@ngockhoale/ukit 1.1.6

package/templates/.codex/settings.json

@@ -0,0 +1,187 @@
+{
+  "profile": "ukit-codex-safe-auto",
+  "version": 2,
+  "packageManager": "{{runtime.packageManager}}",
+  "indexCache": {
+    "strategy": "index-first",
+    "directory": ".cache/index",
+    "artifacts": [
+      "files.json",
+      "symbols.json",
+      "imports.json",
+      "tests-map.json",
+      "hotspots.json",
+      "archetypes.json",
+      "relations.json",
+      "analogs.json"
+    ],
+    "freshnessMaxAgeHours": 24,
+    "whenMissingOrStale": [
+      "node .codex/ukit/index/refresh-index.mjs",
+      "fallback: node .codex/ukit/index/build-index.mjs"
+    ],
+    "triageFlow": [
+      "node .codex/ukit/index/query-index.mjs \"<error|symbol|path>\"",
+      "node .codex/ukit/index/triage.mjs \"<error signature>\"",
+      "open top 1-3 ranked files first",
+      "if analogs found, open 1 analog for pattern reference"
+    ]
+  },
+  "analogRetrieval": {
+    "enabled": true,
+    "contextResolverCommand": "node .codex/ukit/index/resolve-context.mjs \"<intent>\" [--target <file>]",
+    "maxAnalogFiles": 3,
+    "maxSharedAbstractions": 2,
+    "contextBudgetByTier": {
+      "trivial": { "minFiles": 1, "maxFiles": 2 },
+      "simple": { "minFiles": 2, "maxFiles": 5 },
+      "non-trivial": { "minFiles": 4, "maxFiles": 8 }
+    }
+  },
+  "skillRouter": {
+    "autoActivateOnPromptOrToolSignals": true,
+    "helperCommand": "node .codex/ukit/index/route-task.mjs \"<prompt>\" [--tool-command <cmd>] [--target <file>] [--type trivial|simple|non-trivial]",
+    "preferHelperForComplexRouting": true,
+    "sharedStateFile": ".claude/ukit/skill-router-state.json",
+    "rescanAfterFirstRelevantToolCalls": true,
+    "preferToolEvidenceAfterPrompt": true,
+    "maxActiveSkills": 2,
+    "suppressDuplicateRoutingWithinMinutes": 10,
+    "promptSignals": {
+      "review": [
+        "code-review"
+      ],
+      "debug": [
+        "debugging-toolkit"
+      ],
+      "testing": [
+        "testing-quality"
+      ],
+      "documentation": [
+        "docs-quality"
+      ],
+      "security": [
+        "discover-security"
+      ],
+      "maintenance": [
+        "repo-maintenance"
+      ]
+    },
+    "toolSignals": {
+      "bashTriage": [
+        "debugging-toolkit"
+      ],
+      "bashTest": [
+        "testing-quality"
+      ],
+      "writeOrEditDocs": [
+        "docs-quality"
+      ],
+      "editDocs": [
+        "docs-quality"
+      ],
+      "editRiskyBoundary": [
+        "discover-security"
+      ],
+      "installOrRefresh": [
+        "repo-maintenance"
+      ]
+    },
+    "routingRule": {
+      "endUserShouldNotNeedSkillNames": true,
+      "selectSmallestUsefulSkillSet": true
+    },
+    "delegationBridge": {
+      "enabled": true,
