v2.2.2
Added 2
- Add pi/core, a curated Pi-native skills and prompts profile for downstream packagers with 123 curated skills and 24 prompt commands requiring no build step, extensions, hooks, runtime downloads, or network dependencies
- Include compiled OpenCode payload explicitly in the npm package
Changed 7
- Distinguish incomplete memory reads from missing records and classify directory traversal failures in memory MCP
- Accept the reserved _meta parameter on memory MCP ping requests
- Move stable hook metadata into a validated sidecar while keeping hooks.json within Claude Code's schema
- Handle stuck optional values and long-option prefixes in the no-verify guard
- Support Windows linter paths, ESLint 9, and tolerate missing Windows device IDs while retaining full-precision inode checks
- Update lru to 0.18.2 to address RUSTSEC-2026-0253
- Update js-yaml to 4.3.2 to address GHSA-2883-xcg3-v3hh
Removed 1
- Remove Serply and Squish catalog entries
From ECC
ECC 2.2.2
ECC 2.2.2 adds pi/core, a curated Pi-native skills+prompts-only profile built for
downstream packagers that mirror GitHub Releases, plus a set of packaging, memory,
hooks, and Windows compatibility fixes.
Pi core profile
pi/core/ is a self-contained package (ecc-pi-core) that downstream mirrors of the release
tarball can copy directly: no build step, no extensions, no hooks, no runtime
downloads, and no network or SaaS dependencies.
- 123 curated skills (language and framework patterns, testing/TDD, code review, non-offensive security review, planning, refactoring, docs, and git/PR workflows) and 24 prompt commands that are pure prompt workflows.
- Generated deterministically from the explicit include/exclude lists in
manifests/pi-core.jsonbyscripts/build-pi-core.jsand committed, so the release tarball contains it verbatim.pi/core/CURATION.mdlists every excluded skill and command with its reason; thecouncilskill ships asecc-councilinside pi/core to avoid catalog name clashes. - The build fails on safety violations: non-allowlisted URL hosts, pipe-to-shell or fetch-and-run download forms, secrets or tokens, absolute per-user home paths, symlinks, invalid SKILL.md frontmatter, and duplicate skill names.
- CI rebuilds pi/core on every PR and verifies it is up to date, then installs
the Pi coding agent CLI and proves the profile loads fully offline
(
PI_OFFLINE=1), asserting that every curated command actually registers. - The release workflow additionally verifies that
VERSIONmatches the tag and that pi/core is current before publishing.
Downstream consumption: poll /releases, download
archive/refs/tags/vX.Y.Z.tar.gz, pin its sha256, copy pi/core/, and load it
offline with pi --offline --skill pi/core/skills --prompt-template pi/core/commands.
Packaging
- The compiled OpenCode payload is explicitly included in the npm package, and packing is verified from a clean state with lifecycle scripts enabled.
Memory and MCP
- Incomplete memory reads are distinguished from missing records, and directory traversal failures are classified.
- The reserved
_metaparameter is accepted on memory MCP ping requests.
Hooks and Windows compatibility
hooks.jsonstays within Claude Code's schema; stable hook metadata moved into a validated sidecar.- The no-verify guard handles stuck optional values and long-option prefixes.
- Windows linter paths and ESLint 9 are supported, and settings updates tolerate missing Windows device IDs while retaining full-precision inode checks.
Workflow guidance, catalog, and dependency security
- Epic sync filters issues by label; dependency bumps no longer document
auto-merge; naming and Boolean guidance is language-neutral; the
prp-prcommand alias is distinguished; Rails skill discovery, invoice tax calculation order, and framework documentation were corrected; Serply and Squish catalog entries were removed. lruupdated to 0.18.2 (RUSTSEC-2026-0253) andjs-yamlto 4.3.2 (GHSA-2883-xcg3-v3hh).