ctxora 6.2.2 → 6.4.0

package/src/harness_context/skills/catalog.py

@@ -0,0 +1,267 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import shutil
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+SKILL_INSTALL_TARGETS = {
+    "codex": ".agents/skills",
+    "claude": ".claude/skills",
+    "cursor": ".cursor/skills",
+    "gemini": ".gemini/skills",
+    "opencode": ".opencode/skills",
+}
+
+
+@dataclass(frozen=True)
+class SkillSelection:
+    profile: str
+    modules: tuple[str, ...]
+    skills: tuple[str, ...]
+    added: tuple[str, ...]
+    removed: tuple[str, ...]
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "profile": self.profile,
+            "modules": list(self.modules),
+            "skill_count": len(self.skills),
+            "skills": list(self.skills),
+            "added": list(self.added),
+            "removed": list(self.removed),
+        }
+
+
+class SkillCatalog:
+    def __init__(self, manifest_path: str | Path | None = None):
+        path = Path(manifest_path) if manifest_path else Path(__file__).with_name("ecc_catalog.json")
+        data = json.loads(path.read_text("utf-8"))
+        self.version = data["version"]
+        self.source = data["source"]
+        self.commit = data["commit"]
+        self.skills: dict[str, dict[str, Any]] = data["skills"]
+        self.modules: dict[str, dict[str, Any]] = data["modules"]
+        self.profiles: dict[str, dict[str, Any]] = data["profiles"]
+
+    def select(
+        self,
+        profile: str = "developer",
+        add_modules: tuple[str, ...] = (),
+        remove_modules: tuple[str, ...] = (),
+        add_skills: tuple[str, ...] = (),
+        remove_skills: tuple[str, ...] = (),
+    ) -> SkillSelection:
+        if profile not in self.profiles:
+            raise ValueError(f"unknown skills profile: {profile}")
+        modules = list(self.profiles[profile]["modules"])
+        for module in add_modules:
+            self._require_module(module)
+            if module not in modules:
+                modules.append(module)
+        for module in remove_modules:
+            self._require_module(module)
+            modules = [item for item in modules if item != module]
+        selected: set[str] = set()
+        for module in modules:
+            selected.update(self.modules[module]["skills"])
+        for skill in add_skills:
+            self._require_skill(skill)
+            selected.add(skill)
+        for skill in remove_skills:
+            self._require_skill(skill)
+            selected.discard(skill)
+        base = set(self._profile_skills(profile))
+        return SkillSelection(
+            profile,
+            tuple(modules),
+            tuple(sorted(selected)),
+            tuple(sorted(selected - base)),
+            tuple(sorted(base - selected)),
+        )
+
+    def write_selection(self, workspace: str | Path, selection: SkillSelection) -> Path:
+        root = Path(workspace).expanduser().resolve(strict=True)
+        target = root / ".ctxora" / "skills-profile.json"
+        self._reject_symlinks(target)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        payload = {
+            "catalog_version": self.version,
+            "catalog_commit": self.commit,
+            "profile": selection.profile,
+            "modules": list(selection.modules),
+            "skills": list(selection.skills),
+        }
+        target.write_text(json.dumps(payload, ensure_ascii=False, indent=2) + "\n", "utf-8")
+        return target
+
+    @property
+    def source_root(self) -> Path:
+        return Path(__file__).with_name("ecc")
+
+    @staticmethod
+    def install_outputs(targets: tuple[str, ...], output: str = "") -> tuple[tuple[str, str], ...]:
+        if output and targets:
+            raise ValueError("use either --output or --target, not both")
+        if output:
+            return (("custom", output),)
+        selected = list(targets or ("codex",))
+        if "all" in selected:
+            selected = list(SKILL_INSTALL_TARGETS)
+        unknown = sorted(set(selected) - set(SKILL_INSTALL_TARGETS))
+        if unknown:
+            raise ValueError(f"unknown skill install target: {unknown[0]}")
+        return tuple((name, SKILL_INSTALL_TARGETS[name]) for name in dict.fromkeys(selected))
+
+    def install(
+        self,
+        workspace: str | Path,
+        output: str | Path,
+        selection: SkillSelection,
+        *,
+        force: bool = False,
+        prune: bool = False,
+        dry_run: bool = False,
+    ) -> dict[str, Any]:
+        root = Path(workspace).expanduser().resolve(strict=True)
+        destination = Path(output).expanduser()
+        if not destination.is_absolute():
+            destination = root / destination
+        self._reject_symlinks(destination)
