Affaan Mustafa a8295c6bf7 fix: harden local data boundaries ...

Bind the capabilities dashboard exclusively to loopback and reject untrusted Host and Origin values. Constrain project-configured agent data paths to the Cursor data root, and harden lifecycle repair/uninstall operations against state-file traversal, symlink swaps, unsafe sources, and forged install-state destinations.\n\nCloses #2506

2026-07-26 04:51:12 -04:00

..

agent-compress.test.js

chore: reconcile publish/agent surfaces after PR batch

2026-06-15 14:21:28 -04:00

agent-data-home.test.js

fix: harden local data boundaries

2026-07-26 04:51:12 -04:00

agent-proximity.test.js

feat(layer4): line-range channel + trigger firing

2026-06-20 17:30:52 -04:00

changed-files-store.test.js

…

command-plugin-root.test.js

fix(resolve-ecc-root): require ECC skills, not just scripts, before accepting a root (#2544) (#2577)

2026-07-25 22:21:27 -07:00

control-pane-actions.test.js

feat: add ECC2 local control pane (#2131)

2026-06-03 21:54:30 +08:00

control-pane-message-sink.test.js

feat(layer4): live messages-table wiring for proximity triggers

2026-06-20 20:49:17 -04:00

control-pane-proximity.test.js

feat(layer4): live messages-table wiring for proximity triggers

2026-06-20 20:49:17 -04:00

control-pane-state.test.js

feat(control-pane): add agent+human JIT assignment view to the work-items board

2026-06-18 16:59:30 -04:00

cost-estimate.test.js

…

dry-run.test.js

fix(hooks): preserve Stop output through lifecycle wrappers (#2493)

2026-07-26 00:01:57 -07:00

github-coordination.test.js

fix: address second round of code-review findings

2026-06-11 14:25:58 -04:00

inspection.test.js

…

install-config.test.js

…

install-executor.test.js

fix(install): dedupe copy-file operations sharing a destination (#2429)

2026-07-03 20:37:32 -07:00

install-lifecycle.test.js

fix: harden local data boundaries

2026-07-26 04:51:12 -04:00

install-link-rewrite.test.js

fix(install): rewrite relative skill links for injected ecc namespace (#2399)

2026-07-03 20:39:24 -07:00

install-manifests.test.js

…

install-request.test.js

…

install-state.test.js

…

install-targets.test.js

fix(repair): build opencode payload so repair clears doctor's opencode-plugin-not-built warning (#2414) (#2438)

2026-07-08 17:14:33 -04:00

llm-summary.test.js

fix(tests): use mkdtempSync for test scratch dirs (CodeQL js/insecure-temporary-file) (#2443)

2026-07-04 13:44:27 -07:00

locale-install.test.js

…

loopback-guard.test.js

fix: harden local data boundaries

2026-07-26 04:51:12 -04:00

mcp-config.test.js

…

mcp-inventory.test.js

feat: MCP inventory (ecc.mcp.v1) — unified cross-harness MCP config view (#2146)

2026-06-06 03:55:17 +08:00

observer-sessions.test.js

…

orchestration-session.test.js

…

package-manager.test.js

fix(scripts): detect modern bun.lock, ignore stray root lockfiles

2026-07-19 19:39:23 +02:00

path-safety.test.js

fix: harden local data boundaries

2026-07-26 04:51:12 -04:00

plan-canvas-markdown.test.js

fix(plan-canvas): stop dropping list items when a block's first item is over-indented (#2501)

2026-07-17 17:10:58 -04:00

plan-canvas-sessions.test.js

feat: Plan Canvas, a browser review canvas for plans (#2467)

2026-07-08 17:12:48 -04:00

project-detect.test.js

fix(project-detect): parse Python deps pinned with ~ and @ (was losing framework detection on compatible-release pins) (#2498)

2026-07-17 17:11:09 -04:00

resolve-ecc-root.test.js

fix(resolve-ecc-root): require ECC skills, not just scripts, before accepting a root (#2544) (#2577)

2026-07-25 22:21:27 -07:00

resolve-formatter.test.js

…

selective-install.test.js

…

session-adapters-codex.test.js

feat: extend session-adapter layer with codex-worktree + opencode adapters (#2145)

2026-06-06 03:55:00 +08:00

session-adapters-opencode.test.js

feat: extend session-adapter layer with codex-worktree + opencode adapters (#2145)

2026-06-06 03:55:00 +08:00

session-adapters.test.js

…

session-aliases.test.js

test: skip chmod-based permission tests when running as root (#2171)

2026-06-07 13:25:53 +08:00

session-bridge.test.js

…

session-manager.test.js

refactor: consolidate duplicated hook-root resolver into shared resolveEccRoot() (#2368) (#2410)

2026-07-03 20:01:17 -07:00

shell-split.test.js

…

skill-dashboard.test.js

…

skill-evolution.test.js

…

skill-improvement.test.js

…

state-store.test.js

…

tmux-worktree-orchestrator.test.js

…

transcript-context.test.js

fix(suggest-compact): recognize large-window model families without a [1m] marker (#2468)

2026-07-22 12:17:11 -04:00

utils.test.js

feat: Cursor-independent ECC memory via ECC_AGENT_DATA_HOME (#2066)

2026-06-07 13:27:00 +08:00

worktree-lifecycle.test.js

feat: worktree-lifecycle service (deterministic conflict prediction + safe GC) (#2164)

2026-06-07 13:00:08 +08:00