@vyuhlabs/dxkit 0.9.0 → 0.11.0

package/README.md

@@ -138,15 +138,16 @@ These agents auto-trigger when Claude detects a matching question:
 - **quality-reviewer** — "Review my changes" "Check quality before I commit"
 - **doc-writer** — "What needs documentation?" "Help me write docs"
 
-### Dormant (9) — activate with `/enable-agent`
+### Dormant (10) — activate with `/enable-agent`
 - **codebase-explorer** — Deep architecture analysis, generates documentation
 - **code-reviewer** — PR review and security audit (read-only)
 - **test-writer** — Writes tests for existing code
 - **test-gap-finder** — Identifies critical untested code paths, prioritized by risk
 - **dependency-mapper** — Maps import chains and blast radius of changes
 - **health-auditor** — Comprehensive codebase health audit (scores 6 dimensions)
-- **vulnerability-scanner** — Dependency + code vulnerability analysis
+- **vulnerability-scanner** — CWE-classified security scan (Snyk-comparable depth)
 - **dev-report** — Developer activity, quality patterns, security attribution
+- **dashboard-builder** — Generates HTML dashboard from all reports
 - **debugger** — Systematic root cause analysis
 
 ## Reports
@@ -163,7 +164,9 @@ All analysis commands save timestamped reports to `.ai/reports/`:
   dependency-map-2026-03-30.md         # Import chains, most-depended-on files
 ```
 
-Convert to PDF: `/export-pdf all` or `/export-pdf .ai/reports/health-audit-2026-03-30.md`
+Export options:
+- **HTML dashboard**: `/dashboard` — beautiful dark-themed dashboard with sidebar navigation
+- **PDF**: `/export-pdf all` — converts all reports to PDF
 
 ## Learning System
 
@@ -186,6 +189,24 @@ DXKit generates a GitHub Action that automatically reviews PRs using Claude Code
 
 Reviews appear as PR comments with issues rated as critical/warning/suggestion.
 
+## Vulnerability Scanner (Snyk-Comparable)
+
+The `/vulnerabilities` command runs a comprehensive security scan with CWE classification:
+
+| Category | CWE | What It Checks |
+|---|---|---|
+| Command Injection | CWE-78 | `exec()`, `child_process`, unsanitized input |
+| Decompression Bomb | CWE-409 | zlib/tar/decompress without size limits |
+| Uncontrolled Recursion | CWE-674 | JSON/XML/YAML parsers without depth limits |
+| Arbitrary File Upload | CWE-434 | multer/formidable/busboy without validation |
+| Buffer Overflow | CWE-120 | Native modules (binding.gyp, .node files) |
+| Resource Exhaustion | CWE-770 | Missing rate limits, body size limits, WebSocket payload |
+| Hardcoded Secrets | CWE-798 | Passwords, API keys, tokens in source |
+| Prototype Pollution | CWE-1321 | Via dependency audit CWE extraction |
+| + 15 more CWE categories | | Parsed from `npm audit --json` CWE fields |
+
+Reports include a **Findings by CWE Category** table for direct comparison with Snyk/Sonar output.