+      "sharedStateField": "routeSummary.delegateHint",
+      "displaySummaryField": "routeSummary.line",
+      "structuredLaneFields": [
+        "routeSummary.nextActionType",
+        "routeSummary.nextActionCommand",
+        "routeSummary.helperHint",
+        "routeSummary.policyMode"
+      ],
+      "preferIndexFirstBeforeDelegating": true,
+      "treatHintAsInternalOnly": true
+    },
+    "contextBridge": {
+      "enabled": true,
+      "preferRecentContextRecommendation": true,
+      "resolverCommand": "node .codex/ukit/index/resolve-context.mjs \"<intent>\" [--target <file>] [--type trivial|simple|non-trivial]",
+      "includeStyleFiles": true
+    },
+    "verificationBridge": {
+      "enabled": true,
+      "preferTargetedVerificationFromContext": true,
+      "helperCommand": "node .codex/ukit/index/verify-context.mjs \"<intent>\" [--target <file>] [--type trivial|simple|non-trivial]",
+      "expandForRiskySkills": [
+        "discover-security",
+        "repo-maintenance"
+      ],
+      "docsOnlyCanSkipBroadTests": true,
+      "executionPolicy": {
+        "autoRunTargetedVerificationWhenSafe": true,
+        "enforceTargetedBeforeBroadWhenLocalized": true,
+        "preserveLastExplicitPromptAcrossToolSignals": true,
+        "autoRunFallbacksWhen": [
+          "sharedScope",
+          "riskySkillOrTask"
+        ],
+        "askBeforeBroadVerificationWithoutRelatedTests": true,
+        "preferCommandOrderFromVerificationPlan": true
+      }
+    }
+  },
+  "execution": {
+    "mode": "auto-with-guardrails",
+    "riskTiers": {
+      "low": {
+        "autoAllow": [
+          "read",
+          "search",
+          "lint",
+          "test",
+          "typecheck",
+          "git status",
+          "git diff",
+          "git log"
+        ]
+      },
+      "medium": {
+        "autoAllowInWorkspaceOnly": [
+          "build",
+          "format",
+        "safe file writes"
+        ]
+      },
+      "high": {
+        "alwaysAsk": [
+          "git push",
+          "force push",
+          "reset --hard",
+          "delete recursive",
+          "database migration",
+          "system-wide changes"
+        ]
+      }
+    }
+  },
+  "decisionPolicy": {
+    "preferIndexEvidenceOverGuessing": true,
+    "preferAnalogOverGenericGeneration": true,
+    "openLimitedFilesFirst": 3,
+    "escalateToDeepReadAfterFailedLoops": 2
+  },
+  "scopeVerification": {
+    "trivial": "syntax/format check if needed",
+    "simple": "targeted lint/typecheck or test",
+    "non-trivial": "full test + lint + typecheck"
+  },
+  "verification": {
+    "requiredBeforeCompletion": [
+      "{{runtime.packageManager}} test",
+      "{{runtime.packageManager}} lint",
+      "{{runtime.packageManager}} typecheck"
+    ]
+  }
+}

