winter-super-cli 2026.5.32 → 2026.6.6

package/resources/local/ecc/docs/releases/2.0.0-rc.1/release-name-plugin-publication-checklist-2026-05-18.md

@@ -0,0 +1,116 @@
+# ECC v2.0.0-rc.1 Release Name And Plugin Publication Checklist
+
+Snapshot date: 2026-05-18.
+
+This checklist is the operator gate for release naming, package publication,
+and Claude/Codex plugin distribution. It is not a publication action by itself.
+Run it from the exact release commit before creating tags, publishing npm,
+submitting marketplace forms, or posting announcements.
+
+## Fixed rc.1 Decision
+
+Ship `v2.0.0-rc.1` as **Everything Claude Code (ECC)**.
+
+- Keep the GitHub repo at `affaan-m/everything-claude-code`.
+- Keep the npm package as `ecc-universal`.
+- Keep Claude and Codex plugin slugs as `ecc`.
+- Publish the npm prerelease on the `next` dist-tag, not `latest`.
+- Do not rename to `affaan-m/ecc`, `ecc`, or `@affaan-m/ecc` before rc.1.
+
+Reasons:
+
+- `ecc-universal` is the current working install and package surface.
+- `ecc` on npm is occupied by an unrelated elliptic-curve package.
+- `@affaan-m/ecc` is unclaimed on npm, but would require a migration plan.
+- `affaan-m/ecc` is not available to the current GitHub auth context.
+- Claude and Codex already expose the desired short namespace as `ecc`.
+
+## Current Surface Evidence
+
+| Surface | Current value | Evidence command | 2026-05-18 result | Release action |
+| --- | --- | --- | --- | --- |
+| Git commit | `67e63e63f9bfd074bd6a21bf6bac71f3dfefa58b` | `git rev-parse HEAD` | Recorded from clean `main` before this ITO-46 evidence refresh | Re-run from final release commit |
+| GitHub repo | `affaan-m/everything-claude-code` | `git remote get-url origin` | `https://github.com/affaan-m/everything-claude-code.git` | Keep for rc.1 |
+| Possible short repo | `affaan-m/ecc` | `gh repo view affaan-m/ecc --json nameWithOwner,url,isPrivate` | GraphQL could not resolve repository | Do not depend on it for rc.1 |
+| npm package | `ecc-universal@2.0.0-rc.1` local, `1.10.0` registry latest | `node -p "require('./package.json').name + '@' + require('./package.json').version"` and `npm view ecc-universal name version dist-tags --json` | Local rc.1 ready; registry still latest `1.10.0` | Publish rc.1 with `--tag next` after approval |
+| Exact npm short name | `ecc` | `npm view ecc name version description repository.url --json` | Occupied by unrelated `ecc@0.0.2` | Do not use |
+| Scoped npm short name | `@affaan-m/ecc` | `npm view @affaan-m/ecc name version --json` | 404 | Candidate only after migration plan |
+| Claude plugin | `ecc@2.0.0-rc.1` | `claude plugin validate .claude-plugin/plugin.json`; `claude plugin validate .`; `claude plugin tag .claude-plugin --dry-run` | Validation passed on Claude Code `2.1.143`; full plugin validation has one expected root `CLAUDE.md` context warning; dry run would create `ecc--v2.0.0-rc.1` | Run dry-run tag again from the final commit, then tag/push only after approval |
+| Claude marketplace | `.claude-plugin/marketplace.json` | `claude plugin marketplace add --help`; Anthropic plugin marketplace docs | GitHub repo, git URL, remote marketplace JSON, and local path marketplace sources are supported | Verify post-tag marketplace install/update path after final evidence |
+| Codex plugin | `ecc@2.0.0-rc.1` | `node tests/plugin-manifest.test.js`; `codex plugin marketplace add --help`; OpenAI Codex plugin docs | Plugin manifest passed 54/54; local and GitHub-ref repo marketplace smokes passed on Codex CLI `0.131.0` | Use repo marketplace for rc.1; do not claim official directory listing until OpenAI publishing path is available |
