@vyuhlabs/dxkit 0.10.0 → 0.11.1

package/README.md

@@ -34,10 +34,12 @@ Running `init` auto-detects your tech stack and generates a complete `.claude/`
     test-gap-finder.md   # Identifies untested critical code
     dependency-mapper.md # Maps import chains and blast radius
     health-auditor.md    # 6-dimension codebase health audit
-    vulnerability-scanner.md # Dependency + code security scan
+    vulnerability-scanner.md # CWE-classified security scan (Snyk-comparable)
     dev-report.md        # Developer activity + quality attribution
+    dashboard-builder.md # HTML dashboard from all reports
+    hooks-configurator.md # Git hooks from DXKit commands
     debugger.md          # Root cause analysis
-  commands/              # 24 slash commands (see below)
+  commands/              # 26 slash commands (see below)
   skills/                # Domain knowledge
     codebase/            # Auto-generated architecture overview
     learned/             # Evolving gotchas, conventions, deny list
@@ -82,7 +84,7 @@ Auto-detected and integrated when present:
 - **Pulumi** — IaC with preview-before-apply safety
 - **Docker** — Container commands
 
-## Commands (24)
+## Commands (26)
 
 ### Development Workflow
 | Command | Description |
@@ -100,17 +102,17 @@ Auto-detected and integrated when present:
 | `/check` | Full pre-commit validation (quality + tests + AI review) |
 | `/fix` | Auto-fix formatting and lint issues |
 | `/build` | Build the project |
-| `/setup-hooks` | Install git pre-commit/pre-push hooks |
 | `/test-gaps` | Find critical untested code paths |
 
 ### Analysis & Reports
 | Command | Description | Report |
 |---|---|---|
 | `/health` | 6-dimension codebase health audit | `.ai/reports/health-audit-*.md` |
-| `/vulnerabilities` | Dependency + code vulnerability scan | `.ai/reports/vulnerability-scan-*.md` |
+| `/vulnerabilities` | CWE-classified security scan (Snyk-comparable) | `.ai/reports/vulnerability-scan-*.md` |
 | `/dev-report` | Developer activity + security attribution | `.ai/reports/developer-report-*.md` |
 | `/docs audit` | Documentation gap analysis | `.ai/reports/docs-audit-*.md` |
 | `/deps` | Dependency map + blast radius | `.ai/reports/dependency-map-*.md` |
+| `/dashboard` | Generate HTML dashboard from all reports | `.ai/reports/dashboard.html` |
 | `/export-pdf` | Convert markdown reports to PDF | `.ai/reports/*.pdf` |
 
 ### Exploration & Onboarding
@@ -120,11 +122,13 @@ Auto-detected and integrated when present:
 | `/explore-codebase` | Deep architecture exploration |
 | `/help` | List all commands and agents |
 
-### Operations
+### Setup & Hooks
 | Command | Description |
 |---|---|
-| `/fix-issue <number>` | Investigate and fix a GitHub issue |
+| `/setup-hooks` | Configure git hooks (quality, test, vulnerability) — consistent with DXKit reports |
+| `/stealth-mode` | Gitignore DXKit files + install hooks (DXKit local-only, hooks for all devs) |
 | `/setup-pr-review` | Set up automated PR review GitHub Action |
+| `/fix-issue <number>` | Investigate and fix a GitHub issue |
 | `/doctor` | Diagnose environment issues |
 | `/enable-agent <name>` | Activate a dormant agent |
 
@@ -138,16 +142,17 @@ These agents auto-trigger when Claude detects a matching question:
 - **quality-reviewer** — "Review my changes" "Check quality before I commit"
 - **doc-writer** — "What needs documentation?" "Help me write docs"
 
-### Dormant (10) — activate with `/enable-agent`
+### Dormant (12) — activate with `/enable-agent`
 - **codebase-explorer** — Deep architecture analysis, generates documentation
 - **code-reviewer** — PR review and security audit (read-only)
 - **test-writer** — Writes tests for existing code
 - **test-gap-finder** — Identifies critical untested code paths, prioritized by risk
 - **dependency-mapper** — Maps import chains and blast radius of changes
 - **health-auditor** — Comprehensive codebase health audit (scores 6 dimensions)
-- **vulnerability-scanner** — CWE-classified security scan (Snyk-comparable depth)
+- **vulnerability-scanner** — CWE-classified security scan with Snyk-comparable depth
 - **dev-report** — Developer activity, quality patterns, security attribution
 - **dashboard-builder** — Generates HTML dashboard from all reports
+- **hooks-configurator** — Configures scoped git hooks from DXKit commands
 - **debugger** — Systematic root cause analysis
 
 ## Reports
@@ -189,6 +194,28 @@ DXKit generates a GitHub Action that automatically reviews PRs using Claude Code
 
 Reviews appear as PR comments with issues rated as critical/warning/suggestion.
 
