@vyuhlabs/dxkit 2.12.0 → 2.13.1

package/CHANGELOG.md

@@ -7,6 +7,96 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.13.1] - 2026-06-21
+
+### Fixed — the loop Stop hook could fail on every stop when dxkit was not installed
+
+The loop Stop hook (and the `.claude` PreToolUse context hook) invoke the
+dxkit CLI as `npx vyuh-dxkit …`. That only resolves when dxkit is installed
+in the repo (a devDependency or a global). When the loop was wired with a
+pure-`npx @vyuhlabs/dxkit init --claude-loop` flow — no install — the hook
+hit `npm error 404 'vyuh-dxkit' is not in this registry` on every stop,
+because `vyuh-dxkit` is a binary name, not a package. `loop doctor` reported
+the hook as wired even though it could not run.
+
+- **`init --claude-loop` and `update` now declare `@vyuhlabs/dxkit` as a
+  devDependency** whenever they install an artifact that invokes the CLI (the
+  Stop hook, the context hook, the pre-push guardrail, or the CI guardrail),
+  so `npx vyuh-dxkit` resolves to a project-local binary. Skipped for
+  non-Node repos and when the dependency is already declared.
+- **`loop doctor` now verifies the CLI actually resolves**, not just that the
+  hook string is present, and tells you to install dxkit when it does not.
+- **The recommended loop setup installs dxkit first** via
+  `npm init @vyuhlabs/dxkit -- --claude-loop --yes`, which adds the
+  devDependency and registers the hook in one step.
+
+### Changed — one canonical CLI invocation, one registry of self-invoking surfaces
+
+Every generated artifact that runs the dxkit CLI now builds its command from
+a single helper, and every such artifact is listed in one registry that
+drives the devDependency wire-up and the doctor checks. Adding a new
+auto-running surface can no longer silently skip either. Enforced by an
+architecture check and a registry-injection test.
+
+### Changed — positioning aligned to the Stop-gate
+
+The package description, CLI banner, npm keywords, and the docs now lead with
+the deterministic Stop-gate framing. The README loop quickstart installs
+dxkit first, and the demo command is pinned to `@latest` so a stale global or
+npx cache cannot run an older version that lacks the command.
+
+### Changed — `demo loop-guardrail` now runs a real sandbox scan
+
+The demo no longer prints a scripted scenario. When gitleaks is available it
+generates a throwaway git repo, runs the real `baseline create`, introduces a
+real hardcoded secret, and runs the real `guardrail check` — the same commands
+a user runs — so the block→repair→clean walkthrough is an actual scan, not a
+mock. Your repo is never touched. The fabricated "agent" dialogue is gone; when
+gitleaks is absent it shows a clearly-labelled illustration and how to run the
+real sandbox.
+
+## [2.13.0] - 2026-06-18
+
+### Loop pack — a deterministic Stop-gate for autonomous coding loops
+
+When Claude Code runs in an autonomous loop (it keeps working until it
+decides to stop), the new loop pack stops it from declaring "done" while it
+has introduced net-new findings. It re-runs the guardrail on every Stop and
+feeds any net-new findings back to the model for repair. The value is
+predictability, not new detection — it bounds the "loop shipped debt and
+never fixed it" failure mode using the findings, baseline, and identity
+contract dxkit already computes.
+
+- **`vyuh-dxkit init --claude-loop`** registers the Stop-gate hook. The
+  install is **additive**: it deep-merges the hook into an existing
+  `.claude/settings.json` (preserving your other hooks + permissions) and
+  appends a sentinel-delimited managed block to `CLAUDE.md` (never touching
+  your prose). Opt-in even under `--full`, because it registers a hook that
+  blocks the agent from stopping. Re-applied by `vyuh-dxkit update` on repos
+  that opted in.
+- **Loop-scoped presets.** A `loop.preset` in `.dxkit/policy.json` decides
+  what blocks the loop: `security-only` (default — net-new secrets +
+  crit/high security + reachable dependency vulns) or `full-debt` (also
+  blocks test-gap + quality). It is read **only by the Stop-gate**; your CI
+  / PR guardrail always uses the full policy, so the loop posture can't
+  silently weaken your CI gate. `security-only` is the default because a
+  block in a loop tells the model to *fix* the finding, and open-ended debt
+  (write tests / refactor until clear) would make an unattended agent grind.
+- **`vyuh-dxkit loop doctor`** — preflight that verifies a loop is wired
+  safely before an unattended run (baseline present, Stop hook registered,
+  guardrail runnable, posture). Catches the silent-failure class: an
+  unregistered hook never fires, so the loop would run with no gate and no
+  error. Exits non-zero so a CI loop-setup step can gate on it.
+- **`vyuh-dxkit loop ledger [show|summarize|clear]`** — an append-only audit
+  trail of every Stop event (`.dxkit/loop/ledger.jsonl`): blocked vs
+  allowed, net-new counts, and repaired-after-block sessions.
+- **New `dxkit-loop` skill** plus loop-aware updates to `dxkit-config`,
+  `dxkit-learn`, `dxkit-update`, `dxkit-onboard`, and `dxkit-init` so the
+  loop is set up and operated conversationally through Claude Code.
+- No baseline re-creation is needed; existing baselines and allowlists are
+  unaffected. The loop pack is opt-in — existing installs are unchanged
+  until they run `init --claude-loop`.
+
 ## [2.12.0] - 2026-06-17
 
 ### Guardrail: benign line shifts no longer read as net-new