+        destination = destination.resolve()
+        output_key = hashlib.sha256(str(destination).encode("utf-8")).hexdigest()[:12]
+        manifest_path = root / ".ctxora" / "installer" / f"ecc-skills-{output_key}.json"
+        self._reject_symlinks(manifest_path)
+        previous = json.loads(manifest_path.read_text("utf-8")) if manifest_path.exists() else {}
+        previous_hashes = previous.get("hashes", {}) if previous.get("output") == str(destination) else {}
+        for skill in (*selection.skills, *previous_hashes):
+            if not re.fullmatch(r"[a-z0-9][a-z0-9-]*", skill):
+                raise ValueError(f"unsafe skill id: {skill}")
+        source_hashes = {skill: self._directory_hash(self.source_root / skill) for skill in selection.skills}
+        conflicts: list[str] = []
+        operations: list[dict[str, str]] = []
+        for skill, source_hash in source_hashes.items():
+            target = destination / skill
+            self._reject_symlinks(target)
+            if not target.exists():
+                operations.append({"operation": "add", "skill": skill})
+                continue
+            target_hash = self._directory_hash(target)
+            if target_hash == source_hash:
+                operations.append({"operation": "keep", "skill": skill})
+            elif force or previous_hashes.get(skill) == target_hash:
+                operations.append({"operation": "replace", "skill": skill})
+            else:
+                conflicts.append(skill)
+        if prune:
+            for skill, installed_hash in previous_hashes.items():
+                if skill in source_hashes:
+                    continue
+                target = destination / skill
+                self._reject_symlinks(target)
+                if not target.exists():
+                    continue
+                if self._directory_hash(target) == installed_hash:
+                    operations.append({"operation": "remove", "skill": skill})
+                else:
+                    conflicts.append(skill)
+        result = {
+            "profile": selection.profile,
+            "output": str(destination),
+            "skill_count": len(selection.skills),
+            "operations": operations,
+            "conflicts": sorted(set(conflicts)),
+        }
+        if dry_run or conflicts:
+            return result
+        destination.mkdir(parents=True, exist_ok=True)
+        manifest_path.parent.mkdir(parents=True, exist_ok=True)
+        hashes = dict(previous_hashes) if not prune else {}
+        hashes.update(source_hashes)
+        manifest = json.dumps({
+            "catalog_commit": self.commit,
+            "output": str(destination),
+            "profile": selection.profile,
+            "modules": list(selection.modules),
+            "skills": list(selection.skills),
+            "hashes": hashes,
+        }, ensure_ascii=False, indent=2) + "\n"
+        lock_path = manifest_path.with_suffix(".lock")
+        try:
+            lock = lock_path.open("x")
+        except FileExistsError as error:
+            raise ValueError("skill installation is locked; check for an active or interrupted installer") from error
+        with lock:
+            try:
+                current = json.loads(manifest_path.read_text("utf-8")) if manifest_path.exists() else {}
+                if current != previous:
+                    raise ValueError("skill installation changed; preview again")
+                with tempfile.TemporaryDirectory(prefix=".ctxora-ecc-", dir=destination) as staging:
+                    staging_root = Path(staging)
+                    changed = []
+                    try:
+                        for operation in operations:
+                            skill = operation["skill"]
+                            target = destination / skill
+                            if operation["operation"] == "keep":
+                                continue
+                            staged = staging_root / (skill + ".new")
+                            if operation["operation"] != "remove":
+                                shutil.copytree(self.source_root / skill, staged)
+                            backup = staging_root / (skill + ".old")
+                            if target.exists():
+                                target.rename(backup)
+                            changed.append((target, backup))
+                            if staged.exists():
+                                staged.rename(target)
+                        pending = manifest_path.with_suffix(".pending")
+                        self._reject_symlinks(pending)
+                        pending.write_text(manifest, "utf-8")
+                        pending.replace(manifest_path)
+                    except Exception:
