TIMESTAMP="$timestamp"
 
 echo "$PARSED" | "$PYTHON_CMD" -c '
 import json, sys, os, re
+import signal
+
+def _ecc_bail(*_):
+    sys.exit(0)
+try:
+    signal.signal(signal.SIGALRM, _ecc_bail)
+    signal.alarm(8)  # self-terminate before the async hook 10s timeout can orphan us (#2278)
+except Exception:
+    pass
 
 parsed = json.load(sys.stdin)
 observation = {
@@ -315,11 +336,14 @@ observation = {
 
 # Scrub secrets: match common key=value, key: value, and key"value patterns
 # Includes optional auth scheme (e.g., "Bearer", "Basic") before token
+# Linear-time secret matcher. Bounded quantifiers and a fixed set of auth
+# schemes (instead of a generic [A-Za-z]+\s+ that overlapped the value class)
+# prevent the catastrophic backtracking that pegged python at 100% CPU (#2278).
 _SECRET_RE = re.compile(
     r"(?i)(api[_-]?key|token|secret|password|authorization|credentials?|auth)"
-    r"""(["'"'"'\s:=]+)"""
-    r"([A-Za-z]+\s+)?"
-    r"([A-Za-z0-9_\-/.+=]{8,})"
+    r"""(["'"'"'\s:=]{1,8})"""
+    r"((?:bearer|basic|token|bot)\s+)?"
+    r"([A-Za-z0-9_\-/.+=]{8,256})"
 )
 
 def scrub(val):

package/bundled/upstream/ecc/skills/continuous-learning-v2/scripts/instinct-cli.py

@@ -23,6 +23,9 @@ import subprocess
 import sys
 import re
 import shutil
+import ipaddress
+import socket
+import urllib.parse
 import urllib.request
 from pathlib import Path
 from datetime import datetime, timedelta, timezone
@@ -181,6 +184,55 @@ def _validate_instinct_id(instinct_id: str) -> bool:
     return bool(re.match(r"^[A-Za-z0-9][A-Za-z0-9._-]*$", instinct_id))
 
 
+def _validate_import_url(source: str) -> str:
+    """Validate remote instinct imports before opening a network connection."""
+    parsed = urllib.parse.urlparse(source)
+    if parsed.scheme != "https":
+        raise ValueError("remote instinct imports require https URLs")
+    if not parsed.hostname:
+        raise ValueError("remote import URL is missing a hostname")
+
+    try:
+        addr_infos = socket.getaddrinfo(parsed.hostname, parsed.port or 443, type=socket.SOCK_STREAM)
+    except socket.gaierror as exc:
+        raise ValueError(f"remote import host could not be resolved: {parsed.hostname}") from exc
+
+    for family, _, _, _, sockaddr in addr_infos:
+        host = sockaddr[0]
+        try:
+            ip = ipaddress.ip_address(host)
+        except ValueError:
+            continue
+        if (
+            ip.is_private
+            or ip.is_loopback
+            or ip.is_link_local
+            or ip.is_multicast
+            or ip.is_reserved
+            or ip.is_unspecified
+        ):
+            raise ValueError(f"remote import host resolves to a non-public address: {host}")
+
+    return urllib.parse.urlunparse(parsed)
+
+
+def _fetch_import_url(source: str, *, max_bytes: int = 2 * 1024 * 1024) -> str:
+    """Fetch a validated remote instinct file with bounded size and timeout."""
+    url = _validate_import_url(source)
+    req = urllib.request.Request(url, headers={"User-Agent": "ECC-instinct-import/2"})
+    with urllib.request.urlopen(req, timeout=15) as response:
+        content_type = response.headers.get("Content-Type", "")
+        if content_type and not any(
+            allowed in content_type.lower()
+            for allowed in ("text/", "markdown", "yaml", "json", "octet-stream")
+        ):
+            raise ValueError(f"unsupported remote content type: {content_type}")
+        data = response.read(max_bytes + 1)
+    if len(data) > max_bytes:
+        raise ValueError(f"remote import exceeds {max_bytes} bytes")
+    return data.decode("utf-8")
+
+
 def _yaml_quote(value: str) -> str:
     """Quote a string for safe YAML frontmatter serialization.
 