+## Git Hooks (Consistent with Reports)
+
+`/setup-hooks` configures git hooks that run the **exact same tools** as your DXKit reports:
+
+```
+commit  → pre-commit  → lint staged files only         (fast, ~5s)
+push    → pre-push    → test affected areas only        (medium, ~30s)
+PR      → CI workflow  → full quality + tests + security (thorough, ~3m)
+```
+
+- User chooses which checks to enable: quality, test, vulnerability
+- Hooks read from your `/quality`, `/test`, `/vulnerabilities` commands — no hardcoded tools
+- Supports scoped testing: Jest `--changedSince`, Vitest `--changed`, pytest `--testmon`
+- Works for all devs (plain bash, no Claude Code needed at runtime)
+
+### Stealth Mode
+
+`/stealth-mode` keeps DXKit local-only:
+- `.claude/`, `.ai/`, `CLAUDE.md` gitignored — not committed
+- `.githooks/` committed — all devs get the hooks
+- One-time setup: `git config core.hooksPath .githooks`
+
 ## Vulnerability Scanner (Snyk-Comparable)
 
 The `/vulnerabilities` command runs a comprehensive security scan with CWE classification:

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import { ResolvedConfig } from './types';
-export declare const VERSION = "0.10.0";
+export declare const VERSION = "0.11.1";
 export declare const DEFAULT_VERSIONS: {
     python: string;
     go: string;

package/dist/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVOLVING_FILES = exports.DEFAULT_COVERAGE = exports.DEFAULT_VERSIONS = exports.VERSION = void 0;
 exports.buildVariables = buildVariables;
 exports.buildConditions = buildConditions;
-exports.VERSION = '0.10.0';
+exports.VERSION = '0.11.1';
 exports.DEFAULT_VERSIONS = {
     python: '3.12',
     go: '1.24.0',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vyuhlabs/dxkit",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "AI-native developer experience toolkit for any repository",
   "license": "MIT",
   "bin": {

