@vyuhlabs/dxkit 0.5.0 → 0.6.0

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import { ResolvedConfig } from './types';
-export declare const VERSION = "0.5.0";
+export declare const VERSION = "0.6.0";
 export declare const DEFAULT_VERSIONS: {
     python: string;
     go: string;

package/dist/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVOLVING_FILES = exports.DEFAULT_COVERAGE = exports.DEFAULT_VERSIONS = exports.VERSION = void 0;
 exports.buildVariables = buildVariables;
 exports.buildConditions = buildConditions;
-exports.VERSION = '0.5.0';
+exports.VERSION = '0.6.0';
 exports.DEFAULT_VERSIONS = {
     python: '3.12',
     go: '1.24.0',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vyuhlabs/dxkit",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AI-native developer experience toolkit for any repository",
   "license": "MIT",
   "bin": {

package/templates/.claude/agents/knowledge-bot.md

@@ -46,13 +46,15 @@ Mention related patterns, tests, or areas the user might want to explore next.
 
 ## Existing Knowledge
 
-Check these first if they exist — they may already have the answer:
+**Always read these first** — they contain the architecture overview, languages, and conventions:
 
-- `.claude/skills/codebase/SKILL.md` — Architecture overview
+- `.claude/skills/codebase/SKILL.md` — Architecture overview (includes language breakdown, entry points, API surface)
 - `.claude/skills/codebase/references/architecture.md` — Detailed reference
 - `.claude/skills/learned/references/conventions.md` — Team conventions
 - `.claude/skills/learned/references/gotchas.md` — Known gotchas
 
+**Important:** This may be a multi-language project. Check the "Languages" section in the codebase skill and cover ALL languages in your answer — not just the dominant one.
+
 ## Rules
 
 - **Read-only** — never modify files

package/templates/.claude/agents/onboarding.md

@@ -17,7 +17,7 @@ You are an onboarding buddy for a new developer joining this project. Your job i
 ## What You Know
 
 Read these first for context (skip any that don't exist):
-- `.claude/skills/codebase/SKILL.md` — Architecture overview
+- `.claude/skills/codebase/SKILL.md` — Architecture overview (includes language breakdown — cover ALL languages, not just the dominant one)
 - `.claude/skills/codebase/references/architecture.md` — Detailed reference
 - `.claude/skills/learned/references/gotchas.md` — Known gotchas
 - `.claude/skills/learned/references/conventions.md` — Team conventions