@@ -703,10 +755,47 @@ def cmd_status(args) -> int:
                 days_left = max(0, PENDING_TTL_DAYS - item["age_days"])
                 print(f"    - {item['name']} ({days_left}d remaining)")
 
+    # Legacy data warning
+    _warn_legacy_data()
+
     print(f"\n{'='*60}\n")
     return 0
 
 
+def _warn_legacy_data() -> None:
+    """Warn if legacy ~/.claude/homunculus/ contains data while the active
+    path has moved to the XDG directory."""
+    legacy_dir = Path.home() / ".claude" / "homunculus"
+    if legacy_dir == HOMUNCULUS_DIR:
+        return  # CLV2_HOMUNCULUS_DIR explicitly points at the legacy path
+    if not legacy_dir.is_dir():
+        return
+
+    # Count substantive files (skip empty dirs and the directory itself)
+    try:
+        legacy_files = [f for f in legacy_dir.rglob("*") if f.is_file()]
+    except (PermissionError, OSError):
+        print(f"\n  Note: legacy directory exists but cannot be read: {legacy_dir}", file=sys.stderr)
+        return
+    if not legacy_files:
+        return
+
+    migrate_script = Path(__file__).resolve().parent / "migrate-homunculus.sh"
+
+    print(f"\n{'!'*60}")
+    print("  LEGACY DATA DETECTED")
+    print(f"{'!'*60}")
+    print(f"  Found {len(legacy_files)} file(s) in legacy path:")
+    print(f"    {legacy_dir}")
+    print("  Active data directory:")
+    print(f"    {HOMUNCULUS_DIR}")
+    print()
+    print("  Run the migration script to move your data:")
+    print(f'    bash "{migrate_script}"')
+    print(f"  Or set CLV2_HOMUNCULUS_DIR={legacy_dir} to use the legacy path.")
+    print(f"{'!'*60}\n")
+
+
 def _print_instincts_by_domain(instincts: list[dict]) -> None:
     """Helper to print instincts grouped by domain."""
     by_domain = defaultdict(list)
@@ -757,8 +846,7 @@ def cmd_import(args) -> int:
     if source.startswith('http://') or source.startswith('https://'):
         print(f"Fetching from URL: {source}")
         try:
-            with urllib.request.urlopen(source) as response:
-                content = response.read().decode('utf-8')
+            content = _fetch_import_url(source)
         except Exception as e:
             print(f"Error fetching URL: {e}", file=sys.stderr)
             return 1

package/bundled/upstream/ecc/skills/continuous-learning-v2/scripts/test_parse_instinct.py

@@ -44,6 +44,7 @@ _promote_auto = _mod._promote_auto
 _find_cross_project_instincts = _mod._find_cross_project_instincts
 load_registry = _mod.load_registry
 _validate_instinct_id = _mod._validate_instinct_id
+_validate_import_url = _mod._validate_import_url
 _update_registry = _mod._update_registry
 _confidence_bar = _mod._confidence_bar
 
@@ -326,6 +327,32 @@ def test_validate_relative_path(tmp_path, monkeypatch):
     assert result == test_file.resolve()
 
 
+def test_validate_import_url_rejects_http():
+    """Remote imports should not downgrade to plaintext HTTP."""
+    with pytest.raises(ValueError, match="require https"):
+        _validate_import_url("http://example.com/instincts.yaml")
+
+
+def test_validate_import_url_rejects_private_hosts(monkeypatch):
+    """Remote imports should not resolve to private or loopback addresses."""
+    monkeypatch.setattr(
+        _mod.socket,
+        "getaddrinfo",
+        lambda *args, **kwargs: [(None, None, None, None, ("127.0.0.1", 443))],
+    )
+    with pytest.raises(ValueError, match="non-public address"):
+        _validate_import_url("https://example.com/instincts.yaml")
+
+
+def test_validate_import_url_allows_public_https(monkeypatch):
+    monkeypatch.setattr(
+        _mod.socket,
+        "getaddrinfo",
+        lambda *args, **kwargs: [(None, None, None, None, ("93.184.216.34", 443))],
+    )
+    assert _validate_import_url("https://example.com/instincts.yaml") == "https://example.com/instincts.yaml"
+
+
 # ─────────────────────────────────────────────
 # detect_project tests
 # ─────────────────────────────────────────────