+
 ## Smart Detection
 
 - **Test runner** — Detects Jest, Mocha, Vitest, Ava, Tap, pytest, go test from scripts and dependencies

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import { ResolvedConfig } from './types';
-export declare const VERSION = "0.9.0";
+export declare const VERSION = "0.11.0";
 export declare const DEFAULT_VERSIONS: {
     python: string;
     go: string;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,eAAO,MAAM,gBAAgB;;;;;;;;CAQ5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,yEAAyE;AACzE,eAAO,MAAM,cAAc,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgC7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuB/E"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,OAAO,WAAW,CAAC;AAEhC,eAAO,MAAM,gBAAgB;;;;;;;;CAQ5B,CAAC;AAEF,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,yEAAyE;AACzE,eAAO,MAAM,cAAc,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgC7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuB/E"}

package/dist/constants.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVOLVING_FILES = exports.DEFAULT_COVERAGE = exports.DEFAULT_VERSIONS = exports.VERSION = void 0;
 exports.buildVariables = buildVariables;
 exports.buildConditions = buildConditions;
-exports.VERSION = '0.9.0';
+exports.VERSION = '0.11.0';
 exports.DEFAULT_VERSIONS = {
     python: '3.12',
     go: '1.24.0',

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AA6BA,wCAgCC;AAED,0CAuBC;AApFY,QAAA,OAAO,GAAG,OAAO,CAAC;AAElB,QAAA,gBAAgB,GAAG;IAC9B,MAAM,EAAE,MAAM;IACd,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,GAAG;CACX,CAAC;AAEW,QAAA,gBAAgB,GAAG,IAAI,CAAC;AAErC,yEAAyE;AAC5D,QAAA,cAAc,GAAG;IAC5B,8CAA8C;IAC9C,kDAAkD;IAClD,2DAA2D;IAC3D,8CAA8C;IAC9C,2CAA2C;IAC3C,6CAA6C;IAC7C,6CAA6C;IAC7C,kCAAkC;IAClC,oDAAoD;CACrD,CAAC;AAEF,SAAgB,cAAc,CAAC,MAAsB;IACnD,MAAM,CAAC,GAA2B;QAChC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,IAAI,WAAW;QAC7D,UAAU,EAAE,OAAO;QACnB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAgB,CAAC,EAAE;QACrD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,gBAAgB,EAAE,wBAAgB,CAAC,QAAQ;QAC3C,aAAa,EAAE,wBAAgB,CAAC,KAAK;QACrC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,cAAc;QAC3B,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,IAAI,wBAAgB;QAChE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,UAAU;QACtD,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;QACzD,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE;QAC/D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAClC,CAAC;IAEF,oBAAoB;IACpB,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,gBAAgB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACxF,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/F,CAAC,CAAC,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC;IAExC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,eAAe,CAAC,MAAsB;IACpD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;QACzD,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;QAC9B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;QAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK;QACrC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK;QAC9E,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACpC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC7B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,iBAAiB,EAAE,MAAM,CAAC,aAAa;QACvC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,wBAAgB,CAAC,GAAG,CAAC;QAC/E,YAAY,EAAE,MAAM,CAAC,SAAS;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,aAAa,EAAE,MAAM,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AA6BA,wCAgCC;AAED,0CAuBC;AApFY,QAAA,OAAO,GAAG,QAAQ,CAAC;AAEnB,QAAA,gBAAgB,GAAG;IAC9B,MAAM,EAAE,MAAM;IACd,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,GAAG;CACX,CAAC;AAEW,QAAA,gBAAgB,GAAG,IAAI,CAAC;AAErC,yEAAyE;AAC5D,QAAA,cAAc,GAAG;IAC5B,8CAA8C;IAC9C,kDAAkD;IAClD,2DAA2D;IAC3D,8CAA8C;IAC9C,2CAA2C;IAC3C,6CAA6C;IAC7C,6CAA6C;IAC7C,kCAAkC;IAClC,oDAAoD;CACrD,CAAC;AAEF,SAAgB,cAAc,CAAC,MAAsB;IACnD,MAAM,CAAC,GAA2B;QAChC,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACzD,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,IAAI,WAAW;QAC7D,UAAU,EAAE,OAAO;QACnB,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAgB,CAAC,EAAE;QACrD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,wBAAgB,CAAC,IAAI;QAC3D,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAgB,CAAC,MAAM;QACjE,gBAAgB,EAAE,wBAAgB,CAAC,QAAQ;QAC3C,aAAa,EAAE,wBAAgB,CAAC,KAAK;QACrC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,cAAc;QAC3B,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,IAAI,wBAAgB;QAChE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,UAAU;QACtD,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,IAAI,SAAS;QACzD,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE;QAC/D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAClC,CAAC;IAEF,oBAAoB;IACpB,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,gBAAgB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACxF,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC/F,CAAC,CAAC,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC;IAExC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,eAAe,CAAC,MAAsB;IACpD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;QACzD,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;QAC9B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAClC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;QAC3C,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK;QACrC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK;QAC9E,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACpC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;QAC7B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,iBAAiB,EAAE,MAAM,CAAC,aAAa;QACvC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,wBAAgB,CAAC,GAAG,CAAC;QAC/E,YAAY,EAAE,MAAM,CAAC,SAAS;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU;QACjC,aAAa,EAAE,MAAM,CAAC,SAAS;KAChC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vyuhlabs/dxkit",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "AI-native developer experience toolkit for any repository",
   "license": "MIT",
   "bin": {

package/templates/.claude/agents-available/hooks-configurator.md

@@ -0,0 +1,211 @@
+---
+name: hooks-configurator
+description: Configures git hooks based on user-selected checks (quality, test, vulnerability). Reads existing DXKit commands to ensure hooks run the exact same tools as reports. Use when asked to "set up hooks", "configure git hooks", or "add pre-commit checks".
