kodelyth-ecc 1.2.0

package/scripts/codex-git-hooks/pre-commit

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ECC Codex Git Hook: pre-commit
+# Blocks commits that add high-signal secrets.
+
+if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PRECOMMIT:-0}" == "1" ]]; then
+  exit 0
+fi
+
+if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
+  exit 0
+fi
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  exit 0
+fi
+
+staged_files="$(git diff --cached --name-only --diff-filter=ACMR || true)"
+if [[ -z "$staged_files" ]]; then
+  exit 0
+fi
+
+has_findings=0
+
+scan_added_lines() {
+  local file="$1"
+  local name="$2"
+  local regex="$3"
+  local added_lines
+  local hits
+
+  added_lines="$(git diff --cached -U0 -- "$file" | awk '/^\+\+\+ /{next} /^\+/{print substr($0,2)}')"
+  if [[ -z "$added_lines" ]]; then
+    return 0
+  fi
+
+  if hits="$(printf '%s\n' "$added_lines" | rg -n --pcre2 "$regex" 2>/dev/null)"; then
+    printf '\n[ECC pre-commit] Potential secret detected (%s) in %s\n' "$name" "$file" >&2
+    printf '%s\n' "$hits" | head -n 3 >&2
+    has_findings=1
+  fi
+}
+
+while IFS= read -r file; do
+  [[ -z "$file" ]] && continue
+
+  case "$file" in
+    *.png|*.jpg|*.jpeg|*.gif|*.svg|*.pdf|*.zip|*.gz|*.lock|pnpm-lock.yaml|package-lock.json|yarn.lock|bun.lockb)
+      continue
+      ;;
+  esac
+
+  scan_added_lines "$file" "OpenAI key" 'sk-[A-Za-z0-9]{20,}'
+  scan_added_lines "$file" "GitHub classic token" 'ghp_[A-Za-z0-9]{36}'
+  scan_added_lines "$file" "GitHub fine-grained token" 'github_pat_[A-Za-z0-9_]{20,}'
+  scan_added_lines "$file" "AWS access key" 'AKIA[0-9A-Z]{16}'
+  scan_added_lines "$file" "private key block" '-----BEGIN (RSA|EC|OPENSSH|DSA|PRIVATE) KEY-----'
+  scan_added_lines "$file" "generic credential assignment" "(?i)\\b(api[_-]?key|secret|password|token)\\b\\s*[:=]\\s*['\\\"][^'\\\"]{12,}['\\\"]"
+done <<< "$staged_files"
+
+if [[ "$has_findings" -eq 1 ]]; then
+  cat >&2 <<'EOF'
+
+[ECC pre-commit] Commit blocked to prevent secret leakage.
+Fix:
+1) Remove secrets from staged changes.
+2) Move secrets to env vars or secret manager.
+3) Re-stage and commit again.
+
+Temporary bypass (not recommended):
+  ECC_SKIP_PRECOMMIT=1 git commit ...
+EOF
+  exit 1
+fi
+
+exit 0

package/scripts/codex-git-hooks/pre-push

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ECC Codex Git Hook: pre-push
+# Runs a lightweight verification flow before pushes.
+
+if [[ "${ECC_SKIP_GIT_HOOKS:-0}" == "1" || "${ECC_SKIP_PREPUSH:-0}" == "1" ]]; then
+  exit 0
+fi
+
+if [[ -f ".ecc-hooks-disable" || -f ".git/ecc-hooks-disable" ]]; then
+  exit 0
+fi
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  exit 0
+fi
+
+# Skip checks for branch deletion pushes (e.g., git push origin --delete <branch>).
+# The pre-push hook receives lines on stdin: <local ref> <local sha> <remote ref> <remote sha>.
+# For deletions, the local sha is the zero OID.
+is_delete_only=true
+while read -r _local_ref local_sha _remote_ref _remote_sha; do
+  if [[ "$local_sha" != "0000000000000000000000000000000000000000" ]]; then
+    is_delete_only=false
+    break
+  fi
+done
+if [[ "$is_delete_only" == "true" ]]; then
+  exit 0
+fi
+
+ran_any_check=0
+
+log() {
+  printf '[ECC pre-push] %s\n' "$*"
+}
+
+fail() {
+  printf '[ECC pre-push] FAILED: %s\n' "$*" >&2
+  exit 1
+}
+
+detect_pm() {
+  if [[ -f "pnpm-lock.yaml" ]]; then
+    echo "pnpm"
+  elif [[ -f "bun.lockb" ]]; then
+    echo "bun"
+  elif [[ -f "yarn.lock" ]]; then
+    echo "yarn"
+  elif [[ -f "package-lock.json" ]]; then
+    echo "npm"
+  else
+    echo "npm"
+  fi
+}
+
+has_node_script() {
+  local script_name="$1"
+  node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); process.exit(p.scripts && p.scripts[process.argv[1]] ? 0 : 1)' "$script_name" >/dev/null 2>&1
+}
+
+run_node_script() {
+  local pm="$1"
+  local script_name="$2"
+  case "$pm" in
+    pnpm) pnpm run "$script_name" ;;
+    bun) bun run "$script_name" ;;
+    yarn) yarn "$script_name" ;;
+    npm) npm run "$script_name" ;;
+    *) npm run "$script_name" ;;
+  esac
+}
+
+if [[ -f "package.json" ]]; then
+  pm="$(detect_pm)"
+  log "Node project detected (package manager: $pm)"
+
+  for script_name in lint typecheck test build; do
+    if has_node_script "$script_name"; then
+      ran_any_check=1
+      log "Running: $script_name"
+      run_node_script "$pm" "$script_name" || fail "$script_name failed"
+    else
+      log "Skipping missing script: $script_name"
+    fi
+  done
+
+  if [[ "${ECC_PREPUSH_AUDIT:-0}" == "1" ]]; then
+    ran_any_check=1
+    log "Running dependency audit (ECC_PREPUSH_AUDIT=1)"
+    case "$pm" in
+      pnpm) pnpm audit --prod || fail "pnpm audit failed" ;;
+      bun) bun audit || fail "bun audit failed" ;;
+      yarn) yarn npm audit --recursive || fail "yarn audit failed" ;;
+      npm) npm audit --omit=dev || fail "npm audit failed" ;;
+      *) npm audit --omit=dev || fail "npm audit failed" ;;
+    esac
+  fi
+fi
+
+if [[ -f "go.mod" ]] && command -v go >/dev/null 2>&1; then
+  ran_any_check=1
+  log "Go project detected. Running: go test ./..."
+  go test ./... || fail "go test failed"
+fi
+
+if [[ -f "pyproject.toml" || -f "requirements.txt" ]]; then
+  if command -v pytest >/dev/null 2>&1; then
+    ran_any_check=1
+    log "Python project detected. Running: pytest -q"
+    pytest -q || fail "pytest failed"
+  else
+    log "Python project detected but pytest is not installed. Skipping."
+  fi
+fi
+
+if [[ "$ran_any_check" -eq 0 ]]; then
+  log "No supported checks found in this repository. Skipping."
+else
+  log "Verification checks passed."
+fi
+
+exit 0