+                        for target, backup in reversed(changed):
+                            if target.exists():
+                                shutil.rmtree(target)
+                            if backup.exists():
+                                backup.rename(target)
+                        raise
+            finally:
+                lock_path.unlink()
+        return result
+
+    @staticmethod
+    def _reject_symlinks(path: Path) -> None:
+        if any(parent.is_symlink() for parent in (path, *path.parents)):
+            raise ValueError(f"refusing symlink in skill installation path: {path}")
+
+    @staticmethod
+    def _directory_hash(path: Path) -> str:
+        if not path.is_dir():
+            raise ValueError(f"skill directory is missing: {path.name}")
+        digest = hashlib.sha256()
+        if path.is_symlink() or any(item.is_symlink() for item in path.rglob("*")):
+            raise ValueError(f"refusing symlink inside skill: {path.name}")
+        for file_path in sorted(item for item in path.rglob("*") if item.is_file()):
+            digest.update(file_path.relative_to(path).as_posix().encode("utf-8"))
+            digest.update(b"\0")
+            digest.update(file_path.read_bytes())
+            digest.update(b"\0")
+        return digest.hexdigest()
+
+    def _profile_skills(self, profile: str) -> set[str]:
+        selected: set[str] = set()
+        for module in self.profiles[profile]["modules"]:
+            selected.update(self.modules[module]["skills"])
+        return selected
+
+    def _require_module(self, module: str) -> None:
+        if module not in self.modules:
+            raise ValueError(f"unknown skills module: {module}")
+
+    def _require_skill(self, skill: str) -> None:
+        if skill not in self.skills:
+            raise ValueError(f"unknown ECC skill: {skill}")

package/src/harness_context/skills/ecc/accessibility/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/harness_context/skills/ecc/accessibility/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: accessibility
+description: Design, implement, and audit inclusive digital products using WCAG 2.2 Level AA. Use when building or auditing UI that must meet WCAG 2.2 Level AA, or when reviewing a change for keyboard, contrast, or screen-reader support.
+  standards. Use this skill to generate semantic ARIA for Web and accessibility traits for Web and Native platforms (iOS/Android).
+metadata:
+  origin: ECC
+---
+
+# Accessibility (WCAG 2.2)
+
+This skill ensures that digital interfaces are Perceivable, Operable, Understandable, and Robust (POUR) for all users, including those using screen readers, switch controls, or keyboard navigation. It focuses on the technical implementation of WCAG 2.2 success criteria.
+
+## When to Use
+
+- Defining UI component specifications for Web, iOS, or Android.
+- Auditing existing code for accessibility barriers or compliance gaps.
+- Implementing new WCAG 2.2 standards like Target Size (Minimum) and Focus Appearance.
+- Mapping high-level design requirements to technical attributes (ARIA roles, traits, hints).
+
+## Core Concepts
+
+- **POUR Principles**: The foundation of WCAG (Perceivable, Operable, Understandable, Robust).
+- **Semantic Mapping**: Using native elements over generic containers to provide built-in accessibility.
+- **Accessibility Tree**: The representation of the UI that assistive technologies actually "read."
+- **Focus Management**: Controlling the order and visibility of the keyboard/screen reader cursor.
+- **Labeling & Hints**: Providing context through `aria-label`, `accessibilityLabel`, and `contentDescription`.
+
+## How It Works
+
+### Step 1: Identify the Component Role
+
+Determine the functional purpose (e.g., Is this a button, a link, or a tab?). Use the most semantic native element available before resorting to custom roles.
+
+### Step 2: Define Perceivable Attributes
+
+- Ensure text contrast meets **4.5:1** (normal) or **3:1** (large/UI).
+- Add text alternatives for non-text content (images, icons).
+- Implement responsive reflow (up to 400% zoom without loss of function).
+
+### Step 3: Implement Operable Controls
+
+- Ensure a minimum **24x24 CSS pixel** target size (WCAG 2.2 SC 2.5.8).
+- Verify all interactive elements are reachable via keyboard and have a visible focus indicator (SC 2.4.11).
+- Provide single-pointer alternatives for dragging movements.
+
+### Step 4: Ensure Understandable Logic
+
+- Use consistent navigation patterns.
+- Provide descriptive error messages and suggestions for correction (SC 3.3.3).
+- Implement "Redundant Entry" (SC 3.3.7) to prevent asking for the same data twice.
+
+### Step 5: Verify Robust Compatibility
+
+- Use correct `Name, Role, Value` patterns.
+- Implement `aria-live` or live regions for dynamic status updates.