+| OpenCode package | `ecc-universal@2.0.0-rc.1` | `node -p "require('./.opencode/package.json').name + '@' + require('./.opencode/package.json').version"` | Matches rc.1 package identity | Follow npm package publication |
+| Billing claim | Pending ECC Tools readiness | ECC Tools billing gate and Marketplace account readback | Code-side gate exists; live Marketplace account readback still pending | Do not announce native payments |
+
+## Required Gate
+
+Run these checks from the final release commit and paste the exact output into
+a fresh `publication-evidence-YYYY-MM-DD.md` file before release actions:
+
+```bash
+git status --short --branch
+git rev-parse HEAD
+git remote get-url origin
+npm view ecc name version description repository.url --json
+npm view @affaan-m/ecc name version --json
+npm view ecc-universal name version dist-tags --json
+node tests/plugin-manifest.test.js
+node tests/docs/ecc2-release-surface.test.js
+claude plugin validate .claude-plugin/plugin.json
+claude plugin tag .claude-plugin --dry-run
+codex plugin marketplace add --help
+HOME="$(mktemp -d)" codex plugin marketplace add ./
+HOME="$(mktemp -d)" codex plugin marketplace add affaan-m/everything-claude-code --ref "$(git rev-parse HEAD)"
+npm pack --dry-run --json
+npm publish --tag next --dry-run
+npm run build:opencode
+npm run preview-pack:smoke
+```
+
+If a command is unavailable on the release machine, record the exact error and
+keep the related publication action blocked.
+
+## Publication Order
+
+| Step | Action | Required evidence | Stop condition |
+| --- | --- | --- | --- |
+| 1 | Freeze name and version | Package, Claude plugin, Codex plugin, OpenCode package, `VERSION`, and release docs all say `2.0.0-rc.1` | Any `preview`/`rc.1` mismatch |
+| 2 | Verify clean release branch | `git status --short --branch` shows only the intended release commit and no unrelated drift | Any unexplained dirty file |
+| 3 | Verify package and plugin manifests | `node tests/plugin-manifest.test.js` and `node tests/docs/ecc2-release-surface.test.js` pass | Manifest or release-surface failure |
+| 4 | Dry-run package surface | `npm pack --dry-run --json`; `npm publish --tag next --dry-run` | Missing files, wrong dist-tag, or publish dry-run failure |
+| 5 | Dry-run Claude distribution | `claude plugin validate`; `claude plugin tag .claude-plugin --dry-run`; marketplace source/help evidence | Validation, tag, or install-smoke failure |
+| 6 | Verify Codex repo marketplace | `codex plugin marketplace add --help`; temp-home local and GitHub-ref repo marketplace add smoke; OpenAI official directory status recorded | Missing repo marketplace or unverified official-directory status |
+| 7 | Verify OpenCode package | `npm run build:opencode` | Build failure |
+| 8 | Regenerate release URL ledger | Live and approval-gated URLs separated in `release-url-ledger-YYYY-MM-DD.md` | Placeholder, private URL, or announcement URL drift |
+| 9 | Create GitHub prerelease | `gh release view v2.0.0-rc.1 --json tagName,url,isPrerelease` | Missing URL or wrong prerelease flag |
+| 10 | Publish npm rc | `npm view ecc-universal version dist-tags --json` shows rc.1 on `next` | rc.1 lands on `latest` or registry output is unclear |
+| 11 | Publish/plugin-submit | Claude official submission and Codex repo marketplace evidence recorded | Form not submitted, listing not visible, or docs status changed |
+| 12 | Announce | X, LinkedIn, GitHub release, and longform copy use final live URLs | Any final URL is still pending |
+
+## Do Not Proceed
+
+- Do not publish npm before `npm pack --dry-run --json` is captured from the
+  final release commit.
