affaan-m/ecc
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
How ecc is put together
ECC ('ecc-universal') is a harness-native agent operating system distributed as an npm package (v2.2.0) plus a small Python sub-package ('llm-abstraction'). It provides skills (~200+ directories under skills/), agent prompt definitions (agents/*.md), slash commands (commands/*.md), lifecycle hooks, and MCP conventions that plug into multiple AI coding harnesses (Claude Code, Codex, Cursor, Gemini, OpenCode, Zed, Kimi, Qwen, etc.) via per-harness adapter directories (.claude-plugin/, .codex/, .cursor/, .opencode/, .gemini/). The primary language is JavaScript/Node.js (>=18) with CommonJS CLI scripts under scripts/ exposed as six bin entries (ecc, ecc-control-pane, ecc-install, ecc-memory-mcp, ecc-plan-canvas, ecc-universal); a TypeScript OpenCode plugin lives under .opencode/, and a provider-agnostic LLM abstraction layer (Python 3.11+, anthropic/openai SDKs) is defined in pyproject.toml. There is no server-side datastore; state is file-based, with sql.js (WASM SQLite) available for local tooling and hooks executing locally after the host CLI starts.
Languages
Frameworks
Infrastructure
Major components
CLI entrypoints (scripts/ecc.js and bin shims)
Implements the 'ecc' command-line interface dispatching subcommands such as doctor, status, repair, setup, feedback, auto-update, sessions, and orchestration.
Installer subsystem
Plans and applies ECC installation into user projects via scripts/install-plan.js, install-guided.js, install-apply.js, uninstall.js, and cross-platform install.sh/install.ps1.
Hooks engine
Provides lifecycle hook scripts (hooks/, scripts/hooks/) executed by host CLIs on events like session start/end, file edits, and tool executions.
Skills library (skills/*)
Ships 200+ self-contained skill packages covering coding patterns, testing, security review, compliance, and domain operations.
Agent and command definitions
Markdown-defined agents (agents/*.md, e.g. security-reviewer, code-reviewer) and slash commands (commands/*.md) consumed by the host harnesses.
OpenCode plugin package (.opencode/)
TypeScript plugin exporting ECCHooksPlugin with hook events and custom tools (run-tests, check-coverage, security-audit, format-code, lint-check, git-summary).
Memory/MCP services
Provides local memory persistence and an stdio MCP server (scripts/memory.js, scripts/memory-mcp.mjs) plus plan-canvas tooling.
Control plane, dashboards, and CI audits
Operator control pane and web dashboards (control-pane.js, dashboard-web.js, ecc_dashboard.py) plus CI supply-chain IOC scanning (scripts/ci/scan-supply-chain-iocs.js) and various audit/readiness scripts.
A quiet week focused on landing the new TasteForge multimodal video skill through a single pull request.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A quiet week focused on landing the new TasteForge multimodal video skill through a single pull request.
Week of 2026-08-10
The busiest week of the month: a major installer security and reliability overhaul for Windows shipped alongside new Nasiko control-plane integration.
Week of 2026-08-03
Itô market-intelligence skills got a wave of hardening fixes while Discord delivery, a guided multi-harness installer, and several security patches landed.
Week of 2026-07-27
Version 2.1 shipped with a fully refreshed README, a cost-tracker accuracy fix, and a batch of stability improvements across hooks, agents, and the dashboard.
Week of 2026-07-20
Itō compute integration took center stage with sponsor routing and guarded live-node access, while a cross-harness memory vault and many contributor bug fixes landed.
Over the past month, ECC's development has centered on shipping and hardening a growing family of 'Itô' market-intelligence skills, alongside a major installer overhaul that closed numerous security and reliability gaps on Windows. The team also released version 2.1 with a refreshed README, added cross-harness features like a shared memory vault, and fixed dozens of delivery, hook, and dependency issues. The most recent week was quieter, focused on finalizing a new TasteForge multimodal video skill.
Week by week
2026-08-17A quiet week focused on landing the new TasteForge multimodal video skill through a single pull request.latest4 changes
Feature
New TasteForge video skill
Added a skill that supports repeatable, taste-driven video work.