package/templates/.gitignore

@@ -0,0 +1,75 @@
+# Dependencies
+node_modules/
+.pnp
+.pnp.js
+
+# Testing
+coverage/
+.nyc_output/
+
+# Production build
+dist/
+build/
+out/
+
+# Environment variables
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+.claude/ukit/.env
+
+# Logs
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor directories
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Claude Code per-machine config
+/.claude/settings.local.json
+
+# UKit generated files
+.claude/ukit/.ukit/
+.claude/ukit/permission-usage.json
+.claude/ukit/permission-audit.log
+.cache/
+.antigravity/
+.claude/
+.codex/
+.ukit/
+opencode.json
+AGENTS.md
+CLAUDE.md
+.codex/settings.local.json
+
+# Keep tracked template hook sources under templates/.claude/hooks/
+!.claude/
+!.claude/hooks/
+!.claude/hooks/skill-router.sh
+!.claude/hooks/verification-guard.sh
+!.claude/ukit/
+!.claude/ukit/index/
+!.claude/ukit/index/resolve-context.mjs
+!.claude/ukit/index/verify-context.mjs
+!.claude/ukit/index/route-task.mjs
+!.codex/
+!.codex/README.md
+!.codex/settings.json
+
+# Database
+*.sqlite
+*.db

package/templates/AGENTS.md

@@ -0,0 +1,116 @@
+# AGENTS.md — {{project.name}}
+
+## Core UKit Rule
+
+- Human-facing workflow should optimize for one remembered command: `ukit install`.
+- After install, normal work should feel natural inside **Claude/Codex/OpenCode** (and Antigravity when installed).
+- Quality first, then speed, then token discipline: do not waste reads, logs, or repeated helper output.
+
+## Fast Task Classification
+
+- **Trivial** — typo, label, rename nhỏ, spacing, toggle flag, obvious config change.
+  - Act directly. No doc reads. No planning.
+- **Simple** — 1-2 files, clear scope, existing pattern.
+  - Handle directly. Pull only the smallest useful context.
+- **Non-trivial / Risky** — auth, security, migration, uninstall, shared runtime, race/flaky, data-loss.
+  - Read deeper, verify harder, and avoid shortcuts.
+
+## Automatic Skill Activation (mandatory)
+
+- End users should not need to know skill names.
+- For every non-trivial task — and again after the first relevant tool calls — inspect installed project-local skills and **auto-activate the matching skill immediately**.
+- Match from both prompt wording and tool/file evidence.
+- Use the smallest effective set, usually 1-2 skills.
+- If the prompt/tool signals point to docs work, use `.claude/skills/docs-quality/SKILL.md` when present.
+- If evidence becomes more specific than the original prompt, upgrade the active skill choice immediately.
+- Prefer routed, compact context before widening manual reads.
+
+### Common skill triggers
+
+- review / audit / diff / PR feedback → `.claude/skills/code-review/SKILL.md`
+- bug / error / crash / triage / failing path → `.claude/skills/debugging-toolkit/SKILL.md`
+- test / spec / coverage / fixture → `.claude/skills/testing-quality/SKILL.md`
+- docs / README / changelog / handoff / editing `docs/` → `.claude/skills/docs-quality/SKILL.md`
+- auth / security / token / permission / validation / risky shell-path-delete-db work → `.claude/skills/discover-security/SKILL.md`
+- stale workspace / reinstall / cleanup / maintenance → `.claude/skills/repo-maintenance/SKILL.md`
+
+## Internal Helper Routing
+
+- If routing is complex or ambiguous, prefer the canonical helper first: `node .claude/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>]`.
+- If context is needed, prefer `node .claude/ukit/index/resolve-context.mjs ...`.
+- If a concrete verification lane is needed, prefer `node .claude/ukit/index/verify-context.mjs ...`.
+- These helper/index commands are internal orchestration. Run them yourself when needed; never turn them into required end-user workflow.
+
+## UKit v1.1.6 Shared Runtime
+
+- Shared runtime state lives in `.ukit/storage/`.
+- Treat `.ukit/storage/config.json` as the source of runtime toggles for compact, token pipeline, router, memory, and validation behavior.