+- Do not create or push Claude plugin tags before `claude plugin tag
+  .claude-plugin --dry-run` passes from the final release commit.
+- Do not claim an official Codex Plugin Directory listing unless OpenAI
+  documents a public submission path or confirms the plugin has been listed.
+- Do not announce billing, Marketplace, or native payments until ECC Tools live
+  Marketplace account readback returns ready.
+- Do not rename the repo or package until rc.1 is published and a migration
+  guide maps old names to new names.
+- Do not post social copy while any release, npm, plugin, or billing URL is
+  still approval-gated.
+
+## External Distribution Sources
+
+- Anthropic Claude Code plugin docs: `https://code.claude.com/docs/en/plugins`
+- Anthropic Claude Code marketplace docs:
+  `https://code.claude.com/docs/en/plugin-marketplaces`
+- OpenAI Codex plugin docs:
+  `https://developers.openai.com/codex/plugins/build#add-a-marketplace-from-the-cli`
+
+As of this snapshot, Anthropic documents self-hosted marketplace distribution
+through GitHub, git URL, remote marketplace JSON, and local path sources.
+OpenAI documents repo/personal marketplace distribution for Codex and describes
+an official Plugin Directory, but ECC has not submitted or received an official
+directory listing in this pass.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/release-notes.md

@@ -0,0 +1,106 @@
+# ECC v2.0.0-rc.1 Release Notes
+
+## Positioning
+
+ECC v2.0.0-rc.1 is the first release-candidate surface for ECC as a cross-harness operating system for agentic work.
+
+Claude Code remains a core target. Codex, OpenCode, Cursor, Gemini, and other harnesses are treated as execution surfaces that can share the same skills, rules, MCP conventions, and operator workflows. ECC is the reusable substrate; Hermes is documented as the operator shell that can sit on top of that layer.
+
+## What Changed
+
+- Added the sanitized Hermes setup guide to the public release story.
+- Added launch collateral in-repo so the release can ship from one reviewed surface.
+- Clarified the split between ECC as the reusable substrate and Hermes as the operator shell.
+- Documented the cross-harness portability model for skills, hooks, MCPs, rules, and instructions.
+- Added a Hermes import playbook for turning local operator patterns into publishable ECC skills.
+- Added Zed as a project-local planning/install target while keeping BYOK and OpenRouter secrets outside ECC-managed project files.
+- Added command-registry coverage, platform audit, discussion audit, operator dashboard, Linear progress readiness, and preview-pack smoke gates.
+- Added a local [observability readiness gate](../../architecture/observability-readiness.md) for loop status, session traces, harness audit, and ECC2 tool-risk logs.
+- Refreshed the release-readiness evidence after the May 2026 Mini
+  Shai-Hulud/TanStack campaign follow-up, including full-campaign AgentShield
+  IOC coverage, queue-zero/discussion checks, a detailed Linear roadmap gate,
+  the May 18 operator dashboard snapshot, and a live/pending release URL
+  ledger for announcement gating.
+
+## Since v1.10.0
+
+The rc.1 surface now includes the main 2.0 direction rather than one isolated
+feature branch:
+
+- cross-harness substrate work for Claude Code, Codex, OpenCode, Cursor,
+  Gemini, Zed, and terminal-only workflows;
+- stronger package and plugin publication surfaces for npm, Claude plugin,
+  Codex repo-marketplace, OpenCode, and agent metadata;
+- operator gates for PRs, issues, discussions, stale legacy work, Linear
+  progress, release evidence, and dashboard repeatability;
+- supply-chain hardening after the Mini Shai-Hulud/TanStack campaign,
+  including IOC scanning, no-lifecycle CI installs, advisory-source refresh,
+  npm audit/signature checks, and user-level AI-tool persistence targets;
+- AgentShield enterprise-roadmap mirrors for package-manager hardening,
+  evidence-pack provenance, policy export, policy promotion, fleet routing,
+  and GitHub Action output telemetry;
+- ECC Tools roadmap mirrors for hosted analysis, fleet-summary consumption,
+  finding evidence paths, harness policy-route linking, hosted promotion judge
+  audit traces, billing announcement preflight, and production Marketplace
+  readback state;
+- documentation expansion, Japanese localization, zh-CN to ja-JP parity
+  repair, and dependency readiness through TypeScript 6 and Node type updates;
+- launch collateral for GitHub release copy, X, LinkedIn, article outline,
+  Telegram/Hermes handoff, demo prompts, and the approval-gated launch
+  checklist.