package/bundled/upstream/ecc/skills/cost-aware-llm-pipeline/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: cost-aware-llm-pipeline
 description: Cost optimization patterns for LLM API usage — model routing by task complexity, budget tracking, retry logic, and prompt caching.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Cost-Aware LLM Pipeline

package/bundled/upstream/ecc/skills/cost-tracking/SKILL.md

@@ -1,147 +1,97 @@
 ---
 name: cost-tracking
-description: Track and report Claude Code token usage, spending, and budgets from a local cost-tracking database. Use when the user asks about costs, spending, usage, tokens, budgets, or cost breakdowns by project, tool, session, or date.
-origin: community
+description: Track and report Claude Code token usage, spending, and budgets from the local ECC cost-tracker metrics log. Use when the user asks about costs, spending, usage, tokens, budgets, or cost breakdowns by model, session, or date.
+metadata:
+  origin: community
 ---
 
 # Cost Tracking
 
-Use this skill to analyze Claude Code cost and usage history from a local SQLite
-database. It is intended for users who already have a cost-tracking hook or
-plugin writing usage rows to `~/.claude-cost-tracker/usage.db`.
+Use this skill to analyze Claude Code cost and usage history from the metrics log
+that ECC's `stop:cost-tracker` hook writes.
 
-Source: salvaged from stale community PR #1304 by `MayurBhavsar`.
+## Where the data lives
 
-## When to Use
-
-- The user asks "how much have I spent?", "what did this session cost?", or
-  "what is my token usage?"
-- The user mentions budgets, spending limits, overruns, or cost controls.
-- The user wants a cost breakdown by project, tool, session, model, or date.
-- The user wants to compare today against yesterday or inspect a recent trend.
-- The user asks for a CSV export of recent usage records.
-
-## How It Works
+The tracker appends one JSON object per session-stop to
+`~/.claude/metrics/costs.jsonl`. Each row is a **cumulative snapshot for that
+session**, so to total spend you take the **latest row per `session_id`** and
+sum across sessions — summing every row multiply-counts.
 
-First verify prerequisites:
+Row schema:
 
-```bash
-command -v sqlite3 >/dev/null && echo "sqlite3 available" || echo "sqlite3 missing"
-test -f ~/.claude-cost-tracker/usage.db && echo "Database found" || echo "Database not found"
-```
-
-If the database is missing, do not fabricate usage data. Tell the user that cost
-tracking is not configured and suggest installing or enabling a trusted local
-cost-tracking hook/plugin.
-
-The expected `usage` table usually contains one row per tool call or model
-interaction. Column names vary by tracker, but the examples below assume:
-
-| Column | Meaning |
+| Field | Meaning |
 | --- | --- |
-| `timestamp` | ISO timestamp for the usage event |
-| `project` | Project or repository name |
-| `tool_name` | Tool or event name |
-| `input_tokens` | Input token count, when recorded |
-| `output_tokens` | Output token count, when recorded |
-| `cost_usd` | Precomputed cost in USD |
+| `timestamp` | ISO timestamp of the snapshot |
 | `session_id` | Claude Code session identifier |
-| `model` | Model used for the event |
+| `transcript_path` | Path to the session transcript |
+| `model` | Model used |
+| `input_tokens` / `output_tokens` | Token counts |
+| `cache_write_tokens` / `cache_read_tokens` | Prompt-cache token counts |
+| `estimated_cost_usd` | Precomputed cumulative cost in USD for the session |
 
-Prefer `cost_usd` over hand-calculating pricing. Model prices and cache pricing
-change over time, and the tracker should be the source of truth for how each row
-was priced.
+Prefer `estimated_cost_usd` over hand-calculating pricing — model and cache
+prices change, and the tracker is the source of truth.
 