Docs
TasteForge contract documented
Wrote down the rules for how the multimodal skill should behave so future changes stay consistent.
Fix
TasteForge contract hardened
Tightened the skill's contract to prevent edge-case failures before merging it into main.
Chore
TasteForge tests aligned
Updated the skill's tests to match its final agreed-upon behavior.
2026-08-10The busiest week of the month: a major installer security and reliability overhaul for Windows shipped alongside new Nasiko control-plane integration.6 changes
Fix
Installer lifecycle hardened
Closed a series of filesystem race conditions and enforced no-follow security semantics so the installer can't be tricked by malicious file links on Windows.
Fix
Safer installs and uninstalls
Interrupted migrations now roll back cleanly, quarantined files are closed before removal, and user-modified paths are preserved during uninstall.
Feature
Nasiko control-plane bridge
Added a pinned integration connecting ECC to the Nasiko control plane, with hardened artifact lifecycle handling and Windows CI fixes.
Feature
Itô skills consolidated
Merged scattered Itô market skills into a single 'ito-baskets' package with stricter fail-closed training behavior.
Feature
Pi adapter support
Added a lightweight adapter that lets the Pi harness mount ECC's canonical skills and commands.
Docs
README refresh
Surfaced self-hosting documentation and added star-history badges and a chart to the project README.
2026-08-03Itô market-intelligence skills got a wave of hardening fixes while Discord delivery, a guided multi-harness installer, and several security patches landed.6 changes
Fix
Itô skills hardened end-to-end
Fixed safety contracts in the trade planner, basket comparison, device authentication, live data reads, and inference serving across the Itô skill suite.
Feature
Guided multi-harness installer
Added an installer that walks users through setting up ECC across multiple AI coding tools, plus a hardened Docker test harness.
Fix
Discord announcements delivered
ECC announcements now reliably reach Discord through a scoped webhook with dependable delivery receipts.
Fix
Plan Canvas chat fix
Browser-based chat messages are now always delivered to the agent, even when site data is blocked.
Fix
Security dependency bumps
Updated tar, fast-uri, brace-expansion, and other dependencies to patch known vulnerabilities.
Feature
Secure terminal opener
Added a new skill that safely opens terminal sessions.
2026-07-27Version 2.1 shipped with a fully refreshed README, a cost-tracker accuracy fix, and a batch of stability improvements across hooks, agents, and the dashboard.5 changes
Docs
README refreshed for 2.1
Restructured the project README with clearer install instructions, updated section titles, and 2.1.0 release notes with demo assets.
Fix
Cost tracker no longer overcounts
Fixed duplicate counting that inflated reported token costs by roughly 2.5-3x by deduplicating usage records.
Fix
Dashboard boundaries hardened
Tightened security around the local dashboard and its data access boundaries.
Fix
Aura rejects history-free agents
Agents without conversation history are now rejected by default to avoid unpredictable behavior.
Chore
Plugin bumped to 2.1.0
Release tooling updates ensured marketplace listings, banners, and manifests all reflect the new version correctly.
2026-07-20Itō compute integration took center stage with sponsor routing and guarded live-node access, while a cross-harness memory vault and many contributor bug fixes landed.6 changes
Feature
Cross-harness memory vault
Added a shared memory store that works across different AI coding tools, with a roadmap for deeper control-plane integration.
Feature
Itō compute connection
Connected ECC to the canonical Itō compute CLI with read-only handoff, credential-shim rejection, and guarded live-node qualification.
Docs
Sponsors and branding updated
Updated sponsor information (Itō, Moonshot AI/Kimi, Atlas Cloud), centered entry cards, and applied the official Itō logo.
Fix
Secret scanning improved
Pre-commit checks now detect Anthropic API keys (sk-ant-...) to prevent accidental credential commits.
Fix
Observer daemon repaired
Fixed the background analysis daemon failing to boot due to a stale name reference.
Fix
Community bug fixes merged
Merged external contributions fixing OpenCode command scope, Bun lockfile detection, and dashboard refresh rules.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 212 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required