feat: add refined-github-projects ECC bundle - #63
Conversation
…github-projects/SKILL.md)
…github-projects/SKILL.md)
…github-projects/agents/openai.yaml)
…incts/inherited/refined-github-projects-instincts.yaml)
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
|
||
| [mcp_servers.context7] | ||
| command = "npx" | ||
| args = ["-y", "@upstash/context7-mcp@latest"] |
There was a problem hiding this comment.
🔒 Agentic Security Review
Severity: HIGH
The new MCP server setup executes packages via npx -y with floating versions (including @latest), which performs runtime download-and-execute of remote npm code without immutable version pinning.
Impact: A compromised upstream package release can execute arbitrary code in the maintainer environment and access local source and credentials available to the Codex process.
Reviewed by Cursor Security Reviewer for commit c2a717f. Configure here.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor auto review
Found 6 actionable issue(s) on changed lines.
The generated repo skill and instincts encode false project conventions that agents will follow. This is a single-package WXT browser extension, not a React monorepo; only the @/ alias exists; and source lives in features/ui/lib/background/entries, not components/services/utils. Fix both SKILL.md copies plus the matching instincts before merge.
Generated automatically when this PR was submitted using Cursor CLI with --model auto.
| - **Architecture**: type-based module organization | ||
| - **Test Location**: colocated | ||
| - **Test Framework**: vitest | ||
|
|
There was a problem hiding this comment.
This is a WXT browser extension (content/background/popup entrypoints, GitHub GraphQL from the page), not a generic React app. Update the tech stack here and in .agents/skills/refined-github-projects/SKILL.md so agents don't scaffold a web app.
|
|
||
| ## Architecture | ||
|
|
||
| ### Project Structure: Monorepo |
There was a problem hiding this comment.
This repo is a single package, not a monorepo (pnpm-workspace.yaml has no packages: workspaces). Relabel it as a single-package WXT extension and apply the same fix to the Codex skill copy.
|
|
||
| ### Guidelines | ||
|
|
||
| - Group code by type (components, services, utils) |
There was a problem hiding this comment.
The repo does not use components/, services/, or utils/. New code goes in src/features/, src/ui/, src/lib/, src/background/, or src/entries/. These guidelines (and the matching instinct) will create the wrong tree.
| | Classes | PascalCase | | ||
| | Constants | SCREAMING_SNAKE_CASE | | ||
|
|
||
| ### Import Style: Path Aliases (@/, ~/) |
There was a problem hiding this comment.
Only @/ is configured (@ → src/ in vitest.config.ts); ~/ is unused. The examples below (@/components/Button, @/hooks/useAuth) do not exist — use @/lib/..., @/ui/..., @/features/....
|
|
||
| ## Action | ||
|
|
||
| Use path aliases (@/, ~/) instead of relative imports |
There was a problem hiding this comment.
This instinct will fire on every import with a false ~/ alias. Restrict it to @/ (maps to src/); there are no ~/ imports in this repo.
|
|
||
| ## Action | ||
|
|
||
| Place code in the appropriate type folder (components/, services/, utils/, etc.) |
There was a problem hiding this comment.
There are no components/, services/, or utils/ folders. Instruct agents to place code in src/features, src/ui, src/lib, src/background, or src/entries instead.
1 participant
Summary
Auto-generated ECC bundle from repository analysis.
What This Does
Merging this PR adds repo-local ECC artifacts for both Claude Code and Codex. The generated bundle captures repository patterns, Codex baseline config, and reusable workflow scaffolds derived from git history analysis.
Analysis Scope
Files
.claude/ecc-tools.json.claude/skills/refined-github-projects/SKILL.md.agents/skills/refined-github-projects/SKILL.md.agents/skills/refined-github-projects/agents/openai.yaml.claude/identity.json.codex/config.toml.codex/AGENTS.md.codex/agents/explorer.toml.codex/agents/reviewer.toml.codex/agents/docs-researcher.toml.claude/homunculus/instincts/inherited/refined-github-projects-instincts.yaml.claude/commands/refactoring.mdOptional: Continuous Learning (12 instincts)
This PR also includes instincts for the continuous-learning-v2 skill. These are optional and only useful if you use that skill.
Import after merging:
Review Checklist
ECC Tools | Everything Claude Code
Summary by cubic
Adds a repository-local ECC bundle to standardize Claude Code and Codex workflows for this repo. Previously we had no ECC artifacts; now we ship a repo skill, a multi-agent Codex baseline, and a
/refactoringworkflow without changing application code..claude/,.agents/, and.codex/configs only; nosrc/changes.approval_policy=on-request,sandbox_mode=workspace-write,multi_agent=truewith Explorer, Reviewer, and Docs Researcher; MCP servers include@modelcontextprotocol/server-github,@upstash/context7-mcp,@modelcontextprotocol/server-memory,@playwright/mcp,@modelcontextprotocol/server-sequential-thinking, andexa.allow_implicit_invocation: trueinopenai.yaml./refactoringscaffold at.claude/commands/refactoring.md..claude/homunculus/instincts/inherited/refined-github-projects-instincts.yamlvia/instinct-import ....Written for commit c2a717f. Summary will update on new commits.