@eltonssouza/development-utility-kit 0.13.0 → 0.14.1

package/README.md

@@ -24,6 +24,15 @@ npx @eltonssouza/development-utility-kit install
 
 > Run `npx … install` from inside a project folder — not from a drive root.
 
+## Recommended companions
+
+Stands on the best community skills & plugins — recommended, not bundled (the installer prints this too):
+
+- **Impeccable** (frontend design gate) — `npx impeccable skills install`
+- **Caveman** (token-saving output) — `npm install -g @juliusbrussee/caveman-code`
+- **RTK** (token-killer CLI proxy) — `brew install rtk` *(macOS)*
+- **Grill-me** (discovery interview) — `npx skills@latest add mattpocock/skills`
+
 ## What you get
 
 - **18 keyword-triggered skills** + **21 stack-agnostic agents** + stack knowledge packs (Java/Spring, TypeScript/Angular, and more)

package/README.npm.md

@@ -24,6 +24,15 @@ npx @eltonssouza/development-utility-kit install
 
 > Run `npx … install` from inside a project folder — not from a drive root.
 
+## Recommended companions
+
+Stands on the best community skills & plugins — recommended, not bundled (the installer prints this too):
+
+- **Impeccable** (frontend design gate) — `npx impeccable skills install`
+- **Caveman** (token-saving output) — `npm install -g @juliusbrussee/caveman-code`
+- **RTK** (token-killer CLI proxy) — `brew install rtk` *(macOS)*
+- **Grill-me** (discovery interview) — `npx skills@latest add mattpocock/skills`
+
 ## What you get
 
 - **18 keyword-triggered skills** + **21 stack-agnostic agents** + stack knowledge packs (Java/Spring, TypeScript/Angular, and more)