+
+## Accessibility Architecture Diagram
+
+```mermaid
+flowchart TD
+  UI["UI Component"] --> Platform{Platform?}
+  Platform -->|Web| ARIA["WAI-ARIA + HTML5"]
+  Platform -->|iOS| SwiftUI["Accessibility Traits + Labels"]
+  Platform -->|Android| Compose["Semantics + ContentDesc"]
+
+  ARIA --> AT["Assistive Technology (Screen Readers, Switches)"]
+  SwiftUI --> AT
+  Compose --> AT
+```
+
+## Cross-Platform Mapping
+
+| Feature            | Web (HTML/ARIA)          | iOS (SwiftUI)                        | Android (Compose)                                           |
+| :----------------- | :----------------------- | :----------------------------------- | :---------------------------------------------------------- |
+| **Primary Label**  | `aria-label` / `<label>` | `.accessibilityLabel()`              | `contentDescription`                                        |
+| **Secondary Hint** | `aria-describedby`       | `.accessibilityHint()`               | `Modifier.semantics { stateDescription = ... }`             |
+| **Action Role**    | `role="button"`          | `.accessibilityAddTraits(.isButton)` | `Modifier.semantics { role = Role.Button }`                 |
+| **Live Updates**   | `aria-live="polite"`     | `.accessibilityLiveRegion(.polite)`  | `Modifier.semantics { liveRegion = LiveRegionMode.Polite }` |
+
+## Examples
+
+### Web: Accessible Search
+
+```html
+<form role="search">
+  <label for="search-input" class="sr-only">Search products</label>
+  <input type="search" id="search-input" placeholder="Search..." />
+  <button type="submit" aria-label="Submit Search">
+    <svg aria-hidden="true">...</svg>
+  </button>
+</form>
+```
+
+### iOS: Accessible Action Button
+
+```swift
+Button(action: deleteItem) {
+    Image(systemName: "trash")
+}
+.accessibilityLabel("Delete item")
+.accessibilityHint("Permanently removes this item from your list")
+.accessibilityAddTraits(.isButton)
+```
+
+### Android: Accessible Toggle
+
+```kotlin
+Switch(
+    checked = isEnabled,
+    onCheckedChange = { onToggle() },
+    modifier = Modifier.semantics {
+        contentDescription = "Enable notifications"
+    }
+)
+```
+
+## Anti-Patterns to Avoid
+
+- **Div-Buttons**: Using a `<div>` or `<span>` for a click event without adding a role and keyboard support.
+- **Color-Only Meaning**: Indicating an error or status _only_ with a color change (e.g., turning a border red).
+- **Uncontained Modal Focus**: Modals that don't trap focus, allowing keyboard users to navigate background content while the modal is open. Focus must be contained _and_ escapable via the `Escape` key or an explicit close button (WCAG SC 2.1.2).
+- **Redundant Alt Text**: Using "Image of..." or "Picture of..." in alt text (screen readers already announce the role "Image").
+
+## Best Practices Checklist
+
+- [ ] Interactive elements meet the **24x24px** (Web) or **44x44pt** (Native) target size.
+- [ ] Focus indicators are clearly visible and high-contrast.
+- [ ] Modals **contain focus** while open, and release it cleanly on close (`Escape` key or close button).
+- [ ] Dropdowns and menus restore focus to the trigger element on close.
+- [ ] Forms provide text-based error suggestions.
+- [ ] All icon-only buttons have a descriptive text label.
+- [ ] Content reflows properly when text is scaled.
+
+## References
+
+- [WCAG 2.2 Guidelines](https://www.w3.org/TR/WCAG22/)
+- [WAI-ARIA Authoring Practices](https://www.w3.org/TR/wai-aria-practices/)
+- [iOS Accessibility Programming Guide](https://developer.apple.com/documentation/accessibility)
+- [iOS Human Interface Guidelines - Accessibility](https://developer.apple.com/design/human-interface-guidelines/accessibility)
+- [Android Accessibility Developer Guide](https://developer.android.com/guide/topics/ui/accessibility)
+
+## Related Skills
+
+- `frontend-patterns`
+- `design-system`
+- `liquid-glass-design`
+- `swiftui-patterns`

package/src/harness_context/skills/ecc/agent-architecture-audit/LICENSE.ecc

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.