+- Reuse `.ukit/storage/memory/` before asking users to restate prior decisions.
+- For non-trivial work, prefer `ukit memory recall "<current task>"` before widening doc reads.
+- Reusable runtime cache lives in `.ukit/storage/cache/prompt-cache.json`, `.ukit/storage/cache/compact-history.json`, and `.ukit/storage/cache/output-history.json`.
+- Shared route memory lives in `.claude/ukit/skill-router-state.json`.
+- If shared route state already includes compact `previous-context` or `recent-output` lines, reuse those first before rescanning memory or replaying noisy logs.
+- If an older repo still has a visible `ukit/` runtime root, rerun `ukit install`; UKit should migrate the shared runtime into hidden `.ukit/` when safe.
+- Maintainers can inspect runtime state with `ukit status` and `ukit memory export`, but normal teammates should still only need `ukit install`.
+- If runtime files are missing/corrupt, tell maintainers to rerun `ukit install`.
+
+## Context + Verification Budget
+
+- **Trivial**: no docs, no index query unless the file target is unclear.
+- **Simple**: default to `docs/MEMORY.md` only; pull related files/tests with the resolver.
+- **Non-trivial**: read `docs/MEMORY.md` + `docs/PROJECT.md` + `docs/CODE_MAP.md`.
+- `docs/WORKLOG.md`: only recent, relevant entries for continuation/debugging.
+- Follow routed verification policy: targeted first when localized, widen in order for shared/risky scope, ask before blanket broad runs when no related-test evidence exists.
+
+## Subagent Policy (internal only)
+
+- Default to direct execution for trivial/simple work.
+- Delegate only when it clearly reduces context bloat or enables useful parallel progress.
+- Good delegation triggers:
+  - noisy side lanes (broad logs/search/test output)
+  - 3+ independent failures/files/checks
+  - explicit batch/plan execution
+  - broad implementation/debug lanes that can return a concise summary
+- If route memory already includes `delegate=<lane>`, treat it as an internal hint after any required indexed-context step.
+- Do not ask end users to name agents or remember agent commands.
+
+## Team Workflow Safety
+
+- Do not teach normal contributors `ukit doctor`, `ukit diff`, `ukit uninstall`, or `ukit index ...` unless they are explicitly debugging UKit itself.
+- If the workspace needs a refresh, prefer telling them to rerun `ukit install`.
+- Keep scope tight, prefer the smallest correct change set, reuse existing code, and update docs when source changes.
+
+## Environment Snapshot
+
+- Project name: {{project.name}}
+- Detected packs: {{project.stack}}
+- Frontend detected: {{stack.frontend}}
+- Backend API detected: {{stack.backendApi}}
+- PostgreSQL detected: {{stack.postgres}}
+- Package manager: {{runtime.packageManager}}
+
+## Skills
+
+- Canonical skills live in `.claude/skills/`.
+- Adapter mirrors may also exist, for example `.antigravity/skills/`.
+- OpenCode reads `AGENTS.md` plus the canonical `.claude/skills/` tree, so UKit keeps the OpenCode adapter lean and avoids a duplicate `.opencode/skills/` mirror.
+- If `opencode.json` ships `ukit-*` commands, treat them as internal helper entrypoints only and **never ask end users to run them**; humans should still only need `ukit install`.
+
+## DuraOne Skill — Conditional Activation
+
+DuraOne skill chỉ active khi pack `duraone` được cài hoặc `.claude/skills/duraone/SKILL.md` tồn tại.
+
+- Khi active: đọc `.claude/skills/duraone/SKILL.md` trước khi code.
+- References:
+  - `.claude/skills/duraone/references/frontend.md`
+  - `.claude/skills/duraone/references/backend.md`
+  - `.claude/skills/duraone/references/sql.md`
+  - `.claude/skills/duraone/references/workflow.md`
+- Khi không active: dùng generic coding standards + project patterns từ index.
+
+## Completion Checklist
+
+- Requirements implemented
+- No unrelated changes
+- Verification executed and reported
+- Docs updated when source truth changed