+- a release URL ledger that separates links which already resolve from links
+  that must wait for the GitHub release, npm rc package, plugin tag/directory,
+  and ECC Tools billing readback.
+
+## Why This Matters
+
+ECC is no longer only a Claude Code plugin or config bundle.
+
+The system now has a clearer shape:
+
+- reusable skills instead of one-off prompts
+- hooks and tests for workflow discipline
+- MCP-backed access to docs, code, browser automation, and research
+- cross-harness install surfaces for Claude Code, Codex, OpenCode, Cursor, and related tools
+- Hermes as an optional operator shell for chat, cron, handoffs, and daily work routing
+
+## Release Candidate Boundaries
+
+This is a release candidate, not the final GA claim.
+
+What ships in this surface:
+
+- public Hermes setup documentation
+- release notes and launch collateral
+- cross-harness architecture documentation
+- Hermes import guidance for sanitized operator workflows
+- publication-readiness evidence for queue state, discussion state, Linear roadmap coverage, operator dashboard status, and supply-chain follow-up
+- preview-pack smoke evidence proving the public pack is assembled without private Hermes state
+
+What stays local:
+
+- secrets, OAuth tokens, and API keys
+- private workspace exports
+- personal datasets
+- operator-specific automations that have not been sanitized
+- deeper CRM, finance, and Google Workspace playbooks
+
+## Upgrade Motion
+
+1. Follow the [rc.1 quickstart](quickstart.md).
+2. Read the [Hermes setup guide](../../HERMES-SETUP.md).
+3. Review the [cross-harness architecture](../../architecture/cross-harness.md).
+4. Run the [observability readiness gate](../../architecture/observability-readiness.md).
+5. Check the [release URL ledger](release-url-ledger-2026-05-18.md) before
+   using any announcement links.
+6. Start with one workflow lane: engineering, research, content, or outreach.
+7. Import only sanitized operator patterns into ECC skills.
+8. Treat `ecc2/` as an alpha control plane until release packaging and installer
+   behavior is finalized.
+
+## Do Not Treat This As Published Yet
+
+The release candidate copy is ready for final review, but the public release is
+still blocked on approval-gated actions: the GitHub prerelease, npm `next`
+publish, Claude plugin tag/marketplace path, Codex Plugin Directory status,
+final live URLs, and any billing or native-payments announcement.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-18.md

@@ -0,0 +1,55 @@
+# ECC v2.0.0-rc.1 Release URL Ledger
+
+This ledger separates links that are already public from links that only become
+valid after the approval-gated release, package, plugin, and announcement
+steps. Regenerate it from the final release commit before posting any public
+announcement.
+
+Captured from source snapshot
+`81fca2cea6f1399c52c8faa70f9a17e42f0bd447` on 2026-05-18. The ledger file
+may be committed in a later docs-only refresh after the evidence snapshot it
+describes.