-## Examples
+## When to Use
 
-### Quick Summary
+- The user asks "how much have I spent?", "what did this session cost?", or
+  "what is my token usage?"
+- The user mentions budgets, spending limits, overruns, or cost controls.
+- The user wants a cost breakdown by model, session, or date, or a CSV export.
 
-```bash
-sqlite3 ~/.claude-cost-tracker/usage.db "
-  SELECT
-    'Today: $' || ROUND(COALESCE(SUM(CASE WHEN date(timestamp) = date('now') THEN cost_usd END), 0), 4) ||
-    ' | Total: $' || ROUND(COALESCE(SUM(cost_usd), 0), 4) ||
-    ' | Calls: ' || COUNT(*) ||
-    ' | Sessions: ' || COUNT(DISTINCT session_id)
-  FROM usage;
-"
-```
+## How It Works
 
-### Cost By Project
+First verify the log exists (use `node`, not `sqlite3` — the tracker writes
+JSONL, and `node` is cross-platform):
 
 ```bash
-sqlite3 -header -column ~/.claude-cost-tracker/usage.db "
-  SELECT project, ROUND(SUM(cost_usd), 4) AS cost, COUNT(*) AS calls
-  FROM usage
-  GROUP BY project
-  ORDER BY cost DESC;
-"
+node -e 'const fs=require("fs"),os=require("os"),p=require("path");const f=p.join(os.homedir(),".claude","metrics","costs.jsonl");console.log(fs.existsSync(f)?"cost log found":"cost log not found: "+f)'
 ```
 
-### Cost By Tool
+If the log is missing, do not fabricate usage data. Tell the user that cost
+tracking populates after the first session ends with the `stop:cost-tracker`
+hook enabled.
 
-```bash
-sqlite3 -header -column ~/.claude-cost-tracker/usage.db "
-  SELECT tool_name, ROUND(SUM(cost_usd), 4) AS cost, COUNT(*) AS calls
-  FROM usage
-  GROUP BY tool_name
-  ORDER BY cost DESC;
-"
-```
-
-### Last Seven Days
+## Example — summary, by model, last 7 days
 
 ```bash
-sqlite3 -header -column ~/.claude-cost-tracker/usage.db "
-  SELECT date(timestamp) AS date, ROUND(SUM(cost_usd), 4) AS cost, COUNT(*) AS calls
-  FROM usage
-  GROUP BY date(timestamp)
-  ORDER BY date DESC
-  LIMIT 7;
-"
+node -e '
+const fs=require("fs"),os=require("os"),path=require("path");
+const f=path.join(os.homedir(),".claude","metrics","costs.jsonl");
+if(!fs.existsSync(f)){console.log("cost log not found: "+f);process.exit(0);}
+const rows=fs.readFileSync(f,"utf8").split(/\r?\n/).filter(Boolean).map(l=>{try{return JSON.parse(l)}catch{return null}}).filter(Boolean);
+const bySession=new Map();
+for(const r of rows){const k=r.session_id||r.transcript_path||r.timestamp;const p=bySession.get(k);if(!p||String(r.timestamp)>String(p.timestamp))bySession.set(k,r);}
+const latest=[...bySession.values()];
+const cost=r=>Number(r.estimated_cost_usd)||0, day=r=>String(r.timestamp||"").slice(0,10), sum=a=>a.reduce((s,r)=>s+cost(r),0), f4=n=>"$"+n.toFixed(4);
+const today=new Date().toISOString().slice(0,10), yest=new Date(Date.now()-864e5).toISOString().slice(0,10);
+console.log("today: "+f4(sum(latest.filter(r=>day(r)===today)))+" | yesterday: "+f4(sum(latest.filter(r=>day(r)===yest)))+" | total: "+f4(sum(latest))+" ("+latest.length+" sessions)");
+const m=new Map();for(const r of latest){const k=r.model||"(unknown)";m.set(k,(m.get(k)||0)+cost(r));}
+console.log("by model:");[...m.entries()].sort((a,b)=>b[1]-a[1]).forEach(([k,v])=>console.log("  "+f4(v)+"  "+k));
+'
 ```
 