package/templates/CLAUDE.md

@@ -0,0 +1,93 @@
+# CLAUDE.md — {{project.name}}
+
+## Core Rule
+
+- Human-facing UKit workflow should collapse to one remembered command: `ukit install`.
+- After install, default to natural-language work inside Claude/Codex.
+- Optimize for output quality first, then speed, then token discipline.
+
+## Fast Classification
+
+- **Trivial**: act directly, no doc reads, no agents.
+- **Simple**: keep scope tight; use the smallest useful context.
+- **Non-trivial / Risky**: read deeper, verify harder, and avoid shortcuts.
+
+## Automatic Skill Activation (mandatory)
+
+- End users should not need to know skill names.
+- On every non-trivial task — and again after the first relevant tool calls — inspect installed project-local skills and **auto-activate the matching skill immediately**.
+- Match from prompt signals plus tool/file evidence.
+- Use the smallest useful set.
+- If docs work is detected, read `.claude/skills/docs-quality/SKILL.md` when present.
+- Prefer routed context and routed verification over ad-hoc broad reading.
+- Reuse `.claude/ukit/skill-router-state.json` when it already carries compact route memory.
+- If shared route state already includes `previous-context` or `recent-output`, reuse those first.
+
+### Common skill triggers
+
+- review / audit / diff → `.claude/skills/code-review/SKILL.md`
+- bug / error / crash / triage → `.claude/skills/debugging-toolkit/SKILL.md`
+- test / spec / coverage → `.claude/skills/testing-quality/SKILL.md`
+- docs / README / changelog / handoff / editing `docs/` → `.claude/skills/docs-quality/SKILL.md`
+- auth / security / token / permission / validation → `.claude/skills/discover-security/SKILL.md`
+- stale workspace / reinstall / cleanup → `.claude/skills/repo-maintenance/SKILL.md`
+
+## Internal Helper Policy
+
+- Prefer `node .claude/ukit/index/route-task.mjs ...` when routing is complex.
+- Prefer `node .claude/ukit/index/resolve-context.mjs ...` for indexed related-file context.
+- Prefer `node .claude/ukit/index/verify-context.mjs ...` for concrete verification lanes.
+- **Do not ask normal contributors to run internal helper commands**; run them yourself or tell them to rerun `ukit install`.
+- Do not ask normal contributors to memorize `ukit doctor`, `ukit diff`, `ukit uninstall`, or `ukit index ...` unless they explicitly need maintainer/debug help.
+
+## UKit v1.1.6 Shared Runtime
+
+- Shared runtime state lives in `.ukit/storage/`.
+- Treat `.ukit/storage/config.json` as the source of runtime toggles for compact, token pipeline, router, memory, and validation behavior.
+- Reuse `.ukit/storage/memory/` before asking users to restate decisions.
+- For non-trivial work, prefer `ukit memory recall "<current task>"` before widening doc reads.
+- Reusable cache/compact/output state lives in `.ukit/storage/cache/prompt-cache.json`, `.ukit/storage/cache/compact-history.json`, and `.ukit/storage/cache/output-history.json`.
+- If an older repo still has a visible `ukit/` runtime root, rerun `ukit install`; UKit should migrate the shared runtime into hidden `.ukit/` when safe.
+- Maintainers can inspect runtime state with `ukit status` and `ukit memory export`.
+- If runtime files are missing or corrupt, tell maintainers to rerun `ukit install`.
+
+## Context + Verification Budget
+
+- **Trivial**: no docs.
+- **Simple**: `docs/MEMORY.md` only, plus resolver-selected files/tests.
+- **Non-trivial**: `docs/MEMORY.md` + `docs/PROJECT.md` + `docs/CODE_MAP.md`.
+- `docs/WORKLOG.md`: only recent relevant entries.
+- Follow routed verification policy: targeted first, widen only when risk/shared scope justifies it, ask before blanket broad runs.
+
+## Selective Subagent Policy (internal only)
+
+- Keep direct execution as the default for trivial/simple work.
+- Delegate only when it meaningfully shrinks context or enables useful parallel progress.
+- Good delegation triggers: noisy research/log lanes, 3+ independent failures, explicit batch execution, or a broad debug/implementation lane with a clean handoff.
+- If route memory includes `delegate=<lane>`, treat it as an internal hint after any required indexed-context step.
+
+## Project Snapshot
+
+- Project: {{project.name}} | Root: {{project.root}}
+- Packs: {{project.stack}} | Frontend: {{stack.frontend}} | Backend API: {{stack.backendApi}} | PostgreSQL: {{stack.postgres}}
+- Package manager: {{runtime.packageManager}} | OS: {{runtime.os}} | Node: {{runtime.nodeVersion}} | Provider: {{providers.unic}}
+
+## Working Rules
+
+- Keep scope tight.
+- Reuse existing code.
+- Update `docs/WORKLOG.md` after significant work.
+- If source contradicts docs, update docs immediately.
+- Use `{{runtime.packageManager}}`.
+
+## DuraOne Skill — Conditional Activation
+
+DuraOne skill chỉ active khi pack `duraone` được cài hoặc `.claude/skills/duraone/SKILL.md` tồn tại.
+
+- Khi active: luôn đọc `.claude/skills/duraone/SKILL.md` trước khi code.
+- References:
+  - `.claude/skills/duraone/references/frontend.md`
+  - `.claude/skills/duraone/references/backend.md`
+  - `.claude/skills/duraone/references/sql.md`
+  - `.claude/skills/duraone/references/workflow.md`
+- Khi không active: dùng generic coding standards + project-specific patterns từ index.