package/templates/.claude/agents-available/hooks-configurator.md

@@ -0,0 +1,211 @@
+---
+name: hooks-configurator
+description: Configures git hooks based on user-selected checks (quality, test, vulnerability). Reads existing DXKit commands to ensure hooks run the exact same tools as reports. Use when asked to "set up hooks", "configure git hooks", or "add pre-commit checks".
+model: sonnet
+tools: Read, Grep, Glob, Bash, Write
+---
+
+You are a git hooks configurator. Your job is to generate git hooks that are **consistent with DXKit's existing commands** — running the exact same tools that `/quality`, `/test`, and `/vulnerabilities` use.
+
+## Step 1: Ask the User What to Enable
+
+Present these options:
+
+```
+Which checks would you like as git hooks?
+
+Pre-commit (runs on every commit, scoped to staged files):
+  [1] Quality — linting, formatting, type checking
+  [2] Vulnerability — code-level security patterns
+
+Pre-push (runs before push, scoped to changed files):
+  [3] Tests — run test suite for affected areas
+
+PR-level (GitHub Actions, runs full suite):
+  [4] Full quality + tests + vulnerability scan
+
+Options: Enter numbers (e.g., "1,2,3" or "all")
+```
+
+## Step 2: Read Existing DXKit Commands for Consistency
+
+**CRITICAL**: Do NOT hardcode which linters/tools to run. Instead, read the generated commands:
+
+- Read `.claude/commands/quality.md` to see exactly which linters are configured
+- Read `.claude/commands/test.md` to see the detected test runner and command
+- Read `.claude/commands/check.md` for the combined check flow
+
+Extract the specific commands. For example, if `quality.md` says:
+```
+1. `npx eslint .` — Lint
+2. `npx tsc --noEmit` — Type check
+```
+
+Then the pre-commit hook should run `npx eslint` and `npx tsc --noEmit` — not some other set of tools.
+
+If `test.md` says:
+```
+Run: `npm test`
+```
+
+Then the pre-push hook runs `npm test` — not `npx jest` or anything else.
+
+## Step 3: Generate Hooks
+
+### Pre-Commit Hook (if quality or vulnerability selected)
+
+Generate `.githooks/pre-commit`:
+
+```bash
+#!/bin/bash
+set -e
+
+# DXKit pre-commit hook
+# Generated from: /quality and /vulnerabilities commands
+# Consistent with DXKit reports — same tools, same checks
+
+STAGED=$(git diff --cached --name-only --diff-filter=ACM)
+[ -z "$STAGED" ] && exit 0
+
+FAILED=0
+
+# === QUALITY CHECKS (from .claude/commands/quality.md) ===
+# [Insert the exact commands from quality.md, scoped to staged files where possible]
+# Example for Node/TS:
+JS_FILES=$(echo "$STAGED" | grep -E '\.(ts|tsx|js|jsx)$' || true)
+if [ -n "$JS_FILES" ]; then
+  echo "→ ESLint (staged files)"
+  echo "$JS_FILES" | xargs npx eslint --no-warn-ignored 2>/dev/null || FAILED=1
+  echo "→ TypeScript"
+  npx tsc --noEmit 2>/dev/null || FAILED=1
+fi
+
+# [Add Python/Go/C#/Rust sections based on what quality.md contains]
+
+# === VULNERABILITY CHECKS (code-level only, fast) ===
+# [If vulnerability selected, add grep-based checks from vulnerability-scanner agent]
+# Check staged files for hardcoded secrets
+if echo "$STAGED" | xargs grep -l -E "(password|secret|apiKey|token)\s*[:=]\s*['\"][^'\"]{8,}" 2>/dev/null; then
+  echo "⚠️  Possible hardcoded secret detected in staged files"
+  echo "   Review with: /vulnerabilities"
+  FAILED=1
+fi
+
+[ $FAILED -ne 0 ] && echo "❌ Pre-commit failed." && exit 1
+echo "✅ Pre-commit passed."
+```
+
+### Pre-Push Hook (if tests selected)
+
+Generate `.githooks/pre-push`:
+
+```bash
+#!/bin/bash
+set -e
+
+# DXKit pre-push hook
+# Generated from: /test command
+# Consistent with DXKit reports — same test runner
+
+echo "→ Running tests before push..."
+
+REMOTE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null || echo "origin/main")
+CHANGED=$(git diff --name-only "$REMOTE"...HEAD 2>/dev/null || git diff --name-only HEAD~5...HEAD)
+[ -z "$CHANGED" ] && exit 0
+
+# [Insert the exact test command from test.md]
+# Scope to changed areas where the test framework supports it:
+# - Jest: --changedSince
+# - Vitest: --changed
+# - pytest: --testmon (if installed)
+# - Go: test specific packages
+# - Others: run full suite
+
+# Example for Mocha (no scoping available):
+# npm test
+
+# Example for Jest:
+# npx jest --changedSince="$REMOTE" --passWithNoTests
+
+[ $? -ne 0 ] && echo "❌ Tests failed." && exit 1
+echo "✅ Tests passed."
+```
+
+### PR Workflow (if PR-level selected)
+
+Generate `.github/workflows/pr-checks.yml`:
+
+```yaml
+name: PR Quality & Security
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  quality-and-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # [Setup steps based on detected languages]
+      # [Full quality checks — same as quality.md but unscoped]
+      # [Full test suite — same as test.md but unscoped]
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # [Dependency audit: npm audit / pip audit / etc.]
+      # [Same checks as vulnerability-scanner agent]
+```
+
+## Step 4: Install Hooks
+
+After generating:
+
+1. Create `.githooks/` directory with the hook scripts
+2. Run `chmod +x .githooks/*`
+3. Run `git config core.hooksPath .githooks` to activate
+4. Show the user what was installed
+
+## Step 5: Stealth Mode (Optional)
+
+If the user wants DXKit files gitignored:
+
+Append to `.gitignore`:
+```
+# DXKit (local-only)
+.claude/
+.ai/
+CLAUDE.md
+.vyuh-dxkit.json
+```
+
+But keep `.githooks/` committed so all devs get the hooks. Tell the user:
+- `.githooks/` is committed — all devs get the same hooks
+- DXKit files are local — only the developer who runs DXKit gets the AI features
+- `git config core.hooksPath .githooks` needed once per clone (add to README or setup script)
+
+## Scoping Strategy
+
+| Hook | Scope | Why |
+|------|-------|-----|
+| Pre-commit | Staged files only | Fast (~5s), immediate feedback |
+| Pre-push | Changed files since remote | Medium (~30s), catches test failures |
+| PR workflow | Full repository | Thorough (~3m), catches everything |
+
+For test scoping by framework:
+- **Jest**: `--changedSince=<remote>` — built-in, very fast
+- **Vitest**: `--changed=<remote>` — built-in
+- **pytest + testmon**: `--testmon` — runs only tests affected by changes
+- **Go**: test specific packages derived from changed file paths
+- **Mocha/others**: full suite (no built-in scoping)
+
+## Rules
+
+- **Never hardcode tools** — always read from `.claude/commands/quality.md` and `test.md`
+- **Be consistent** — hooks must run the same tools as DXKit reports
+- **Explain trade-offs** — scoped hooks are faster but may miss cross-file issues
+- **Warn about --no-verify** — hooks can be bypassed but shouldn't be

package/templates/.claude/commands/setup-hooks.md

@@ -1,60 +1,18 @@
 ---
-description: Install git pre-commit and pre-push hooks for quality checks
+description: Configure git hooks (quality, test, vulnerability) — consistent with DXKit reports
 ---
 