-### Session Drilldown
-
-```bash
-sqlite3 -header -column ~/.claude-cost-tracker/usage.db "
-  SELECT session_id,
-    MIN(timestamp) AS started,
-    MAX(timestamp) AS ended,
-    ROUND(SUM(cost_usd), 4) AS cost,
-    COUNT(*) AS calls
-  FROM usage
-  GROUP BY session_id
-  ORDER BY started DESC
-  LIMIT 10;
-"
-```
+For a session drilldown or CSV export, iterate the same `latest` set (or the raw
+rows for CSV) and print the fields you need.
 
 ## Reporting Guidance
 
-When presenting cost data, include:
-
-1. Today's spend and yesterday comparison.
-2. Total spend across the tracked database.
-3. Top projects ranked by cost.
-4. Top tools ranked by cost.
-5. Session count and average cost per session when enough data exists.
-
-For small amounts, format currency with four decimal places. For larger amounts,
-two decimals are enough.
+When presenting cost data, include today's spend vs yesterday, total across all
+sessions, a by-model breakdown, and session count. Format sub-dollar amounts
+with four decimals, larger amounts with two.
 
 ## Anti-Patterns
 
-- Do not estimate costs from raw token counts when `cost_usd` is present.
-- Do not assume the database exists without checking.
-- Do not run unbounded `SELECT *` exports on large databases.
+- Do not sum every row — they are cumulative per session; reduce to the latest
+  row per `session_id` first.
+- Do not estimate costs from raw token counts when `estimated_cost_usd` is present.
+- Do not assume the log exists without checking.
 - Do not hard-code current model pricing in user-facing answers.
-- Do not recommend installing unreviewed hooks or plugins that execute arbitrary
-  code.
+- Do not recommend installing unreviewed hooks or plugins that execute arbitrary code.
 
 ## Related
 
-- `/cost-report` - Command-form report using the same database.
+- `/cost-report` - Command-form report over the same metrics log.
 - `cost-aware-llm-pipeline` - Model-routing and budget-design patterns.
 - `token-budget-advisor` - Context and token-budget planning.
 - `strategic-compact` - Context compaction to reduce repeated token spend.

package/bundled/upstream/ecc/skills/council/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: council
 description: Convene a four-voice council for ambiguous decisions, tradeoffs, and go/no-go calls. Use when multiple valid paths exist and you need structured disagreement before choosing.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Council

package/bundled/upstream/ecc/skills/cpp-coding-standards/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: cpp-coding-standards
 description: C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # C++ Coding Standards (C++ Core Guidelines)

package/bundled/upstream/ecc/skills/cpp-testing/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: cpp-testing
 description: Use only when writing/updating/fixing C++ tests, configuring GoogleTest/CTest, diagnosing failing or flaky tests, or adding coverage/sanitizers.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # C++ Testing (Agent Skill)

package/bundled/upstream/ecc/skills/crosspost/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: crosspost
 description: Multi-platform content distribution across X, LinkedIn, Threads, and Bluesky. Adapts content per platform using content-engine patterns. Never posts identical content cross-platform. Use when the user wants to distribute content across social platforms.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Crosspost

package/bundled/upstream/ecc/skills/csharp-testing/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: csharp-testing
 description: C# and .NET testing patterns with xUnit, FluentAssertions, mocking, integration tests, and test organization best practices.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # C# Testing Patterns