package/templates/adapter-presets/antigravity/README.md

@@ -0,0 +1,22 @@
+# {{project.name}}
+
+Auto-generated by UKit for Google Antigravity.
+
+- Packs: {{project.stack}}
+- Package manager: {{runtime.packageManager}}
+
+## Start
+Use graduated doc budget:
+- Trivial: no docs
+- Simple: `docs/MEMORY.md`
+- Non-trivial: `docs/MEMORY.md` + `docs/PROJECT.md` + `docs/CODE_MAP.md`
+- `docs/WORKLOG.md`: recent relevant entries only
+
+If routing is complex/ambiguous, use:
+- `node .antigravity/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>]`
+
+Routing uses natural-language intent (fix/review/brainstorm/build/test/docs).  
+If confidence is low, ask one short clarifying question.
+
+## Skills
+Skills are shared from `.claude/skills/` via symlink. Each skill folder contains `SKILL.md`.

package/templates/adapter-presets/antigravity/rules.md

@@ -0,0 +1,49 @@
+# Project Rules — {{project.name}}
+
+Auto-generated by UKit. Edit `.claude/` sources to update.
+
+## Core policy
+
+- Natural language only; do not require slash commands or skill names.
+- If helper/index commands are needed, run them internally and never ask users to run them.
+- Quality first, keep latency low, avoid repeated token waste.
+- Reuse shared route state from `.claude/ukit/skill-router-state.json`. If it already carries compact `previous-context` or `recent-output` lines, use those before widening docs, memory, or raw logs.
+- Shared runtime lives in `.ukit/storage/`. Reuse `.ukit/storage/memory/`, `.ukit/storage/cache/compact-pressure.json`, `.ukit/storage/cache/output-history.json`, and `.ukit/storage/cache/tee/` before asking users to restate context.
+
+## Route fast
+
+- `fix/bug/error/debug/lỗi/sửa` → fix lane
+- `review/audit/check/soát code` → review lane
+- `brainstorm/idea/design/plan` → design lane
+- `build/implement/add/create` → build lane
+- `clone/copy/similar/giống/tương tự` → follow-pattern lane
+- `test/spec/coverage` → test lane
+- `docs/readme/changelog/tài liệu` → docs lane
+- If intent is ambiguous, ask one short clarifying question.
+- If routing is complex or shared route memory needs refresh, run `node .antigravity/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>]`.
+
+## Skill + context loop
+
+- Auto-activate the smallest useful installed skill set from prompt + tool/file evidence.
+- Prefer `node .antigravity/ukit/index/resolve-context.mjs "<intent>" [--target <file>]` after choosing a skill.
+- Prefer `node .antigravity/ukit/index/verify-context.mjs "<intent>" [--target <file>]` for verification planning.
+
+## Indexed reading + verification
+
+- Trivial: no docs, 1-2 files, minimal verify.
+- Simple: `docs/MEMORY.md` only, 2-5 files, targeted verify.
+- Non-trivial/risky: `docs/MEMORY.md` + `docs/PROJECT.md` + `docs/CODE_MAP.md`, broader verify.
+- `docs/WORKLOG.md`: recent relevant entries only.
+- Clone/follow-pattern: open at least 1 analog file.
+- Shared logic: open the shared abstraction.
+- Bug with tests: open related test first.
+- If broad verification is blocked because targeted verification was skipped, go back to the routed targeted lane first.
+- For bugfix tasks, run index-first triage: `node .antigravity/ukit/index/build-index.mjs` then `node .antigravity/ukit/index/triage.mjs "<error signature>"`, inspect top suspects, then widen only if needed.
+
+## Safety
+
+- Package manager: `{{runtime.packageManager}}`.
+- Keep scope tight and prefer existing code paths.
+- Update `docs/WORKLOG.md`, `docs/MEMORY.md`, `docs/CODE_MAP.md`, or `docs/PROJECT.md` after significant work when relevant.
+- Never edit `.env*`, lock files, `.git/`, or `node_modules/`.
+- Never run destructive commands without explicit confirmation.

