Samarjeet Singh Tomar 754b8dd76c fix: make the installer runtime pass strict supply-chain vetting (#2503) ... * fix: make the installer runtime pass strict supply-chain vetting Remediate the four enterprise supply-chain vetting blockers from affaan-m/ECC#2502 so the installer runtime (package.json + manifests + scripts/lib/**) passes strict exact-pin evidence policy: 1. Remove the package.json `postinstall` lifecycle script (it only echoed a post-install banner) and move that banner to an explicit opt-in `npm run welcome` command. No install-time lifecycle script remains. 2. Exact-pin every dependency in package.json (dependencies + devDependencies) to the versions already resolved in package-lock.json; no ^/~ ranges. 3. Replace non-ASCII characters on the installer runtime script/config surface: em-dashes (U+2014) in scripts/lib/{path-safety,install-executor, install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in manifests/{install-components,install-modules}.json descriptions become ASCII, so strict-surface Unicode scanners are clean. 4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file already carries a complete hand-rolled validator enforcing the same schemas/install-state.schema.json (ecc.install.v1) constraints, so the installer closure is dependency-free (zero non-builtin bare requires). Refs affaan-m/ECC#2502 * fix: avoid unpinned welcome invocations Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: validate translated skill frontmatter Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: repair skill frontmatter YAML Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> * fix: add MIT license to core skill manifests; pin verification-loop tsc invocation * fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail) * chore(deps): sync lockfiles with exact-pinned package.json Regenerate package-lock.json and yarn.lock so the pinned dependency specs are reflected in both lockfiles. npm ci and Yarn's --immutable install now pass the sync check. The resolution tree is unchanged (231 yarn resolutions, byte-identical set; zero npm transitive drift); only the root descriptor strings move from ranges to the versions already resolved in the committed lockfiles. Addresses the Codex P1 on #2503. --------- Signed-off-by: Samar Tomar <samar_tomar@hotmail.com> Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>		2026-07-17 17:13:49 -04:00
..
accessibility	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
agent-eval	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
agent-harness-construction	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
agent-introspection-debugging	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
agent-payment-x402	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
agent-sort	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
agentic-engineering	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
ai-first-engineering	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
ai-regression-testing	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
android-clean-architecture	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
api-connector-builder	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
api-design	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
architecture-decision-records	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
article-writing	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
automation-audit-ops	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
autonomous-agent-harness	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
autonomous-loops	docs: restore zh-CN autonomous-loops install warning (#1907)	2026-05-15 01:37:42 -04:00
backend-patterns	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
benchmark	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
blueprint	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
brand-voice	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
browser-qa	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
bun-runtime	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
canary-watch	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
carrier-relationship-management	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
ck	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
claude-devfleet	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
click-path-audit	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
clickhouse-io	fix(clickhouse-io): use official @clickhouse/client instead of unmaintained clickhouse package (#2422)	2026-07-03 20:36:46 -07:00
code-tour	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
codebase-onboarding	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
coding-standards	fix: refresh stale technical content in agents, rules, and skills (#2168)	2026-06-07 13:26:01 +08:00
compose-multiplatform-patterns	docs(zh-CN): update	2026-03-13 17:45:44 +08:00
configure-ecc	fix: integrate recent hook and docs PRs (#1905)	2026-05-14 21:37:28 -04:00
connections-optimizer	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
content-engine	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
content-hash-cache-pattern	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
context-budget	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
continuous-agent-loop	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
continuous-learning	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
continuous-learning-v2	docs(continuous-learning-v2): observer.md promotion uses avg confidence, not per-instance (#2411)	2026-07-03 20:37:03 -07:00
cost-aware-llm-pipeline	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
council	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
cpp-coding-standards	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
cpp-testing	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
crosspost	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
csharp-testing	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
customer-billing-ops	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
customs-trade-compliance	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
dart-flutter-patterns	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
dashboard-builder	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
data-scraper-agent	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
database-migrations	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
deep-research	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
defi-amm-security	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
deployment-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
design-system	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
django-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
django-security	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
django-tdd	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
django-verification	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
dmux-workflows	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
docker-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
documentation-lookup	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
dotnet-patterns	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
e2e-testing	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
ecc-guide	docs(zh-CN): translate ecc-guide and parallel-execution-optimizer skills (#2217)	2026-06-11 01:01:28 -04:00
ecc-tools-cost-audit	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
email-ops	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
energy-procurement	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
enterprise-agent-ops	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
eval-harness	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
evm-token-decimals	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
exa-search	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
fal-ai-media	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
finance-billing-ops	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
flutter-dart-code-review	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