package/scripts/doctor.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+const os = require('os');
+const { buildDoctorReport } = require('./lib/install-lifecycle');
+const { SUPPORTED_INSTALL_TARGETS } = require('./lib/install-manifests');
+
+function showHelp(exitCode = 0) {
+  console.log(`
+Usage: node scripts/doctor.js [--target <${SUPPORTED_INSTALL_TARGETS.join('|')}>] [--json]
+
+Diagnose drift and missing managed files for ECC install-state in the current context.
+`);
+  process.exit(exitCode);
+}
+
+function parseArgs(argv) {
+  const args = argv.slice(2);
+  const parsed = {
+    targets: [],
+    json: false,
+    help: false,
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+
+    if (arg === '--target') {
+      parsed.targets.push(args[index + 1] || null);
+      index += 1;
+    } else if (arg === '--json') {
+      parsed.json = true;
+    } else if (arg === '--help' || arg === '-h') {
+      parsed.help = true;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return parsed;
+}
+
+function statusLabel(status) {
+  if (status === 'ok') {
+    return 'OK';
+  }
+
+  if (status === 'warning') {
+    return 'WARNING';
+  }
+
+  if (status === 'error') {
+    return 'ERROR';
+  }
+
+  return status.toUpperCase();
+}
+
+function printHuman(report) {
+  if (report.results.length === 0) {
+    console.log('No ECC install-state files found for the current home/project context.');
+    return;
+  }
+
+  console.log('Doctor report:\n');
+  for (const result of report.results) {
+    console.log(`- ${result.adapter.id}`);
+    console.log(`  Status: ${statusLabel(result.status)}`);
+    console.log(`  Install-state: ${result.installStatePath}`);
+
+    if (result.issues.length === 0) {
+      console.log('  Issues: none');
+      continue;
+    }
+
+    for (const issue of result.issues) {
+      console.log(`  - [${issue.severity}] ${issue.code}: ${issue.message}`);
+    }
+  }
+
+  console.log(`\nSummary: checked=${report.summary.checkedCount}, ok=${report.summary.okCount}, warnings=${report.summary.warningCount}, errors=${report.summary.errorCount}`);
+}
+
+function main() {
+  try {
+    const options = parseArgs(process.argv);
+    if (options.help) {
+      showHelp(0);
+    }
+
+    const report = buildDoctorReport({
+      repoRoot: require('path').join(__dirname, '..'),
+      homeDir: process.env.HOME || os.homedir(),
+      projectRoot: process.cwd(),
+      targets: options.targets,
+    });
+    const hasIssues = report.summary.errorCount > 0 || report.summary.warningCount > 0;
+
+    if (options.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      printHuman(report);
+    }
+
+    process.exitCode = hasIssues ? 1 : 0;
+  } catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+main();