-Set up git hooks for this project based on the detected tech stack.
+Delegate to the **hooks-configurator** agent. It will:
 
-## Detect Stack
+1. Ask which checks to enable (quality, test, vulnerability)
+2. Read your existing `/quality`, `/test`, and `/vulnerabilities` commands to ensure hooks run the **exact same tools** as your reports
+3. Generate scoped hooks (staged files for commit, changed files for push, full suite for PR)
+4. Optionally enable stealth mode (gitignore DXKit files, keep hooks committed)
 
-Check which languages/tools are present by looking for:
-- `package.json` → Node/TypeScript (eslint, prettier, tsc)
-- `pyproject.toml` or `requirements.txt` → Python (ruff, mypy)
-- `go.mod` → Go (golangci-lint, gofmt)
-- `*.csproj` or `*.sln` → C# (dotnet format)
-- `Cargo.toml` → Rust (cargo clippy, cargo fmt)
-
-## Generate Hooks
-
-Create `.git/hooks/pre-commit` with the appropriate checks:
-
-**Structure:**
-```bash
-#!/bin/bash
-set -e
-echo "Running pre-commit checks..."
-
-# Only check staged files
-STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-
-# [language-specific checks based on detected stack]
-
-echo "All checks passed!"
+**IMPORTANT: End the report with this exact footer:**
 ```
-
-**Per language (only include detected ones):**
-
-- **Node/TS**: `npx eslint --no-warn-ignored $JS_FILES` and `npx prettier --check $JS_FILES`
-- **Python**: `ruff check $PY_FILES` and `ruff format --check $PY_FILES`
-- **Go**: `gofmt -l $GO_FILES` (fail if any output) and `golangci-lint run`
-- **C#**: `dotnet format --verify-no-changes`
-- **Rust**: `cargo fmt --check` and `cargo clippy -- -D warnings`
-
-Also create `.git/hooks/pre-push` with test runners:
-- **Node**: `npm test`
-- **Python**: `pytest`
-- **Go**: `go test ./...`
-- **C#**: `dotnet test`
-- **Rust**: `cargo test`
-
-Make both hooks executable with `chmod +x`.
-
-## If pre-commit framework exists
-
-If `.pre-commit-config.yaml` already exists or `pre-commit` is installed, suggest using that instead:
-```bash
-pre-commit install
+---
+*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
 ```
 
-## After Setup
-
-Confirm what hooks were installed and what they check. Mention that hooks can be bypassed with `git commit --no-verify` (but discourage it).
+$ARGUMENTS

package/templates/.claude/commands/stealth-mode.md

@@ -0,0 +1,17 @@
+---
+description: Configure DXKit as local-only (gitignore all generated files) + install git hooks
+---
+
+Delegate to the **hooks-configurator** agent with stealth mode enabled.
+
+This will:
+1. Add all DXKit files to `.gitignore` (`.claude/`, `.ai/`, `CLAUDE.md`, `.vyuh-dxkit.json`)
+2. Ask which hooks to enable (quality, test, vulnerability)
+3. Generate `.githooks/` directory (committed — all devs get the hooks)
+4. Install hooks with `git config core.hooksPath .githooks`
+
+Result: DXKit AI features are local-only, but quality/test/security hooks run for everyone.
+
+**Enable stealth mode: yes**
+
+$ARGUMENTS

package/templates/CLAUDE.md.template

@@ -163,6 +163,7 @@ Slash commands for common workflows. Run `/help` to list all with descriptions.
 - `/dev-report` - Developer activity and code quality report
 - `/docs` - Audit, write, or improve documentation
 - `/dashboard` - Generate HTML dashboard from all reports
+- `/stealth-mode` - Gitignore DXKit files + install smart scoped git hooks
 - `/export-pdf` - Convert markdown reports to PDF
 - `/fix-issue <number>` - Investigate and fix a GitHub issue
 
@@ -186,6 +187,7 @@ Language-specific conventions that activate automatically when editing matching
 - `vulnerability-scanner` — Dependency and code vulnerability analysis (sonnet)
 - `dev-report` — Developer activity, quality patterns, security attribution (sonnet)
 - `dashboard-builder` — Generates HTML dashboard from all reports (sonnet)
+- `hooks-configurator` — Configures scoped git hooks from DXKit commands (sonnet)
 - `doc-writer` — Audits docs, identifies gaps, writes/improves documentation (sonnet)
 - `debugger` — Traces root causes systematically (sonnet, no file edits)