feat: add voltagent ECC bundle - #3
Open
ecc-tools[bot] wants to merge 11 commits into
Open
Conversation
…d/voltagent-instincts.yaml)
5 tasks
📝 WalkthroughWalkthroughAdds Voltagent development guidance, generated repository instincts, Claude metadata, and Codex configuration for MCP integrations and read-only multi-agent roles. ChangesVoltagent tooling setup
Estimated code review effort: 2 (Simple) | ~15 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (11 files)
Reviewed by nemotron-3-ultra-550b-a55b:free · Input: 162.8K · Output: 2.2K · Cached: 2.8K |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/voltagent/SKILL.md:
- Around line 72-79: Align the command guidance with the registered adapters by
updating the “Commands” sections in .agents/skills/voltagent/SKILL.md lines
72-79 and .claude/skills/voltagent/SKILL.md lines 72-79: either register all
listed slash commands in the relevant adapter configuration or rename the
sections to describe suggested workflows rather than executable commands,
applying the same correction to both copies.
- Line 1: Remove the outer opening and closing Markdown fences from both
generated skill copies: .agents/skills/voltagent/SKILL.md at lines 1 and 80, and
.claude/skills/voltagent/SKILL.md at lines 1 and 80. Preserve all inner Markdown
fences and the remaining document content unchanged.
In @.claude/homunculus/instincts/inherited/voltagent-instincts.yaml:
- Around line 14-25: Convert the “Voltagent Commit Length” instinct block into
valid YAML by placing its title, action, and evidence under explicit YAML keys
or a block scalar. Ensure the unkeyed Markdown content is no longer parsed as
top-level YAML and the entire file remains parseable.
In @.codex/config.toml:
- Around line 12-14: Update the MCP server entries in .codex/config.toml for
github, context7, memory, playwright, and sequential-thinking to use exact
immutable package versions instead of `@latest` or versionless package references,
while preserving their existing commands and server configuration.
- Around line 4-5: The baseline configuration and its safety documentation make
an overbroad “ECC-safe” claim. In .codex/config.toml, tighten the default
sandbox policy from workspace-write or otherwise restrict the baseline; in
.codex/AGENTS.md, revise the safety claim to explicitly require trusted external
MCP/browser integrations and acknowledge their potential side effects.
- Around line 8-10: Update the [mcp_servers.github] configuration to use a
maintained GitHub MCP server instead of `@modelcontextprotocol/server-github`,
preserving the existing command/argument structure as appropriate. Configure
only the minimum required GitHub credentials and tool permissions for this
server, and keep the GitHub MCP entry’s access scope restricted.
- Around line 23-25: Remove the --extension argument from the
mcp_servers.playwright configuration in the repository baseline
.codex/config.toml, leaving the default Playwright MCP setup intact;
browser-extension mode must be configured only through a user-specific or
explicitly opt-in profile.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0be22ca3-3520-4aaf-93f2-9f03acec340c
📒 Files selected for processing (11)
.agents/skills/voltagent/SKILL.md.agents/skills/voltagent/agents/openai.yaml.claude/ecc-tools.json.claude/homunculus/instincts/inherited/voltagent-instincts.yaml.claude/identity.json.claude/skills/voltagent/SKILL.md.codex/AGENTS.md.codex/agents/docs-researcher.toml.codex/agents/explorer.toml.codex/agents/reviewer.toml.codex/config.toml
| @@ -0,0 +1,80 @@ | |||
| ```markdown | |||
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Remove the outer Markdown fence from both generated skill copies. The top-level fence conflicts with nested fences and prevents the files from being valid, normally rendered Markdown.
.agents/skills/voltagent/SKILL.md#L1-L1: remove the opening```markdown..agents/skills/voltagent/SKILL.md#L80-L80: remove the matching closing fence..claude/skills/voltagent/SKILL.md#L1-L1: remove the opening```markdown..claude/skills/voltagent/SKILL.md#L80-L80: remove the matching closing fence.
📍 Affects 2 files
.agents/skills/voltagent/SKILL.md#L1-L1(this comment).agents/skills/voltagent/SKILL.md#L80-L80.claude/skills/voltagent/SKILL.md#L1-L1.claude/skills/voltagent/SKILL.md#L80-L80
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/voltagent/SKILL.md at line 1, Remove the outer opening and
closing Markdown fences from both generated skill copies:
.agents/skills/voltagent/SKILL.md at lines 1 and 80, and
.claude/skills/voltagent/SKILL.md at lines 1 and 80. Preserve all inner Markdown
fences and the remaining document content unchanged.
Source: Linters/SAST tools
Comment on lines
+72
to
+79
| ## Commands | ||
|
|
||
| | Command | Purpose | | ||
| |-----------------|----------------------------------------------| | ||
| | /test | Run all test files matching *.test.* | | ||
| | /lint | Lint the codebase for style consistency | | ||
| | /docs-update | Update documentation files | | ||
| | /example-update | Add or update usage examples | |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align the command guidance with the registered adapters. Both generated skills advertise slash commands, but .claude/ecc-tools.json has no Claude command paths.