foundation-models-on-device	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
frontend-patterns	fix: refresh stale technical content in agents, rules, and skills (#2168)	2026-06-07 13:26:01 +08:00
frontend-slides	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
gan-style-harness	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
gateguard	fix(gateguard): finish tool-agnostic checklist across edit gate and SKILL.md copies (#2274)	2026-06-29 18:38:24 -07:00
git-workflow	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
github-ops	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
golang-patterns	fix(golang-patterns): replace removed govet check-shadowing with enable: [shadow] (#2423)	2026-07-03 20:36:50 -07:00
golang-testing	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
google-workspace-ops	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
healthcare-cdss-patterns	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
healthcare-emr-patterns	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
healthcare-eval-harness	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
healthcare-phi-compliance	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
hermes-imports	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
hexagonal-architecture	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
hipaa-compliance	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
hookify-rules	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
inventory-demand-planning	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
investor-materials	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
investor-outreach	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
iterative-retrieval	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
java-coding-standards	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
jira-integration	fix(skills): keep curl credentials out of argv (#2175)	2026-06-07 13:25:45 +08:00
jpa-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
knowledge-ops	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
kotlin-coroutines-flows	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
kotlin-exposed-patterns	docs(zh-CN): update	2026-03-13 17:45:44 +08:00
kotlin-ktor-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
kotlin-patterns	docs(zh-CN): update	2026-03-13 17:45:44 +08:00
kotlin-testing	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
laravel-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
laravel-plugin-discovery	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
laravel-security	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
laravel-tdd	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
laravel-verification	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
lead-intelligence	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
liquid-glass-design	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
llm-trading-agent-security	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
logistics-exception-management	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
manim-video	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
market-research	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
mcp-server-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
messages-ops	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
nanoclaw-repl	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
nestjs-patterns	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
nextjs-turbopack	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
nodejs-keccak256	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
nutrient-document-processing	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
nuxt4-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
opensource-pipeline	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
parallel-execution-optimizer	docs(zh-CN): translate ecc-guide and parallel-execution-optimizer skills (#2217)	2026-06-11 01:01:28 -04:00
perl-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
perl-security	docs(zh-CN): update	2026-03-13 17:45:44 +08:00
perl-testing	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
plankton-code-quality	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
postgres-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
product-capability	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
product-lens	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
production-scheduling	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
project-flow-ops	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
prompt-optimizer	feat: add Quarkus handling	2026-05-12 09:30:26 -04:00
python-patterns	fix: refresh stale technical content in agents, rules, and skills (#2168)	2026-06-07 13:26:01 +08:00
python-testing	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
pytorch-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00
quality-nonconformance	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
ralphinho-rfc-pipeline	docs(zh-CN): sync Chinese docs with latest upstream changes (#341)	2026-03-07 14:48:02 -08:00
regex-vs-llm-structured-text	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
remotion-video-creation	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
repo-scan	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
research-ops	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
returns-reverse-logistics	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
rules-distill	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
rust-patterns	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
rust-testing	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
safety-guard	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
santa-method	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
search-first	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
security-bounty-hunter	docs: salvage zh-CN health security skill translations	2026-05-11 15:14:55 -04:00
security-review	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
security-scan	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
seo	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
skill-comply	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
skill-stocktake	fix: sync skill frontmatter and catalog counts	2026-05-11 02:33:29 -04:00
social-graph-ranker	docs: salvage remaining stable zh-CN skill translations	2026-05-11 15:31:49 -04:00
springboot-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
springboot-security	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
springboot-tdd	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
springboot-verification	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
strategic-compact	fix(skills): document plugin vs manual hook setup for strategic-compact (#2420)	2026-07-03 20:36:59 -07:00
swift-actor-persistence	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
swift-concurrency-6-2	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
swift-protocol-di-testing	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
swiftui-patterns	docs(zh-CN): sync Chinese docs with latest upstream changes (#304)	2026-03-02 22:28:27 -08:00
tdd-workflow	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
team-builder	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
terminal-ops	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
token-budget-advisor	fix: make the installer runtime pass strict supply-chain vetting (#2503)	2026-07-17 17:13:49 -04:00
ui-demo	docs: salvage zh-CN framework skill translations	2026-05-11 14:38:12 -04:00
unified-notifications-ops	docs: salvage zh-CN business ops skill translations	2026-05-11 14:58:51 -04:00
verification-loop	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
video-editing	docs(zh-CN): translate code block(plain text) (#753)	2026-03-22 15:39:24 -07:00
videodb	fix: harden unicode safety checks	2026-03-29 21:21:18 -04:00
visa-doc-translate	docs: resolve markdownlint errors across translated docs	2026-04-05 14:41:27 -07:00
workspace-surface-audit	docs: salvage zh-CN core skill translations	2026-05-11 14:21:49 -04:00
x-api	docs(zh-CN): sync Chinese docs with latest upstream changes	2026-03-21 12:55:58 +08:00