+
+## Live Now
+
+| Surface | URL | Verification |
+| --- | --- | --- |
+| Repository | <https://github.com/affaan-m/everything-claude-code> | `git remote get-url origin` |
+| Evidence source commit | <https://github.com/affaan-m/everything-claude-code/commit/81fca2cea6f1399c52c8faa70f9a17e42f0bd447> | `git rev-parse HEAD` at evidence capture |
+| Release pack folder | <https://github.com/affaan-m/everything-claude-code/tree/main/docs/releases/2.0.0-rc.1> | Release pack evidence captured from `81fca2ce` |
+| Release notes draft | <https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md> | In-tree release copy |
+| Hermes setup guide | <https://github.com/affaan-m/everything-claude-code/blob/main/docs/HERMES-SETUP.md> | In-tree sanitized Hermes guide |
+| May 18 evidence snapshot | <https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/publication-evidence-2026-05-18.md> | Current strongest readiness evidence |
+| May 18 operator dashboard | <https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-18.md> | Prompt-to-artifact dashboard |
+| Pushed-head CI | <https://github.com/affaan-m/everything-claude-code/actions/runs/26011460500> | CI passed 37/37 jobs for `81fca2ce`, including the supply-chain IOC scan job |
+| Latest Supply-Chain Watch | <https://github.com/affaan-m/everything-claude-code/actions/runs/26010432490> | Supply-Chain Watch passed for `25ac57ac`; rerun from the final release commit before publication |
+| npm package page | <https://www.npmjs.com/package/ecc-universal> | `npm view ecc-universal name version dist-tags --json` returned `latest: 1.10.0`; rc.1 is not published yet |
+| Codex marketplace CLI docs | <https://developers.openai.com/codex/cli/reference#codex-plugin-marketplace> | Official docs list `codex plugin marketplace add` for GitHub shorthand, Git URLs, SSH URLs, and local marketplace roots |
+| Codex official Plugin Directory status | <https://developers.openai.com/codex/plugins/build#publish-official-public-plugins> | Official docs say public Plugin Directory publishing and self-serve management are coming soon |
+
+## Approval-Gated URLs
+
+| Surface | Intended URL or command | Gate before use |
+| --- | --- | --- |
+| GitHub prerelease | <https://github.com/affaan-m/everything-claude-code/releases/tag/v2.0.0-rc.1> | `gh release view v2.0.0-rc.1 --repo affaan-m/everything-claude-code --json tagName,url,isPrerelease` must return the prerelease |
+| npm rc package | <https://www.npmjs.com/package/ecc-universal/v/2.0.0-rc.1> | `npm publish --tag next` approval and post-publish `npm view ecc-universal dist-tags --json` |
+| Claude plugin tag | `claude plugin tag .claude-plugin --dry-run`, then real tag only after approval | Clean release commit and plugin tag/push approval |
+| Codex repo marketplace install | `codex plugin marketplace add affaan-m/everything-claude-code --ref v2.0.0-rc.1` | GitHub tag must exist; official Plugin Directory submission remains separate |
+| ECC Tools native-payments announcement | ECC Tools Marketplace/App URL plus billing readiness readback | Marketplace-managed test account must return `announcementGate.ready === true` |
+| Public announcements | X, LinkedIn, GitHub release, and longform URLs | GitHub release, npm, plugin, and billing URLs must resolve first |
+
+## Pre-Post Check
+
+Run these immediately before publication:
+
+```bash
+git status --short --branch
+gh release view v2.0.0-rc.1 --repo affaan-m/everything-claude-code --json tagName,url,isPrerelease
+npm view ecc-universal name version dist-tags --json
+codex plugin marketplace add --help
+rg -n "TODO|TBD|PLACEHOLDER" docs/releases/2.0.0-rc.1
+npm run preview-pack:smoke
+```
+
+Do not post the social or notification copy until the approval-gated URLs above
+resolve from a clean release commit.

package/resources/local/ecc/docs/releases/2.0.0-rc.1/telegram-handoff.md

@@ -0,0 +1,30 @@
+# Telegram Handoff For Hermes
+
+Send this to Hermes when you want it to help package the launch workflow.