.agents/skills/voltagent/SKILL.md#L72-L79: register the listed commands or rename the section as suggested workflows..claude/skills/voltagent/SKILL.md#L72-L79: apply the same correction to the Claude-facing copy.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 79-79: Tables should be surrounded by blank lines
(MD058, blanks-around-tables)
📍 Affects 2 files
.agents/skills/voltagent/SKILL.md#L72-L79(this comment).claude/skills/voltagent/SKILL.md#L72-L79
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/voltagent/SKILL.md around lines 72 - 79, Align the command
guidance with the registered adapters by updating the “Commands” sections in
.agents/skills/voltagent/SKILL.md lines 72-79 and
.claude/skills/voltagent/SKILL.md lines 72-79: either register all listed slash
commands in the relevant adapter configuration or rename the sections to
describe suggested workflows rather than executable commands, applying the same
correction to both copies.
Comment on lines
+14
to
+25
| --- | ||
|
|
||
| # Voltagent Commit Length | ||
|
|
||
| ## Action | ||
|
|
||
| Write moderate-length commit messages (~67 characters) | ||
|
|
||
| ## Evidence | ||
|
|
||
| - Average commit message length: 67 chars | ||
| - Based on 2 commits |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
python - <<'PY'
from pathlib import Path
import yaml
path = Path(".claude/homunculus/instincts/inherited/voltagent-instincts.yaml")
list(yaml.safe_load_all(path.read_text(encoding="utf-8")))
print("valid YAML")
PYRepository: nilhemdot/voltagent
Length of output: 1184
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".claude/homunculus/instincts/inherited/voltagent-instincts.yaml"
printf '== file size ==\n'
wc -l "$file"
printf '\n== numbered excerpt ==\n'
sed -n '1,80p' "$file" | cat -n
printf '\n== nearby sibling files ==\n'
fd -t f .claude/homunculus/instincts -a
printf '\n== search for yaml parsing / loading ==\n'
rg -n "safe_load_all|yaml|front matter|instincts" .claude/homunculus -SRepository: nilhemdot/voltagent
Length of output: 2856
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== parse consumer search ==\n'
rg -n "safe_load_all|safe_load|load_all|yaml\.|instincts" . -S
printf '\n== full file structure around later instincts ==\n'
sed -n '80,180p' .claude/homunculus/instincts/inherited/voltagent-instincts.yaml | cat -n
printf '\n== scan for similar bundle format files ==\n'
fd -t f '*.yaml' .claude/homunculus | xargs -I{} sh -c 'printf "\nFILE: %s\n" "{}"; sed -n "1,20p" "{}" | cat -n'Repository: nilhemdot/voltagent
Length of output: 3080
Convert each instinct block into valid YAML. The file mixes YAML documents with raw Markdown, so the second document starts with an unkeyed list item and the parser fails at line 24. Store each instinct as YAML fields or under a block scalar.
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 24-24: syntax error: expected '', but found ''
(syntax)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/homunculus/instincts/inherited/voltagent-instincts.yaml around lines
14 - 25, Convert the “Voltagent Commit Length” instinct block into valid YAML by
placing its title, action, and evidence under explicit YAML keys or a block
scalar. Ensure the unkeyed Markdown content is no longer parsed as top-level
YAML and the entire file remains parseable.
Source: Linters/SAST tools
Comment on lines
+4
to
+5
| approval_policy = "on-request" | ||
| sandbox_mode = "workspace-write" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## .codex/config.toml\n'
cat -n .codex/config.toml
printf '\n## .codex/AGENTS.md\n'
cat -n .codex/AGENTS.mdRepository: nilhemdot/voltagent
Length of output: 2871
Tighten the baseline or reword the safety claim.
.codex/config.toml still allows workspace-write under on-request, and the repo-local docs call that setup “ECC-safe” while also enabling external MCP/browser integrations. Either make the default more restrictive or qualify the docs with the trust and side-effect requirements.
📍 Affects 2 files
.codex/config.toml#L4-L5(this comment).codex/AGENTS.md#L13-L14
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.codex/config.toml around lines 4 - 5, The baseline configuration and its
safety documentation make an overbroad “ECC-safe” claim. In .codex/config.toml,
tighten the default sandbox policy from workspace-write or otherwise restrict
the baseline; in .codex/AGENTS.md, revise the safety claim to explicitly require
trusted external MCP/browser integrations and acknowledge their potential side
effects.
Comment on lines
+8
to
+10
| [mcp_servers.github] | ||
| command = "npx" | ||
| args = ["-y", "@modelcontextprotocol/server-github"] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
npm view `@modelcontextprotocol/server-github` version deprecated repository.url --json
rg -n 'GITHUB_PERSONAL_ACCESS_TOKEN|env_vars|read-only|toolsets' .codex/config.tomlRepository: nilhemdot/voltagent
Length of output: 446
Replace the deprecated GitHub MCP server. @modelcontextprotocol/server-github is deprecated and no longer supported; swap it for a maintained GitHub MCP server, and keep credentials/tool access scoped to the minimum needed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.codex/config.toml around lines 8 - 10, Update the [mcp_servers.github]
configuration to use a maintained GitHub MCP server instead of
`@modelcontextprotocol/server-github`, preserving the existing command/argument
structure as appropriate. Configure only the minimum required GitHub credentials
and tool permissions for this server, and keep the GitHub MCP entry’s access
scope restricted.