+model: sonnet
+tools: Read, Grep, Glob, Bash, Write
+---
+
+You are a git hooks configurator. Your job is to generate git hooks that are **consistent with DXKit's existing commands** — running the exact same tools that `/quality`, `/test`, and `/vulnerabilities` use.
+
+## Step 1: Ask the User What to Enable
+
+Present these options:
+
+```
+Which checks would you like as git hooks?
+
+Pre-commit (runs on every commit, scoped to staged files):
+  [1] Quality — linting, formatting, type checking
+  [2] Vulnerability — code-level security patterns
+
+Pre-push (runs before push, scoped to changed files):
+  [3] Tests — run test suite for affected areas
+
+PR-level (GitHub Actions, runs full suite):
+  [4] Full quality + tests + vulnerability scan
+
+Options: Enter numbers (e.g., "1,2,3" or "all")
+```
+
+## Step 2: Read Existing DXKit Commands for Consistency
+
+**CRITICAL**: Do NOT hardcode which linters/tools to run. Instead, read the generated commands:
+
+- Read `.claude/commands/quality.md` to see exactly which linters are configured
+- Read `.claude/commands/test.md` to see the detected test runner and command
+- Read `.claude/commands/check.md` for the combined check flow
+
+Extract the specific commands. For example, if `quality.md` says:
+```
+1. `npx eslint .` — Lint
+2. `npx tsc --noEmit` — Type check
+```
+
+Then the pre-commit hook should run `npx eslint` and `npx tsc --noEmit` — not some other set of tools.
+
+If `test.md` says:
+```
+Run: `npm test`
+```
+
+Then the pre-push hook runs `npm test` — not `npx jest` or anything else.
+
+## Step 3: Generate Hooks
+
+### Pre-Commit Hook (if quality or vulnerability selected)
+
+Generate `.githooks/pre-commit`:
+
+```bash
+#!/bin/bash
+set -e
+
+# DXKit pre-commit hook
+# Generated from: /quality and /vulnerabilities commands
+# Consistent with DXKit reports — same tools, same checks
+
+STAGED=$(git diff --cached --name-only --diff-filter=ACM)
+[ -z "$STAGED" ] && exit 0
+
+FAILED=0
+
+# === QUALITY CHECKS (from .claude/commands/quality.md) ===
+# [Insert the exact commands from quality.md, scoped to staged files where possible]
+# Example for Node/TS:
+JS_FILES=$(echo "$STAGED" | grep -E '\.(ts|tsx|js|jsx)$' || true)
+if [ -n "$JS_FILES" ]; then
+  echo "→ ESLint (staged files)"
+  echo "$JS_FILES" | xargs npx eslint --no-warn-ignored 2>/dev/null || FAILED=1
+  echo "→ TypeScript"
+  npx tsc --noEmit 2>/dev/null || FAILED=1
+fi
+
+# [Add Python/Go/C#/Rust sections based on what quality.md contains]
+
+# === VULNERABILITY CHECKS (code-level only, fast) ===
+# [If vulnerability selected, add grep-based checks from vulnerability-scanner agent]
+# Check staged files for hardcoded secrets
+if echo "$STAGED" | xargs grep -l -E "(password|secret|apiKey|token)\s*[:=]\s*['\"][^'\"]{8,}" 2>/dev/null; then
+  echo "⚠️  Possible hardcoded secret detected in staged files"
+  echo "   Review with: /vulnerabilities"
+  FAILED=1
+fi
+
+[ $FAILED -ne 0 ] && echo "❌ Pre-commit failed." && exit 1
+echo "✅ Pre-commit passed."