+
+```text
+Use the public ECC release pack in the repo:
+
+- docs/releases/2.0.0-rc.1/release-notes.md
+- docs/releases/2.0.0-rc.1/x-thread.md
+- docs/releases/2.0.0-rc.1/linkedin-post.md
+- docs/releases/2.0.0-rc.1/article-outline.md
+- docs/releases/2.0.0-rc.1/launch-checklist.md
+- docs/releases/2.0.0-rc.1/preview-pack-manifest.md
+- docs/releases/2.0.0-rc.1/publication-evidence-2026-05-17.md
+- docs/releases/2.0.0-rc.1/operator-readiness-dashboard-2026-05-17.md
+- docs/HERMES-SETUP.md
+- docs/architecture/cross-harness.md
+
+Task:
+
+1. Finalize one strong X thread for ECC v2.0.0-rc.1.
+2. Finalize one strong LinkedIn post for ECC v2.0.0-rc.1.
+3. Give me one 30-60 second Hermes x ECC video script and one 15-30 second variant.
+4. Tell me exactly what to record now with screen capture, face camera, and voice lines.
+5. Tell me what Hermes can generate automatically after I record.
+6. Keep every public claim release-candidate framed until live release/npm/plugin URLs exist.
+7. End with a minimal checklist of the assets or logins still needed.
+
+Be decisive. Return final drafts plus a practical recording checklist.
+```

package/resources/local/ecc/docs/releases/2.0.0-rc.1/x-thread.md

@@ -0,0 +1,83 @@
+# X Thread Draft - ECC v2.0.0-rc.1
+
+1/ ECC v2.0.0-rc.1 is the first release-candidate pass at the 2.0 direction.
+
+The repo is moving from a Claude Code config pack into a cross-harness operating system for agentic work.
+
+2/ The important split:
+
+ECC is the reusable substrate.
+Hermes is the operator shell that can run on top.
+
+Skills, hooks, MCP configs, rules, and workflow packs live in ECC.
+
+3/ Claude Code is still a core target.
+
+Codex, OpenCode, Cursor, Gemini, and other harnesses are part of the same story now.
+
+The goal is fewer one-off harness tricks and more reusable workflow surface.
+
+4/ Since v1.10.0, the work also picked up the operator layer:
+
+PR/issue/discussion audits, Linear progress sync, release evidence, observability checks, and a generated readiness dashboard.
+
+5/ The security posture changed too.
+
+The Mini Shai-Hulud/TanStack campaign forced a real supply-chain loop:
+
+- IOC scanning
+- no-lifecycle CI installs
+- advisory-source refresh
+- npm audit/signature checks
+- AI-tool persistence targets
+
+6/ The rc.1 surface ships the public pieces:
+
+- Hermes setup guide
+- release notes
+- launch checklist
+- cross-harness architecture doc
+- Hermes import guidance
+- preview-pack smoke gate
+- X, LinkedIn, and article drafts
+
+7/ It does not ship private workspace state.
+
+No secrets.
+No OAuth tokens.
+No raw local exports.
+No personal datasets.
+
+The point is to publish the reusable system shape.
+
+8/ Why Hermes matters:
+
+Most agent systems fail in the daily operating loop.
+
+They can code, but they do not keep research, content, handoffs, reminders, and execution in one measurable surface.
+
+9/ ECC gives the reusable layer.
+
+Hermes gives the operator shell.
+
+Together they make the work feel less like scattered chat windows and more like a system you can run.
+
+10/ This is still a release candidate.
+
+The public docs and reusable surfaces are ready for review.
+
+The deeper local integrations stay local until they are sanitized, and publication still waits on the GitHub release, npm, plugin, and final URL gates.
+
+11/ Start here:
+
+Repo:
+<https://github.com/affaan-m/everything-claude-code>
+
+Hermes x ECC setup:
+<https://github.com/affaan-m/everything-claude-code/blob/main/docs/HERMES-SETUP.md>
+
+12/ Release notes:
+<https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-notes.md>
+
+URL ledger:
+<https://github.com/affaan-m/everything-claude-code/blob/main/docs/releases/2.0.0-rc.1/release-url-ledger-2026-05-18.md>