package/bundled/upstream/ecc/skills/customer-billing-ops/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: customer-billing-ops
 description: Operate customer billing workflows such as subscriptions, refunds, churn triage, billing-portal recovery, and plan analysis using connected billing tools like Stripe. Use when the user needs to help a customer, inspect subscription state, or manage revenue-impacting billing operations.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Customer Billing Ops

package/bundled/upstream/ecc/skills/customs-trade-compliance/SKILL.md

@@ -11,8 +11,8 @@ description: >
 license: Apache-2.0
 version: 1.0.0
 homepage: https://github.com/affaan-m/everything-claude-code
-origin: ECC
 metadata:
+  origin: ECC
   author: evos
   clawdbot:
     emoji: ""

package/bundled/upstream/ecc/skills/dart-flutter-patterns/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: dart-flutter-patterns
 description: Production-ready Dart and Flutter patterns covering null safety, immutable state, async composition, widget architecture, popular state management frameworks (BLoC, Riverpod, Provider), GoRouter navigation, Dio networking, Freezed code generation, and clean architecture.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Dart/Flutter Patterns

package/bundled/upstream/ecc/skills/dashboard-builder/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: dashboard-builder
 description: Build monitoring dashboards that answer real operator questions for Grafana, SigNoz, and similar platforms. Use when turning metrics into a working dashboard instead of a vanity board.
-origin: ECC direct-port adaptation
+metadata:
+  origin: ECC direct-port adaptation
 version: "1.0.0"
 ---
 

package/bundled/upstream/ecc/skills/data-scraper-agent/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: data-scraper-agent
 description: Build a fully automated AI-powered data collection agent for any public source — job boards, prices, news, GitHub, sports, anything. Scrapes on a schedule, enriches data with a free LLM (Gemini Flash), stores results in Notion/Sheets/Supabase, and learns from user feedback. Runs 100% free on GitHub Actions. Use when the user wants to monitor, collect, or track any public data automatically.
-origin: community
+metadata:
+  origin: community
 ---
 
 # Data Scraper Agent

package/bundled/upstream/ecc/skills/data-throughput-accelerator/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: data-throughput-accelerator
 description: Use when large data ingestion, backfill, export, ETL, warehouse loading, manifest catch-up, or table synchronization needs to become much faster while preserving data correctness.
-origin: ECC
+metadata:
+  origin: ECC
 tools: Read, Write, Edit, Bash, Grep, Glob
 ---
 

package/bundled/upstream/ecc/skills/database-migrations/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: database-migrations
 description: Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Kysely, Django, TypeORM, golang-migrate).
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Database Migration Patterns

package/bundled/upstream/ecc/skills/deep-research/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: deep-research
 description: Multi-source deep research using firecrawl and exa MCPs. Searches the web, synthesizes findings, and delivers cited reports with source attribution. Use when the user wants thorough research on any topic with evidence and citations.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Deep Research

package/bundled/upstream/ecc/skills/defi-amm-security/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: defi-amm-security
 description: Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math.
-origin: ECC direct-port adaptation
+metadata:
+  origin: ECC direct-port adaptation
 version: "1.0.0"
 ---
 

package/bundled/upstream/ecc/skills/deployment-patterns/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: deployment-patterns
 description: Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Deployment Patterns

package/bundled/upstream/ecc/skills/design-system/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: design-system
 description: Use this skill to generate or audit design systems, check visual consistency, and review PRs that touch styling.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Design System — Generate & Audit Visual Systems

package/bundled/upstream/ecc/skills/django-celery/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: django-celery
 description: Django + Celery async task patterns — configuration, task design, beat scheduling, retries, canvas workflows, monitoring, and testing. Use when adding background jobs, scheduled tasks, or async processing to a Django app.
-origin: ECC
+metadata:
+  origin: ECC
 ---
 
 # Django + Celery Async Task Patterns
@@ -22,7 +23,7 @@ Production-grade patterns for background task processing in Django using Celery
 ### Installation
 
 ```bash
-pip install celery[redis] django-celery-results django-celery-beat
+pip install 'celery[redis]' django-celery-results django-celery-beat
 ```
 
 ### `celery.py` — App Entrypoint