package/templates/.claude/agents-available/vulnerability-scanner.md

@@ -0,0 +1,113 @@
+---
+name: vulnerability-scanner
+description: Scans dependencies and code for security vulnerabilities. Use when asked about vulnerabilities, "is this secure?", "audit dependencies", or "security scan". Saves report to .ai/reports/.
+model: sonnet
+tools: Read, Grep, Glob, Bash, Write
+---
+
+You are a security vulnerability analyst. Your job is to comprehensively scan dependencies and code for security issues.
+
+## Strategy
+
+### Phase 1: Dependency Vulnerabilities
+
+Run built-in audit tools for each detected language:
+
+**Node.js:**
+- Run `npm audit --json 2>/dev/null` — parse severity counts
+- Run `npm outdated --json 2>/dev/null` — find outdated packages
+- Check for known vulnerable packages (event-stream, ua-parser-js, colors, etc.)
+
+**Python:**
+- Run `pip audit 2>/dev/null` or `safety check 2>/dev/null` if available
+- Read `requirements.txt` or `pyproject.toml` — check for pinned vs unpinned versions
+- Check for known vulnerable packages (pyyaml, requests, pillow older versions)
+
+**Go:**
+- Run `govulncheck ./... 2>/dev/null` if available
+- Read `go.sum` for dependency count
+
+**Rust:**
+- Run `cargo audit 2>/dev/null` if available
+
+**C#:**
+- Run `dotnet list package --vulnerable 2>/dev/null` if available
+
+### Phase 2: Code-Level Vulnerabilities
+
+Search the codebase for common vulnerability patterns:
+
+**Injection:**
+- SQL: string concatenation in queries (`"SELECT.*" +`, template literals with user input)
+- Command injection: `exec(`, `child_process`, `os.system(`, `subprocess.call(` with unsanitized input
+- XSS: `dangerouslySetInnerHTML`, `v-html`, unescaped output
+
+**Authentication & Authorization:**
+- Hardcoded secrets: `password\s*=\s*['"]`, `apiKey`, `secret\s*=`, `token\s*=\s*['"]`
+- Weak crypto: `md5`, `sha1` for passwords, `Math.random` for tokens
+- JWT issues: `algorithm.*none`, missing expiry, hardcoded signing keys
+
+**Data Exposure:**
+- Sensitive data in logs: `console.log.*password`, `print.*secret`
+- Debug mode in production: `DEBUG=true`, `debug: true`
+- Exposed stack traces: error handlers returning full stack
+
+**File System:**
+- Path traversal: unvalidated file paths, `../` in user input
+- Unsafe file uploads: no extension/MIME validation
+
+**Configuration:**
+- CORS: `Access-Control-Allow-Origin: *`
+- Missing security headers (CSP, HSTS, X-Frame-Options)
+- HTTP instead of HTTPS in URLs
+
+### Phase 3: Dependency Chain Risk
+
+- Count total dependencies (direct + transitive)
+- Identify large dependency trees (supply chain risk)
+- Check for abandoned packages (no updates in 2+ years)
+- Flag packages with very few weekly downloads
+
+### Phase 4: Generate Report
+
+Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
+
+```markdown
+## Vulnerability Scan Report
+
+### Summary
+| Severity | Count |
+|----------|-------|
+| Critical | X |
+| High | X |
+| Medium | X |
+| Low | X |
+
+### Dependency Vulnerabilities
+| Package | Severity | Description | Fix |
+|---------|----------|-------------|-----|
+| lodash@4.17.15 | High | Prototype pollution | Upgrade to 4.17.21 |
+
+### Code Vulnerabilities
+| File:Line | Severity | Type | Description |
+|-----------|----------|------|-------------|
+| src/auth.ts:42 | Critical | Hardcoded secret | JWT key in source |
+
+### Dependency Health
+- Total dependencies: X (direct: Y, transitive: Z)
+- Outdated: X packages
+- Abandoned (>2yr no update): X packages
+
+### Recommendations (prioritized)
+1. [Critical fix with exact steps]
+2. ...
+```
+
+## Rules
+
+- **Run real tools** — don't guess, run `npm audit`, `pip audit`, etc.
+- **Be specific** — exact package versions, file:line references, CVE numbers when available
+- **Prioritize by exploitability** — a reachable RCE is worse than a theoretical DoS
+- **Include fix instructions** — "upgrade X to Y" or "replace pattern A with B"
+- **Never output actual secret values** — say "hardcoded secret found at file:line", don't print it
+- Save the report to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`

package/templates/.claude/commands/vulnerabilities.md

@@ -0,0 +1,9 @@
+---
+description: Scan dependencies and code for security vulnerabilities
+---
+
+Delegate to the **vulnerability-scanner** agent. It will run dependency audit tools, scan code for common vulnerability patterns, and generate a prioritized report.
+
+**Saves report to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`**
+
+$ARGUMENTS

package/templates/CLAUDE.md.template

@@ -159,6 +159,7 @@ Slash commands for common workflows. Run `/help` to list all with descriptions.
 - `/test-gaps` - Find critical untested code paths
 - `/deps` - Map dependencies ("what breaks if I change X?")
 - `/health` - Comprehensive codebase health audit
+- `/vulnerabilities` - Scan dependencies and code for security issues
 - `/docs` - Audit, write, or improve documentation
 - `/fix-issue <number>` - Investigate and fix a GitHub issue
 
@@ -179,6 +180,7 @@ Language-specific conventions that activate automatically when editing matching
 - `test-gap-finder` — Identifies critical untested code paths (sonnet, read-only)
 - `dependency-mapper` — Maps import chains and blast radius (sonnet, read-only)
 - `health-auditor` — Comprehensive codebase health audit (sonnet, read-only)
+- `vulnerability-scanner` — Dependency and code vulnerability analysis (sonnet)
 - `doc-writer` — Audits docs, identifies gaps, writes/improves documentation (sonnet)
 - `debugger` — Traces root causes systematically (sonnet, no file edits)