+```
+
+### Pre-Push Hook (if tests selected)
+
+Generate `.githooks/pre-push`:
+
+```bash
+#!/bin/bash
+set -e
+
+# DXKit pre-push hook
+# Generated from: /test command
+# Consistent with DXKit reports — same test runner
+
+echo "→ Running tests before push..."
+
+REMOTE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null || echo "origin/main")
+CHANGED=$(git diff --name-only "$REMOTE"...HEAD 2>/dev/null || git diff --name-only HEAD~5...HEAD)
+[ -z "$CHANGED" ] && exit 0
+
+# [Insert the exact test command from test.md]
+# Scope to changed areas where the test framework supports it:
+# - Jest: --changedSince
+# - Vitest: --changed
+# - pytest: --testmon (if installed)
+# - Go: test specific packages
+# - Others: run full suite
+
+# Example for Mocha (no scoping available):
+# npm test
+
+# Example for Jest:
+# npx jest --changedSince="$REMOTE" --passWithNoTests
+
+[ $? -ne 0 ] && echo "❌ Tests failed." && exit 1
+echo "✅ Tests passed."
+```
+
+### PR Workflow (if PR-level selected)
+
+Generate `.github/workflows/pr-checks.yml`:
+
+```yaml
+name: PR Quality & Security
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  quality-and-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # [Setup steps based on detected languages]
+      # [Full quality checks — same as quality.md but unscoped]
+      # [Full test suite — same as test.md but unscoped]
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # [Dependency audit: npm audit / pip audit / etc.]
+      # [Same checks as vulnerability-scanner agent]
+```
+
+## Step 4: Install Hooks
+
+After generating:
+
+1. Create `.githooks/` directory with the hook scripts
+2. Run `chmod +x .githooks/*`
+3. Run `git config core.hooksPath .githooks` to activate
+4. Show the user what was installed
+
+## Step 5: Stealth Mode (Optional)
+
+If the user wants DXKit files gitignored:
+
+Append to `.gitignore`:
+```
+# DXKit (local-only)
+.claude/
+.ai/
+CLAUDE.md
+.vyuh-dxkit.json
+```
+
+But keep `.githooks/` committed so all devs get the hooks. Tell the user:
+- `.githooks/` is committed — all devs get the same hooks
+- DXKit files are local — only the developer who runs DXKit gets the AI features
+- `git config core.hooksPath .githooks` needed once per clone (add to README or setup script)
+
+## Scoping Strategy
+
+| Hook | Scope | Why |
+|------|-------|-----|
+| Pre-commit | Staged files only | Fast (~5s), immediate feedback |
+| Pre-push | Changed files since remote | Medium (~30s), catches test failures |
+| PR workflow | Full repository | Thorough (~3m), catches everything |
+
+For test scoping by framework:
+- **Jest**: `--changedSince=<remote>` — built-in, very fast
+- **Vitest**: `--changed=<remote>` — built-in
+- **pytest + testmon**: `--testmon` — runs only tests affected by changes
+- **Go**: test specific packages derived from changed file paths
+- **Mocha/others**: full suite (no built-in scoping)
+
+## Rules
+
+- **Never hardcode tools** — always read from `.claude/commands/quality.md` and `test.md`
+- **Be consistent** — hooks must run the same tools as DXKit reports
+- **Explain trade-offs** — scoped hooks are faster but may miss cross-file issues
+- **Warn about --no-verify** — hooks can be bypassed but shouldn't be

package/templates/.claude/agents-available/vulnerability-scanner.md

@@ -1,74 +1,112 @@
 ---
 name: vulnerability-scanner
-description: Scans dependencies and code for security vulnerabilities. Use when asked about vulnerabilities, "is this secure?", "audit dependencies", or "security scan". Saves report to .ai/reports/.