package/scripts/ecc.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+
+const { spawnSync } = require('child_process');
+const path = require('path');
+const { listAvailableLanguages } = require('./lib/install-executor');
+
+const COMMANDS = {
+  install: {
+    script: 'install-apply.js',
+    description: 'Install ECC content into a supported target',
+  },
+  plan: {
+    script: 'install-plan.js',
+    description: 'Inspect selective-install manifests and resolved plans',
+  },
+  catalog: {
+    script: 'catalog.js',
+    description: 'Discover install profiles and component IDs',
+  },
+  'install-plan': {
+    script: 'install-plan.js',
+    description: 'Alias for plan',
+  },
+  'list-installed': {
+    script: 'list-installed.js',
+    description: 'Inspect install-state files for the current context',
+  },
+  doctor: {
+    script: 'doctor.js',
+    description: 'Diagnose missing or drifted ECC-managed files',
+  },
+  repair: {
+    script: 'repair.js',
+    description: 'Restore drifted or missing ECC-managed files',
+  },
+  status: {
+    script: 'status.js',
+    description: 'Query the ECC SQLite state store status summary',
+  },
+  sessions: {
+    script: 'sessions-cli.js',
+    description: 'List or inspect ECC sessions from the SQLite state store',
+  },
+  'session-inspect': {
+    script: 'session-inspect.js',
+    description: 'Emit canonical ECC session snapshots from dmux or Claude history targets',
+  },
+  uninstall: {
+    script: 'uninstall.js',
+    description: 'Remove ECC-managed files recorded in install-state',
+  },
+};
+
+const PRIMARY_COMMANDS = [
+  'install',
+  'plan',
+  'catalog',
+  'list-installed',
+  'doctor',
+  'repair',
+  'status',
+  'sessions',
+  'session-inspect',
+  'uninstall',
+];
+
+function showHelp(exitCode = 0) {
+  console.log(`
+ECC selective-install CLI
+
+Usage:
+  ecc <command> [args...]
+  ecc [install args...]
+
+Commands:
+${PRIMARY_COMMANDS.map(command => `  ${command.padEnd(15)} ${COMMANDS[command].description}`).join('\n')}
+
+Compatibility:
+  ecc-install        Legacy install entrypoint retained for existing flows
+  ecc [args...]      Without a command, args are routed to "install"
+  ecc help <command> Show help for a specific command
+
+Examples:
+  ecc typescript
+  ecc install --profile developer --target claude
+  ecc plan --profile core --target cursor
+  ecc catalog profiles
+  ecc catalog components --family language
+  ecc catalog show framework:nextjs
+  ecc list-installed --json
+  ecc doctor --target cursor
+  ecc repair --dry-run
+  ecc status --json
+  ecc sessions
+  ecc sessions session-active --json
+  ecc session-inspect claude:latest
+  ecc uninstall --target antigravity --dry-run
+`);
+
+  process.exit(exitCode);
+}
+
+function resolveCommand(argv) {
+  const args = argv.slice(2);
+
+  if (args.length === 0) {
+    return { mode: 'help' };
+  }
+
+  const [firstArg, ...restArgs] = args;
+
+  if (firstArg === '--help' || firstArg === '-h') {
+    return { mode: 'help' };
+  }
+
+  if (firstArg === 'help') {
+    return {
+      mode: 'help-command',
+      command: restArgs[0] || null,
+    };
+  }
+
+  if (COMMANDS[firstArg]) {
+    return {
+      mode: 'command',
+      command: firstArg,
+      args: restArgs,
+    };
+  }
+
+  const knownLegacyLanguages = listAvailableLanguages();
+  const shouldTreatAsImplicitInstall = (
+    firstArg.startsWith('-')
+    || knownLegacyLanguages.includes(firstArg)
+  );
+
+  if (!shouldTreatAsImplicitInstall) {
+    throw new Error(`Unknown command: ${firstArg}`);
+  }
+
+  return {
+    mode: 'command',
+    command: 'install',
+    args,
+  };
+}
+
+function runCommand(commandName, args) {
+  const command = COMMANDS[commandName];
+  if (!command) {
+    throw new Error(`Unknown command: ${commandName}`);
+  }
+
+  const result = spawnSync(
+    process.execPath,
+    [path.join(__dirname, command.script), ...args],
+    {
+      cwd: process.cwd(),
+      env: process.env,
+      encoding: 'utf8',
+      maxBuffer: 10 * 1024 * 1024,
+    }
+  );
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  if (result.stdout) {
+    process.stdout.write(result.stdout);
+  }
+
+  if (result.stderr) {
+    process.stderr.write(result.stderr);
+  }
+
+  if (typeof result.status === 'number') {
+    return result.status;
+  }
+
+  if (result.signal) {
+    throw new Error(`Command "${commandName}" terminated by signal ${result.signal}`);
+  }
+
+  return 1;
+}
+
+function main() {
+  try {
+    const resolution = resolveCommand(process.argv);
+
+    if (resolution.mode === 'help') {
+      showHelp(0);
+    }
+
+    if (resolution.mode === 'help-command') {
+      if (!resolution.command) {
+        showHelp(0);
+      }
+
+      if (!COMMANDS[resolution.command]) {
+        throw new Error(`Unknown command: ${resolution.command}`);
+      }
+
+      process.exitCode = runCommand(resolution.command, ['--help']);
+      return;
+    }
+
+    process.exitCode = runCommand(resolution.command, resolution.args);
+  } catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+main();