package/README.repo.md

@@ -27,6 +27,17 @@ CLI binary: `duk` · Node `>=18` · License: MIT
 npx @eltonssouza/development-utility-kit install
 ```
 
+### Recommended companions
+
+development-utility-kit stands on the best community skills & plugins. They are **recommended, not bundled** — install the ones you want separately (the npx installer prints this list too). We use them, credit them ([§Acknowledgements](#acknowledgements)), and never re-distribute them.
+
+| Companion | What it adds | Install |
+|---|---|---|
+| **Impeccable** | frontend design gate (polish / audit / critique) — wired into `project-manager` §6.6 | `npx impeccable skills install` |
+| **Caveman** | token-saving telegraphic output (~75% fewer tokens) | `npm install -g @juliusbrussee/caveman-code` |
+| **RTK** | Rust Token Killer CLI proxy (60–90% savings) — powers the dashboard widget | `brew install rtk` *(macOS; see RTK repo for Windows/Linux)* |
+| **Grill-me** | relentless discovery interview (opens the delivery pipeline) | `npx skills@latest add mattpocock/skills` |
+
 ---
 
 ## What it is

package/bin/cli.js

@@ -267,6 +267,31 @@ function harnessVersion() {
   }
 }
 
+// ─── spawn helpers (DEP0190-safe) ─────────────────────────────────────────────
+
+/**
+ * Whether a binary resolves on PATH — cross-platform, no shell (so no DEP0190).
+ * @param {string} bin
+ * @returns {boolean}
+ */
+function isOnPath(bin) {
+  const probe = process.platform === 'win32' ? 'where' : 'which';
+  const r = spawnSync(probe, [bin], { stdio: 'ignore' });
+  return r.status === 0;
+}
+
+/**
+ * Run a TRUSTED, static command line. A shell is needed on Windows to resolve
+ * `.cmd`/`.bat` shims (npm, git, rtk). Passing the command as a SINGLE string
+ * (not args[] + shell:true) avoids Node's DEP0190 warning. Never pass untrusted
+ * input — quote path arguments at the call site.
+ * @param {string} cmd
+ * @param {object} [opts]
+ */
+function runShell(cmd, opts = {}) {
+  return spawnSync(cmd, { shell: true, ...opts });
+}
+
 // ─── adoptProject (install / update) ──────────────────────────────────────────
 
 /**
@@ -432,17 +457,11 @@ function adoptProject(opts) {
   process.stdout.write('Written        : CLAUDE.md\n');
 
   // Auto-install duk globally when running via npx (duk not yet in PATH).
-  const dukCheck = spawnSync('duk', ['--version'], {
-    shell: process.platform === 'win32',
-    stdio: 'ignore',
-  });
-  if (dukCheck.error) {
+  if (!isOnPath('duk')) {
     process.stdout.write('\nInstalling duk CLI globally...\n');
-    const globalInstall = spawnSync(
-      'npm',
-      ['install', '-g', '@eltonssouza/development-utility-kit'],
-      { stdio: 'inherit', shell: process.platform === 'win32' }
-    );
+    const globalInstall = runShell('npm install -g @eltonssouza/development-utility-kit', {
+      stdio: 'inherit',
+    });
     if (globalInstall.status === 0) {
       process.stdout.write('duk installed globally. Run: duk help\n');
     } else {
@@ -450,6 +469,38 @@ function adoptProject(opts) {
       process.stdout.write('  npm install -g @eltonssouza/development-utility-kit\n');
     }
   }
+
+  printCompanionsNotice();
+}
+
+// ─── companion skills/plugins notice ──────────────────────────────────────────
+
+/**
+ * The community skills/plugins the harness builds on. Recommended, not bundled —
+ * each is installed separately by the user (per ADR-010 / Acknowledgements).
+ */
+const COMPANIONS = [
+  { name: 'Impeccable', what: 'frontend design gate (polish / audit / critique)', cmd: 'npx impeccable skills install' },
+  { name: 'Caveman', what: 'token-saving telegraphic output (~75% fewer tokens)', cmd: 'npm install -g @juliusbrussee/caveman-code' },
+  { name: 'RTK', what: 'Rust Token Killer CLI proxy (60-90% savings)', cmd: 'brew install rtk', note: 'macOS; see the RTK repo for Windows/Linux' },
+  { name: 'Grill-me', what: 'relentless discovery interview', cmd: 'npx skills@latest add mattpocock/skills' },
+];
+
+/**
+ * Print the recommended-companions notice after an install. Recommendation
+ * only — never auto-installs (commands span npx / npm -g / brew and are
+ * platform-specific). Credits live in README §Acknowledgements.
+ */
+function printCompanionsNotice() {
+  process.stdout.write('\n' + '─'.repeat(70) + '\n');
+  process.stdout.write('development-utility-kit stands on the best community skills & plugins.\n');
+  process.stdout.write('Recommended companions (install separately, when you want them):\n\n');
+  for (const c of COMPANIONS) {
+    process.stdout.write(`  • ${c.name} — ${c.what}\n`);
+    process.stdout.write(`      ${c.cmd}${c.note ? `   (${c.note})` : ''}\n`);
+  }
+  process.stdout.write('\nWe use them, credit them, and never re-distribute them. See README §Acknowledgements.\n');
+  process.stdout.write('─'.repeat(70) + '\n');
 }
 
 // ─── newProject (duk new <name>) ──────────────────────────────────────────────
@@ -498,10 +549,9 @@ function newProject(name, options) {
   fs.mkdirSync(target, { recursive: true });
 
   // 2. git init (non-fatal if git not installed; warn and continue)
-  const gitResult = spawnSync('git', ['init', '-q'], {
+  const gitResult = runShell('git init -q', {
     cwd: target,
     stdio: 'inherit',
-    shell: process.platform === 'win32',
   });
   if (gitResult.status !== 0) {
     process.stdout.write('Warning: "git init" failed or git is not in PATH. Continuing without git repo.\n');
@@ -675,9 +725,8 @@ function dashboard(passthroughArgs) {
 
   if (!fs.existsSync(nodeModulesDir)) {
     process.stdout.write('Installing dashboard dependencies (first run)...\n');
-    const result = spawnSync('npm', ['install', '--prefix', dashboardDir], {
+    const result = runShell(`npm install --prefix "${dashboardDir}"`, {
       stdio: 'inherit',
-      shell: process.platform === 'win32',
     });
     if (result.status !== 0) {
       process.stderr.write('Error: npm install failed for dashboard dependencies.\n');
@@ -686,8 +735,7 @@ function dashboard(passthroughArgs) {
   }
 
   // FR-008: print rtk gain output before starting the server
-  const rtkResult = spawnSync('rtk', ['gain'], {
-    shell: process.platform === 'win32',
+  const rtkResult = runShell('rtk gain', {
     stdio: ['ignore', 'pipe', 'ignore'],
   });
   if (rtkResult.status === 0 && rtkResult.stdout && rtkResult.stdout.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eltonssouza/development-utility-kit",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "npx installer for the development-utility-kit harness",
   "bin": {
     "duk": "bin/cli.js"