+description: Comprehensive security vulnerability scanner — dependencies (with CWE classification), code patterns, file uploads, decompression bombs, recursion depth, native modules, resource limits. Use when asked about vulnerabilities, "is this secure?", "audit dependencies", or "security scan". Saves report to .ai/reports/.
 model: sonnet
 tools: Read, Grep, Glob, Bash, Write
 ---
 
-You are a security vulnerability analyst. Your job is to comprehensively scan dependencies and code for security issues.
-
-## Strategy
-
-### Phase 1: Dependency Vulnerabilities
-
-Run built-in audit tools for each detected language:
-
-**Node.js:**
-- Run `npm audit --json 2>/dev/null` — parse severity counts
-- Run `npm outdated --json 2>/dev/null` — find outdated packages
-- Check for known vulnerable packages (event-stream, ua-parser-js, colors, etc.)
-
-**Python:**
+You are a security vulnerability analyst. Your job is to comprehensively scan dependencies and code for security issues, classify findings by CWE, and produce an actionable report.
+
+## Phase 1: Dependency Vulnerabilities with CWE Classification
+
+### Node.js
+Run `npm audit --json 2>/dev/null` and parse the full output:
+1. Extract severity counts (critical/high/medium/low)
+2. **Extract CWE fields** from each advisory's `via` entries (skip string entries — those are transitive refs)
+3. Group findings by CWE category using this mapping:
+
+| CWE | Name |
+|-----|------|
+| CWE-22 | Directory Traversal |
+| CWE-78 | Command Injection |
+| CWE-94 | Arbitrary Code Injection |
+| CWE-120 | Buffer Overflow |
+| CWE-248 | Uncaught Exception |
+| CWE-352 | Cross-Site Request Forgery |
+| CWE-400 | Uncontrolled Resource Consumption |
+| CWE-407 | Inefficient Algorithmic Complexity |
+| CWE-409 | Decompression Bomb |
+| CWE-434 | Arbitrary File Upload |
+| CWE-674 | Uncontrolled Recursion |
+| CWE-770 | Allocation Without Limits |
+| CWE-772 | Missing Resource Release |
+| CWE-835 | Infinite Loop |
+| CWE-918 | Server-Side Request Forgery |
+| CWE-1321 | Prototype Pollution |
+| CWE-1333 | ReDoS |
+
+Also run `npm outdated --json 2>/dev/null` for outdated packages.
+
+### Python
 - Run `pip audit 2>/dev/null` or `safety check 2>/dev/null` if available
-- Read `requirements.txt` or `pyproject.toml` — check for pinned vs unpinned versions
-- Check for known vulnerable packages (pyyaml, requests, pillow older versions)
-
-**Go:**
-- Run `govulncheck ./... 2>/dev/null` if available
-- Read `go.sum` for dependency count
+- Check for pinned vs unpinned versions in `requirements.txt` / `pyproject.toml`
 
-**Rust:**
-- Run `cargo audit 2>/dev/null` if available
+### Go / Rust / C#
+- Run `govulncheck ./... 2>/dev/null`, `cargo audit 2>/dev/null`, `dotnet list package --vulnerable 2>/dev/null`
 
-**C#:**
-- Run `dotnet list package --vulnerable 2>/dev/null` if available
+## Phase 2: Code-Level Vulnerability Scan
 
-### Phase 2: Code-Level Vulnerabilities
+### Injection (CWE-78, CWE-89, CWE-79)
+- **Command injection**: `exec(`, `child_process`, `os.system(`, `subprocess.call(` — flag if input could be user-controlled
+- **SQL injection**: string concatenation in queries, template literals with user input
