$ show affaan-m/ECC
ECC (Everything Claude Code) is a comprehensive meta-harness toolkit for AI coding assistants. It provides a universal install system, lifecycle hooks, skill management, multi-agent orchestration, evaluation harnesses, and safety validation across multiple agent IDEs (Claude Code, Codex, Cursor, Gemini, OpenCode, and others). The codebase is primarily a Node.js CLI application (published as `ecc-universal`) with secondary Python and Rust components. It includes a sophisticated hook engine (pre/post bash, session lifecycle, tool use), a manifest-driven installer with ownership tracking and path-safety guards, an eval-harness framework with deterministic replay and effect-class isolation, a skill evolution system with provenance tracking, and a multi-agent proximity coordination system. The repository also bundles a large collection of domain-specific skills (video production, compliance checking, visa document translation, financial market data) and extensive documentation translated into multiple languages. While the core architecture is well-structured and demonstrates high craftsmanship in security-critical components, the codebase suffers from some duplication (e.g., taste-application/taste-distillation skills), legacy shims, and a sprawling surface area that increases maintenance burden. The Rust TUI control-plane (`ecc2/`) is explicitly alpha. Overall, it is a production-grade, actively maintained platform with strong engineering practices in its core modules.
The LLM identified 8 files worth highlighting for reuse:
Provides `assertWithinTrustedRoot()` and `isWithinRoot()` using realpath-based canonicalization to prevent symlink escapes and path traversal attacks. Reusable across any Node.js project needing file operation containment. Demonstrates non-obvious handling of non-existent paths via `realpathNearestExisting` and single-canonicalization guarantee.
Implements canonical JSON serialization with deterministic key ordering, `__proto__` preservation, and SHA-256 hashing. Used across the eval harness for content-addressed receipts and append-only journals. Extractable as a standalone utility for any system requiring reproducible JSON digests.
Secure atomic file write using temp-file + rename pattern with parent-directory validation and TOCTOU hardening. Handles Windows retry logic. A clean, isolated utility that can be dropped into any Node.js project needing crash-safe file writes.
Host/Origin allowlist guard for local loopback HTTP servers, preventing DNS-rebinding attacks. Used by the control pane and plan canvas servers. Reusable pattern for any local web server that should only accept requests from localhost.
Implements a capability disclosure and consent system for hook installation. Validates plan materialization, checks consent flags, and prevents unauthorized hook activation. A well-encapsulated module that could be adapted for any plugin system requiring user consent before enabling capabilities.
Computes multi-channel proximity metrics (tree overlap, line overlap, dependency graph distance) between AI agents for collision avoidance. Includes rolling-window z-score normalization and PCA projection. A novel pattern for multi-agent coordination that could be reused in any agent-based system.
Atomic cross-process state sharing via tmp+rename JSON files. Used to pass session metrics between Claude Code and hooks without shared memory. Includes Windows retry logic and unique-tmp-file-per-write to mitigate concurrent writer races. A clean IPC pattern for lightweight process coordination.
Zero-dependency Python trust adapter for counterparty DID reputation lookup. Uses only stdlib, fails closed on network errors, and supports injectable HTTP fetch for testing. A model of minimal, secure integration code that can be extracted for any reputation-based system.