Comment on lines
+12
to
+14
| [mcp_servers.context7] | ||
| command = "npx" | ||
| args = ["-y", "@upstash/context7-mcp@latest"] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== .codex/config.toml ==\n'
cat -n .codex/config.toml
printf '\n== MCP server entries ==\n'
rg -n '^\[mcp_servers|command\s*=|args\s*=' .codex/config.tomlRepository: nilhemdot/voltagent
Length of output: 2333
Pin the MCP package versions. The npx -y entries in .codex/config.toml all fetch mutable package contents at run time; @latest makes that explicit, and the versionless entries are just as unpinned. Use exact versions (or another immutable distribution) for the github, context7, memory, playwright, and sequential-thinking servers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.codex/config.toml around lines 12 - 14, Update the MCP server entries in
.codex/config.toml for github, context7, memory, playwright, and
sequential-thinking to use exact immutable package versions instead of `@latest`
or versionless package references, while preserving their existing commands and
server configuration.
Comment on lines
+23
to
+25
| [mcp_servers.playwright] | ||
| command = "npx" | ||
| args = ["-y", "@playwright/mcp@latest", "--extension"] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- .codex/config.toml ---\n'
cat -n .codex/config.toml | sed -n '1,120p'
printf '\n--- Playwright references ---\n'
rg -n --hidden --glob '!**/.git/**' -S 'playwright|mcp_servers|--extension|browser profile|read-only|sandbox' .Repository: nilhemdot/voltagent
Length of output: 248
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .codex/config.toml || true
printf '\n--- file contents ---\n'
cat -n .codex/config.toml | sed -n '1,120p'
printf '\n--- search ---\n'
rg -n --hidden --glob '!**/.git/**' -S 'playwright|mcp_servers|--extension' .codex . 2>/dev/null || trueRepository: nilhemdot/voltagent
Length of output: 45511
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- .codex/AGENTS.md ---'
cat -n .codex/AGENTS.md | sed -n '1,120p'
printf '\n%s\n' '--- Playwright MCP docs search ---'
python3 - <<'PY'
import urllib.request, urllib.parse, json, sys
queries = [
"Playwright MCP --extension existing browser tabs cookies sessions",
"`@playwright/mcp` --extension documentation",
"site:github.com/microsoft/playwright mcp extension cookies sessions"
]
for q in queries:
print(f"\nQUERY: {q}")
url = "https://duckduckgo.com/html/?" + urllib.parse.urlencode({"q": q})
try:
with urllib.request.urlopen(url, timeout=20) as resp:
html = resp.read().decode("utf-8", "ignore")
# crude extraction of first few result titles/snippets
import re
results = re.findall(r'nofollow" class="result__a" href="[^"]+">([^<]+)</a>.*?result__snippet">([^<]+)</a>', html, re.S)
print("results:", len(results))
for title, snippet in results[:5]:
print("-", re.sub(r"\s+", " ", title).strip())
print(" ", re.sub(r"\s+", " ", snippet).strip())
except Exception as e:
print("search failed:", e)
PYRepository: nilhemdot/voltagent
Length of output: 1952
Make browser-extension mode opt-in.
.codex/config.toml is the repo baseline, so enabling --extension here exposes browser tabs, cookies, and sessions for every checkout. Keep it in ~/.codex/config.toml or another explicit opt-in profile.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.codex/config.toml around lines 23 - 25, Remove the --extension argument
from the mcp_servers.playwright configuration in the repository baseline
.codex/config.toml, leaving the default Playwright MCP setup intact;
browser-extension mode must be configured only through a user-specific or
explicitly opt-in profile.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Auto-generated ECC bundle from repository analysis.
What This Does
Merging this PR adds repo-local ECC artifacts for both Claude Code and Codex. The generated bundle captures repository patterns, Codex baseline config, and reusable workflow scaffolds derived from git history analysis.
Analysis Scope
Files
.claude/ecc-tools.json.claude/skills/voltagent/SKILL.md.agents/skills/voltagent/SKILL.md.agents/skills/voltagent/agents/openai.yaml.claude/identity.json.codex/config.toml.codex/AGENTS.md.codex/agents/explorer.toml.codex/agents/reviewer.toml.codex/agents/docs-researcher.toml.claude/homunculus/instincts/inherited/voltagent-instincts.yamlOptional: Continuous Learning (15 instincts)
This PR also includes instincts for the continuous-learning-v2 skill. These are optional and only useful if you use that skill.
Import after merging:
Review Checklist
ECC Tools | Everything Claude Code
Summary by CodeRabbit
Documentation
Configuration