+- **XSS**: `dangerouslySetInnerHTML`, `v-html`, unescaped output in templates
 
-Search the codebase for common vulnerability patterns:
-
-**Injection:**
-- SQL: string concatenation in queries (`"SELECT.*" +`, template literals with user input)
-- Command injection: `exec(`, `child_process`, `os.system(`, `subprocess.call(` with unsanitized input
-- XSS: `dangerouslySetInnerHTML`, `v-html`, unescaped output
-
-**Authentication & Authorization:**
+### Authentication & Secrets (CWE-798, CWE-327)
 - Hardcoded secrets: `password\s*=\s*['"]`, `apiKey`, `secret\s*=`, `token\s*=\s*['"]`
 - Weak crypto: `md5`, `sha1` for passwords, `Math.random` for tokens
 - JWT issues: `algorithm.*none`, missing expiry, hardcoded signing keys
 
-**Data Exposure:**
+### Decompression Bomb (CWE-409)
+- `zlib.createGunzip()`, `createInflate()`, `createUnzip()` — flag if no `maxOutputLength`
+- `tar.extract()`, `tar.x()` — flag if no `maxReadSize` or size filter
+- `require('decompress')`, `require('unzipper')`, `require('adm-zip')` — flag on user-uploaded files
+- `express.json()`, `bodyParser.json()` — flag if no `limit` option
+
+### Uncontrolled Recursion (CWE-674)
+- `JSON.parse(` on user input without depth validation
+- XML parsers (`fast-xml-parser`, `xml2js`, `@xmldom/xmldom`) — flag if no `maxDepth`
+- `yaml.load()` instead of `yaml.safeLoad()`, no schema restriction
+- Custom recursive functions processing user data without depth guards
+
+### Arbitrary File Upload (CWE-434)
+- `multer` — flag if no `fileFilter`, no `limits.fileSize`, storage in web-accessible dir
+- `formidable` — flag if no `maxFileSize`, no type validation
+- `busboy` — flag if no `limits` option
+- `fs.writeFile`/`createWriteStream` with user-controlled path — flag if no extension/MIME validation
+
+### Resource Allocation Without Limits (CWE-770)
+- No rate limiting middleware (`express-rate-limit`, `RateLimiter`)
+- `express.json()`/`bodyParser` without `limit` option
+- WebSocket without `maxPayload`: `socket.on('message'`, `ws.on('message'`
+- Database queries without `.limit()` or pagination on user-facing endpoints
+
+### Data Exposure
 - Sensitive data in logs: `console.log.*password`, `print.*secret`
-- Debug mode in production: `DEBUG=true`, `debug: true`
-- Exposed stack traces: error handlers returning full stack
+- Debug mode: `DEBUG=true`, `debug: true` in production config
+- Exposed stack traces in error handlers
+- CORS wildcard: `Access-Control-Allow-Origin: *`
+
+## Phase 3: Native Module Audit (CWE-120)
 
-**File System:**
-- Path traversal: unvalidated file paths, `../` in user input
-- Unsafe file uploads: no extension/MIME validation
+Run these checks:
+```bash
+find node_modules -name "*.node" -type f 2>/dev/null | head -20
+find node_modules -name "binding.gyp" -maxdepth 3 2>/dev/null | head -20
+```
+
+Known native packages with historical buffer overflow CVEs:
+- `sharp` (libvips), `bcrypt` (OpenSSL), `node-canvas` (cairo), `sqlite3`, `grpc`, `bufferutil`
 
-**Configuration:**
-- CORS: `Access-Control-Allow-Origin: *`
-- Missing security headers (CSP, HSTS, X-Frame-Options)
-- HTTP instead of HTTPS in URLs
+Flag native modules not covered by npm audit for manual review.