package/templates/adapter-presets/claude/settings.local.json

@@ -0,0 +1,42 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(docker:*)",
+      "Bash(curl:*)",
+      "Bash(python3:*)",
+      "Bash(cat:*)",
+      "Bash(go:*)",
+      "Bash(yarn:*)",
+      "Bash(pnpm:*)",
+      "Bash(npm:*)",
+      "Bash(wc:*)",
+      "Bash(jq:*)",
+      "Bash(head:*)",
+      "Bash(cut:*)",
+      "Bash(time curl:*)",
+      "Bash(sleep:*)",
+      "Bash(git:*)",
+      "Bash(echo:*)",
+      "Bash(find:*)",
+      "Bash(grep:*)",
+      "Bash(rg:*)",
+      "Bash(test:*)",
+      "Bash(lsof:*)",
+      "Bash(tail:*)",
+      "Bash(bash:*)",
+      "Bash(chmod:*)",
+      "WebFetch(domain:docs.anthropic.com)",
+      "WebFetch(domain:dev.to)",
+      "WebFetch(domain:www.reddit.com)",
+      "WebFetch(domain:www.steveruiz.me)",
+      "WebFetch(domain:desktopcommander.com)",
+      "WebFetch(domain:gist.github.com)",
+      "WebFetch(domain:opencodedocs.com)",
+      "WebFetch(domain:zenn.dev)",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:gist.githubusercontent.com)",
+      "Bash(./run.sh:*)",
+      "Bash(ls:*)"
+    ]
+  }
+}

package/templates/adapter-presets/codex/settings.local.json

@@ -0,0 +1,6 @@
+{
+  "execution": {
+    "allowExtra": []
+  },
+  "notes": "Machine-local Codex overrides. This file is preserved on reinstall (mergeStrategy: skip)."
+}