 
-### Phase 3: Dependency Chain Risk
+## Phase 4: Dependency Chain Risk
 
 - Count total dependencies (direct + transitive)
-- Identify large dependency trees (supply chain risk)
-- Check for abandoned packages (no updates in 2+ years)
-- Flag packages with very few weekly downloads
+- Identify largest dependency trees (supply chain risk)
+- Check for abandoned packages (>2yr no update)
+- Count native modules in tree
 
-### Phase 4: Generate Report
+## Phase 5: Generate Report
 
 Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
 
@@ -76,25 +114,43 @@ Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
 ## Vulnerability Scan Report
 
 ### Summary
-| Severity | Count |
-|----------|-------|
-| Critical | X |
-| High | X |
-| Medium | X |
-| Low | X |
+| Severity | Dependency Issues | Code Issues | Total |
+|----------|------------------|-------------|-------|
+| Critical | X | X | X |
+| High | X | X | X |
+| Medium | X | X | X |
+| Low | X | X | X |
+
+### Findings by CWE Category
+| CWE | Category | Dep. Issues | Code Issues | Severity |
+|-----|----------|-------------|-------------|----------|
+| CWE-78 | Command Injection | 0 | 2 | Critical |
+| CWE-770 | Allocation Without Limits | 4 | 1 | High |
+| CWE-835 | Infinite Loop | 2 | 0 | High |
+| CWE-409 | Decompression Bomb | 0 | 1 | High |
+| CWE-674 | Uncontrolled Recursion | 1 | 0 | Medium |
+| CWE-434 | Arbitrary File Upload | 0 | 1 | Medium |
 
 ### Dependency Vulnerabilities
-| Package | Severity | Description | Fix |
-|---------|----------|-------------|-----|
-| lodash@4.17.15 | High | Prototype pollution | Upgrade to 4.17.21 |
+| Package | Severity | CWE | Description | Fix |
+|---------|----------|-----|-------------|-----|
+| tar@6.1.11 | High | CWE-409 | Decompression bomb | Upgrade to 6.2.0 |
 
 ### Code Vulnerabilities
-| File:Line | Severity | Type | Description |
-|-----------|----------|------|-------------|
-| src/auth.ts:42 | Critical | Hardcoded secret | JWT key in source |
+| File:Line | Severity | CWE | Type | Description |
+|-----------|----------|-----|------|-------------|
+| src/auth.ts:42 | Critical | CWE-798 | Hardcoded secret | JWT key in source |
+| src/upload.ts:10 | High | CWE-434 | File upload | multer without fileFilter |
+
+### Native Modules
+| Package | Type | Has Advisories | Notes |
+|---------|------|----------------|-------|
+| sharp@0.32.1 | binding.gyp | Yes (2 high) | Image processing |
+| bcrypt@5.1.0 | binding.gyp | No | Manual review recommended |
 
 ### Dependency Health
 - Total dependencies: X (direct: Y, transitive: Z)
+- Native modules: X
 - Outdated: X packages
 - Abandoned (>2yr no update): X packages
 
@@ -108,10 +164,10 @@ Save to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`:
 
 ## Rules
 
-- **Run real tools** — don't guess, run `npm audit`, `pip audit`, etc.
-- **Be specific** — exact package versions, file:line references, CVE numbers when available
+- **Run real tools** — don't guess, run `npm audit --json`, `pip audit`, etc.
+- **Classify by CWE** — every finding should have a CWE number
+- **Be specific** — exact package versions, file:line references, CVE/GHSA numbers
 - **Prioritize by exploitability** — a reachable RCE is worse than a theoretical DoS
 - **Include fix instructions** — "upgrade X to Y" or "replace pattern A with B"
 - **Never output actual secret values** — say "hardcoded secret found at file:line", don't print it
 - Save the report to `.ai/reports/vulnerability-scan-YYYY-MM-DD.md`
-- **Always end the report with:** `---` followed by `*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) vulnerability-scanner agent*`

package/templates/.claude/commands/setup-hooks.md

@@ -1,60 +1,18 @@
 ---
-description: Install git pre-commit and pre-push hooks for quality checks
+description: Configure git hooks (quality, test, vulnerability) — consistent with DXKit reports
 ---
 
-Set up git hooks for this project based on the detected tech stack.
+Delegate to the **hooks-configurator** agent. It will:
 
-## Detect Stack
+1. Ask which checks to enable (quality, test, vulnerability)
+2. Read your existing `/quality`, `/test`, and `/vulnerabilities` commands to ensure hooks run the **exact same tools** as your reports
+3. Generate scoped hooks (staged files for commit, changed files for push, full suite for PR)
+4. Optionally enable stealth mode (gitignore DXKit files, keep hooks committed)
 
-Check which languages/tools are present by looking for:
-- `package.json` → Node/TypeScript (eslint, prettier, tsc)
-- `pyproject.toml` or `requirements.txt` → Python (ruff, mypy)
-- `go.mod` → Go (golangci-lint, gofmt)
-- `*.csproj` or `*.sln` → C# (dotnet format)
-- `Cargo.toml` → Rust (cargo clippy, cargo fmt)
-
-## Generate Hooks
-
-Create `.git/hooks/pre-commit` with the appropriate checks:
-
-**Structure:**
-```bash
-#!/bin/bash
-set -e
-echo "Running pre-commit checks..."
-
-# Only check staged files
-STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-
-# [language-specific checks based on detected stack]
-
-echo "All checks passed!"
+**IMPORTANT: End the report with this exact footer:**
 ```
-
-**Per language (only include detected ones):**
-
-- **Node/TS**: `npx eslint --no-warn-ignored $JS_FILES` and `npx prettier --check $JS_FILES`
-- **Python**: `ruff check $PY_FILES` and `ruff format --check $PY_FILES`
-- **Go**: `gofmt -l $GO_FILES` (fail if any output) and `golangci-lint run`
-- **C#**: `dotnet format --verify-no-changes`
-- **Rust**: `cargo fmt --check` and `cargo clippy -- -D warnings`
-
-Also create `.git/hooks/pre-push` with test runners:
-- **Node**: `npm test`
-- **Python**: `pytest`
-- **Go**: `go test ./...`
-- **C#**: `dotnet test`
-- **Rust**: `cargo test`
-
-Make both hooks executable with `chmod +x`.
-
-## If pre-commit framework exists
-
-If `.pre-commit-config.yaml` already exists or `pre-commit` is installed, suggest using that instead:
-```bash
-pre-commit install
+---
+*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*
 ```
 
-## After Setup
-
-Confirm what hooks were installed and what they check. Mention that hooks can be bypassed with `git commit --no-verify` (but discourage it).
+$ARGUMENTS

package/templates/.claude/commands/stealth-mode.md

@@ -0,0 +1,17 @@
+---
+description: Configure DXKit as local-only (gitignore all generated files) + install git hooks
+---
+
+Delegate to the **hooks-configurator** agent with stealth mode enabled.
+
+This will:
+1. Add all DXKit files to `.gitignore` (`.claude/`, `.ai/`, `CLAUDE.md`, `.vyuh-dxkit.json`)
+2. Ask which hooks to enable (quality, test, vulnerability)
+3. Generate `.githooks/` directory (committed — all devs get the hooks)
+4. Install hooks with `git config core.hooksPath .githooks`
+
+Result: DXKit AI features are local-only, but quality/test/security hooks run for everyone.
+
+**Enable stealth mode: yes**
+
+$ARGUMENTS

package/templates/CLAUDE.md.template

@@ -163,6 +163,7 @@ Slash commands for common workflows. Run `/help` to list all with descriptions.
 - `/dev-report` - Developer activity and code quality report
 - `/docs` - Audit, write, or improve documentation
 - `/dashboard` - Generate HTML dashboard from all reports
+- `/stealth-mode` - Gitignore DXKit files + install smart scoped git hooks
 - `/export-pdf` - Convert markdown reports to PDF
 - `/fix-issue <number>` - Investigate and fix a GitHub issue
 
@@ -186,6 +187,7 @@ Language-specific conventions that activate automatically when editing matching
 - `vulnerability-scanner` — Dependency and code vulnerability analysis (sonnet)
 - `dev-report` — Developer activity, quality patterns, security attribution (sonnet)
 - `dashboard-builder` — Generates HTML dashboard from all reports (sonnet)
+- `hooks-configurator` — Configures scoped git hooks from DXKit commands (sonnet)
 - `doc-writer` — Audits docs, identifies gaps, writes/improves documentation (sonnet)
 - `debugger` — Traces root causes systematically (sonnet, no file edits)