package/templates/adapter-presets/opencode/opencode.template.json

@@ -0,0 +1 @@
+{"$schema":"https://opencode.ai/config.json","default_agent":"build","share":"disabled","compaction":{"auto":true,"prune":true,"reserved":10000},"watcher":{"ignore":[".git/**","node_modules/**",".cache/**",".claude/ukit/.ukit/**",".claude/ukit/permission-usage.json",".claude/ukit/permission-audit.log"]},"permission":{"doom_loop":"deny"},"command":{"ukit-route":{"description":"Internal shared UKit route.","agent":"build","template":"Run `node .claude/ukit/index/route-task.mjs \"<task>\" --adapter opencode`; reuse `.claude/ukit/skill-router-state.json`."},"ukit-context":{"description":"Internal UKit context.","agent":"build","template":"Run `node .claude/ukit/index/resolve-context.mjs \"<intent>\" [--target <file>]`."},"ukit-verify":{"description":"Internal UKit verify lane.","agent":"build","template":"Run `node .claude/ukit/index/verify-context.mjs \"<intent>\" [--target <file>]`."},"ukit-triage":{"description":"Internal UKit triage.","agent":"build","template":"Run `node .claude/ukit/index/triage.mjs \"<error>\"`."},"ukit-query":{"description":"Internal UKit query.","agent":"build","template":"Run `node .claude/ukit/index/query-index.mjs \"<error|symbol|path>\"`."},"ukit-index":{"description":"Internal UKit index.","agent":"build","template":"Run `node .claude/ukit/index/refresh-index.mjs` (fallback: `node .claude/ukit/index/build-index.mjs`)."}},"agent":{"build":{"description":"UKit coding agent; keep internal helpers hidden, users only need ukit install.","permission":{"edit":"allow","task":"allow","skill":"allow","bash":{"*":"ask","pwd":"allow","ls":"allow","ls *":"allow","find *":"allow","rg *":"allow","grep *":"allow","cat *":"allow","sed *":"allow","head *":"allow","tail *":"allow","wc *":"allow","git status":"allow","git status *":"allow","git diff":"allow","git diff *":"allow","git log":"allow","git log *":"allow","git show *":"allow","git grep *":"allow","git rev-parse *":"allow","node .claude/ukit/index/*":"allow","{{runtime.packageManager}} test":"allow","{{runtime.packageManager}} test *":"allow","{{runtime.packageManager}} lint":"allow","{{runtime.packageManager}} lint *":"allow","{{runtime.packageManager}} typecheck":"allow","{{runtime.packageManager}} typecheck *":"allow","{{runtime.packageManager}} build":"allow","{{runtime.packageManager}} build *":"allow","npm run test":"allow","npm run test *":"allow","npm run lint":"allow","npm run lint *":"allow","npm run typecheck":"allow","npm run typecheck *":"allow","npm run build":"allow","npm run build *":"allow","git commit":"ask","git commit *":"ask","git push":"ask","git push *":"ask","git clean":"deny","git clean *":"deny","git reset":"deny","git reset *":"deny","rm *":"deny"}}},"plan":{"permission":{"edit":"ask","bash":"ask"}}}}

package/templates/docs/BUGFIX.md

@@ -0,0 +1,20 @@
+# Bugfix SOP (Index-First)
+
+## Objective
+Giảm thời gian fix bug bằng cách ưu tiên bằng chứng + index codebase trước khi đọc sâu docs/source.
+
+## Required Commands
+- `node .claude/ukit/index/build-index.mjs`
+- `node .claude/ukit/index/query-index.mjs "<error|symbol|path>"`
+- `node .claude/ukit/index/triage.mjs "<error signature>"`
+
+## Decision Tree
+1. Có repro command rõ ràng -> chạy triage index.
+2. Lane fast: mở tối đa 1-3 suspect files, patch nhỏ, verify test mục tiêu.
+3. Fail 2 vòng 15 phút liên tiếp -> chuyển lane deep.
+4. Lane deep: instrumentation + root-cause tracing trước khi sửa.
+
+## Hard Rules
+- Không sửa khi chưa có evidence (failing test / stack trace / logs).
+- Không refactor lớn trong bug ticket.
+- Verify tối thiểu: test fail ban đầu + test liên quan.

package/templates/docs/BUG_INDEX.md

@@ -0,0 +1,12 @@
+# BUG INDEX
+
+Append-only recurring bug signatures.
+
+## Entry format
+- Date:
+- Signature:
+- Repro command:
+- Root cause:
+- Files changed:
+- Tests used:
+- Commit/PR:

package/templates/docs/BUG_METRICS.md

@@ -0,0 +1,7 @@
+# Bug Metrics
+
+Track weekly:
+- MTTR P2/P3
+- First-pass fix rate
+- Avg files opened per simple bug
+- Fast-lane usage rate

package/templates/docs/BUG_TEMPLATE.md

@@ -0,0 +1,13 @@
+# Bug Intake Template
+
+- Title:
+- Priority: P0/P1/P2/P3
+- Repro command:
+- Expected vs Actual:
+- Error signature:
+- Stack trace excerpt:
+- Index triage output (`node .claude/ukit/index/triage.mjs "..."`):
+- Suspect files (top 3):
+- Lane (fast/deep):
+- Hypothesis:
+- Verify commands: